last executing test programs: 10.230365974s ago: executing program 1 (id=11): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) sched_setaffinity(0x0, 0xffffffffffffffe2, &(0x7f00000002c0)=0x20000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r3 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000980)={0x802}, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x1c, 0x52, 0x1, 0x0, 0x0, {0xa}, [@typed={0x8, 0x2, 0x0, 0x0, @binary="9f00d4f3"}]}, 0x1c}, 0x1, 0x0, 0x0, 0x14}, 0x0) 10.090232597s ago: executing program 0 (id=12): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x1, 0x1, 0x4, 0x4}, 0x50) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$int_in(r1, 0x5452, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001080)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000006007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000005000000095"], &(0x7f0000000440)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$trusted_overlay_upper(r0, 0x0, &(0x7f0000000040)={0x0, 0xfb, 0x96, 0x4, 0x4, "45940fa6f47f707d4b6bb8b3b0a388f6", "533ee116b32f9bbb2f6a338c4d276daa24685724ee919064de49616668aade5f77e666083475503379df5c954b7037ece0af3b0af1939ea1a87b6ad54ab67ab785d492439de908493376f7aa8e5bf84993a8c6a7c3008903929499ea90af239a45c3b90a3dbfeef7a0a6aa248d1fb0e6b5fe3a08e2d2580256bf541da2dea55c19"}, 0x96, 0x1) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080), &(0x7f0000000380), 0xc, r0}, 0x38) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2}, 0xc) 9.820925554s ago: executing program 0 (id=14): mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) mmap$binder(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x1, 0x11, 0xffffffffffffffff, 0x10000000000) syz_open_dev$vcsn(&(0x7f0000000000), 0x80, 0x4b4400) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = fcntl$getown(0xffffffffffffffff, 0x9) sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) fsopen(0x0, 0x0) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x100000f, 0x11, 0xffffffffffffffff, 0x0) socket$packet(0x11, 0x2, 0x300) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) wait4(r4, 0x0, 0x2, 0x0) ptrace$getregset(0x4204, r4, 0x201, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x18}}, 0x2, 0x1}}, 0x2e) getsockopt(r7, 0x10d, 0x5, 0x0, &(0x7f00000000c0)) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r8, 0x400448ca, 0x0) 8.447939749s ago: executing program 2 (id=17): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x40}, 0xc, 0x0}, 0x20000880) sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TID_CONFIG(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r4, @ANYBLOB="8b332abd7000000000000500000008000300", @ANYRES32=0x0, @ANYBLOB="3d68ffabe0f45a3ce7064b6516549c14e106c9d869298b3abc2ebe4aa9b29eea6210eae484935f6f9887ff5b5b44cbd03050183bbff3258f8b4e5e5d0322d0d18f812097e67876a35a0d96c8f4103aa3f858b82346c195ff90df99b5e36d4da73861c318ecc9e0cccfd4f06b049133d3e5a497b5bbb409a1ba845ad5e9796caf35d04f966ae4e9ad72341de84c7bea0e5b4214c0ebec90cd561fc8594ca2464951eb76d1583f1f49418e46872b433491024bf0bcdcb9b0d48fb0bb9397301ce36770d216a792bef29b3c1808ab7ffb0dd22c9a785ca2bbad29f0338d6080274d0350222e21"], 0x1c}}, 0x24000000) r5 = epoll_create(0x8001) fchmod(r5, 0x100) sched_setaffinity(0x0, 0xfffffffffffffccd, &(0x7f00000001c0)=0x2) r6 = syz_open_procfs(0x0, &(0x7f00000002c0)='net/netlink\x00') read(r6, &(0x7f0000001180)=""/4096, 0x1000) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000380)=ANY=[@ANYBLOB='mpol=interlReave:7-N:0/', @ANYBLOB='N']) 8.322634132s ago: executing program 1 (id=18): socket(0x2c, 0x3, 0x0) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, 0x0, 0x0}, 0x20) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x4, 0x2, 0x7fff7ffc}]}) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r2, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) sendto$inet(r2, &(0x7f0000000580)='g', 0x1, 0x0, 0x0, 0x0) recvmsg(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000800)=""/140, 0x8c}], 0x1}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) sendfile(0xffffffffffffffff, r0, 0x0, 0x7) close_range(r1, 0xffffffffffffffff, 0x200000000000000) 8.241972184s ago: executing program 3 (id=19): syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000600)='./file0\x00', 0xc8d0, &(0x7f0000000140)=ANY=[], 0x1, 0x30e, &(0x7f0000000f00)="$eJzs3E1rE10UwPGTNEnTlHayeHhEQXrRjW6GNu7FIC2IAUttxBcQp81EQ8akZEIlIrZduXEhfggXpcvuCtov0I07V27cdSO4sAtxJDOTl7aJrWnSWPv/QZlD7j0z9+Y24dyBzPbdN0/zWVvPGmUJRpUERER2ROISlJqAfwy6cUSaLcvl4W+fzt++d/9mMpWanFFqKjl7JaGUGh17/+zFkN9tY1C24g+3vya+bP2/dXb75+yTnK1ytioUy8pQc8XPZWPOMlUmZ+d1paYt07BNlSvYZslrd5ZELFNlreLCQkUZhcxIbKFk2rYyChWVNyuqXFTlUkUZj41cQem6rkZigoOkV2dmjGSHyfNdHgx6pFRKGgMiMrSvJb3alwEBAIC+8uv/erUfrJb0ndT/oZb1/9qFzfLwnfVRv/7fiFTrf5Gm+v9R41ymygTr9X9URBr1f9HbH3S7/t9fEZ1sr3cvjjhOPYy06n+k+h8nRLX+j/mfX9fKg7VxN6D+BwAAAAAAAAAAAAAAAAAAAADgJNhxHM1xHM07DvivOtqgiETdX5B47X0eJnpk9/o3/lj/06Hx4I7QqIj1ajG9mPaOfodNEbHElHHR5If7/+CrxpFl5XZSVXH5YC35+UuLae+7JJmVnJs/IZrE9+Y7ztSN1OSE8uzOD0usOT8hmvzXOj+xNz9cPUbk0sWmfF00+TgvRbEk4/8yrpb/ckKp67dSe64/5PYDAAAAAOBfoKu6+v59sLld39/u7Y+9dm9/HZLW9we8/fV4y/19SM6F+jVrAAAAAABOF7vyPG9YllnqUbAiIj2+RJugNsPDZtUekNumT0AC7Zq6ENQu3ll6dWxdG0/4UO9YsKOhjkX+cFFaBrXbRu36yHQnZ3Y0kaO+h2fevvv++z7enTGRw5zw6nr0gJl2GkQOmmn42L6AAAAAABybRtFfe+VafwcEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAMApdByP4uv3HAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC/xa8AAAD//46ZAFE=") r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x42, 0x130) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='./file0\x00', 0x80000c17) io_setup(0x3, &(0x7f0000000200)=0x0) io_submit(r2, 0xb, &(0x7f0000000440)=[&(0x7f0000000080)={0x0, 0x0, 0x10, 0x7, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x2}]) 7.671587358s ago: executing program 0 (id=20): r0 = fsopen(&(0x7f0000000100)='exfat\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6d71b000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, &(0x7f00000001c0)='!,\x00\xe5\x9b\xb41\x89\x1a\xd1;m\x83+\xbd\xe1\xdb5f\x14\x8a\xe8\xf7\x8fe\xf0\xea\x15\x1am\xe8=\x99I\xe1\xb6^\xf40\x99\xae\xa2&\xf7\xcc\fJ|aW\xab\xd6\xbcD[\xb5\x97\x14\x11\xac\x83\xce\xaf4g\x14\x9b\xb4%Zn\xe7\x8e[\xf8\xefQ=\xb6\xff\xd3\xeaX\x01\n\xaf\x9b\xc7=\x83\x88\xae\xcb-\xac\xbc\x12\xe7i\xdd\xddy[\xa2\x00\x16\xca\xcfca\xd7A\xfdL\xf1I\xb5\xab\xf7c\xb5\xb8\b\xe6m\n\x85\x00L') setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, &(0x7f00000000c0)=ANY=[], 0x1c) fsconfig$FSCONFIG_SET_BINARY(r0, 0x2, 0x0, &(0x7f0000000080)="a6", 0x1) ioctl$FS_IOC_RESVSP(r0, 0x40305828, &(0x7f0000000000)={0x0, 0x1, 0x3, 0x7fffffffffffffff}) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) clock_getres(0x2, &(0x7f00000000c0)) 7.57742426s ago: executing program 3 (id=21): syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r1, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff0180000008003950323030302e4c"], 0x15) r2 = dup(r1) write$FUSE_BMAP(r2, &(0x7f0000000240)={0x18}, 0x18) write$FUSE_DIRENTPLUS(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="380100"], 