last executing test programs: 5.52981057s ago: executing program 1 (id=95): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) mount$afs(0x0, 0x0, &(0x7f0000002880), 0x700, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r3 = openat2$dir(0xffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x10000, 0x88, 0x5}, 0x18) openat(r3, &(0x7f00000003c0)='./file0\x00', 0x10200, 0x3) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) syz_open_dev$tty20(0xc, 0x4, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000140)=0x40, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x6c}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) 5.148361956s ago: executing program 3 (id=96): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) socket(0x1, 0x803, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) 4.795911256s ago: executing program 3 (id=98): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000300)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) read$FUSE(0xffffffffffffffff, &(0x7f0000002680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r3, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x10000000000c, 0xa, 0x1, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r5, 0xfffffffffffffffe, r5, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0xecf86c37d53049c4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) sendmsg$unix(r8, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r0, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x4, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x6, 0x7, 0xfffffffe, 0xe3, 0x3ff, 0x2}}]}}}]}, 0x78}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r9, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x20, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x10000f0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) socketpair$unix(0x1, 0x1, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) 4.614632732s ago: executing program 0 (id=99): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000"], 0x0, 0x26}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef64bd465b9780e2bbe408ccc58187feb0e3d43347f98e1a298327e6f9b312ecb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259620618c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a30536455bb774f7f154263178151ea93f5774b56a7142047326f940e95b8489e1c5650f5c61299a295f79c88456521cffdef93e29f10f4a11f0ca134a375a7ecfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d9823659d1945258fc668950e5aacfa06e1a212661b3f57a266c90e64efc8d8f730867202a9ee94e6a1f851337c2c9671d98a19bdc132c153b3ad843bdd308a07ba8f50a20cfd2c8b94e86ea0af0a9e0e9789ffd38f9b86da101e2266700"/441], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc00c6211, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x6faa, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x3e0}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x93}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, 0x3505}}, 0xe4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r6 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x2503, 0x0) gettid() sendmsg$nl_generic(r6, &(0x7f0000002cc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002c80)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000140)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000001a00), 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) 3.75953383s ago: executing program 3 (id=100): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) 3.757315081s ago: executing program 3 (id=101): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0xa0380, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000005c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x8, 0x25dfdbfc, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8000) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0xfffffff8, {0x0, 0x0, 0x0, r4, {0xb, 0xd}, {}, {0x8}}}, 0x24}}, 0x40004) recvmmsg(r5, &(0x7f0000000b40)=[{{0x0, 0x0, &(0x7f00000027c0)=[{&(0x7f0000001500)=""/4096, 0x1000}, {&(0x7f0000002540)=""/73, 0x49}], 0x2}, 0x3}], 0x1, 0x40010022, 0x0) 3.648817149s ago: executing program 0 (id=102): r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) r1 = syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x4002) syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0xe10c, 0x4005, 0x0, 0x40, 0x0, 0x0}, &(0x7f00000003c0)=0x0, &(0x7f0000000400)=0x0, &(0x7f0000000440)=0x0) ioctl$PPPIOCGIDLE64(r0, 0x8010743f, &(0x7f0000000000)) r5 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) openat$mice(0xffffff9c, &(0x7f0000000040), 0x41) connect$inet6(r5, &(0x7f00000000c0)={0xa, 0x4e1b, 0x80000040, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x2}, 0x1c) setsockopt$inet6_tcp_int(r5, 0x6, 0x2e, &(0x7f0000000080)=0x200004, 0x4) syz_io_uring_submit(r2, r3, r4, &(0x7f0000000480)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd=r1, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, '\x00', &(0x7f0000000540)}}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffffffff) socket$nl_rdma(0x10, 0x3, 0x14) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r8, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth1_to_bridge\x00', 0x20}, 0x18) getsockopt$IP_VS_SO_GET_DAEMON(r8, 0x0, 0x31, &(0x7f0000000040), &(0x7f0000000080)=0x30) r9 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r9, 0x6, 0x13, 0x0, 0x0) connect$inet(r9, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r9, 0x0, 0x48c, &(0x7f00000002c0)={0x1, 'bridge0\x00', 0x1}, 0x18) sendmsg$nl_route(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000001300010029bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="073000000904000008001300", @ANYRES32=0x0, @ANYBLOB="6763efe48edd4b47d6442b14d6a1e52bb6ceb40697e06680d7c23ab85e965fd3b9b6d788b0cd4d074b020db1091184e17f311f68d963c757d6948719b9100dff66ed6d19c73ac66dec5bc5dc4fd328ff26bdef73d1aee164d3fe9b83fa538ecc786fc87d60d7377dfbcd9586a44ff032eed345702857d82b01683db0fb7703e65e62e19856e7915e623c5a31f72c07b879167a5f287022d7ed88ba1ce18d99e6f53e02b725bcdf1e909dac6c27f4374acc00"/191], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r10 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 3.527347336s ago: executing program 3 (id=103): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000300)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) read$FUSE(0xffffffffffffffff, &(0x7f0000002680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r3, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x10000000000c, 0xa, 0x1, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r5, 0xfffffffffffffffe, r5, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0xecf86c37d53049c4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) sendmsg$unix(r8, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r7, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r0, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x4, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x6, 0x7, 0xfffffffe, 0xe3, 0x3ff, 0x2}}]}}}]}, 0x78}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r9, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x20, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x10000f0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) socketpair$unix(0x1, 0x1, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) 3.421419601s ago: executing program 1 (id=104): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="18010000050000000000000080000000850000007500000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000018000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a600000095"], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x51, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400000}, 0x94) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=@newqdisc={0x164, 0x24, 0xf0b, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xe, 0x5}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x6e, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0x1, 0x5}}}}, @qdisc_kind_options=@q_gred={{0x9}, {0x118, 0x2, [@TCA_GRED_STAB={0x104, 0x2, "ee086d755b44a028c6cfe58b616cdef1e3ec0f65f968f261dd45d30f95c5082a44c386ef1dddfb903b7aeed78b2291928ff95dc73f271e7514cfecc2b369b129757ab0227f93d81b75396268e59e5f79f86bfed728ff4720d58845f2b955e6f1077b0a75342e02cf0347f507188bc835a973118cf1e865e2f515f7bb038671e7b8b36d419c0abdfda041fa87d5ba585b03902ba575169fea0eb0d102a4829afcacb43a90c6f5cf064e26447235236bf79e1d749a3aff48cb5647fd9054741bdb490f93b8e178a86b0b934d4c90b2309afbba2692924fab1b16f6c82f3a9b3c883cffcf169f59ae1abf0816ff161ca6ae06a65c3afa752ff1361cec1afd00"}, @TCA_GRED_MAX_P={0x8, 0x4, 0x81}, @TCA_GRED_LIMIT={0x8, 0x5, 0x6}]}}]}, 0x164}}, 0x4000010) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0xaad80) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5", 0x4) r6 = accept4(r5, 0x0, 0x0, 0x80800) sendmmsg$alg(r6, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000280)="02c5150d44df388611cd97cfa0a3fed26f75e79c0974641f432d3898c7d3c675ba2c3ce3d6fe05a7512383bfbe1eb6d1810c27d15dbe1162d734c030ec6f8622998ae46b037973c99e98a911412b19ac", 0x50}, {&(0x7f0000000340)="e6f616b848c25d1364996bdebcb618b09a9cdd91df285326497368692222f3fd6227cf49d8de356dd8deb6b5e7c8b2c1e4d1ea1680f4968daf7c4589e66c71ade65011b5cb2a4c", 0x47}, {&(0x7f00000003c0)="ba094f7f1691908f95ba6bb6e2f77ed31bc14707f30a41717c", 0x19}], 0x3, 0x0, 0x0, 0x890}], 0x1, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x10, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0xf5000000}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r8 = fsopen(&(0x7f00000003c0)='pvfs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='c:::\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r4, 0x402c5342, &(0x7f00000000c0)={0xfffffffc, 0x7a120, 0x7, {0x98c1, 0x400}, 0x200}) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r9, &(0x7f0000000340)='blkio.bfq.sectors\x00', 0x0, 0x0) readv(r9, &(0x7f0000000040)=[{&(0x7f0000001640)=""/244, 0xf4}], 0x1) 2.759620817s ago: executing program 0 (id=105): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) mount$afs(0x0, 0x0, &(0x7f0000002880), 0x700, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r3 = openat2$dir(0xffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x10000, 0x88, 0x5}, 0x18) openat(r3, &(0x7f00000003c0)='./file0\x00', 0x10200, 0x3) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) syz_open_dev$tty20(0xc, 0x4, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000140)=0x40, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x6c}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) 2.759349038s ago: executing program 2 (id=106): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) 2.582233962s ago: executing program 2 (id=107): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000000)={0xe, 0x18, 0xfa00, @ib_path={0x0, r1, 0x1, 0x7ffffffe}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000200)=0xa0, r1}}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="95140900000000090000000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000000780)='./file2\x00') symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c09425, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0xffffffffffffff7c, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x1, './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) timer_getoverrun(r2) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0xfffffffffffffeef, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 2.572572553s ago: executing program 3 (id=115): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905"], 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100009ac0b620110f2110"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r1, 0x0, 0x14) syz_usb_ep_write(r0, 0x81, 0x2, &(0x7f00000002c0)="28d3") 1.99626439s ago: executing program 2 (id=108): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000300)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) read$FUSE(0xffffffffffffffff, &(0x7f0000002680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r3, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x10000000000c, 0xa, 0x1, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r5, 0xfffffffffffffffe, r5, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0xecf86c37d53049c4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) sendmsg$unix(r8, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r0, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x4, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x6, 0x7, 0xfffffffe, 0xe3, 0x3ff, 0x2}}]}}}]}, 0x78}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r9, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x20, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x10000f0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) socketpair$unix(0x1, 0x1, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) 1.991951966s ago: executing program 1 (id=117): socket$inet_mptcp(0x2, 0x1, 0x106) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000004c0), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x20000004, &(0x7f0000000040)={0xffffffffffffffff}, 0x2, 0x3}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000000000)={0xe, 0x18, 0xfa00, @ib_path={0x0, r1, 0x1, 0x7ffffffe}}, 0x20) write$RDMA_USER_CM_CMD_SET_OPTION(r0, &(0x7f0000001300)={0xe, 0x18, 0xfa00, @id_tos={&(0x7f0000000200)=0xa0, r1}}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000380)={0x1f, 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB="95140900000000090000000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x12}, 0x94) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000000780)='./file2\x00') symlinkat(&(0x7f0000001040)='./file0/file0\x00', 0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00') fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c09425, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0xffffffffffffff7c, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x1, './file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) timer_getoverrun(r2) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0xfffffffffffffeef, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) 1.627231083s ago: executing program 1 (id=109): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f00000005c0), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="050000007f0000000000010000000000", @ANYRES64=0x0, @ANYRES64=0x2710], 0x48}}, 0x0) 1.520604099s ago: executing program 1 (id=110): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000"], 0x0, 0x26}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef64bd465b9780e2bbe408ccc58187feb0e3d43347f98e1a298327e6f9b312ecb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259620618c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a30536455bb774f7f154263178151ea93f5774b56a7142047326f940e95b8489e1c5650f5c61299a295f79c88456521cffdef93e29f10f4a11f0ca134a375a7ecfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d9823659d1945258fc668950e5aacfa06e1a212661b3f57a266c90e64efc8d8f730867202a9ee94e6a1f851337c2c9671d98a19bdc132c153b3ad843bdd308a07ba8f50a20cfd2c8b94e86ea0af0a9e0e9789ffd38f9b86da101e2266700"/441], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc00c6211, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x6faa, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x3e0}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x93}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, 0x3505}}, 0xe4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r6 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x2503, 0x0) gettid() sendmsg$nl_generic(r6, &(0x7f0000002cc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000002c80)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000140)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000001a00), 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) 1.120442157s ago: executing program 0 (id=111): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000002000000000000000000"], 0x0, 0x26}, 0x28) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f00000009c0)=ANY=[@ANYBLOB="18000000000000000000000000000000950000000000000009000000dfa2bff372df8cdbeb318ab2bec8fc36903c0ec359caa1af3c914019395cc154010c693709800000000000000016a85adef34bf78c76e6222337923e1bea6ef64bd465b9780e2bbe408ccc58187feb0e3d43347f98e1a298327e6f9b312ecb4af936461f34a8a32a50bbbb69ec85168947b86df9f2609bf93f7a1be259620618c3c75da31290bce645451b851111dd98ac4d8da9317c2c082020e0b2d634086785f3fe41a30536455bb774f7f154263178151ea93f5774b56a7142047326f940e95b8489e1c5650f5c61299a295f79c88456521cffdef93e29f10f4a11f0ca134a375a7ecfbfc0ff976b20fef6033495b9b94777db9bb9b678ffc1130000009faa798226a080c01e47151268a02dc1a557cfdcf76305fbf6643df66b1b4d2d5e7bf698fc5a18d9823659d1945258fc668950e5aacfa06e1a212661b3f57a266c90e64efc8d8f730867202a9ee94e6a1f851337c2c9671d98a19bdc132c153b3ad843bdd308a07ba8f50a20cfd2c8b94e86ea0af0a9e0e9789ffd38f9b86da101e2266700"/441], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r0, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1, 0x0, 0xffffffffffffffff, 0xf5010000}, 0x6d) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc00c6211, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000100)={{{@in6=@ipv4={'\x00', '\xff\xff', @broadcast}, @in=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x6faa, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0x3e0}, 0x0, 0x0, 0x1}, {{@in=@rand_addr=0x64010102, 0x0, 0x93}, 0x0, @in6=@initdev={0xfe, 0x88, '\x00', 0x2, 0x0}, 0x3505}}, 0xe4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r6 = openat$ndctl0(0xffffffffffffff9c, &(0x7f0000000000), 0x2503, 0x0) gettid() sendmsg$nl_generic(r6, &(0x7f0000002cc0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) ioctl$DRM_IOCTL_GEM_FLINK(r6, 0xc008640a, &(0x7f0000000140)) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r1, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, &(0x7f0000001a00), 0x0, 0x0, 0x10, 0x8, 0x0, 0x0}}, 0x10) 1.057961866s ago: executing program 2 (id=112): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) connect$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x7fffffff, @loopback, 0x1000}, 0x1c) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB='4\x00?