last executing test programs: 30.205188133s ago: executing program 3 (id=252): r0 = userfaultfd(0x80001) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x40eb, 0x0, 0x0, 0x0, &(0x7f0000000080)) socket(0x10, 0x803, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x200) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffb, 0x6, 0x0, 0x1, 'syz1\x00'}, 0x6, 0x100, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00'}) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000100)=[{{0x3}, {0x3, 0x0, 0x1, 0x1}}, {{0x2, 0x1}, {0x1, 0x1, 0x1}}], 0x10) close(r3) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newtaction={0xb0, 0x30, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{0x9c, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x9, 0x4, 0x8be6, 0x5}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_skbedit={0x48, 0x2, 0x0, 0x0, {{0xc}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x0, 0x6, 0xffffffff, 0x10000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4001}, 0x2400c800) 26.312867597s ago: executing program 3 (id=258): socketpair$unix(0x1, 0x3, 0x0, 0x0) openat$pidfd(0xffffffffffffff9c, &(0x7f0000001180), 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000840), 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) pipe2(0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@any_dev={0x4, 0x3f7, 0x0, 0x0, 0x1000, 0xe}}}, &(0x7f0000000300)=0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = dup(r2) syz_ublk_setup_queues(r3, r1, &(0x7f0000000040)={0x0, 0xc1, 0x10, 0xfffffffd, 0x230}, &(0x7f0000000a80)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x403, 0x10, 0x3, 0x91}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xc81d, 0x2, 0x1, 0x3ac}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x299}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x626d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) 24.819870343s ago: executing program 3 (id=261): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x6, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$IORING_OFF_CQ_RING(0x7fffffffb000, 0x7, 0x3000001, 0xbd4c341840b03bf2, 0xffffffffffffffff, 0x8000000) socket(0x8000000010, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) 16.720054238s ago: executing program 0 (id=271): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB="52990000"], 0x8) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r0, 0x84, 0x79, &(0x7f0000000240)={0x0, 0x964, 0x89f8}, 0x8) 15.521345447s ago: executing program 3 (id=273): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aa4000000060a010400000000000000000a0600010900010073797a31000000000900020073797a32000000007800048064000180090001006861736800000000540002800800074000000001080005"], 0xcc}}, 0x24000840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=@deltclass={0x24, 0x29, 0x300, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x10, 0xe}, {0x0, 0xffff}, {0xa, 0xfff3}}}, 0x24}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$cgroup_subtree(r0, 0x0, 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1812", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002abd70045d5f1b8070c85aa508000300", @ANYRES32=r5], 0x48}, 0x1, 0x0, 0x0, 0x20040040}, 0x8800) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r2, r1}, 0xc) sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200029bd7400ffdbdf250c00000008000b00030000000c0006000100000001000000080003", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="0c000600020000000000000008000b00c20d00000c000600000000000000000008000300", @ANYRES32=0x0], 0x60}, 0x1, 0x0, 0x0, 0x4002000}, 0x1000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) socket$inet_icmp_raw(0x2, 0x3, 0x1) r8 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet(r8, &(0x7f0000000680)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000040)="93", 0x1}], 0x1}}], 0x1, 0x4040040) bind$can_raw(r7, &(0x7f00000005c0), 0x10) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, 0x0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) 12.377830122s ago: executing program 1 (id=277): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') pread64(r2, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000300) r3 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r3, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, 0x0) setsockopt$PNPIPE_ENCAP(r3, 0x113, 0x1, &(0x7f0000000080)=0x1, 0x4) 12.335419713s ago: executing program 0 (id=278): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000006cc0)={r2}, &(0x7f0000006d80)=0x8) 12.227522216s ago: executing program 3 (id=279): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f00000002c0)=0x80000000000003) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) 11.602219321s ago: executing program 0 (id=280): landlock_create_ruleset(&(0x7f00000002c0)={0x120, 0xd, 0x3}, 0x30, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x280, 0x100, 0x14}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$FS_IOC_SETFLAGS(r1, 0x40046f41, &(0x7f0000000440)=0x20000) 9.213768539s ago: executing program 3 (id=281): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x6, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mmap$IORING_OFF_CQ_RING(0x7fffffffb000, 0x7, 0x3000001, 0xbd4c341840b03bf2, 0xffffffffffffffff, 0x8000000) socket(0x8000000010, 0x2, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@ipv4_delroute={0x24, 0x20, 0x901, 0x0, 0x25dfdbff, {0x2, 0x18, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x2000000}, [@RTA_DST={0x8, 0x1, @dev}]}, 0x24}}, 0x0) 8.914186286s ago: executing program 0 (id=282): r0 = userfaultfd(0x80001) syz_open_dev$char_usb(0xc, 0xb4, 0x0) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000240)={0x0, 0x0}, 0x10) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x40eb, 0x0, 0x0, 0x0, &(0x7f0000000080)) socket(0x10, 0x803, 0x0) r1 = syz_open_dev$sndctrl(&(0x7f0000000300), 0x0, 0x200) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r1, 0xc1105517, &(0x7f0000000340)={{0xfffffffb, 0x6, 0x0, 0x1, 'syz1\x00'}, 0x6, 0x100, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000080)={'vxcan0\x00'}) setsockopt$CAN_RAW_FILTER(r3, 0x65, 0x1, &(0x7f0000000100)=[{{0x3}, {0x3, 0x0, 0x1, 0x1}}, {{0x2, 0x1}, {0x1, 0x1, 0x1}}], 0x10) close(r3) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newtaction={0xb0, 0x30, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{0x9c, 0x1, [@m_skbedit={0x50, 0x1, 0x0, 0x0, {{0xc}, {0x24, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x9, 0x4, 0x8be6, 0x5}}, @TCA_SKBEDIT_PTYPE={0x6, 0x7, 0x1}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_skbedit={0x48, 0x2, 0x0, 0x0, {{0xc}, {0x1c, 0x2, 0x0, 0x1, [@TCA_SKBEDIT_PARMS={0x18, 0x2, {0x2, 0x0, 0x6, 0xffffffff, 0x10000}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0xb0}, 0x1, 0x0, 0x0, 0x4001}, 0x2400c800) 8.871751187s ago: executing program 2 (id=283): mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/compatible_id\x00', 0x1, 0x0) write(r0, &(0x7f00000006c0)='WINNCM\n\x00', 0x8) 8.559822094s