0x138) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000640)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}}) openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0/file1\x00', 0x40, 0x83) 7.348015016s ago: executing program 2 (id=22): unshare(0x64000600) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='net/ip6_tables_names\x00') preadv(r0, &(0x7f0000000040)=[{&(0x7f0000000200)=""/233, 0xe9}], 0x1, 0xfff, 0x0) 7.140514562s ago: executing program 1 (id=23): userfaultfd(0x801) socket$inet6(0xa, 0x2, 0x0) r0 = syz_clone(0x0, 0x0, 0x9, 0x0, 0x0, 0x0) syz_pidfd_open(r0, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) unshare(0x22020600) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 6.253057964s ago: executing program 3 (id=24): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x132) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000001c0), 0x802, &(0x7f0000000500)=ANY=[@ANYBLOB='huge=always,huge=within_size,nr_blocks=', @ANYRESDEC=0x0]) chdir(&(0x7f0000000140)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x84022, &(0x7f0000000340)=ANY=[@ANYBLOB='nr_inodes=0,size=4']) 5.875325803s ago: executing program 3 (id=25): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$inet6_int(r3, 0x29, 0x4e, &(0x7f0000000000)=0x1, 0x4) bind$inet6(r3, &(0x7f00000001c0)={0xa, 0x4e24, 0x5, @remote, 0xc}, 0x1c) r4 = syz_open_procfs(0x0, &(0x7f0000000300)='net/icmp\x00') socket$inet6_icmp(0xa, 0x2, 0x3a) pread64(r4, &(0x7f0000000140)=""/245, 0xf5, 0x4) socket(0x10, 0x3, 0x0) syz_clone3(&(0x7f0000000340)={0xc6107700, &(0x7f00000000c0), 0x0, 0x0, {0x19}, 0x0, 0x0, 0x0, 0x0}, 0x58) 5.873191323s ago: executing program 1 (id=26): prctl$PR_PAC_RESET_KEYS(0x36, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./mnt_trace\x00', 0x1ff) mount(0x0, &(0x7f0000001040)='./mnt_trace\x00', &(0x7f0000001080)='tracefs\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001140)='./mnt_trace/trace_pipe\x00', 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xe, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x0, 0xd, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x0, 0x5, 0x101, 0x1000, 0x9, 0x7, 0x3, 0x1, 0xfffffffa, 0x0, 0x6, 0x100009, 0x4, 0x7, 0x5, 0x100000, 0x102, 0x2, 0xd, 0xe, 0x2b12, 0xff, 0x6, 0x7ffffffe, 0xb, 0x7, 0xbed4, 0x8, 0x8, 0x3, 0x0, 0x11000, 0x8, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x0, 0xd7, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0x4007, 0x8b, 0x2, 0x6, 0xf7, 0x5, 0x2, 0x4, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0xfffffffe, 0x400, 0x752, 0x0, 0x1005, 0x3, 0x10001, 0x0, 0x1, 0x6, 0x6, 0x9, 0xd, 0xfdfeffff, 0x2, 0x2, 0x2, 0x100, 0x0, 0x252, 0x2000081, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffe, 0xfff, 0x7fffffff, 0x5, 0xffffffcc, 0x0, 0x2, 0x2, 0x40, 0xfffffeff, 0x204, 0x3, 0x401, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 5.664918118s ago: executing program 2 (id=27): syz_mount_image$vfat(&(0x7f0000000100), &(0x7f0000000300)='./bus\x00', 0x2010414, &(0x7f0000000c00)=ANY=[@ANYBLOB="6e6f6e756d7461696c2c6e66732c73686f72746e616d653d6c6f7765722c757466383d312c64656275672c696f636861727365743d757466382c73686f72746e616d653d6d697865642c757466383d312c004845160000000000", @ANYRESOCT, @ANYBLOB="b58208b37a58446284048f26b79953e521b27c3a5dbc8e7fcd644e2caaa1acc91237f4447b548c7caab7ede0f978d175cd8108db49a660493d3511a7f6d67dba109d4f769a1cddfc97c554c8d7c38ecae48c95955fb02bcd2da02935ab9658f576b9d2526dd40f73035883f2f7d388f9cb004bcef6c90d011afc4849d7d7ee3abdf4dfa36378701a61a8f83187960881d90cf42cae6384fa916f5df9e11d2546c01011f28c9be1a2a5aa2139ef29be6d87c8d93fce5239580e58fe24d4304f196fa0d43d7aeb4dc3da644ba32b1e61734c4211811d81d78f283d637a78b107898d59c7048fa04ea6e0ebe491f42f2f32bd531eeb8e2659d2", @ANYRESHEX, @ANYRES64], 0x1, 0x2d3, &(0x7f00000010c0)="$eJzs3U9rE0EYx/GnSWzSlDYRRFBQB73oZWnjC9AgLYgBpTaiHoSt3WjImpTdUImIzUW8+jqKR2+C+gZ6ES/evRVB8NKDdKS7m3TTpG1q06R/vh8oO7szP2bSTcqzC92sPnz/olRwjYJZlUhCSUSkLmsi6Y1WYCjYRrz2sITV5dronx8X7j96fCeby03NKDWdnb2eUUqNX/r88vWHy1+row8+jn+Ky0r6yervzM+V4ZVzq+uzz4uuKrqqXKkqU81VKlVzzrbUfNEtGUrdsy3TtVSx7FpOS3/Briws1JRZnh9LLjiW6yqzXFMlq6aqFVV1asp8ZhbLyjAMNZaUky3WxZj88syMmd22Ww+Fzj6OgJFOBx0nW+/cmV/uw5oAAMAhs3P979f629X/0WZrL/X/2d3rf5Fw/Z8IJqH+74F6y94u9T+OBcfJmsng89uK+h8AAAAAAAAAAAAAAAAAAAAAgKNgTeuU1jq1sQ0OeftxEUmIiI76+wNeJg5I+Pzr0E/z/Af7W2I3BrRc9FjoH/cSIva7xfxi3t/6/dmCFMUWSyYkJX+990PAb0/fzk1NKE9avthLQX5pMR+VeCPfkO6Uv3h60s+r1vwpSYbnz0hKznSeP9MxPyxXr4TyhqTk21OpiC3z3vt6M/9mUqlbd3Nb8iPeOAAAAAAAjgNDNbVdv3v93oCEtPf7+dD9Aa31UkSal+ht9we2XF/H5Hw3j6gEAAAAAAD75tZelUzbtpz/aMRFZB/x3je0Fhn8MqJyOH4brY2bItK3SWMDf8kJEfGPqJYu/86UyC7xX814V5PqLsbEgm/g8I8M9eWzs76P+KD/MgEAAADotc2ifw+h728PcEUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJw83T4PrDG+ravRsUM8NF207y8QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOET+BQAA//9mAxFo") syz_mount_image$vfat(&(0x7f0000000000), &(0x7f0000000280)='./bus\x00', 0xdb9303c4986513a7, 0x0, 0x1, 0x0, &(0x7f00000002c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) sched_setaffinity(0x0, 0xffffffffffffffe2, &(0x7f00000002c0)=0x20000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) prctl$PR_GET_SECUREBITS(0x1b) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x8100, 0x0, 0x0, &(0x7f00000002c0), 0x0, 0xadf0, 0x21, 0x0, 0x0, 0x0, 0x0}, 0x50) r4 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x80) r6 = openat$cgroup_procs(r5, &(0x7f0000000080)='cgroup.threads\x00', 0x2, 0x0) r7 = add_key$keyring(&(0x7f0000000200), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) add_key$user(&(0x7f0000001040), &(0x7f0000000180)={'syz', 0x1}, &(0x7f0000000040), 0x0, r7) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r7, &(0x7f0000000000)='asymmetric\x00', &(0x7f00000003c0)=@secondary) write$cgroup_pid(r6, &(0x7f0000001c00)=r0, 0x12) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x15) 5.59970199s ago: executing program 1 (id=28): prlimit64(0x0, 0xe, &(0x7f0000000340)={0xd, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socket(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r3, &(0x7f00000007c0)={0x1f, 0x0, @none, 0x4}, 0xe) setsockopt$bt_l2cap_L2CAP_OPTIONS(r3, 0x6, 0x1, &(0x7f0000000000)={0x20b, 0x6, 0x7, 0x5, 0xef, 0xfb, 0x100}, 0xc) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, &(0x7f0000000640)=@nat={'nat\x00', 0x670, 0x5, 0x500, 0x228, 0x0, 0xffffffff, 0x0, 0x228, 0x468, 0x468, 0xffffffff, 0x468, 0x468, 0x5, 0x0, {[{{@ip={@multicast2, @local, 0xff000000, 0xffffff00, 'macsec0\x00', 'wg1\x00', {0xff}, {0xff}, 0x16}, 0x0, 0x1f0, 0x228, 0x48, {}, [@common=@unspec=@string={{0xc0}, {0x5, 0xc, 'bm\x00', "9401d3e4c6b2bfd892aa7400051624fa86999b13d39b99407a9b7abe75a728baa18da576811985de44110b8602025e1298ea55f1c5087ab16f67b18ca90ac68f0b3d6a068f727f7d23fa5fad26a59a5da2651212bdf9d29248ae63e2349b2470915eea2c39ade5129ff26b6fe772493180cfda2cdd49412e9469d85abdb467ba", 0x79, 0x2, {0x1}}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0x10}, [0xffffff00, 0x0, 0x0, 0xff000000], @ipv4=@dev={0xac, 0x14, 0x14, 0x29}, [0x0, 0xffffff00, 0xff000000, 0xffffffff], @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}, [0xff000000, 