\x00', @ANYRES16=r2, @ANYBLOB="01002cde701004002000050000000600010005000000080009000200000008000b000000000008000c"], 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) 980.10575ms ago: executing program 2 (id=113): r0 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) syz_open_dev$loop(&(0x7f00000000c0), 0x0, 0x4002) syz_io_uring_setup(0xf00, &(0x7f0000000340)={0x0, 0xe10c, 0x4005, 0x0, 0x40, 0x0, 0x0}, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)) ioctl$PPPIOCGIDLE64(r0, 0x8010743f, &(0x7f0000000000)) r1 = socket(0x2b, 0x1, 0x1) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000000)=0x1, 0x4) connect$inet6(r1, &(0x7f00000001c0)={0xa, 0x4e1f, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) openat$mice(0xffffff9c, &(0x7f0000000040), 0x41) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e1b, 0x80000040, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x2}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2e, &(0x7f0000000080)=0x200004, 0x4) r2 = syz_open_procfs(0x0, &(0x7f00000003c0)='mountinfo\x00') sendfile(0xffffffffffffffff, r2, 0x0, 0xffffffff) socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IP_VS_SO_SET_STARTDAEMON(r5, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth1_to_bridge\x00', 0x20}, 0x18) getsockopt$IP_VS_SO_GET_DAEMON(r5, 0x0, 0x31, &(0x7f0000000040), &(0x7f0000000080)=0x30) r6 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r6, 0x6, 0x13, 0x0, 0x0) connect$inet(r6, &(0x7f0000000040)={0x2, 0x4e23, @loopback}, 0x10) setsockopt$IP_VS_SO_SET_STOPDAEMON(r6, 0x0, 0x48c, &(0x7f00000002c0)={0x1, 'bridge0\x00', 0x1}, 0x18) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=ANY=[@ANYBLOB="300000001300010029bd7000fedbdf2500000000", @ANYRES32=0x0, @ANYBLOB="073000000904000008001300", @ANYRES32=0x0, @ANYBLOB="6763efe48edd4b47d6442b14d6a1e52bb6ceb40697e06680d7c23ab85e965fd3b9b6d788b0cd4d074b020db1091184e17f311f68d963c757d6948719b9100dff66ed6d19c73ac66dec5bc5dc4fd328ff26bdef73d1aee164d3fe9b83fa538ecc786fc87d60d7377dfbcd9586a44ff032eed345702857d82b01683db0fb7703e65e62e19856e7915e623c5a31f72c07b879167a5f287022d7ed88ba1ce18d99e6f53e02b725bcdf1e909dac6c27f4374acc00"/191], 0x30}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r7, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) 610.264831ms ago: executing program 1 (id=114): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010002000000406a0800010100000000010902120001010080320904000000"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000900)='./sys/class/firmware/emi26!loader.fw/loading\x00', 0x1, 0x0) write(r0, &(0x7f0000000a00)='0\x00', 0x2) 175.813381ms ago: executing program 0 (id=116): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x10, 0x803, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) writev(0xffffffffffffffff, &(0x7f0000000840), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x19, 0x4, 0x4, 0x1ffff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x2}, 0x50) 80.200716ms ago: executing program 2 (id=118): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'syz_tun\x00', 0x0}) bpf$BPF_GET_MAP_INFO(0x3, &(0x7f0000000000)={0xffffffffffffffff, 0x58, &(0x7f0000000300)}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) read$FUSE(0xffffffffffffffff, &(0x7f0000002680)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(r3, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x10000000000c, 0xa, 0x1, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r5 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$KEYCTL_MOVE(0x1e, r5, 0xfffffffffffffffe, r5, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0xecf86c37d53049c4) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000180100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000008740000000c0a95c900000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800c0001"], 0xe4}}, 0x0) read$FUSE(r4, &(0x7f0000000640)={0x2020}, 0x2020) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000680)={0xffffffffffffffff}) sendmsg$unix(r8, 0x0, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r0, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x4, 0x0, 0x0, 0xffffffff}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0x6, 0x7, 0xfffffffe, 0xe3, 0x3ff, 0x2}}]}}}]}, 0x78}}, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) r9 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$ARPT_SO_SET_REPLACE(r9, 0x0, 0x60, &(0x7f00000002c0)={'filter\x00', 0x7, 0x4, 0x3ac, 0x0, 0x2cc, 0xe0, 0x2cc, 0x2cc, 0x2cc, 0x4, 0x0, {[{{@arp={@multicast1, @empty, 0x0, 0xffffff00, 0xc, 0x0, {@mac=@local, {[0xff, 0x80, 0x0, 0x1fe, 0xff, 0xff]}}, {@mac=@broadcast, {[0xff, 0x0, 0xff, 0x0, 0xff]}}, 0xdfe, 0x2, 0x7, 0xe, 0xfa, 0x8a5c, 'batadv0\x00', 'team0\x00', {0xff}, {}, 0x0, 0x12}, 0xbc, 0xe0}, @unspec=@NFQUEUE0={0x20, 'NFQUEUE\x00', 0x0, {0x9}}}, {{@arp={@empty, @multicast1, 0xff, 0x0, 0x4, 0x2, {@empty, {[0xff, 0x0, 0xff, 0x0, 0xff, 0x101]}}, {@mac=@broadcast, {[0x0, 0xff, 0x0, 0x0, 0x0, 0xff]}}, 0x9, 0x5, 0x5, 0x2, 0x7, 0xa7c, 'wlan0\x00', 'bond_slave_0\x00', {}, {0xb50cca1d00497645}, 0x0, 0x202}, 0xbc, 0xe0, 0x10000f0}, @unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0xfff}}}, {{@arp={@multicast1, @remote, 0xff, 0xff000000, 0xa, 0x6, {@empty, {[0xff, 0xff, 0x0, 0xff]}}, {@empty, {[0xff, 0xff, 0xff, 0xff]}}, 0x1, 0x10, 0x3, 0x5, 0x4, 0x9e, 'gre0\x00', 'wg0\x00', {}, {0xff}, 0x0, 0x8}, 0xbc, 0x10c}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @multicast2, @rand_addr=0x64010100, 0x2}}}], {{'\x00', 0xbc, 0xe0}, {0x24}}}}, 0x3f8) socketpair$unix(0x1, 0x1, 0x0, 0x0) setresuid(0x0, 0xee00, 0x0) 0s ago: executing program 0 (id=119): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_rdma(0x10, 0x3, 0x14) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) mount$afs(0x0, 0x0, &(0x7f0000002880), 0x700, &(0x7f0000000200)=ANY=[@ANYBLOB='dyn']) r3 = openat2$dir(0xffffff9c, &(0x7f0000000340)='./file0\x00', &(0x7f0000000380)={0x10000, 0x88, 0x5}, 0x18) openat(r3, &(0x7f00000003c0)='./file0\x00', 0x10200, 0x3) umount2(&(0x7f00000002c0)='./file0\x00', 0x9) syz_open_dev$tty20(0xc, 0x4, 0x0) r4 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000140)=0x40, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}]}, @CTA_TIMEOUT={0x8}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x1}]}, 0x6c}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="14000000020105"], 0x14}, 0x1, 0x0, 0x0, 0x20044804}, 0x40040) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:13413' (ED25519) to the list of known hosts. [ 42.337015][ T5728] cgroup: Unknown subsys name 'net' [ 42.510192][ T5728] cgroup: Unknown subsys name 'cpuset' [ 42.514637][ T5728] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 43.596270][ T5728] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 47.593803][ T5756] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 47.595548][ T5758] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 47.597408][ T5756] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 47.599792][ T5758] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 47.601186][ T5756] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 47.601960][ T5757] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 47.602963][ T5759] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 47.602972][ T5757] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 47.603468][ T5757] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 47.605466][ T5758] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 47.605715][ T5759] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 47.605935][ T5759] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 47.606182][ T5756] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 47.606630][ T5756] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 47.607903][ T5756] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 47.612238][ T5758] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 47.614029][ T5756] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 47.614262][ T5759] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 47.614900][ T5759] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 47.617020][ T5758] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 48.170172][ T5743] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.172918][ T5743] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.175284][ T5743] bridge_slave_0: entered allmulticast mode [ 48.178036][ T5743] bridge_slave_0: entered promiscuous mode [ 48.195549][ T5743] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.197949][ T5743] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.200347][ T5743] bridge_slave_1: entered allmulticast mode [ 48.202902][ T5743] bridge_slave_1: entered promiscuous mode [ 48.245000][ T5743] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.281002][ T5742] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.284077][ T5742] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.288137][ T5742] bridge_slave_0: entered allmulticast mode [ 48.291858][ T5742] bridge_slave_0: entered promiscuous mode [ 48.297835][ T5743] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.331515][ T5742] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.334149][ T5742] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.336537][ T5742] bridge_slave_1: entered allmulticast mode [ 48.339182][ T5742] bridge_slave_1: entered promiscuous mode [ 48.394598][ T5752] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.396964][ T5752] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.399584][ T5752] bridge_slave_0: entered allmulticast mode [ 48.402283][ T5752] bridge_slave_0: entered promiscuous mode [ 48.406598][ T5743] team0: Port device team_slave_0 added [ 48.408594][ T5744] bridge0: port 1(bridge_slave_0) entered blocking state [ 48.411534][ T5744] bridge0: port 1(bridge_slave_0) entered disabled state [ 48.413951][ T5744] bridge_slave_0: entered allmulticast mode [ 48.416553][ T5744] bridge_slave_0: entered promiscuous mode [ 48.422791][ T5744] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.425013][ T5744] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.427281][ T5744] bridge_slave_1: entered allmulticast