ago: executing program 2 (id=284): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$rtc(0xffffffffffffff9c, 0x0, 0x8440, 0x0) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000180)={0x1d, 0x2c, 0x4, 0x15, 0x9, 0x2, 0x6, 0x10a, 0x1}) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) setns(0xc9, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000140)=0x4f4e, 0x4) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) unshare(0x80) recvmmsg(r4, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0) 7.423086852s ago: executing program 2 (id=285): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x80000000000003) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x8, 0x20010, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000100)={0x0, 'veth1_to_batadv\x00', {0x4}, 0x26}) 5.903522948s ago: executing program 2 (id=286): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha1\x00'}, 0x58) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0x58}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) socket$netlink(0x10, 0x3, 0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) socket$igmp(0x2, 0x3, 0x2) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x12, 0x5, &(0x7f00000001c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x502902ab}, [@map_fd={0x18, 0x6}]}, &(0x7f00000002c0)='GPL\x00', 0x13, 0x92, &(0x7f0000000400)=""/146, 0x0, 0x40, '\x00', 0x0, @cgroup_sock_addr=0x34, 0xffffffffffffffff, 0x8, &(0x7f0000000640)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000680)={0x5, 0x3, 0x81c6, 0xe}, 0x10, 0x0, 0xffffffffffffffff, 0xa, &(0x7f0000000740)=[0xffffffffffffffff, 0xffffffffffffffff, r4], &(0x7f0000000780)=[{0x5, 0x5, 0x9, 0x5}, {0x2, 0x5, 0xe}, {0x0, 0x1, 0x5, 0x2}, {0x0, 0x4, 0x0, 0x5}, {0x0, 0x4, 0xf, 0x7}, {0x4, 0x4, 0x4, 0x8}, {0x0, 0x5, 0x6, 0xc}, {0x4, 0x1, 0x10001, 0x2}, {0x2, 0x5, 0x6, 0x4}, {0x0, 0x3}], 0x10, 0xc}, 0x94) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="50000000100001060100000000000000000000006400000000000000000000000c00030076786c616e300000240012800c00010076786c616e00000014000280050019000100000005001e0001"], 0x50}}, 0x24000000) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c000000780001040200000000000000070000006400000014000180080001006400000008000200c8"], 0x2c}}, 0x0) 4.806560985s ago: executing program 1 (id=287): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000aa4000000060a010400000000000000000a0600010900010073797a31000000000900020073797a32000000007800048064000180090001006861736800000000540002800800074000000001080005"], 0xcc}}, 0x24000840) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=@deltclass={0x24, 0x29, 0x300, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x10, 0xe}, {0x0, 0xffff}, {0xa, 0xfff3}}}, 0x24}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$cgroup_subtree(r0, 0x0, 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x4, 0x4, 0x4, 0x10, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x8, &(0x7f0000000000)=ANY=[@ANYBLOB="1812", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000008000017bfa400000000000007040000f8ffffffb705000000000000850000001900000095"], &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000680), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000003540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000003740)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01002abd70045d5f1b8070c85aa508000300", @ANYRES32=r5], 0x48}, 0x1, 0x0, 0x0, 0x20040040}, 0x8800) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000380)={r2, r1}, 0xc) sendmsg$NL802154_CMD_SET_TX_POWER(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="200029bd7400ffdbdf250c00000008000b00030000000c0006000100000001000000080003", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="0c000600020000000000000008000b00c20d00000c000600000000000000000008000300", @ANYRES32=0x0], 0x60}, 0x1, 0x0, 0x0, 0x4002000}, 0x1000) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000080)={'vxcan1\x00'}) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000001c0)={0x84, @remote, 0x0, 0x0, 'lblc\x00'}, 0x2c) r8 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet(r8, &(0x7f0000000680)=[{{&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000040)="93", 0x1}], 0x1}}], 0x1, 0x4040040) bind$can_raw(r7, &(0x7f00000005c0), 0x10) socket$inet_smc(0x2b, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x4c, 0x0, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x38, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0x2}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8, 0x6}]}]}, 0x4c}}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x0) 4.543775581s ago: executing program 1 (id=288): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r0, 0x84, 0x7a, &(0x7f0000000340)={r1, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000006cc0)={r2}, &(0x7f0000006d80)=0x8) 4.366377925s ago: executing program 0 (id=289): socket$inet6_sctp(0xa, 0x1, 0x84) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xb, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x8, &(0x7f00000002c0)=0x80000000000003) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpu.stat\x00', 0x275a, 0x0) 4.287956727s ago: executing program 1 (id=290): landlock_create_ruleset(&(0x7f00000002c0)={0x120, 0xd, 0x3}, 0x30, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat2(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)={0x280, 0x100, 0x14}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xfffff000) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000002000/0x1000)=nil, 0x1000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) r1 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) ioctl$FS_IOC_SETFLAGS(r1, 0x40046f41, &(0x7f0000000440)=0x20000) 2.786242263s ago: executing program 0 (id=291): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000000100)={r1, 0x5}, &(0x7f0000000140)=0x8) 2.208176968s ago: executing program 1 (id=292): mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000100)='./sys\x00', 0x0, 0x0, 0x0) mount(0x0, 0x0, &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./config/usb_gadget/g1/idVendor\x00', 0x1, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./config/usb_gadget/g1/functions/ncm.usb0/os_desc/interface.ncm/compatible_id\x00', 0x1, 0x0) write(r0, &(0x7f00000006c0)='WINNCM\n\x00', 0x8) 1.096164674s ago: executing program 2 (id=293): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0xa27}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat$rtc(0xffffffffffffff9c, 0x0, 0x8440, 0x0) ioctl$RTC_ALM_SET(r3, 0x40247007, &(0x7f0000000180)={0x1d, 0x2c, 0x4, 0x15, 0x9, 0x2, 0x6, 0x10a, 0x1}) openat(0xffffffffffffff9c, 0x0, 0x20842, 0x63) setns(0xc9, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x41, &(0x7f0000000140)=0x4f4e, 0x4) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) unshare(0x80) recvmmsg(r4, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=""/33, 0x21}, 0x4}], 0x3d5, 0x45833af92e4b38ff, 0x0) 1.043887765s ago: executing program 1 (id=294): socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r1, 0x8, &(0x7f00000002c0)=0x80000000000003) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x8, 0x20010, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r4, 0x8983, &(0x7f0000000100)={0x0, 'veth1_to_batadv\x00', {0x4}, 0x26}) 0s ago: executing program 2 (id=295): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r2, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x8, r3, 0x0, 0x1, 0x0, 0x0, 0x5}) syz_open_dev$cec(0x0, 0xffffffffffffffff, 0x4ae60) syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') syz_open_dev$dvb_frontend(&(0x7f0000000400), 0x0, 0x84003) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.30' (ED25519) to the list of known hosts. [ 74.534374][ T5762] cgroup: Unknown subsys name 'net' [ 74.667726][ T5762] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 76.450089][ T5762] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 77.989754][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 77.998306][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 78.006394][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 78.019412][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 78.029900][ T5778] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 78.038084][ T5778] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 78.079232][ T5781] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 78.087284][ T5781] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 78.100270][ T5776] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 78.107519][ T5087] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 78.116811][ T5776] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 78.126301][ T5776] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3 [ 78.133493][ T5087] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 78.143112][ T5087] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 78.160885][ T5785] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 78.169201][ T5783] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 78.177449][ T5785] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 78.185077][ T5087] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 78.192700][ T5785] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 78.214478][ T5785] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 78.221917][ T5087] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 78.229398][ T5087] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 78.237284][ T5087] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 78.245550][ T5785] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 78.627424][ T5774] chnl_net:caif_netlink_parms(): no params data found [ 78.684650][ T5777] chnl_net:caif_netlink_parms(): no params data found [ 78.848994][ T5774] bridge0: port 1(bridge_slave_0) entered blocking state [ 78.857211][ T5774] bridge0: port 1(bridge_slave_0) entered disabled state [ 78.865399][ T5774] bridge_slave_0: entered allmulticast mode [ 78.873373][ T5774] bridge_slave_0: entered promiscuous mode [ 78.883896][ T5774] bridge0: port 2(bridge_slave_1) entered blocking state [ 78.891476][ T5774] bridge0: port 2(bridge_slave_1) entered disabled state [ 78.898744][ T5774] bridge_slave_1: entered allmulticast mode [ 78.906037][ T5774] bridge_slave_1: entered promiscuous mode [ 78.940603][ T5780] chnl_net:caif_netlink_parms(): no params data found [ 78.968239][ T5774] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 78.994950][ T5774] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.004347][ T5782] chnl_net:caif_netlink_parms(): no params data found [ 79.016836][ T5777] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.024179][ T5777] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.031569][ T5777] bridge_slave_0: entered allmulticast mode [ 79.038397][ T5777] bridge_slave_0: entered promiscuous mode [ 79.055751][ T5777] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.063421][ T5777] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.070784][ T5777] bridge_slave_1: entered allmulticast mode [ 79.077629][ T5777] bridge_slave_1: entered promiscuous mode [ 79.144513][ T5774] team0: Port device team_slave_0 added [ 79.154966][ T5774] team0: Port device team_slave_1 added [ 79.211611][ T5777] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.224893][ T5777] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.283209][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.290394][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.316588][ T5774] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.330219][ T5774] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.337208][ T5774] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.363813][ T5774] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.386083][ T5780] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.393683][ T5780] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.403571][ T5780] bridge_slave_0: entered allmulticast mode [ 79.410629][ T5780] bridge_slave_0: entered promiscuous mode [ 79.418654][ T5780] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.426542][ T5780] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.434410][ T5780] bridge_slave_1: entered allmulticast mode [ 79.442092][ T5780] bridge_slave_1: entered promiscuous mode [ 79.476085][ T5777] team0: Port device team_slave_0 added [ 79.517357][ T5782] bridge0: port 1(bridge_slave_0) entered blocking state [ 79.524844][ T5782] bridge0: port 1(bridge_slave_0) entered disabled state [ 79.532546][ T5782] bridge_slave_0: entered allmulticast mode [ 79.539440][ T5782] bridge_slave_0: entered promiscuous mode [ 79.548922][ T5777] team0: Port device team_slave_1 added [ 79.557606][ T5780] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.570887][ T5780] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.599372][ T5782] bridge0: port 2(bridge_slave_1) entered blocking state [ 79.606876][ T5782] bridge0: port 2(bridge_slave_1) entered disabled state [ 79.614378][ T5782] bridge_slave_1: entered allmulticast mode [ 79.622004][ T5782] bridge_slave_1: entered promiscuous mode [ 79.669251][ T5774] hsr_slave_0: entered promiscuous mode [ 79.675983][ T5774] hsr_slave_1: entered promiscuous mode [ 79.723812][ T5780] team0: Port device team_slave_0 added [ 79.733289][ T5780] team0: Port device team_slave_1 added [ 79.741313][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.748402][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.774938][ T5777] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.789163][ T5782] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 79.803250][ T5782] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 79.844979][ T5777] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.852290][ T5777] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.878905][ T5777] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 79.901234][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 