0xff, 0x0, 0xff], @ipv4=@broadcast, [0xffffffff, 0x0, 0xff], 0x7, 0x1, 0x5c, 0x4e1c, 0x4e26, 0x4e24, 0x4e24, 0x814, 0x20c0}, 0x80, 0x2}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0xf, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id=0x65, @icmp_id=0x65}}}}, {{@uncond, 0x0, 0x70, 0xa0}, @common=@inet=@SET2={0x30, 'SET\x00', 0x2, {{0xffffffffffffffff, 0xd, 0x1}, {0x2, 0x4, 0x3}, 0x1000, 0x2}}}, {{@ip={@multicast2, @broadcast, 0xff, 0x0, 'nicvf0\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa8}, @MASQUERADE={0x38, 'MASQUERADE\x00', 0x0, {0x1, {0x2, @loopback, @empty, @icmp_id=0x68, @port=0x4e22}}}}, {{@uncond, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@icmp={{0x28}, {0x8, "c81f"}}, @common=@ttl={{0x28}, {0x2, 0x6}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x10, @rand_addr, @multicast2, @icmp_id, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x560) socket(0x840000000002, 0x3, 0xff) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$unix(0x1, 0x1, 0x0) 4.597402235s ago: executing program 0 (id=29): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r4, 0x40046210, &(0x7f00000001c0)=0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x104, 0x4, 0x3c8, 0xe8, 0x1d0, 0x1d0, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@remote, @multicast2, 0x0, 0x0, 0x7, 0x0, {@mac=@link_local={0x2, 0x80, 0xc2, 0x7}}, {}, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 'bridge0\x00', 'erspan0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x100}}}, {{@arp={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0xfc, {@empty, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bond_slave_1\x00', 'ipvlan1\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) ioctl$SIOCSIFHWADDR(r0, 0x8923, &(0x7f00000000c0)={'team_slave_1\x00', @random="01320136b1ff"}) clock_gettime(0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x10}, [@ldst={0x4}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) 4.503137897s ago: executing program 3 (id=30): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x181, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r0, 0xc008ae05, &(0x7f0000000140)={0x28729f328c68897}) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x1, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f0000000000)={0x2f}) 1.942176921s ago: executing program 1 (id=31): bpf$PROG_LOAD(0x5, 0x0, 0x0) getpgrp(0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e1d, 0x9, @local, 0x2}, 0x1c) r1 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e24}, 0x6e) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r5, 0x5) r6 = epoll_create(0x40) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r5, &(0x7f0000000080)={0x80000009}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x4000000000000, 0x40, &(0x7f0000000780)=@raw={'raw\x00', 0x701, 0x3, 0x258, 0x1c0, 0xb, 0x108, 0x108, 0x0, 0x1c0, 0x1c8, 0x1c8, 0x1c0, 0x1c8, 0x3, 0x0, {[{{@ip={@rand_addr, @remote, 0x0, 0x0, 'ip6erspan0\x00', '\x00', {}, {0xff}, 0x32}, 0x0, 0xa0, 0x108, 0x0, {}, [@common=@inet=@esp={{0x30}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}, {{@ip={@loopback, @empty, 0xffffff00, 0x0, 'veth1_to_batadv\x00', 'ip6erspan0\x00'}, 0x0, 0x70, 0xb8}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x4}}}}, 0x2b8) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) connect$netlink(r0, &(0x7f00000000c0)=@unspec, 0xc) 1.710543757s ago: executing program 0 (id=32): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) recvmsg$unix(r0, &(0x7f00000008c0)={&(0x7f0000000240), 0x6e, 0x0}, 0x40000020) 971.178826ms ago: executing program 3 (id=33): setpriority(0x0, 0x0, 0x200002a14b56) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040)={{0x77359400}}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) socket$inet6(0xa, 0x4, 0xffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r2, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r1, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000005e00)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_MOVE_RANGE(r4, 0x541b, &(0x7f0000000000)={0xffffffffffffffff, 0x8e59, 0x0, 0x3}) close_range(r5, r3, 0x0) close_range(r3, 0xffffffffffffffff, 0x2) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f00000002c0)=@raw={'raw\x00', 0x8, 0x3, 0x238, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x1a0, 0xffffffff, 0xffffffff, 0x1a0, 0xffffffff, 0x7fffffe, 0x0, {[{{@uncond, 0x6, 0x70, 0xd0}, @common=@inet=@HMARK={0x60, 'HMARK\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x1f}, [0x0, 0xffffff00, 0xffffffff, 0xff], 0x4e22, 0x4e23, 0x4e22, 0x4e21, 0x8, 0x6, 0x50b5, 0x804, 0x4}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'veth0_to_team\x00', 'veth1_virt_wifi\x00', {}, {}, 0x0, 0x0, 0x60}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x6, 0x2, 0x0, 0x3, 0x4, 0x4], 0x4, 0x5}, {0x3, [0x0, 0x2, 0x2, 0x5, 0x7, 0x7], 0x5, 0x2}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28, '\x00', 0x0, 0xfffffffb}}}}, 0x298) r6 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) syz_emit_ethernet(0x76, 0x0, 0x0) waitid(0x2, r6, 0x0, 0x61000006, &(0x7f0000000340)) 830.91766ms ago: executing program 2 (id=34): r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./config\x00', &(0x7f0000000300)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./config/usb_gadget/g1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000900)='./config/usb_gadget/g1/configs/c1.1\x00', 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000a00)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0x1ff) symlinkat(&(0x7f0000001300)='./config/usb_gadget/g1/functions/hid.usb0\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./config/usb_gadget/g1/configs/c1.1/hid.usb0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000002200)='./dev\x00', &(0x7f0000002300)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000001500)='./config/usb_gadget/g1/UDC\x00', 0x1, 0x1ff) openat2(r1, &(0x7f0000000040)='./config/usb_gadget/g1\x00', 0x0, 0x0) write(r1, &(0x7f0000001600)='dummy_udc.0', 0xb) r2 = openat(0xffffffffffffff9c, &(0x7f0000002400)='./dev/hidg0\x00', 0x800, 0x0) read(r2, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0xe403, 0x0, 0x3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_IFLAGS={0x6, 0x2, 0x13}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000ee86dd6015690900132f00fc020000000000000000000000000000ff020000000000000000000000000001242088a88d"], 0x0) 347.703531ms ago: executing program 2 (id=35): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000000)={0x8}, 0x9) write(r0, &(0x7f0000000040)="240000001e005f0214f6fffffffffff8070000000009000d00"/36, 0x24) 169.968896ms ago: executing program 2 (id=36): ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_ethernet(0x46, &(0x7f0000000000)={@broadcast, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "120008", 0x10, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x1, 0x0, 0x2}}}}}}, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000100)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_ENABLE_ONEWAY_SPAM_DETECTION(r4, 