mode [ 48.429837][ T5744] bridge_slave_1: entered promiscuous mode [ 48.434682][ T5742] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.438433][ T5752] bridge0: port 2(bridge_slave_1) entered blocking state [ 48.440933][ T5752] bridge0: port 2(bridge_slave_1) entered disabled state [ 48.443229][ T5752] bridge_slave_1: entered allmulticast mode [ 48.445954][ T5752] bridge_slave_1: entered promiscuous mode [ 48.449729][ T5743] team0: Port device team_slave_1 added [ 48.470309][ T5742] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.487354][ T5744] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.491682][ T5744] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.522100][ T5742] team0: Port device team_slave_0 added [ 48.524998][ T5752] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 48.528456][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.530756][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.538547][ T5743] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.572826][ T5742] team0: Port device team_slave_1 added [ 48.581335][ T5752] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 48.590248][ T5743] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.592846][ T5743] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.601370][ T5743] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.612215][ T5744] team0: Port device team_slave_0 added [ 48.629443][ T5752] team0: Port device team_slave_0 added [ 48.632417][ T5744] team0: Port device team_slave_1 added [ 48.634728][ T5742] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.636949][ T5742] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.644995][ T5742] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.649158][ T5742] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.651304][ T5742] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.659083][ T5742] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.663698][ T5752] team0: Port device team_slave_1 added [ 48.705977][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.708197][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.716100][ T5744] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.719904][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 48.722124][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.730124][ T5752] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 48.737231][ T5743] hsr_slave_0: entered promiscuous mode [ 48.739597][ T5743] hsr_slave_1: entered promiscuous mode [ 48.742683][ T5744] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.744883][ T5744] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.752558][ T5744] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.756443][ T5752] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 48.759142][ T5752] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 48.768991][ T5752] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 48.830585][ T5742] hsr_slave_0: entered promiscuous mode [ 48.833810][ T5742] hsr_slave_1: entered promiscuous mode [ 48.836885][ T5742] debugfs: 'hsr0' already exists in 'hsr' [ 48.839270][ T5742] Cannot create hsr debugfs directory [ 48.892820][ T5752] hsr_slave_0: entered promiscuous mode [ 48.895048][ T5752] hsr_slave_1: entered promiscuous mode [ 48.897158][ T5752] debugfs: 'hsr0' already exists in 'hsr' [ 48.899064][ T5752] Cannot create hsr debugfs directory [ 48.903911][ T5744] hsr_slave_0: entered promiscuous mode [ 48.906207][ T5744] hsr_slave_1: entered promiscuous mode [ 48.909086][ T5744] debugfs: 'hsr0' already exists in 'hsr' [ 48.911231][ T5744] Cannot create hsr debugfs directory [ 49.208331][ T5743] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 49.222030][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.227579][ T5743] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 49.236133][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.250076][ T5743] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 49.258193][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.281723][ T5743] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 49.286070][ T5743] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.310227][ T5742] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 49.317181][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.320803][ T5742] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 49.326633][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.332985][ T5742] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 49.339193][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.344813][ T5742] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 49.351246][ T5742] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.405149][ T5744] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 49.410017][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.421185][ T5744] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 49.425060][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.439134][ T5744] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 49.444535][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.448612][ T5744] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 49.452667][ T5744] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.486384][ T5752] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 49.490633][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 49.494470][ T5752] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 49.499877][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 49.503857][ T5752] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 49.510947][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 49.519076][ T5752] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 49.524065][ T5752] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 49.552149][ T5743] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.588930][ T5743] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.608512][ T5742] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.619917][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.622695][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.631081][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.633647][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.662236][ T5742] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.667794][ T64] Bluetooth: hci3: command tx timeout [ 49.674232][ T48] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.676706][ T48] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.676944][ T64] Bluetooth: hci2: command tx timeout [ 49.679657][ T5758] Bluetooth: hci1: command tx timeout [ 49.679943][ T5747] Bluetooth: hci0: command tx timeout [ 49.694701][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.697040][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.742772][ T5744] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.763575][ T5752] 8021q: adding VLAN 0 to HW filter on device bond0 [ 49.771856][ T5744] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.780714][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.783557][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.801124][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.803619][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state [ 49.813660][ T5752] 8021q: adding VLAN 0 to HW filter on device team0 [ 49.834535][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state [ 49.837017][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state [ 49.851644][ T48] bridge0: port 2(bridge_slave_1) entered blocking state [ 49.854199][ T48] bridge0: port 2(bridge_slave_1) entered forwarding state [ 50.091141][ T5742] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.110982][ T5743] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.139218][ T5742] veth0_vlan: entered promiscuous mode [ 50.157525][ T5742] veth1_vlan: entered promiscuous mode [ 50.179055][ T5743] veth0_vlan: entered promiscuous mode [ 50.182598][ T5744] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.191596][ T5752] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 50.196021][ T5743] veth1_vlan: entered promiscuous mode [ 50.215435][ T5742] veth0_macvtap: entered promiscuous mode [ 50.229764][ T5742] veth1_macvtap: entered promiscuous mode [ 50.249900][ T5744] veth0_vlan: entered promiscuous mode [ 50.258532][ T5743] veth0_macvtap: entered promiscuous mode [ 50.265275][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.269063][ T5744] veth1_vlan: entered promiscuous mode [ 50.273482][ T5743] veth1_macvtap: entered promiscuous mode [ 50.279888][ T5742] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.291332][ T13] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.298700][ T13] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.307262][ T13] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.310897][ T13] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.321773][ T5752] veth0_vlan: entered promiscuous mode [ 50.325769][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.342021][ T5743] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.351558][ T5744] veth0_macvtap: entered promiscuous mode [ 50.356052][ T13] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.360321][ T13] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.364531][ T5752] veth1_vlan: entered promiscuous mode [ 50.371575][ T13] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.375180][ T13] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.386487][ T5744] veth1_macvtap: entered promiscuous mode [ 50.415818][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.433316][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.437664][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.449953][ T5744] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.483017][ T13] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.485765][ T13] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.489684][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.492729][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.504242][ T5752] veth0_macvtap: entered promiscuous mode [ 50.507190][ T13] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.510251][ T13] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.525501][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.528354][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.535399][ T5752] veth1_macvtap: entered promiscuous mode [ 50.565688][ T177] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.568507][ T177] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.584157][ T5742] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 50.597892][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 50.601908][ T5742] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.609198][ T5742] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.610001][ T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.615988][ T5752] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 50.616607][ T5742] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.617732][ T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.625874][ T5821] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.630071][ T5821] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.631099][ T5742] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 50.642272][ T5821] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.645389][ T5821] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 50.654059][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.661563][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.732000][ T1162] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.737592][ T1162] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 50.753684][ T177] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 50.757523][ T177] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 51.052851][ T5829] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 51.078164][ T5906] netlink: 20 bytes leftover after parsing attributes in process `syz.2.3'. [ 51.094059][ T5913] process 'syz.0.6' launched './file2' with NULL argv: empty string added [ 51.098822][ T5906] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3'. [ 51.209333][ T5829] usb 6-1: New USB device found, idVendor=086a, idProduct=0100, bcdDevice= 0.01 [ 51.212611][ T5829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 51.263649][ T5829] emi26 - firmware loader 6-1:1.0: emi26_probe start [ 51.280024][ T5829] usb 6-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 51.282837][ T5829] usb 6-1: Falling back to sysfs fallback for: emi26/loader.fw [ 51.438936][ T5916] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 51.461110][ C2] raw-gadget.1 gadget.3: ignoring, device is not running [ 51.503299][ T5829] usb 6-1: emi26_load_firmware - request_firmware() failed [ 51.515894][ T5829] usb 6-1: emi26_load_firmware - error loading firmware: error = -12 [ 51.525068][ T5829] emi26 - firmware loader 6-1:1.0: probe with driver emi26 - firmware loader failed with error -5 [ 51.548404][ T5829] usb 6-1: USB disconnect, device number 2 [ 51.617632][ T5916] usb 8-1: device descriptor read/64, error -32 [ 51.747939][ T5758] Bluetooth: hci2: command tx timeout [ 51.749604][ T5758] Bluetooth: hci3: command tx timeout [ 51.751323][ T64] Bluetooth: hci0: command tx timeout [ 51.752998][ T64] Bluetooth: hci1: command tx timeout [ 51.856838][ T5916] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 51.859597][ C2] raw-gadget.1 gadget.3: ignoring, device is not running [ 51.986914][ T5916] usb 8-1: device descriptor read/64, error -32 [ 52.098770][ T5916] usb usb8-port1: attempt power cycle [ 52.486869][ T5916] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 52.540967][ T5916] usb 8-1: Using ep0 maxpacket: 32 [ 52.596348][ T5916] usb 8-1: config index 0 descriptor too short (expected 13339, got 27) [ 52.651327][ T5916] usb 8-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 52.697708][ T5958] netlink: 20 bytes leftover after parsing attributes in process `syz.0.8'. [ 52.705081][ T5916] usb 8-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 52.751900][ T5916] usb 8-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 52.768124][ T5916] usb 8-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 52.785950][ T5916] usb 8-1: Product: syz [ 52.793638][ T5916] usb 8-1: Manufacturer: syz [ 52.801433][ T5916] usb 8-1: SerialNumber: syz [ 52.809602][ T5958] netlink: 4 bytes leftover after parsing attributes in process `syz.0.8'. [ 52.880482][ T5962] binder: 5961:5962 ioctl c00c6211 0 returned -14 [ 53.371822][ T5901] syz.3.5 uses obsolete (PF_INET,SOCK_PACKET) [ 53.627443][ T5916] usb 8-1: USB disconnect, device number 4 [ 53.827731][ T5747] Bluetooth: hci1: command tx timeout [ 53.827808][ T5889] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 53.830027][ T5747] Bluetooth: hci3: command tx timeout [ 53.832745][ T64] Bluetooth: hci0: command tx timeout [ 53.834947][ T5747] Bluetooth: hci2: command tx timeout [ 53.977327][ T5990] netlink: 20 bytes leftover after parsing attributes in process `syz.2.10'. [ 53.980648][ T5990] netlink: 4 bytes leftover after parsing attributes in process `syz.2.10'. [ 54.006886][ T5889] usb 6-1: Using ep0 maxpacket: 32 [ 54.012366][ T5889] usb 6-1: config index 0 descriptor too short (expected 13339, got 27) [ 54.019738][ T5889] usb 6-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 54.027833][ T5889] usb 6-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 54.038128][ T5889] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 54.045697][ T5889] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 54.051806][ T5889] usb 6-1: Product: syz [ 54.053546][ T5889] usb 6-1: Manufacturer: syz [ 54.058903][ T5889] usb 6-1: SerialNumber: syz [ 54.235678][ T5992] netlink: 20 bytes leftover after parsing attributes in process `syz.3.12'. [ 54.254545][ T5992] team0 (unregistering): Port device team_slave_0 removed [ 54.261149][ T5992] team0 (unregistering): Port device team_slave_1 removed [ 54.348309][ T5889] usb 6-1: USB disconnect, device number 3 [ 54.364018][ T5992] netlink: 'syz.3.12': attribute type 1 has an invalid length. [ 54.367195][ T5992] netlink: 'syz.3.12': attribute type 2 has an invalid length. [ 54.922180][ T6001] binder: 6000:6001 ioctl c00c6211 0 returned -14 [ 55.776852][ T1487] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 55.917232][ T5747] Bluetooth: hci3: command tx timeout [ 55.919668][ T64] Bluetooth: hci1: command tx timeout [ 55.922028][ T5758] Bluetooth: hci2: command tx timeout [ 55.924052][ T5759] Bluetooth: hci0: command tx timeout [ 55.941309][ T1487] usb 8-1: New USB device found, idVendor=086a, idProduct=0100, bcdDevice= 0.01 [ 55.945289][ T1487] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 55.946947][ T5822] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 55.955206][ T1487] emi26 - firmware loader 8-1:1.0: emi26_probe start [ 55.961217][ T1487] usb 8-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 55.966657][ T1487] usb 8-1: Falling back to sysfs fallback for: emi26/loader.fw [ 56.009253][ T6037] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 56.013575][ T6033] IPVS: stopping master sync thread 6037 ... [ 56.019369][ T6033] netlink: 8 bytes leftover after parsing attributes in process `syz.2.17'. [ 56.106924][ T5822] usb 5-1: Using ep0 maxpacket: 32 [ 56.116665][ T5822] usb 5-1: config index 0 descriptor too short (expected 13339, got 27) [ 56.120494][ T5822] usb 5-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 56.124029][ T5822] usb 5-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 56.133592][ T5822] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 56.136566][ T5822] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 56.141858][ T5822] usb 5-1: Product: syz [ 56.144653][ T5822] usb 5-1: Manufacturer: syz [ 56.156884][ T5822] usb 5-1: SerialNumber: syz [ 56.175055][ T1487] usb 8-1: emi26_load_firmware - request_firmware() failed [ 56.178100][ T1487] usb 8-1: emi26_load_firmware - error loading firmware: error = -12 [ 56.180696][ T1487] emi26 - firmware loader 8-1:1.0: probe with driver emi26 - firmware loader failed with error -5 [ 56.191995][ T1487] usb 8-1: USB disconnect, device number 5 [ 56.739165][ T6050] binder: 6049:6050 ioctl c00c6211 0 returned -14 [ 56.871567][ T5822] usb 5-1: USB disconnect, device number 2 [ 56.978268][ T6056] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 56.979061][ T6054] IPVS: stopping master sync thread 6056 ... [ 56.987103][ T6054] netlink: 8 bytes leftover after parsing attributes in process `syz.2.20'. [ 57.242563][ T6055] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(12) [ 57.245500][ T6055] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 57.251845][ T6055] vhci_hcd vhci_hcd.0: Device attached [ 57.393535][ T6059] vhci_hcd: connection closed [ 57.397199][ T5821] vhci_hcd vhci_hcd.1: stop threads [ 57.401348][ T5821] vhci_hcd vhci_hcd.1: release socket [ 57.403367][ T5821] vhci_hcd vhci_hcd.1: disconnect device [ 57.644821][ T6064] netlink: 20 bytes leftover after parsing attributes in process `syz.0.21'. [ 57.649399][ T6064] netlink: 4 bytes leftover after parsing attributes in process `syz.0.21'. [ 57.765243][ T6068] bridge_slave_0: left allmulticast mode [ 57.769761][ T6068] bridge_slave_0: left promiscuous mode [ 57.774962][ T6068] bridge0: port 1(bridge_slave_0) entered disabled state [ 57.799841][ T6068] bridge_slave_1: left allmulticast mode [ 57.804115][ T6068] bridge_slave_1: left promiscuous mode [ 57.810588][ T6068] bridge0: port 2(bridge_slave_1) entered disabled state [ 57.829191][ T6068] bond0: (slave bond_slave_0): Releasing backup interface [ 57.840372][ T6068] bond0: (slave bond_slave_1): Releasing backup interface [ 57.956605][ T6068] team0: Port device team_slave_0 removed [ 57.976284][ T6068] team0: Port device team_slave_1 removed [ 57.980473][ T6068] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 57.984959][ T6068] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 57.998428][ T6068] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 58.006239][ T6068] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 58.014440][ T6068] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 58.072952][ T6070] team0: Mode changed to "loadbalance" [ 58.081822][ T6071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.24'. [ 58.089556][ T6071] netlink: 8 bytes leftover after parsing attributes in process `syz.2.24'. [ 58.093663][ T6073] bridge_slave_0: default FDB implementation only supports local addresses [ 58.655402][ T6107] netlink: 20 bytes leftover after parsing attributes in process `syz.3.28'. [ 58.727530][ T6108] netlink: 'syz.3.28': attribute type 1 has an invalid length. [ 58.730037][ T6108] netlink: 'syz.3.28': attribute type 2 has an invalid length. [ 58.794395][ T60] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 59.009275][ T60] usb 7-1: Using ep0 maxpacket: 32 [ 59.056653][ T60] usb 7-1: config index 0 descriptor too short (expected 13339, got 27) [ 59.078715][ T60] usb 7-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 59.110291][ T60] usb 7-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 59.146184][ T60] usb 7-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 59.157772][ T60] usb 7-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 59.167910][ T60] usb 7-1: Product: syz [ 59.173604][ T60] usb 7-1: Manufacturer: syz [ 59.176030][ T60] usb 7-1: SerialNumber: syz [ 59.520081][ T6113] Bluetooth: MGMT ver 1.23 [ 60.587171][ T5916] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 60.600022][ T6122] netlink: 200 bytes leftover after parsing attributes in process `syz.3.30'. [ 60.758013][ T5916] usb 5-1: Using ep0 maxpacket: 32 [ 60.763396][ T5916] usb 5-1: config index 0 descriptor too short (expected 13339, got 27) [ 60.766561][ T5916] usb 5-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 60.769846][ T5916] usb 5-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 60.791998][ T5916] usb 5-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 60.795295][ T5916] usb 5-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 60.801140][ T5916] usb 5-1: Product: syz [ 60.809378][ T5916] usb 5-1: Manufacturer: syz [ 60.811328][ T5916] usb 5-1: SerialNumber: syz [ 60.894654][ T60] usb 7-1: USB disconnect, device number 2 [ 61.046598][ T6122] orangefs_mount: mount request failed with -4 [ 61.091488][ T6128] binder: 6127:6128 ioctl c00c6211 0 returned -14 [ 62.046622][ T5916] usb 5-1: USB disconnect, device number 3 [ 62.058958][ T6134] netlink: 20 bytes leftover after parsing attributes in process `syz.2.32'. [ 62.061872][ T6134] netlink: 4 bytes leftover after parsing attributes in process `syz.2.32'. [ 62.175953][ T6141] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 62.179914][ T6138] IPVS: stopping master sync thread 6141 ... [ 62.185600][ T6138] netlink: 8 bytes leftover after parsing attributes in process `syz.1.33'. [ 62.261862][ T6143] netlink: 'syz.3.35': attribute type 2 has an invalid length. [ 62.746121][ T6151] netlink: 20 bytes leftover after parsing attributes in process `syz.0.38'. [ 62.758639][ T6151] team0 (unregistering): Port device team_slave_0 removed [ 62.764035][ T6151] team0 (unregistering): Port device team_slave_1 removed [ 62.886009][ T6151] netlink: 'syz.0.38': attribute type 1 has an invalid length. [ 62.889836][ T6151] netlink: 'syz.0.38': attribute type 2 has an invalid length. [ 63.187852][ T6154] binder: 6153:6154 ioctl c00c6211 0 returned -14 [ 63.688119][ T6169] binder: 6168:6169 ioctl c00c6211 0 returned -14 [ 64.278137][ T5916] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 64.446187][ T6188] netlink: 20 bytes leftover after parsing attributes in process `syz.2.42'. [ 64.452566][ T6188] netlink: 4 bytes leftover after parsing attributes in process `syz.2.42'. [ 64.457216][ T5916] usb 6-1: Using ep0 maxpacket: 32 [ 64.468929][ T5916] usb 6-1: config index 0 descriptor too short (expected 13339, got 27) [ 64.471950][ T5916] usb 6-1: config 108 has an invalid descriptor of length 32, skipping remainder of the config [ 64.478490][ T5916] usb 6-1: config 108 has 0 interfaces, different from the descriptor's value: 32 [ 64.483198][ T5916] usb 6-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 64.486153][ T5916] usb 6-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 64.489524][ T5916] usb 6-1: Product: syz [ 64.490899][ T5916] usb 6-1: Manufacturer: syz [ 64.492413][ T5916] usb 6-1: SerialNumber: syz [ 64.707124][ T10] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 64.798210][ T5916] usb 6-1: USB disconnect, device number 4 [ 64.868760][ T10] usb 8-1: New USB device found, idVendor=086a, idProduct=0100, bcdDevice= 0.01 [ 64.872749][ T10] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 64.884605][ T10] emi26 - firmware loader 8-1:1.0: emi26_probe start [ 64.889283][ T10] usb 8-1: Direct firmware load for emi26/loader.fw failed with error -2 [ 64.892891][ T10] usb 8-1: Falling back to sysfs fallback for: emi26/loader.fw [ 65.415207][ T6215] netlink: 20 bytes leftover after parsing attributes in process `syz.2.49'. [ 65.511335][ T6218] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 65.518028][ T6213] IPVS: stopping master sync thread 6218 ... [ 65.521674][ T6213] netlink: 8 bytes leftover after parsing attributes in process `syz.1.48'. [ 65.538448][ T6215] netlink: 'syz.2.49': attribute type 1 has an invalid length. [ 65.541914][ T6215] netlink: 'syz.2.49': attribute type 2 has an invalid length. [ 65.880226][ T6222] netlink: 20 bytes leftover after parsing attributes in process `syz.3.50'. [ 65.884404][ T6222] netlink: 4 bytes leftover after parsing attributes in process `syz.3.50'. [ 65.964411][ T6224] binder: 6223:6224 ioctl c00c6211 0 returned -14 [ 67.326872][ T5889] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 67.391648][ T845] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 67.730738][ T845] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 67.738193][ T845] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 67.742749][ T845] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 67.746136][ T845] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.751013][ T845] usb 6-1: config 0 descriptor?? [ 67.756208][ T845] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 67.954124][ T5889] usb 5-1: New USB device found, idVendor=086a, idProduct=0100, bcdDevice= 0.01 [ 67.957765][ T5889] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 67.958427][ T845] usb 6-1: USB disconnect, device number 5 [ 67.984957][ T5889] emi26 - firmware loader 5-1:1.0: emi26_probe start [ 68.124859][ T6284] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 68.126372][ T6280] IPVS: stopping master sync thread 6284 ... [ 68.131526][ T6280] netlink: 8 bytes leftover after parsing attributes in process `syz.2.62'. [ 68.264982][ T6286] FAULT_INJECTION: forcing a failure. [ 68.264982][ T6286] name failslab, interval 1, probability 0, space 0, times 1 [ 68.269343][ T6286] CPU: 0 UID: 0 PID: 6286 Comm: syz.3.63 Not tainted syzkaller #0 PREEMPT(full) [ 68.269357][ T6286] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 68.269368][ T6286] Call Trace: [ 68.269373][ T6286] [ 68.269377][ T6286] dump_stack_lvl+0x100/0x190 [ 68.269392][ T6286] should_fail_ex.cold+0x5/0xa [ 68.269405][ T6286] should_failslab+0xc2/0x120 [ 68.269419][ T6286] kmem_cache_alloc_noprof+0x91/0x6a0 [ 68.269432][ T6286] ? trace_kmem_cache_alloc+0xdd/0x100 [ 68.269447][ T6286] ? security_file_alloc+0x34/0x2c0 [ 68.269465][ T6286] security_file_alloc+0x34/0x2c0 [ 68.269479][ T6286] init_file+0x95/0x480 [ 68.269492][ T6286] alloc_empty_file+0x79/0x1c0 [ 68.269506][ T6286] alloc_file_pseudo+0x183/0x290 [ 68.269520][ T6286] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 68.269539][ T6286] ? _raw_spin_unlock+0x28/0x50 [ 68.269553][ T6286] ? alloc_fd+0x471/0x7a0 [ 68.269570][ T6286] __anon_inode_getfile+0xe8/0x280 [ 68.269615][ T6286] __anon_inode_getfd+0x5c/0xe0 [ 68.269639][ T6286] __ia32_sys_fsopen+0x192/0x230 [ 68.269663][ T6286] __do_fast_syscall_32+0xe7/0x970 [ 68.269685][ T6286] ? lockdep_hardirqs_on+0x78/0x100 [ 68.269707][ T6286] do_fast_syscall_32+0x32/0x70 [ 68.269729][ T6286] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 68.269749][ T6286] RIP: 0023:0xf7f42fec [ 68.269769][ T6286] Code: Unable to access opcode bytes at 0xf7f42fc2. [ 68.269776][ T6286] RSP: 002b:00000000f540650c EFLAGS: 00000292 ORIG_RAX: 00000000000001ae [ 68.269791][ T6286] RAX: ffffffffffffffda RBX: 0000000080000040 RCX: 0000000000000000 [ 68.269803][ T6286] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 68.269811][ T6286] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 68.269820][ T6286] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 68.269828][ T6286] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 68.269847][ T6286] [ 68.467077][ T5916] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 68.570370][ T6296] binder: 6295:6296 ioctl c00c6211 0 returned -14 [ 68.616861][ T5916] usb 6-1: Using ep0 maxpacket: 32 [ 68.619956][ T5916] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 68.623365][ T5916] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 68.627539][ T5916] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 68.630654][ T5916] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 68.635927][ T5916] usb 6-1: config 0 descriptor?? [ 68.641965][ T5916] ldusb 6-1:0.0: Interrupt in endpoint not found [ 68.644522][ T5916] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 68.882430][ T9] usb 6-1: USB disconnect, device number 6 [ 68.932086][ T6303] netlink: 20 bytes leftover after parsing attributes in process `syz.0.67'. [ 68.935199][ T6303] netlink: 4 bytes leftover after parsing attributes in process `syz.0.67'. [ 69.638947][ T6327] netlink: 20 bytes leftover after parsing attributes in process `syz.1.71'. [ 69.645985][ T6327] netlink: 4 bytes leftover after parsing attributes in process `syz.1.71'. [ 70.695511][ T6361] binder: 6360:6361 ioctl c00c6211 0 returned -14 [ 70.767735][ T6363] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 70.768543][ T6359] IPVS: stopping master sync thread 6363 ... [ 70.775445][ T6359] netlink: 8 bytes leftover after parsing attributes in process `syz.2.76'. [ 70.960416][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 70.962989][ T1439] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.224729][ T6367] netlink: 20 bytes leftover after parsing attributes in process `syz.0.78'. [ 71.303428][ T6368] netlink: 'syz.0.78': attribute type 1 has an invalid length. [ 71.306012][ T6368] netlink: 'syz.0.78': attribute type 2 has an invalid length. [ 71.876872][ T9] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 72.058378][ T9] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 72.061864][ T9] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 72.064919][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.072235][ T9] usb 6-1: config 0 descriptor?? [ 72.077633][ T9] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 72.280759][ T5829] usb 6-1: USB disconnect, device number 7 [ 72.586026][ T6408] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 72.590461][ T6397] IPVS: stopping master sync thread 6408 ... [ 72.592924][ T6397] netlink: 8 bytes leftover after parsing attributes in process `syz.2.83'. [ 72.736865][ T5829] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 72.896821][ T5829] usb 6-1: Using ep0 maxpacket: 32 [ 72.900372][ T5829] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 72.904703][ T5829] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 72.907795][ T5829] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 72.912052][ T5829] usb 6-1: config 0 descriptor?? [ 72.917383][ T5829] ldusb 6-1:0.0: Interrupt in endpoint not found [ 72.920111][ T5829] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 73.118040][ T6103] usb 6-1: USB disconnect, device number 8 [ 73.393626][ T6421] netlink: 20 bytes leftover after parsing attributes in process `syz.0.85'. [ 73.396631][ T6421] netlink: 4 bytes leftover after parsing attributes in process `syz.0.85'. [ 73.591104][ T6426] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 73.593116][ T6426] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 73.609673][ T6426] vhci_hcd vhci_hcd.0: Device attached [ 73.705477][ T6434] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 73.709397][ T6430] IPVS: stopping master sync thread 6434 ... [ 73.711731][ T6433] netlink: 200 bytes leftover after parsing attributes in process `syz.1.89'. [ 73.711741][ T6430] netlink: 8 bytes leftover after parsing attributes in process `syz.3.88'. [ 73.887158][ T6103] usb 42-1: SetAddress Request (2) to port 0 [ 73.890426][ T6103] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 74.200469][ T6427] vhci_hcd: connection reset by peer [ 74.205374][ T13] vhci_hcd vhci_hcd.2: stop threads [ 74.209730][ T13] vhci_hcd vhci_hcd.2: release socket [ 74.211865][ T13] vhci_hcd vhci_hcd.2: disconnect device [ 74.437668][ T6441] input: syz1 as /devices/virtual/input/input5 [ 74.539614][ T6433] orangefs_mount: mount request failed with -4 [ 75.258336][ T6468] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 75.260620][ T6468] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 75.324834][ T6468] vhci_hcd vhci_hcd.0: Device attached [ 75.479573][ T6493] netlink: 20 bytes leftover after parsing attributes in process `syz.3.98'. [ 75.482663][ T6493] netlink: 4 bytes leftover after parsing attributes in process `syz.3.98'. [ 75.536145][ T6496] binder: 6495:6496 ioctl c00c6211 0 returned -14 [ 75.576912][ T5829] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 75.698536][ T1043] usb 40-1: SetAddress Request (2) to port 0 [ 75.708679][ T1043] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 75.748854][ T5829] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 75.752885][ T5829] usb 7-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 75.756189][ T5829] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 75.777285][ T5829] usb 7-1: config 0 descriptor?? [ 75.822741][ T5829] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 75.994966][ T5829] usb 7-1: USB disconnect, device number 3 [ 76.143868][ T6473] vhci_hcd: connection reset by peer [ 76.147279][ T13] vhci_hcd vhci_hcd.1: stop threads [ 76.149663][ T13] vhci_hcd vhci_hcd.1: release socket [ 76.152144][ T13] vhci_hcd vhci_hcd.1: disconnect device [ 76.446897][ T5829] usb 7-1: new high-speed USB device number 4 using dummy_hcd [ 76.595607][ T6508] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 76.599832][ T6506] IPVS: stopping master sync thread 6508 ... [ 76.606831][ T5829] usb 7-1: Using ep0 maxpacket: 32 [ 76.607324][ T6506] netlink: 8 bytes leftover after parsing attributes in process `syz.0.102'. [ 76.610008][ T5829] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 76.615046][ T5829] usb 7-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice= 0.40 [ 76.617955][ T5829] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 76.622164][ T5829] usb 7-1: config 0 descriptor?? [ 76.626452][ T5829] ldusb 7-1:0.0: Interrupt in endpoint not found [ 76.630735][ T5829] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 76.722555][ T6513] netlink: 200 bytes leftover after parsing attributes in process `syz.1.104'. [ 76.728262][ T6514] netlink: 20 bytes leftover after parsing attributes in process `syz.3.103'. [ 76.731301][ T6514] netlink: 4 bytes leftover after parsing attributes in process `syz.3.103'. [ 76.829629][ T60] usb 7-1: USB disconnect, device number 4 [ 77.549425][ T6513] orangefs_mount: mount request failed with -4 [ 77.586422][ T6522] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 77.589033][ T6522] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 77.592376][ T6522] vhci_hcd vhci_hcd.0: Device attached [ 77.886865][ T60] usb 38-1: SetAddress Request (2) to port 0 [ 77.888823][ T60] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 78.175209][ T6525] vhci_hcd: connection reset by peer [ 78.179428][ T13] vhci_hcd vhci_hcd.0: stop threads [ 78.181650][ T13] vhci_hcd vhci_hcd.0: release socket [ 78.185020][ T13] vhci_hcd vhci_hcd.0: disconnect device [ 78.564909][ T6541] binder: 6540:6541 ioctl c00c6211 0 returned -14 [ 78.947007][ T6103] usb 42-1: device descriptor read/8, error -110 [ 78.997365][ T6545] binder: 6544:6545 ioctl c00c6211 0 returned -14 [ 79.227960][ T6552] IPVS: sync thread started: state = MASTER, mcast_ifn = veth1_to_bridge, syncid = 32, id = 0 [ 79.229662][ T6550] IPVS: stopping master sync thread 6552 ... [ 79.237753][ T6550] __nla_validate_parse: 2 callbacks suppressed [ 79.237763][ T6550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.113'. [ 79.390229][ T6103] usb usb42-port1: attempt power cycle [ 79.717058][ T6500] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 79.950610][ T6500] usb 6-1: New USB device found, idVendor=086a, idProduct=0100, bcdDevice= 0.01 [ 79.956482][ T6500] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 79.971404][ T6500] emi26 - firmware loader 6-1:1.0: emi26_probe start [ 80.018504][ T6103] usb usb42-port1: unable to enumerate USB device [ 80.129934][ T6563] netlink: 20 bytes leftover after parsing attributes in process `syz.2.118'. [ 80.133321][ T6563] netlink: 4 bytes leftover after parsing attributes in process `syz.2.118'. [ 80.194115][ T6500] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI [ 80.198502][ T6500] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 80.201771][ T6500] CPU: 1 UID: 0 PID: 6500 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT(full) [ 80.205085][ T6500] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.208688][ T6500] Workqueue: usb_hub_wq hub_event [ 80.210543][ T6500] RIP: 0010:request_ihex_firmware.constprop.0+0x11e/0x250 [ 80.213126][ T6500] Code: 48 89 04 24 e8 f3 79 b7 00 4c 39 24 24 0f 82 94 00 00 00 e8 e4 79 b7 00 49 8d 7c 24 04 48 89 f8 48 89 fe 48 c1 e8 03 83 e6 07 <42> 8a 0c 38 49 8d 44 24 05 48 89 c2 48 c1 ea 03 40 38 f1 40 0f 9e [ 80.220045][ T6500] RSP: 0018:ffffc9002719eec8 EFLAGS: 00010202 [ 80.222256][ T6500] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81523207 [ 80.225128][ T6500] RDX: ffff888029930000 RSI: 0000000000000004 RDI: 0000000000000004 [ 80.227930][ T6500] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 80.230829][ T6500] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 80.233747][ T6500] R13: ffff888046dd7140 R14: ffffc9002719efe8 R15: dffffc0000000000 [ 80.236632][ T6500] FS: 0000000000000000(0000) GS:ffff888096ce3000(0000) knlGS:0000000000000000 [ 80.239933][ T6500] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.242464][ T6500] CR2: 00000000800bd01c CR3: 00000000501f7000 CR4: 0000000000352ef0 [ 80.245320][ T6500] Call Trace: [ 80.246560][ T6500] [ 80.247659][ T6500] ? __pfx_request_ihex_firmware.constprop.0+0x10/0x10 [ 80.250119][ T6500] ? emi26_probe+0x114/0xe30 [ 80.251881][ T6500] emi26_probe+0x13c/0xe30 [ 80.253488][ T6500] ? _raw_spin_lock_irqsave+0x52/0x60 [ 80.255537][ T6500] ? find_held_lock+0x2b/0x80 [ 80.257289][ T6500] ? __pfx_emi26_probe+0x10/0x10 [ 80.259074][ T6500] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 80.261280][ T6500] ? lockdep_hardirqs_on+0x78/0x100 [ 80.263197][ T6500] ? __pm_runtime_set_status+0x13c/0x970 [ 80.265238][ T6500] usb_probe_interface+0x303/0x8f0 [ 80.267126][ T6500] ? __pfx_usb_probe_interface+0x10/0x10 [ 80.269181][ T6500] really_probe+0x241/0xa60 [ 80.270864][ T6500] __driver_probe_device+0x20e/0x450 [ 80.272723][ T6500] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 80.274935][ T6500] driver_probe_device+0x4a/0x140 [ 80.276821][ T6500] __device_attach_driver+0x1df/0x320 [ 80.278934][ T6500] ? __pfx___device_attach_driver+0x10/0x10 [ 80.281150][ T6500] bus_for_each_drv+0x159/0x1e0 [ 80.282948][ T6500] ? __pfx_bus_for_each_drv+0x10/0x10 [ 80.284894][ T6500] ? lockdep_hardirqs_on+0x78/0x100 [ 80.286813][ T6500] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 80.288967][ T6500] __device_attach+0x1e4/0x4d0 [ 80.290826][ T6500] ? __pfx___device_attach+0x10/0x10 [ 80.292787][ T6500] ? do_raw_spin_unlock+0x145/0x1e0 [ 80.294719][ T6500] device_initial_probe+0xaf/0xd0 [ 80.296543][ T6500] bus_probe_device+0x64/0x160 [ 80.298334][ T6500] device_add+0x121d/0x1970 [ 80.300011][ T6500] ? __pfx_device_add+0x10/0x10 [ 80.301816][ T6500] ? mark_held_locks+0x40/0x70 [ 80.303584][ T6500] usb_set_configuration+0xd97/0x1c60 [ 80.305528][ T6500] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 80.307788][ T6500] usb_generic_driver_probe+0xa1/0xe0 [ 80.309821][ T6500] usb_probe_device+0xef/0x400 [ 80.311597][ T6500] ? __pfx_usb_probe_device+0x10/0x10 [ 80.313568][ T6500] really_probe+0x241/0xa60 [ 80.315262][ T6500] __driver_probe_device+0x20e/0x450 [ 80.317260][ T6500] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 80.319460][ T6500] driver_probe_device+0x4a/0x140 [ 80.321310][ T6500] __device_attach_driver+0x1df/0x320 [ 80.323283][ T6500] ? __pfx___device_attach_driver+0x10/0x10 [ 80.325407][ T6500] bus_for_each_drv+0x159/0x1e0 [ 80.327155][ T6500] ? __pfx_bus_for_each_drv+0x10/0x10 [ 80.329109][ T6500] ? lockdep_hardirqs_on+0x78/0x100 [ 80.331014][ T6500] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 80.333195][ T6500] __device_attach+0x1e4/0x4d0 [ 80.334981][ T6500] ? __pfx___device_attach+0x10/0x10 [ 80.336942][ T6500] ? do_raw_spin_unlock+0x145/0x1e0 [ 80.338894][ T6500] device_initial_probe+0xaf/0xd0 [ 80.340719][ T6500] bus_probe_device+0x64/0x160 [ 80.342511][ T6500] device_add+0x121d/0x1970 [ 80.344202][ T6500] ? __pfx_device_add+0x10/0x10 [ 80.346072][ T6500] ? usb_detect_static_quirks+0x335/0x3e0 [ 80.348107][ T6500] usb_new_device.cold+0x685/0x115c [ 80.350028][ T6500] ? _mutex_trylock_nest_lock+0x241/0x310 [ 80.352134][ T6500] ? do_raw_spin_lock+0x128/0x260 [ 80.353935][ T6500] ? __pfx_usb_new_device+0x10/0x10 [ 80.355798][ T6500] ? mark_held_locks+0x40/0x70 [ 80.357554][ T6500] hub_event+0x30a3/0x4a60 [ 80.359257][ T6500] ? __pfx_hub_event+0x10/0x10 [ 80.361068][ T6500] ? debug_object_deactivate+0x2e4/0x3b0 [ 80.363158][ T6500] ? rcu_is_watching+0x12/0xc0 [ 80.364875][ T6500] process_one_work+0xa23/0x1940 [ 80.366650][ T6500] ? __pfx_process_one_work+0x10/0x10 [ 80.368638][ T6500] ? __pfx_hub_event+0x10/0x10 [ 80.370333][ T6500] worker_thread+0x5ef/0xe50 [ 80.372008][ T6500] ? __pfx_worker_thread+0x10/0x10 [ 80.373932][ T6500] ? kthread+0x13a/0x450 [ 80.375506][ T6500] ? __pfx_worker_thread+0x10/0x10 [ 80.377415][ T6500] kthread+0x370/0x450 [ 80.378972][ T6500] ? __pfx_kthread+0x10/0x10 [ 80.380717][ T6500] ret_from_fork+0x72b/0xd50 [ 80.382491][ T6500] ? __pfx_ret_from_fork+0x10/0x10 [ 80.384432][ T6500] ? __switch_to+0x800/0x10f0 [ 80.386165][ T6500] ? __pfx_kthread+0x10/0x10 [ 80.387832][ T6500] ret_from_fork_asm+0x1a/0x30 [ 80.389557][ T6500] [ 80.390700][ T6500] Modules linked in: [ 80.392101][ T5889] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#2] SMP KASAN NOPTI [ 80.392404][ T6500] ---[ end trace 0000000000000000 ]--- [ 80.396238][ T5889] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] [ 80.396261][ T5889] CPU: 0 UID: 0 PID: 5889 Comm: kworker/0:4 Tainted: G D syzkaller #0 PREEMPT(full) [ 80.396285][ T5889] Tainted: [D]=DIE [ 80.396291][ T5889] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 80.396303][ T5889] Workqueue: usb_hub_wq hub_event [ 80.396326][ T5889] RIP: 0010:request_ihex_firmware.constprop.0+0x11e/0x250 [ 80.396343][ T5889] Code: 48 89 04 24 e8 f3 79 b7 00 4c 39 24 24 0f 82 94 00 00 00 e8 e4 79 b7 00 49 8d 7c 24 04 48 89 f8 48 89 fe 48 c1 e8 03 83 e6 07 <42> 8a 0c 38 49 8d 44 24 05 48 89 c2 48 c1 ea 03 40 38 f1 40 0f 9e [ 80.396353][ T5889] RSP: 0018:ffffc900067c6ec8 EFLAGS: 00010202 [ 80.396362][ T5889] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81523207 [ 80.396371][ T5889] RDX: ffff888021118000 RSI: 0000000000000004 RDI: 0000000000000004 [ 80.396381][ T5889] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 80.396390][ T5889] R10: 0000000000000000 R11: ffffffff81d5692c R12: 0000000000000000 [ 80.396400][ T5889] R13: ffff88801372ef40 R14: ffffc900067c6fe8 R15: dffffc0000000000 [ 80.396411][ T5889] FS: 0000000000000000(0000) GS:ffff888096be3000(0000) knlGS:0000000000000000 [ 80.396441][ T5889] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.405261][ T6500] RIP: 0010:request_ihex_firmware.constprop.0+0x11e/0x250 [ 80.406500][ T5889] CR2: 000000000c249257 CR3: 000000004b8c5000 CR4: 0000000000352ef0 [ 80.410496][ T6500] Code: 48 89 04 24 e8 f3 79 b7 00 4c 39 24 24 0f 82 94 00 00 00 e8 e4 79 b7 00 49 8d 7c 24 04 48 89 f8 48 89 fe 48 c1 e8 03 83 e6 07 <42> 8a 0c 38 49 8d 44 24 05 48 89 c2 48 c1 ea 03 40 38 f1 40 0f 9e [ 80.412015][ T5889] Call Trace: [ 80.414646][ T6500] RSP: 0018:ffffc9002719eec8 EFLAGS: 00010202 [ 80.421380][ T5889] [ 80.421394][ T5889] ? __pfx_request_ihex_firmware.constprop.0+0x10/0x10 [ 80.421422][ T5889] ? emi26_probe+0x114/0xe30 [ 80.421437][ T5889] emi26_probe+0x13c/0xe30 [ 80.424013][ T6500] [ 80.426395][ T5889] ? _raw_spin_lock_irqsave+0x52/0x60 [ 80.426415][ T5889] ? find_held_lock+0x2b/0x80 [ 80.429402][ T6500] RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff81523207 [ 80.432232][ T5889] ? __pfx_emi26_probe+0x10/0x10 [ 80.432257][ T5889] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 80.435056][ T6500] RDX: ffff888029930000 RSI: 0000000000000004 RDI: 0000000000000004 [ 80.438063][ T5889] ? lockdep_hardirqs_on+0x78/0x100 [ 80.438088][ T5889] ? __pm_runtime_set_status+0x13c/0x970 [ 80.438113][ T5889] usb_probe_interface+0x303/0x8f0 [ 80.441997][ T6500] RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 [ 80.444091][ T5889] ? __pfx_usb_probe_interface+0x10/0x10 [ 80.444118][ T5889] really_probe+0x241/0xa60 [ 80.446418][ T6500] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 [ 80.449244][ T5889] __driver_probe_device+0x20e/0x450 [ 80.449271][ T5889] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 80.449294][ T5889] driver_probe_device+0x4a/0x140 [ 80.449319][ T5889] __device_attach_driver+0x1df/0x320 [ 80.456412][ T6500] R13: ffff888046dd7140 R14: ffffc9002719efe8 R15: dffffc0000000000 [ 80.457137][ T5889] ? __pfx___device_attach_driver+0x10/0x10 [ 80.457154][ T5889] bus_for_each_drv+0x159/0x1e0 [ 80.457167][ T5889] ? __pfx_bus_for_each_drv+0x10/0x10 [ 80.457178][ T5889] ? lockdep_hardirqs_on+0x78/0x100 [ 80.459695][ T6500] FS: 0000000000000000(0000) GS:ffff888096ce3000(0000) knlGS:0000000000000000 [ 80.460463][ T5889] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 80.462905][ T6500] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 80.464493][ T5889] __device_attach+0x1e4/0x4d0 [ 80.466190][ T6500] CR2: 00000000800bd01c CR3: 00000000216df000 CR4: 0000000000352ef0 [ 80.467001][ T5889] ? __pfx___device_attach+0x10/0x10 [ 80.467038][ T5889] ? do_raw_spin_unlock+0x145/0x1e0 [ 80.467059][ T5889] device_initial_probe+0xaf/0xd0 [ 80.469595][ T6500] Kernel panic - not syncing: Fatal exception [ 80.533548][ T6500] Kernel Offset: disabled [ 80.535098][ T6500] Rebooting in 86400 seconds..