79.908579][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 79.937588][ T5780] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 79.970883][ T5780] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 79.977884][ T5780] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.004270][ T5780] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.036590][ T5782] team0: Port device team_slave_0 added [ 80.052372][ T5782] team0: Port device team_slave_1 added [ 80.122343][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 80.129447][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.156249][ T5782] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 80.174174][ T5777] hsr_slave_0: entered promiscuous mode [ 80.181367][ T5777] hsr_slave_1: entered promiscuous mode [ 80.188153][ T5777] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.196581][ T5778] Bluetooth: hci0: command tx timeout [ 80.205047][ T5777] Cannot create hsr debugfs directory [ 80.232555][ T5782] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 80.242164][ T5782] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 80.269230][ T5778] Bluetooth: hci1: command tx timeout [ 80.275332][ T5782] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 80.298977][ T5780] hsr_slave_0: entered promiscuous mode [ 80.307154][ T5780] hsr_slave_1: entered promiscuous mode [ 80.313934][ T5780] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.321909][ T5780] Cannot create hsr debugfs directory [ 80.339871][ T5778] Bluetooth: hci2: command tx timeout [ 80.356953][ T5778] Bluetooth: hci3: command tx timeout [ 80.445155][ T5782] hsr_slave_0: entered promiscuous mode [ 80.452582][ T5782] hsr_slave_1: entered promiscuous mode [ 80.458697][ T5782] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 80.466477][ T5782] Cannot create hsr debugfs directory [ 80.763100][ T5774] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 80.777763][ T5774] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 80.805815][ T5774] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 80.829124][ T5774] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 80.897918][ T5777] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 80.907813][ T5777] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 80.924940][ T5777] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 80.935214][ T5777] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 81.021030][ T5782] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 81.036690][ T5782] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 81.073992][ T5782] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 81.084496][ T5782] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 81.181365][ T5780] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 81.208281][ T5780] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 81.219332][ T5780] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 81.241492][ T5780] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 81.283500][ T5774] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.336059][ T5777] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.369188][ T5777] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.379179][ T5774] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.405851][ T3436] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.413280][ T3436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.436278][ T3436] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.443661][ T3436] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.454628][ T3436] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.461951][ T3436] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.494153][ T3450] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.501563][ T3450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.517802][ T5782] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.562150][ T5782] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.605768][ T11] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.612927][ T11] bridge0: port 1(bridge_slave_0) entered forwarding state [ 81.644335][ T3450] bridge0: port 2(bridge_slave_1) entered blocking state [ 81.651757][ T3450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 81.678338][ T5777] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 81.689026][ T5777] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 81.857246][ T5780] 8021q: adding VLAN 0 to HW filter on device bond0 [ 81.943810][ T5780] 8021q: adding VLAN 0 to HW filter on device team0 [ 81.977516][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 81.985018][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 82.013259][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 82.020464][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 82.244897][ T5777] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.264138][ T5778] Bluetooth: hci0: command tx timeout [ 82.341467][ T5778] Bluetooth: hci1: command tx timeout [ 82.387780][ T5774] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.419852][ T5778] Bluetooth: hci3: command tx timeout [ 82.423769][ T5782] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.425314][ T5778] Bluetooth: hci2: command tx timeout [ 82.478414][ T5777] veth0_vlan: entered promiscuous mode [ 82.571899][ T5777] veth1_vlan: entered promiscuous mode [ 82.618544][ T5774] veth0_vlan: entered promiscuous mode [ 82.626356][ T5782] veth0_vlan: entered promiscuous mode [ 82.646971][ T5780] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 82.671350][ T5782] veth1_vlan: entered promiscuous mode [ 82.687347][ T5774] veth1_vlan: entered promiscuous mode [ 82.733603][ T5777] veth0_macvtap: entered promiscuous mode [ 82.761306][ T5777] veth1_macvtap: entered promiscuous mode [ 82.811473][ T5774] veth0_macvtap: entered promiscuous mode [ 82.836938][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 82.856796][ T5782] veth0_macvtap: entered promiscuous mode [ 82.868874][ T5777] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 82.878799][ T5780] veth0_vlan: entered promiscuous mode [ 82.894189][ T5774] veth1_macvtap: entered promiscuous mode [ 82.911577][ T5777] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.921122][ T5777] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.931106][ T5777] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.940115][ T5777] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 82.955658][ T5782] veth1_macvtap: entered promiscuous mode [ 82.969548][ T5780] veth1_vlan: entered promiscuous mode [ 83.010389][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.025068][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.037333][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.049388][ T5782] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.060471][ T5782] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.077006][ T5782] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.090803][ T5782] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.099855][ T5782] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.108797][ T5782] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.119724][ T5782] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.131839][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.145313][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.156679][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.167648][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.179522][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.234053][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.246957][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.257573][ T5774] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.268862][ T5774] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.280779][ T5774] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.341753][ T5774] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.353196][ T5774] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.363208][ T5774] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.374965][ T5774] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.404560][ T5780] veth0_macvtap: entered promiscuous mode [ 83.410432][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.418700][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.460611][ T5780] veth1_macvtap: entered promiscuous mode [ 83.567930][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.584636][ T3450] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.587631][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.593415][ T3450] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.612846][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.627292][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.637416][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.648171][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.658188][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 83.669021][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.685983][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 83.726115][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.736834][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.752574][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.764054][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.774037][ T5780] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 83.786570][ T5780] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 83.799363][ T5780] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 83.827561][ T5780] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.843552][ T5780] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.854213][ T5780] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.864633][ T5780] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 83.902022][ T3413] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.911869][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 83.931331][ T3413] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 83.948825][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.053458][ T5833] syz.0.1[5833]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set [ 84.085173][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.121439][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.161361][ T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.180124][ T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 84.192345][ T5833] loop0: detected capacity change from 0 to 2048 [ 84.282171][ T5833] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 84.328226][ T3450] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 84.340360][ T5778] Bluetooth: hci0: command tx timeout [ 85.829944][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c2!!! [ 85.952041][ T5778] Bluetooth: hci1: command tx timeout [ 85.957561][ T5778] Bluetooth: hci2: command tx timeout [ 85.965653][ T5087] Bluetooth: hci3: command tx timeout [ 85.990987][ T3450] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 86.421180][ T5778] Bluetooth: hci0: command tx timeout [ 87.423026][ T5851] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 87.529733][ T5854] Zero length message leads to an empty skb [ 87.667875][ T5859] loop1: detected capacity change from 0 to 128 [ 87.710824][ T5859] FAT-fs (loop1): Directory bread(block 1048) failed [ 87.745368][ T5859] FAT-fs (loop1): Directory bread(block 1049) failed [ 87.763367][ T5859] FAT-fs (loop1): Directory bread(block 1050) failed [ 87.813986][ T5859] FAT-fs (loop1): Directory bread(block 1051) failed [ 87.839905][ T5859] FAT-fs (loop1): Directory bread(block 1052) failed [ 87.909209][ T5859] FAT-fs (loop1): Directory bread(block 1053) failed [ 87.929789][ T5859] FAT-fs (loop1): Directory bread(block 1054) failed [ 87.942556][ T5859] FAT-fs (loop1): Directory bread(block 1055) failed [ 88.079652][ T5778] Bluetooth: hci2: command tx timeout [ 88.079704][ T5087] Bluetooth: hci1: command tx timeout [ 88.086145][ T5778] Bluetooth: hci3: command tx timeout [ 89.429757][ T5870] tipc: Started in network mode [ 89.434757][ T5870] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 89.630227][ T5872] Invalid ELF header magic: != ELF [ 91.601957][ T5881] tipc: Cannot configure node identity twice [ 91.910269][ T5882] Invalid ELF header magic: != ELF [ 92.267907][ T5877] sched: RT throttling activated [ 92.671170][ T787] cfg80211: failed to load regulatory.db [ 92.837775][ T5884] loop2: detected capacity change from 0 to 2048 [ 93.919880][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 94.408990][ T5884] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 96.116588][ T5900] warning: `syz.2.16' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 96.642645][ T5910] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 96.655544][ T5910] ip6gretap1: entered allmulticast mode [ 98.354362][ T5918] ip_tables: iptables: counters copy to user failed while replacing table [ 99.629742][ T5925] tipc: Started in network mode [ 99.634662][ T5925] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 99.811127][ T5927] Invalid ELF header magic: != ELF [ 100.312726][ T5924] loop3: detected capacity change from 0 to 128 [ 100.408576][ T5924] FAT-fs (loop3): Directory bread(block 1048) failed [ 100.464505][ T5924] FAT-fs (loop3): Directory bread(block 1049) failed [ 100.490492][ T5924] FAT-fs (loop3): Directory bread(block 1050) failed [ 100.497379][ T5924] FAT-fs (loop3): Directory bread(block 1051) failed [ 100.544622][ T5924] FAT-fs (loop3): Directory bread(block 1052) failed [ 100.564668][ T5924] FAT-fs (loop3): Directory bread(block 1053) failed [ 100.586587][ T5924] FAT-fs (loop3): Directory bread(block 1054) failed [ 101.599888][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 101.999836][ T5924] FAT-fs (loop3): Directory bread(block 1055) failed [ 102.443282][ T5933] loop3: detected capacity change from 0 to 2048 [ 102.496217][ T5933] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 103.929736][ T5941] tipc: Cannot configure