0x40046210, &(0x7f00000001c0)=0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x30, 0x10, 0x1, 0x0, 0x0, {}, [@IFLA_MTU={0x8, 0x4, 0x600}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r6, 0x0, 0x60, &(0x7f0000000440)={'filter\x00', 0x104, 0x4, 0x3c8, 0xe8, 0x1d0, 0x1d0, 0x2e0, 0x2e0, 0x2e0, 0x7fffffe, 0x0, {[{{@arp={@remote, @multicast2, 0x0, 0x0, 0x7, 0x0, {@mac=@link_local={0x2, 0x80, 0xc2, 0x7}}, {}, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 'bridge0\x00', 'erspan0\x00'}, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x100}}}, {{@arp={@rand_addr, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0xfc, {@empty, {[0xff, 0x0, 0x0, 0x0, 0x0, 0xff]}}, {@mac=@multicast, {[0xff]}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bond_slave_1\x00', 'ipvlan1\x00'}, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@mac=@multicast, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x418) ioctl$SIOCSIFHWADDR(r0, 0x8923, &(0x7f00000000c0)={'team_slave_1\x00', @random="01320136b1ff"}) clock_gettime(0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x10}, [@ldst={0x4}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) r7 = syz_mount_image$fuse(0x0, &(0x7f0000000100)='./file0\x00', 0x40, 0x0, 0x0, 0x0, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r9, &(0x7f00000002c0)=ANY=[@ANYBLOB="1500000065ffff018000000800395032303030"], 0x15) write$P9_RLERRORu(r9, &(0x7f00000003c0)=ANY=[@ANYBLOB='S\x00\x00\x00\a\x00\x00', @ANYRESDEC=r8, @ANYRESDEC=r7, @ANYBLOB], 0x53) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x2004000, &(0x7f0000000080)={'trans=fd,', {'rfdno', 0x3d, r8}, 0x2c, {'wfdno', 0x3d, r9}, 0x2c, {[], [], 0x6b}}) 0s ago: executing program 0 (id=37): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x80, &(0x7f0000000200)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r0 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents64(r0, 0xfffffffffffffffe, 0x29) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.171' (ED25519) to the list of known hosts. [ 73.089585][ T5766] cgroup: Unknown subsys name 'net' [ 73.234592][ T5766] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 74.621945][ T5766] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 76.034856][ T5781] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 76.055056][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 76.060871][ T5789] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 76.063558][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 76.070470][ T5789] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 76.077348][ T51] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 76.093090][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 76.093184][ T5789] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 76.100609][ T51] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 76.109632][ T5791] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 76.116020][ T51] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 76.129247][ T51] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 76.136794][ T51] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 76.139043][ T5791] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 76.145338][ T51] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 76.158854][ T5791] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 76.159246][ T51] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 76.175754][ T51] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 76.182394][ T5790] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 76.197870][ T5790] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 76.205246][ T5790] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 76.212641][ T5790] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 76.224181][ T51] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 76.233321][ T5792] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 76.607464][ T5778] chnl_net:caif_netlink_parms(): no params data found [ 76.689207][ T5785] chnl_net:caif_netlink_parms(): no params data found [ 76.724574][ T5778] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.732485][ T5778] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.740163][ T5778] bridge_slave_0: entered allmulticast mode [ 76.746975][ T5778] bridge_slave_0: entered promiscuous mode [ 76.756065][ T5778] bridge0: port 2(bridge_slave_1) entered blocking state [ 76.763421][ T5778] bridge0: port 2(bridge_slave_1) entered disabled state [ 76.770752][ T5778] bridge_slave_1: entered allmulticast mode [ 76.777541][ T5778] bridge_slave_1: entered promiscuous mode [ 76.849658][ T5778] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 76.860454][ T5784] chnl_net:caif_netlink_parms(): no params data found [ 76.884413][ T5778] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 76.978307][ T5785] bridge0: port 1(bridge_slave_0) entered blocking state [ 76.985516][ T5785] bridge0: port 1(bridge_slave_0) entered disabled state [ 76.993227][ T5785] bridge_slave_0: entered allmulticast mode [ 77.002167][ T5785] bridge_slave_0: entered promiscuous mode [ 77.010343][ T5785] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.017426][ T5785] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.024960][ T5785] bridge_slave_1: entered allmulticast mode [ 77.032329][ T5785] bridge_slave_1: entered promiscuous mode [ 77.045655][ T5778] team0: Port device team_slave_0 added [ 77.054149][ T5778] team0: Port device team_slave_1 added [ 77.097594][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.104785][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.133530][ T5778] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.165556][ T5785] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.174858][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 77.187365][ T5778] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.194452][ T5778] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.221299][ T5778] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.243251][ T5785] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.281492][ T5784] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.289375][ T5784] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.296945][ T5784] bridge_slave_0: entered allmulticast mode [ 77.304126][ T5784] bridge_slave_0: entered promiscuous mode [ 77.326076][ T5785] team0: Port device team_slave_0 added [ 77.344250][ T5784] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.352117][ T5784] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.359920][ T5784] bridge_slave_1: entered allmulticast mode [ 77.366868][ T5784] bridge_slave_1: entered promiscuous mode [ 77.376283][ T5785] team0: Port device team_slave_1 added [ 77.433731][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.441126][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.467156][ T5785] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.480160][ T5785] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.487153][ T5785] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.513477][ T5785] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 77.558645][ T5784] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 77.591767][ T5778] hsr_slave_0: entered promiscuous mode [ 77.600568][ T5778] hsr_slave_1: entered promiscuous mode [ 77.610384][ T5784] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 77.668604][ T5785] hsr_slave_0: entered promiscuous mode [ 77.674916][ T5785] hsr_slave_1: entered promiscuous mode [ 77.681233][ T5785] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 77.697460][ T5785] Cannot create hsr debugfs directory [ 77.717606][ T5784] team0: Port device team_slave_0 added [ 77.724339][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.731625][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 77.739331][ T5780] bridge_slave_0: entered allmulticast mode [ 77.746100][ T5780] bridge_slave_0: entered promiscuous mode [ 77.771874][ T5784] team0: Port device team_slave_1 added [ 77.786039][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.793589][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 77.801048][ T5780] bridge_slave_1: entered allmulticast mode [ 77.807854][ T5780] bridge_slave_1: entered promiscuous mode [ 77.845617][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 77.853242][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.879587][ T5784] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 77.915546][ T5784] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 77.922682][ T5784] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 77.948719][ T5784] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.016860][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.031545][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 78.051311][ T5784] hsr_slave_0: entered promiscuous mode [ 78.057845][ T5784] hsr_slave_1: entered promiscuous mode [ 78.063998][ T5784] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.072244][ T5784] Cannot create hsr debugfs directory [ 78.116855][ T5780] team0: Port device team_slave_0 added [ 78.151922][ T5780] team0: Port device team_slave_1 added [ 78.246952][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 78.254362][ T5781] Bluetooth: hci0: command tx timeout [ 78.258088][ T51] Bluetooth: hci2: command tx timeout [ 78.260300][ T5790] Bluetooth: hci1: command tx timeout [ 78.266518][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.297743][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 78.328577][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 78.328720][ T5790] Bluetooth: hci3: command tx timeout [ 78.335549][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 78.335576][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 78.515105][ T5780] hsr_slave_0: entered promiscuous mode [ 78.521972][ T5780] hsr_slave_1: entered promiscuous mode [ 78.528378][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 78.535962][ T5780] Cannot create hsr debugfs directory [ 78.541976][ T5778] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 78.553922][ T5778] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 78.582037][ T5778] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 78.593373][ T5778] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 78.701011][ T5785] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 78.712729][ T5785] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 78.759422][ T5785] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 78.770792][ T5785] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 78.868525][ T5784] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 78.886419][ T5784] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 78.897406][ T5784] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 78.927415][ T5784] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 79.012629][ T5780] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 79.025059][ T5780] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 79.036632][ T5778] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.047657][ T5780] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 79.058992][ T5780] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 79.113031][ T5778] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.132542][ T5785] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.168564][ T1091] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.176085][ T1091] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.190857][ T1091] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.198079][ T1091] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.224027][ T5785] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.274519][ T4507] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.281712][ T4507] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.301886][ T1145] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.309279][ T1145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.336007][ T5784] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.381126][ T5784] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.396044][ T2937] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.403249][ T2937] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.455056][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 79.481385][ T1145] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.488620][ T1145] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.612111][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 79.640404][ T1145] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.647622][ T1145] bridge0: port 1(bridge_slave_0) entered forwarding state [ 79.671789][ T5784] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 79.705507][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.712857][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 79.864314][ T5778] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 79.981330][ T5785] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.012837][ T5778] veth0_vlan: entered promiscuous mode [ 80.045374][ T5778] veth1_vlan: entered promiscuous mode [ 80.133372][ T5785] veth0_vlan: entered promiscuous mode [ 80.154090][ T5784] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.184765][ T5785] veth1_vlan: entered promiscuous mode [ 80.236237][ T5778] veth0_macvtap: entered promiscuous mode [ 80.276767][ T5778] veth1_macvtap: entered promiscuous mode [ 80.303018][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 80.326237][ T5784] veth0_vlan: entered promiscuous mode [ 80.331922][ T5790] Bluetooth: hci2: command tx timeout [ 80.341046][ T5790] Bluetooth: hci1: command tx timeout [ 80.346522][ T5790] Bluetooth: hci0: command tx timeout [ 80.382278][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.391668][ T5785] veth0_macvtap: entered promiscuous mode [ 80.409108][ T5790] Bluetooth: hci3: command tx timeout [ 80.409780][ T5784] veth1_vlan: entered promiscuous mode [ 80.425872][ T5778] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.462422][ T5785] veth1_macvtap: entered promiscuous mode [ 80.471942][ T5780] veth0_vlan: entered promiscuous mode [ 80.485010][ T5778] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.494279][ T5778] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.506470][ T5778] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.515567][ T5778] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.548610][ T5780] veth1_vlan: entered promiscuous mode [ 80.557604][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.574619][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.589159][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.635282][ T5784] veth0_macvtap: entered promiscuous mode [ 80.646940][ T5785] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.660153][ T5785] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.671795][ T5785] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 80.693117][ T5784] veth1_macvtap: entered promiscuous mode [ 80.726498][ T5780] veth0_macvtap: entered promiscuous mode [ 80.741887][ T5785] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.755337][ T5785] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.764970][ T5785] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.773973][ T5785] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 80.812385][ T5780] veth1_macvtap: entered promiscuous mode [ 80.856586][ T2987] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 80.859862][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.873024][ T2987] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 80.876439][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.896775][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 80.908283][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.920447][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 80.931588][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.945517][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.955421][ T5784] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 80.969290][ T5784] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 80.980787][ T5784] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.025276][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.038525][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.050622][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.061502][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.071578][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 81.082091][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.093325][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 81.107227][ T5784] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.116561][ T5784] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.126012][ T5784] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.136252][ T5784] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.166372][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.177682][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.190700][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.201453][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.213746][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 81.224412][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 81.237927][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 81.247037][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.251794][ T5780] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.264108][ T5780] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.264793][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.273889][ T5780] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.291367][ T5780] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 81.384286][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.407699][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.512360][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.533043][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.634605][ T1091] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.655292][ T1091] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.668441][ T2937] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.702342][ T2937] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.746453][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.771158][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 81.907782][ T2937] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 81.931657][ T2937] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 82.003531][ T5850] xt_hashlimit: size too large, truncated to 1048576 [ 82.048828][ T5852] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 82.156082][ T5853] syz.3.4[5853]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 82.245194][ T5853] loop3: detected capacity change from 0 to 256 [ 82.306785][ T5853] exfat: Unknown parameter '000000000000000000000000x0000000000000000' [ 82.408831][ T5781] Bluetooth: hci0: command tx timeout [ 82.414384][ T51] Bluetooth: hci2: command tx timeout [ 82.420106][ T5790] Bluetooth: hci1: command tx timeout [ 82.533453][ T5790] Bluetooth: hci3: command tx timeout [ 84.127962][ C0] sched: RT throttling activated [ 84.549366][ T51] Bluetooth: hci2: command tx timeout [ 84.555019][ T5781] Bluetooth: hci0: command tx timeout [ 84.565598][ T5790] Bluetooth: hci1: command tx timeout [ 84.571752][ T5781] Bluetooth: hci3: command tx timeout [ 85.093089][ T5862] kvm: kvm [5861]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x100000085 [ 85.106455][ T5862] kvm: kvm [5861]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x300000022 [ 85.137284][ T5862] kvm: kvm [5861]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x300000027 [ 85.921677][ T5880] loop0: detected capacity change from 0 to 512 [ 86.124662][ T5880] EXT4-fs (loop0): 1 truncate cleaned up [ 86.140079][ T5880] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 86.428993][ T28] audit: type=1800 audit(1785532179.030:2): pid=5880 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.8" name="file1" dev="loop0" ino=13 res=0 errno=0 [ 87.140011][ T176] cfg80211: failed to load regulatory.db [ 87.913632][ T5784] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 87.953824][ T5873] loop1: detected capacity change from 0 to 40427 [ 88.094816][ T5873] F2FS-fs (loop1): invalid crc value [ 88.137101][ T5873] F2FS-fs (loop1): Found nat_bits in checkpoint [ 88.138868][ T5886] loop0: detected capacity change from 0 to 512 [ 88.264570][ T5878] loop2: detected capacity change from 0 to 2048 [ 88.347204][ T5878] loop2: p1 p3 < > p4 < p5 > [ 88.355848][ T5873] F2FS-fs (loop1): Start checkpoint disabled! [ 88.362396][ T5878] loop2: partition table partially beyond EOD, truncated [ 88.392609][ T5878] loop2: p1 size 196608 extends beyond EOD, truncated [ 88.415541][ T5878] loop2: p3 start 4284289 is beyond EOD, truncated [ 88.451825][ T5878] loop2: p5 size 196608 extends beyond EOD, truncated [ 88.520916][ T5886] EXT4-fs (loop0): failed to open journal device unknown-block(0,0) -6 [ 89.059437][ T5894] WARNING! power/level is deprecated; use power/control instead [ 90.736645][ T5914] loop3: detected capacity change from 0 to 128 [ 90.754406][ T5914] ======================================================= [ 90.754406][ T5914] WARNING: The mand mount option has been deprecated and [ 90.754406][ T5914] and is ignored by this kernel. Remove the mand [ 90.754406][ T5914] option from the mount to silence this warning. [ 90.754406][ T5914] ======================================================= [ 90.797777][ T5915] tmpfs: Bad value for 'mpol' [ 92.837312][ T5931] tmpfs: Cannot retroactively limit size [ 94.254724][ T5942] loop2: detected capacity change from 0 to 128 [ 94.315225][ T5942] FAT-fs (loop2): utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive! [ 94.393628][ T5942] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 94.708631][ T5951] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 94.718124][ T5951] ±ÿ: renamed from team_slave_1 (while UP) [ 94.893473][ T5953] Cannot find del_set index 2 as target [ 98.021572][ T4507] FAT-fs (loop2): Invalid FSINFO signature: 0x41615252, 0x80417272 (sector = 1) [ 98.570307][ T5957] xt_CT: No such helper "netbios-ns" [ 98.599100][ T55] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 98.628166][ T5974] netlink: 8 bytes leftover after parsing attributes in process `syz.2.35'. [ 98.815937][ T55] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 98.866934][ T55] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 98.936028][ T5979] x_tables: arp_tables: NFQUEUE target: not valid for this family [ 98.950297][ T5979] ±ÿ: renamed from team_slave_1 (while UP) [ 98.970762][ T55] usb 1-1: Dual-Role OTG device on HNP port [ 99.073489][ T55] usb 1-1: New USB device found, idVendor=0000, idProduct=0000, bcdDevice= 6.06 [ 99.283387][ T55] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 99.636537][ C1] ------------[ cut here ]------------ [ 99.642433][ C1] usb_ep_enable: ep129 (ep1in-bulk) has maxpacket 0 [ 99.649782][ C1] WARNING: CPU: 1 PID: 55 at drivers/usb/gadget/udc/core.c:125 usb_ep_enable+0x263/0x440 [ 99.659663][ C1] Modules linked in: [ 99.663592][ C1] CPU: 1 PID: 55 Comm: kworker/1:2 Not tainted syzkaller #0 [ 99.670988][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 99.681068][ C1] Workqueue: usb_hub_wq hub_event [ 99.686135][ C1] RIP: 0010:usb_ep_enable+0x263/0x440 [ 99.691537][ C1] Code: 49 8b 0e 48 c7 c0 40 bd 7a 8b 49 c7 c0 60 bd 7a 8b 4c 0f 44 c0 48 c7 c7 00 bd 7a 8b 48 c7 c6 e7 8b a6 8c 89 ea e8 fd e0 97 fa <0f> 0b e9 e1 fe ff ff e8 e1 10 ce fa 49 bc 00 00 00 00 00 fc ff df [ 99.711186][ C1] RSP: 0018:ffffc900001f07b0 EFLAGS: 00010046 [ 99.717298][ C1] RAX: e98ca61da088c500 RBX: ffff8880254280e0 RCX: ffff88801d279e00 [ 99.725388][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 99.733477][ C1] RBP: 0000000000000081 R08: ffff8880b8f28c53 R09: 1ffff110171e518a [ 99.741501][ C1] R10: dffffc0000000000 R11: ffffed10171e518b R12: dffffc0000000000 [ 99.749634][ C1] R13: ffff88802542810d R14: ffff8880254280e8 R15: ffff88802da254ba [ 99.757645][ C1] FS: 0000000000000000(0000) GS:ffff8880b8f00000(0000) knlGS:0000000000000000 [ 99.766608][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 99.773225][ C1] CR2: 0000001b2e021ff8 CR3: 0000000062a81000 CR4: 00000000003506e0 [ 99.781331][ C1] Call Trace: [ 99.784788][ C1] [ 99.787716][ C1] hidg_set_alt+0x12a/0xa10 [ 99.792284][ C1] ? usb_gadget_set_state+0x12c/0x2a0 [ 99.797719][ C1] set_config+0x735/0xff0 [ 99.802153][ C1] composite_setup+0x1df4/0x33a0 [ 99.807150][ C1] configfs_composite_setup+0xc7/0x100 [ 99.812654][ C1] dummy_timer+0x1309/0x3420 [ 99.817309][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 99.822365][ C1] ? lock_chain_count+0x20/0x20 [ 99.827254][ C1] ? dummy_free_streams+0x520/0x520 [ 99.832502][ C1] ? dummy_free_streams+0x520/0x520 [ 99.837731][ C1] __hrtimer_run_queues+0x525/0xc10 [ 99.843005][ C1] ? hrtimer_interrupt+0x980/0x980 [ 99.848418][ C1] ? read_tsc+0x9/0x20 [ 99.852533][ C1] hrtimer_run_softirq+0x177/0x290 [ 99.857695][ C1] handle_softirqs+0x27d/0x820 [ 99.862495][ C1] ? read_tsc+0x9/0x20 [ 99.866611][ C1] ? ktime_get+0x24b/0x280 [ 99.871071][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 99.875877][ C1] ? do_softirq+0x1a0/0x1a0 [ 99.880604][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 99.885845][ C1] __irq_exit_rcu+0xd3/0x190 [ 99.890471][ C1] ? irq_exit_rcu+0x20/0x20 [ 99.895017][ C1] irq_exit_rcu+0x9/0x20 [ 99.899290][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 99.904978][ C1] [ 99.907929][ C1] [ 99.910890][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 99.916910][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 99.923461][ C1] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 3b 6f c6 f6 65 8b 05 9c 3d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 99.943115][ C1] RSP: 0018:ffffc9000130efe0 EFLAGS: 00000206 [ 99.949344][ C1] RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: e98ca61da088c500 [ 99.957629][ C1] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 99.965645][ C1] RBP: ffffc9000130f070 R08: ffffffff911eb56f R09: 1ffffffff223d6ad [ 99.973651][ C1] R10: dffffc0000000000 R11: fffffbfff223d6ae R12: dffffc0000000000 [ 99.981651][ C1] R13: dffffc0000000000 R14: ffff888025428000 R15: 1ffff92000261dfc [ 99.989677][ C1] ? _raw_spin_unlock+0x40/0x40 [ 99.994661][ C1] ? kobject_get+0xcc/0x120 [ 99.999200][ C1] dummy_urb_enqueue+0x587/0x780 [ 100.004435][ C1] usb_hcd_submit_urb+0x318/0x1aa0 [ 100.009597][ C1] ? __init_swait_queue_head+0xa8/0x140 [ 100.015176][ C1] usb_start_wait_urb+0x140/0x580 [ 100.020245][ C1] ? usb_api_blocking_completion+0xb0/0xb0 [ 100.026113][ C1] usb_control_msg+0x235/0x3e0 [ 100.030999][ C1] usb_set_configuration+0x12a8/0x2150 [ 100.036539][ C1] usb_generic_driver_probe+0x8d/0x150 [ 100.042058][ C1] usb_probe_device+0x12a/0x260 [ 100.046994][ C1] ? usb_register_device_driver+0x230/0x230 [ 100.053493][ C1] really_probe+0x247/0xae0 [ 100.058146][ C1] ? pm_runtime_barrier+0x14b/0x1c0 [ 100.063391][ C1] __driver_probe_device+0x1f5/0x390 [ 100.068747][ C1] driver_probe_device+0x4f/0x420 [ 100.073825][ C1] __device_attach_driver+0x2ca/0x510 [ 100.079253][ C1] bus_for_each_drv+0x252/0x2e0 [ 100.084144][ C1] ? coredump_store+0x90/0x90 [ 100.088860][ C1] ? bus_find_device+0x300/0x300 [ 100.094016][ C1] __device_attach+0x2c1/0x420 [ 100.098831][ C1] ? device_attach+0x20/0x20 [ 100.103542][ C1] ? __kmem_cache_free+0xba/0x1f0 [ 100.108815][ C1] ? do_raw_spin_unlock+0x121/0x230 [ 100.114063][ C1] bus_probe_device+0x180/0x260 [ 100.118973][ C1] device_add+0x87c/0xc40 [ 100.123361][ C1] usb_new_device+0x995/0x1550 [ 100.128167][ C1] ? usb_disconnect+0x8a0/0x8a0 [ 100.133056][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.138311][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 100.143553][ C1] hub_event+0x29d5/0x4a80 [ 100.148048][ C1] ? hub_post_resume+0x120/0x120 [ 100.153105][ C1] ? read_lock_is_recursive+0x20/0x20 [ 100.158524][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.163762][ C1] ? process_scheduled_works+0x975/0x1600 [ 100.169522][ C1] ? process_scheduled_works+0x975/0x1600 [ 100.175287][ C1] process_scheduled_works+0xa60/0x1600 [ 100.180913][ C1] ? worker_attach_to_pool+0x370/0x370 [ 100.186428][ C1] ? assign_work+0x3cc/0x5d0 [ 100.191065][ C1] worker_thread+0xa5e/0xfe0 [ 100.195703][ C1] ? _raw_spin_unlock+0x40/0x40 [ 100.200598][ C1] ? __kthread_parkme+0x71/0x1c0 [ 100.205586][ C1] kthread+0x2fa/0x390 [ 100.209869][ C1] ? pr_cont_work+0x550/0x550 [ 100.214587][ C1] ? kthread_blkcg+0xd0/0xd0 [ 100.219213][ C1] ret_from_fork+0x48/0x80 [ 100.223753][ C1] ? kthread_blkcg+0xd0/0xd0 [ 100.228376][ C1] ret_from_fork_asm+0x11/0x20 [ 100.233196][ C1] [ 100.236252][ C1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 100.243556][ C1] CPU: 1 PID: 55 Comm: kworker/1:2 Not tainted syzkaller #0 [ 100.250872][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 100.261215][ C1] Workqueue: usb_hub_wq hub_event [ 100.266276][ C1] Call Trace: [ 100.269580][ C1] [ 100.272445][ C1] dump_stack_lvl+0x18c/0x250 [ 100.277160][ C1] ? show_regs_print_info+0x20/0x20 [ 100.282392][ C1] ? load_image+0x420/0x420 [ 100.286956][ C1] panic+0x2ca/0x720 [ 100.290900][ C1] ? bpf_jit_dump+0xd0/0xd0 [ 100.295478][ C1] ? ret_from_fork_asm+0x11/0x20 [ 100.300458][ C1] __warn+0x2e0/0x470 [ 100.304469][ C1] ? usb_ep_enable+0x263/0x440 [ 100.309262][ C1] ? usb_ep_enable+0x263/0x440 [ 100.314060][ C1] report_bug+0x2be/0x4f0 [ 100.318421][ C1] ? usb_ep_enable+0x263/0x440 [ 100.323220][ C1] ? usb_ep_enable+0x263/0x440 [ 100.328005][ C1] ? usb_ep_enable+0x265/0x440 [ 100.332788][ C1] handle_bug+0xcf/0x120 [ 100.337066][ C1] exc_invalid_op+0x1a/0x50 [ 100.341682][ C1] asm_exc_invalid_op+0x1a/0x20 [ 100.346559][ C1] RIP: 0010:usb_ep_enable+0x263/0x440 [ 100.352048][ C1] Code: 49 8b 0e 48 c7 c0 40 bd 7a 8b 49 c7 c0 60 bd 7a 8b 4c 0f 44 c0 48 c7 c7 00 bd 7a 8b 48 c7 c6 e7 8b a6 8c 89 ea e8 fd e0 97 fa <0f> 0b e9 e1 fe ff ff e8 e1 10 ce fa 49 bc 00 00 00 00 00 fc ff df [ 100.371686][ C1] RSP: 0018:ffffc900001f07b0 EFLAGS: 00010046 [ 100.377776][ C1] RAX: e98ca61da088c500 RBX: ffff8880254280e0 RCX: ffff88801d279e00 [ 100.385772][ C1] RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000002 [ 100.393775][ C1] RBP: 0000000000000081 R08: ffff8880b8f28c53 R09: 1ffff110171e518a [ 100.401879][ C1] R10: dffffc0000000000 R11: ffffed10171e518b R12: dffffc0000000000 [ 100.409876][ C1] R13: ffff88802542810d R14: ffff8880254280e8 R15: ffff88802da254ba [ 100.417893][ C1] hidg_set_alt+0x12a/0xa10 [ 100.422439][ C1] ? usb_gadget_set_state+0x12c/0x2a0 [ 100.427851][ C1] set_config+0x735/0xff0 [ 100.432225][ C1] composite_setup+0x1df4/0x33a0 [ 100.437201][ C1] configfs_composite_setup+0xc7/0x100 [ 100.442697][ C1] dummy_timer+0x1309/0x3420 [ 100.447350][ C1] ? __lock_acquire+0x7d80/0x7d80 [ 100.452423][ C1] ? lock_chain_count+0x20/0x20 [ 100.457312][ C1] ? dummy_free_streams+0x520/0x520 [ 100.462538][ C1] ? dummy_free_streams+0x520/0x520 [ 100.467752][ C1] __hrtimer_run_queues+0x525/0xc10 [ 100.472990][ C1] ? hrtimer_interrupt+0x980/0x980 [ 100.478140][ C1] ? read_tsc+0x9/0x20 [ 100.482274][ C1] hrtimer_run_softirq+0x177/0x290 [ 100.487442][ C1] handle_softirqs+0x27d/0x820 [ 100.492250][ C1] ? read_tsc+0x9/0x20 [ 100.496339][ C1] ? ktime_get+0x24b/0x280 [ 100.500793][ C1] ? __irq_exit_rcu+0xd3/0x190 [ 100.505591][ C1] ? do_softirq+0x1a0/0x1a0 [ 100.510129][ C1] ? irqtime_account_irq+0xb6/0x1c0 [ 100.515358][ C1] __irq_exit_rcu+0xd3/0x190 [ 100.520035][ C1] ? irq_exit_rcu+0x20/0x20 [ 100.524604][ C1] irq_exit_rcu+0x9/0x20 [ 100.528901][ C1] sysvec_apic_timer_interrupt+0xa4/0xc0 [ 100.534589][ C1] [ 100.537541][ C1] [ 100.540492][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 100.546514][ C1] RIP: 0010:_raw_spin_unlock_irqrestore+0xc0/0x120 [ 100.553057][ C1] Code: c7 44 24 20 00 00 00 00 9c 8f 44 24 20 f7 44 24 20 00 02 00 00 41 c6 04 07 f8 75 4b f7 c3 00 02 00 00 74 01 fb bf 01 00 00 00 3b 6f c6 f6 65 8b 05 9c 3d 6d 75 85 c0 74 3c 48 c7 04 24 0e 36 [ 100.572726][ C1] RSP: 0018:ffffc9000130efe0 EFLAGS: 00000206 [ 100.578823][ C1] RAX: dffffc0000000004 RBX: 0000000000000a06 RCX: e98ca61da088c500 [ 100.586914][ C1] RDX: dffffc0000000000 RSI: ffffffff8acacbe0 RDI: 0000000000000001 [ 100.595096][ C1] RBP: ffffc9000130f070 R08: ffffffff911eb56f R09: 1ffffffff223d6ad [ 100.603112][ C1] R10: dffffc0000000000 R11: fffffbfff223d6ae R12: dffffc0000000000 [ 100.611292][ C1] R13: dffffc0000000000 R14: ffff888025428000 R15: 1ffff92000261dfc [ 100.619362][ C1] ? _raw_spin_unlock+0x40/0x40 [ 100.624266][ C1] ? kobject_get+0xcc/0x120 [ 100.628803][ C1] dummy_urb_enqueue+0x587/0x780 [ 100.633773][ C1] usb_hcd_submit_urb+0x318/0x1aa0 [ 100.638934][ C1] ? __init_swait_queue_head+0xa8/0x140 [ 100.645391][ C1] usb_start_wait_urb+0x140/0x580 [ 100.650460][ C1] ? usb_api_blocking_completion+0xb0/0xb0 [ 100.656319][ C1] usb_control_msg+0x235/0x3e0 [ 100.661355][ C1] usb_set_configuration+0x12a8/0x2150 [ 100.666877][ C1] usb_generic_driver_probe+0x8d/0x150 [ 100.672473][ C1] usb_probe_device+0x12a/0x260 [ 100.677551][ C1] ? usb_register_device_driver+0x230/0x230 [ 100.683513][ C1] really_probe+0x247/0xae0 [ 100.688057][ C1] ? pm_runtime_barrier+0x14b/0x1c0 [ 100.693370][ C1] __driver_probe_device+0x1f5/0x390 [ 100.698699][ C1] driver_probe_device+0x4f/0x420 [ 100.703764][ C1] __device_attach_driver+0x2ca/0x510 [ 100.709186][ C1] bus_for_each_drv+0x252/0x2e0 [ 100.714076][ C1] ? coredump_store+0x90/0x90 [ 100.718793][ C1] ? bus_find_device+0x300/0x300 [ 100.723764][ C1] __device_attach+0x2c1/0x420 [ 100.728613][ C1] ? device_attach+0x20/0x20 [ 100.733240][ C1] ? __kmem_cache_free+0xba/0x1f0 [ 100.738303][ C1] ? do_raw_spin_unlock+0x121/0x230 [ 100.743530][ C1] bus_probe_device+0x180/0x260 [ 100.748420][ C1] device_add+0x87c/0xc40 [ 100.752785][ C1] usb_new_device+0x995/0x1550 [ 100.757586][ C1] ? usb_disconnect+0x8a0/0x8a0 [ 100.762546][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.767779][ C1] ? lockdep_hardirqs_on+0x98/0x150 [ 100.773012][ C1] hub_event+0x29d5/0x4a80 [ 100.777499][ C1] ? hub_post_resume+0x120/0x120 [ 100.782457][ C1] ? read_lock_is_recursive+0x20/0x20 [ 100.787871][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 100.793107][ C1] ? process_scheduled_works+0x975/0x1600 [ 100.798874][ C1] ? process_scheduled_works+0x975/0x1600 [ 100.804624][ C1] process_scheduled_works+0xa60/0x1600 [ 100.810235][ C1] ? worker_attach_to_pool+0x370/0x370 [ 100.815728][ C1] ? assign_work+0x3cc/0x5d0 [ 100.820345][ C1] worker_thread+0xa5e/0xfe0 [ 100.824973][ C1] ? _raw_spin_unlock+0x40/0x40 [ 100.829857][ C1] ? __kthread_parkme+0x71/0x1c0 [ 100.834892][ C1] kthread+0x2fa/0x390 [ 100.838983][ C1] ? pr_cont_work+0x550/0x550 [ 100.843698][ C1] ? kthread_blkcg+0xd0/0xd0 [ 100.848400][ C1] ret_from_fork+0x48/0x80 [ 100.852848][ C1] ? kthread_blkcg+0xd0/0xd0 [ 100.857470][ C1] ret_from_fork_asm+0x11/0x20 [ 100.862273][ C1] [ 100.865579][ C1] Kernel Offset: disabled [ 100.869949][ C1] Rebooting in 86400 seconds..