node identity twice [ 104.219717][ T5941] Invalid ELF header magic: != ELF [ 106.660494][ T5955] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 106.672785][ T5955] ip6gretap1: entered allmulticast mode [ 108.500094][ T5960] ip_tables: iptables: counters copy to user failed while replacing table [ 110.263284][ T5969] loop3: detected capacity change from 0 to 128 [ 110.329305][ T5969] FAT-fs (loop3): Directory bread(block 1048) failed [ 111.279707][ T5969] FAT-fs (loop3): Directory bread(block 1049) failed [ 111.286968][ T5969] FAT-fs (loop3): Directory bread(block 1050) failed [ 111.401539][ T5971] tipc: Started in network mode [ 111.406607][ T5971] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 111.418731][ T5969] FAT-fs (loop3): Directory bread(block 1051) failed [ 111.430184][ T0] NOHZ tick-stop error: local softirq work is pending, handler #240!!! [ 111.514641][ T5969] FAT-fs (loop3): Directory bread(block 1052) failed [ 111.541536][ T5969] FAT-fs (loop3): Directory bread(block 1053) failed [ 111.548350][ T5969] FAT-fs (loop3): Directory bread(block 1054) failed [ 111.643658][ T5971] Invalid ELF header magic: != ELF [ 111.669831][ T5969] FAT-fs (loop3): Directory bread(block 1055) failed [ 114.714463][ T5990] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 114.726669][ T5990] ip6gretap1: entered allmulticast mode [ 115.779913][ T5997] tipc: Cannot configure node identity twice [ 115.795043][ T5997] Invalid ELF header magic: != ELF [ 117.307598][ T6007] ======================================================= [ 117.307598][ T6007] WARNING: The mand mount option has been deprecated and [ 117.307598][ T6007] and is ignored by this kernel. Remove the mand [ 117.307598][ T6007] option from the mount to silence this warning. [ 117.307598][ T6007] ======================================================= [ 117.807589][ T6011] loop1: detected capacity change from 0 to 2048 [ 119.781190][ T6011] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 119.851175][ T6026] loop0: detected capacity change from 0 to 128 [ 119.894842][ T6026] FAT-fs (loop0): Directory bread(block 1048) failed [ 119.959724][ T6026] FAT-fs (loop0): Directory bread(block 1049) failed [ 119.966521][ T6026] FAT-fs (loop0): Directory bread(block 1050) failed [ 120.037436][ T6026] FAT-fs (loop0): Directory bread(block 1051) failed [ 120.116697][ T6026] FAT-fs (loop0): Directory bread(block 1052) failed [ 120.123594][ T6026] FAT-fs (loop0): Directory bread(block 1053) failed [ 120.130402][ T6026] FAT-fs (loop0): Directory bread(block 1054) failed [ 120.138198][ T6026] FAT-fs (loop0): Directory bread(block 1055) failed [ 120.418024][ T6031] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 120.430332][ T6031] ip6gretap1: entered allmulticast mode [ 121.218884][ T6034] netlink: 8 bytes leftover after parsing attributes in process `syz.0.46'. [ 122.839741][ T6041] tipc: Cannot configure node identity twice [ 123.189700][ T6041] Invalid ELF header magic: != ELF [ 127.661569][ T6071] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 127.673888][ T6071] ip6gretap1: entered allmulticast mode [ 128.537288][ T6078] loop0: detected capacity change from 0 to 128 [ 128.613896][ T6079] tipc: Started in network mode [ 128.619091][ T6079] tipc: Node identity 0010000000000000002, cluster identity 4711 [ 128.633679][ T6079] Invalid ELF header magic: != ELF [ 128.828859][ T6078] FAT-fs (loop0): Directory bread(block 1048) failed [ 129.000913][ T6078] FAT-fs (loop0): Directory bread(block 1049) failed [ 129.179839][ T6078] FAT-fs (loop0): Directory bread(block 1050) failed [ 129.207468][ T6078] FAT-fs (loop0): Directory bread(block 1051) failed [ 129.249274][ T6078] FAT-fs (loop0): Directory bread(block 1052) failed [ 129.300063][ T6078] FAT-fs (loop0): Directory bread(block 1053) failed [ 129.306899][ T6078] FAT-fs (loop0): Directory bread(block 1054) failed [ 129.334136][ T6078] FAT-fs (loop0): Directory bread(block 1055) failed [ 133.502215][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 133.508888][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 135.266452][ T6113] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 135.276967][ T6113] ip6gretap1: entered allmulticast mode [ 138.186768][ T6132] loop2: detected capacity change from 0 to 512 [ 139.590221][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 143.019735][ T6167] Bluetooth: MGMT ver 1.22 [ 143.580674][ T6169] loop1: detected capacity change from 0 to 32768 [ 143.598756][ T6169] BTRFS: device fsid 395ef67a-297e-477c-816d-cd80a5b93e5d devid 1 transid 8 /dev/loop1 scanned by syz.1.81 (6169) [ 143.626915][ T6169] BTRFS info (device loop1): first mount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 143.639727][ T6169] BTRFS info (device loop1): using sha256 (sha256-avx2) checksum algorithm [ 143.648689][ T6169] BTRFS info (device loop1): use zlib compression, level 3 [ 143.656110][ T6169] BTRFS info (device loop1): turning on sync discard [ 143.662928][ T6169] BTRFS info (device loop1): using free space tree [ 144.155789][ T6165] loop0: detected capacity change from 0 to 32768 [ 145.369447][ T6165] ocfs2: Mounting device (7,0) on (node local, slot 0) with ordered data mode. [ 145.755929][ T6165] syz.0.76 (6165) used greatest stack depth: 20944 bytes left [ 145.793016][ T6169] BTRFS info (device loop1): enabling ssd optimizations [ 146.015398][ T5777] ocfs2: Unmounting device (7,0) on (node local) [ 146.232747][ T5774] BTRFS info (device loop1): last unmount of filesystem 395ef67a-297e-477c-816d-cd80a5b93e5d [ 147.305035][ T6200] loop2: detected capacity change from 0 to 1024 [ 148.516186][ T28] audit: type=1326 audit(1788962975.957:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6203 comm="syz.1.85" exe="/root/ci2-linux-6-6-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f590279e159 code=0x0 [ 149.872700][ T6206] xt_CT: No such helper "pptp" [ 153.504134][ T6225] ip_tables: iptables: counters copy to user failed while replacing table [ 155.530184][ T971] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 155.759761][ T971] usb 3-1: Using ep0 maxpacket: 32 [ 155.789691][ T971] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 155.891423][ T971] usb 3-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 155.949663][ T971] usb 3-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 155.958023][ T971] usb 3-1: Product: syz [ 155.999650][ T971] usb 3-1: Manufacturer: syz [ 156.014745][ T971] usb 3-1: SerialNumber: syz [ 156.085820][ T971] usb 3-1: config 0 descriptor?? [ 156.103300][ T6249] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 156.175143][ T6257] loop0: detected capacity change from 0 to 1024 [ 156.303486][ T6257] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only. [ 157.301131][ T6266] ip_tables: iptables: counters copy to user failed while replacing table [ 157.898697][ T27] usb 3-1: USB disconnect, device number 2 [ 161.586318][ T6281] loop2: detected capacity change from 0 to 512 [ 164.821976][ T6295] syz.1.113 (6295) used greatest stack depth: 20344 bytes left [ 168.479734][ T5811] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 169.989680][ T5811] usb 3-1: Using ep0 maxpacket: 8 [ 170.020718][ T5811] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 170.039677][ T5811] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 170.058392][ T5811] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 170.068682][ T5811] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 170.084330][ T5811] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 170.097906][ T5811] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 170.116562][ T5811] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 170.390266][ T5811] usb 3-1: GET_CAPABILITIES returned 0 [ 170.426239][ T5811] usbtmc 3-1:16.0: can't read capabilities [ 171.473677][ T5811] usb 3-1: USB disconnect, device number 3 [ 176.880529][ T6359] loop2: detected capacity change from 0 to 2048 [ 176.952019][ T6359] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 178.602850][ T6356] bridge0: port 2(bridge_slave_1) entered disabled state [ 178.612273][ T6356] bridge0: port 1(bridge_slave_0) entered disabled state [ 179.452438][ T6356] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 179.537782][ T6356] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 182.139877][ T6356] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.152670][ T6356] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.172059][ T6356] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.184053][ T6356] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 182.489774][ T6372] netlink: 28 bytes leftover after parsing attributes in process `syz.2.137'. [ 183.585497][ T6398] loop1: detected capacity change from 0 to 32768 [ 183.608080][ T6398] XFS (loop1): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 183.629720][ T5414] IPVS: starting estimator thread 0... [ 183.695763][ T6398] XFS (loop1): Ending clean mount [ 183.739923][ T6410] IPVS: using max 16 ests per chain, 38400 per kthread [ 183.918918][ T6372] syz.2.137 (6372) used greatest stack depth: 18840 bytes left [ 184.077379][ T5774] XFS (loop1): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 185.670084][ T0] NOHZ tick-stop error: local softirq work is pending, handler #1c0!!! [ 186.079638][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 186.387154][ T6443] netlink: 28 bytes leftover after parsing attributes in process `syz.1.154'. [ 189.989893][ T5437] veth0_vlan: left promiscuous mode [ 190.004572][ T5437] veth0_vlan: entered promiscuous mode [ 190.799908][ T6484] netlink: 28 bytes leftover after parsing attributes in process `syz.2.164'. [ 194.761012][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.767417][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 200.100844][ T6553] netlink: 'syz.2.182': attribute type 10 has an invalid length. [ 200.133769][ T6553] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 201.962018][ T5087] Bluetooth: hci3: command 0x0406 tx timeout [ 201.968839][ T5087] Bluetooth: hci1: command 0x0406 tx timeout [ 201.980690][ T5087] Bluetooth: hci2: command 0x0406 tx timeout [ 201.981545][ T5783] Bluetooth: hci0: command 0x0406 tx timeout [ 208.710165][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 227.426645][ T6725] bridge0: port 2(bridge_slave_1) entered disabled state [ 227.435026][ T6725] bridge0: port 1(bridge_slave_0) entered disabled state [ 228.073788][ T6725] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 228.145888][ T6725] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 228.427995][ T6725] veth0_vlan: left promiscuous mode [ 228.660434][ T6725] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.669728][ T6725] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.681673][ T6725] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 228.691199][ T6725] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 231.749568][ T0] NOHZ tick-stop error: local softirq work is pending, handler #c0!!! [ 236.798696][ T6788] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 238.677916][ T6807] Bluetooth: ISO socket layer initialized [ 239.429758][ T0] NOHZ tick-stop error: local softirq work is pending, handler #142!!! [ 241.276056][ T6816] netlink: 44 bytes leftover after parsing attributes in process `syz.0.242'. [ 241.366652][ T6364] IPVS: starting estimator thread 0... [ 241.501257][ T6819] IPVS: using max 15 ests per chain, 36000 per kthread [ 247.563503][ T6865] netlink: 44 bytes leftover after parsing attributes in process `syz.0.253'. [ 247.604836][ T6865] IPVS: lblc: SCTP 172.20.20.187:0 - no destination available [ 252.633566][ T6903] netlink: 44 bytes leftover after parsing attributes in process `syz.1.262'. [ 256.345650][ T1290] ieee802154 phy0 wpan0: encryption failed: -22 [ 256.352319][ T1290] ieee802154 phy1 wpan1: encryption failed: -22 [ 260.376925][ T6932] i2c i2c-0: dvb_frontend_start: failed to start kthread (-4) [ 261.906153][ T6944] netlink: 44 bytes leftover after parsing attributes in process `syz.3.273'. [ 261.965431][ T6938] bridge0: port 2(bridge_slave_1) entered disabled state [ 261.973317][ T6938] bridge0: port 1(bridge_slave_0) entered disabled state [ 264.247533][ T6938] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 264.271885][ T6938] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 264.569051][ T6938] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.578998][ T6938] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.589796][ T6938] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 264.598873][ T6938] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 266.869571][ T6971] overlayfs: failed to resolve './file2': -2 [ 272.654490][ T6996] netlink: 44 bytes leftover after parsing attributes in process `syz.1.287'. [ 273.534011][ T7006] overlayfs: failed to resolve './file2': -2 [ 277.481388][ T7026] ================================================================== [ 277.489540][ T7026] BUG: KASAN: slab-use-after-free in dvb_device_open+0xc9/0x360 [ 277.497217][ T7026] Read of size 8 at addr ffff888026ae8018 by task syz.2.295/7026 [ 277.505140][ T7026] [ 277.507501][ T7026] CPU: 1 PID: 7026 Comm: syz.2.295 Not tainted syzkaller #0 [ 277.514829][ T7026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 277.525104][ T7026] Call Trace: [ 277.528561][ T7026] [ 277.531533][ T7026] dump_stack_lvl+0x18c/0x250 [ 277.536537][ T7026] ? read_lock_is_recursive+0x20/0x20 [ 277.541973][ T7026] ? show_regs_print_info+0x20/0x20 [ 277.547220][ T7026] ? load_image+0x420/0x420 [ 277.552032][ T7026] ? _raw_spin_lock_irqsave+0xc0/0x100 [ 277.557699][ T7026] ? __virt_addr_valid+0x10c/0x380 [ 277.562861][ T7026] ? __virt_addr_valid+0x10c/0x380 [ 277.568016][ T7026] ? __virt_addr_valid+0x10c/0x380 [ 277.573187][ T7026] print_report+0xa8/0x210 [ 277.577689][ T7026] ? dvb_device_open+0xc9/0x360 [ 277.582661][ T7026] kasan_report+0x117/0x150 [ 277.587373][ T7026] ? chrdev_open+0x385/0x600 [ 277.592098][ T7026] ? dvb_device_open+0xc9/0x360 [ 277.596995][ T7026] dvb_device_open+0xc9/0x360 [ 277.601715][ T7026] chrdev_open+0x58c/0x600 [ 277.606260][ T7026] ? cd_forget+0x160/0x160 [ 277.610698][ T7026] do_dentry_open+0x880/0x14b0 [ 277.615497][ T7026] ? cd_forget+0x160/0x160 [ 277.619929][ T7026] path_openat+0x284f/0x3270 [ 277.624543][ T7026] ? do_sys_openat2+0xda/0x1d0 [ 277.629330][ T7026] ? __x64_sys_openat+0x139/0x160 [ 277.634372][ T7026] ? verify_lock_unused+0x140/0x140 [ 277.639590][ T7026] ? do_filp_open+0x430/0x430 [ 277.644288][ T7026] do_filp_open+0x1f2/0x430 [ 277.648812][ T7026] ? vfs_tmpfile+0x620/0x620 [ 277.653419][ T7026] ? _raw_spin_unlock+0x28/0x40 [ 277.658407][ T7026] ? alloc_fd+0x590/0x640 [ 277.662955][ T7026] do_sys_openat2+0x134/0x1d0 [ 277.667682][ T7026] ? do_sys_open+0xe0/0xe0 [ 277.672206][ T7026] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 277.678199][ T7026] ? lock_chain_count+0x20/0x20 [ 277.683076][ T7026] __x64_sys_openat+0x139/0x160 [ 277.688262][ T7026] do_syscall_64+0x55/0xb0 [ 277.692881][ T7026] ? clear_bhb_loop+0x40/0x90 [ 277.697573][ T7026] ? clear_bhb_loop+0x40/0x90 [ 277.702667][ T7026] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 277.708685][ T7026] RIP: 0033:0x7f74fd35e98e [ 277.713573][ T7026] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 277.733366][ T7026] RSP: 002b:00007f74fe1b4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 277.741982][ T7026] RAX: ffffffffffffffda RBX: 00007f74fe1b56c0 RCX: 00007f74fd35e98e [ 277.750191][ T7026] RDX: 0000000000084003 RSI: 00007f74fe1b4c00 RDI: ffffffffffffff9c [ 277.758559][ T7026] RBP: 00007f74fe1b4c00 R08: 0000000000000000 R09: 0000000000000000 [ 277.767960][ T7026] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 277.776838][ T7026] R13: 00007f74fd626128 R14: 00007f74fd626090 R15: 00007ffc6fb3bf88 [ 277.785300][ T7026] [ 277.788333][ T7026] [ 277.790664][ T7026] Allocated by task 1: [ 277.794741][ T7026] kasan_set_track+0x4e/0x70 [ 277.799362][ T7026] __kasan_kmalloc+0x8f/0xa0 [ 277.803968][ T7026] dvb_register_device+0x309/0x1df0 [ 277.809562][ T7026] dvb_register_frontend+0x62d/0x900 [ 277.814996][ T7026] vidtv_bridge_probe+0x9d6/0xf60 [ 277.820925][ T7026] platform_probe+0x13b/0x1c0 [ 277.825644][ T7026] really_probe+0x247/0xae0 [ 277.830175][ T7026] __driver_probe_device+0x1f5/0x390 [ 277.835563][ T7026] driver_probe_device+0x4f/0x420 [ 277.840789][ T7026] __driver_attach+0x444/0x6d0 [ 277.845918][ T7026] bus_for_each_dev+0x235/0x2b0 [ 277.850915][ T7026] bus_add_driver+0x340/0x630 [ 277.855630][ T7026] driver_register+0x23a/0x310 [ 277.860415][ T7026] vidtv_bridge_init+0x49/0x80 [ 277.865368][ T7026] do_one_initcall+0x242/0x790 [ 277.870143][ T7026] do_initcall_level+0x13d/0x1f0 [ 277.875086][ T7026] do_initcalls+0x69/0xd0 [ 277.879596][ T7026] kernel_init_freeable+0x3d9/0x560 [ 277.884802][ T7026] kernel_init+0x1d/0x1c0 [ 277.889180][ T7026] ret_from_fork+0x48/0x80 [ 277.893618][ T7026] ret_from_fork_asm+0x11/0x20 [ 277.898394][ T7026] [ 277.900722][ T7026] Freed by task 6932: [ 277.904708][ T7026] kasan_set_track+0x4e/0x70 [ 277.909399][ T7026] kasan_save_free_info+0x28/0x40 [ 277.914526][ T7026] ____kasan_slab_free+0x126/0x1f0 [ 277.919739][ T7026] slab_free_freelist_hook+0x130/0x1a0 [ 277.925250][ T7026] __kmem_cache_free+0xba/0x1f0 [ 277.930226][ T7026] dvb_device_open+0x2d9/0x360 [ 277.935105][ T7026] chrdev_open+0x58c/0x600 [ 277.939567][ T7026] do_dentry_open+0x880/0x14b0 [ 277.944361][ T7026] path_openat+0x284f/0x3270 [ 277.949146][ T7026] do_filp_open+0x1f2/0x430 [ 277.953658][ T7026] do_sys_openat2+0x134/0x1d0 [ 277.958365][ T7026] __x64_sys_openat+0x139/0x160 [ 277.963245][ T7026] do_syscall_64+0x55/0xb0 [ 277.968072][ T7026] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 277.973978][ T7026] [ 277.976320][ T7026] The buggy address belongs to the object at ffff888026ae8000 [ 277.976320][ T7026] which belongs to the cache kmalloc-256 of size 256 [ 277.990382][ T7026] The buggy address is located 24 bytes inside of [ 277.990382][ T7026] freed 256-byte region [ffff888026ae8000, ffff888026ae8100) [ 278.004193][ T7026] [ 278.006524][ T7026] The buggy address belongs to the physical page: [ 278.012988][ T7026] page:ffffea00009aba00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26ae8 [ 278.023157][ T7026] head:ffffea00009aba00 order:1 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 278.032192][ T7026] flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 278.040193][ T7026] page_type: 0xffffffff() [ 278.044981][ T7026] raw: 00fff00000000840 ffff888017c41b40 dead000000000122 0000000000000000 [ 278.053768][ T7026] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 [ 278.062379][ T7026] page dumped because: kasan: bad access detected [ 278.068893][ T7026] page_owner tracks the page as allocated [ 278.074613][ T7026] page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 18112325166, free_ts 0 [ 278.094514][ T7026] post_alloc_hook+0x1c1/0x200 [ 278.099299][ T7026] get_page_from_freelist+0x2181/0x22a0 [ 278.104859][ T7026] __alloc_pages+0x1f0/0x460 [ 278.109457][ T7026] alloc_page_interleave+0x24/0x1e0 [ 278.114666][ T7026] alloc_slab_page+0x5d/0x180 [ 278.119478][ T7026] new_slab+0x87/0x2d0 [ 278.123566][ T7026] ___slab_alloc+0xc5c/0x12f0 [ 278.128335][ T7026] __kmem_cache_alloc_node+0x11f/0x250 [ 278.133833][ T7026] kmalloc_trace+0x2a/0xe0 [ 278.138335][ T7026] dvb_register_device+0x309/0x1df0 [ 278.143554][ T7026] dvb_register_frontend+0x62d/0x900 [ 278.149045][ T7026] vidtv_bridge_probe+0x9d6/0xf60 [ 278.154194][ T7026] platform_probe+0x13b/0x1c0 [ 278.158994][ T7026] really_probe+0x247/0xae0 [ 278.163624][ T7026] __driver_probe_device+0x1f5/0x390 [ 278.169122][ T7026] driver_probe_device+0x4f/0x420 [ 278.174193][ T7026] page_owner free stack trace missing [ 278.179747][ T7026] [ 278.182081][ T7026] Memory state around the buggy address: [ 278.187909][ T7026] ffff888026ae7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 278.195985][ T7026] ffff888026ae7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 278.204154][ T7026] >ffff888026ae8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 278.212331][ T7026] ^ [ 278.217205][ T7026] ffff888026ae8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 278.225459][ T7026] ffff888026ae8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 278.233633][ T7026] ================================================================== [ 278.243660][ T7026] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 278.251095][ T7026] CPU: 1 PID: 7026 Comm: syz.2.295 Not tainted syzkaller #0 [ 278.258421][ T7026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 278.268512][ T7026] Call Trace: [ 278.271835][ T7026] [ 278.274805][ T7026] dump_stack_lvl+0x18c/0x250 [ 278.279812][ T7026] ? show_regs_print_info+0x20/0x20 [ 278.285069][ T7026] ? load_image+0x420/0x420 [ 278.289617][ T7026] panic+0x2ca/0x720 [ 278.293806][ T7026] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 278.300181][ T7026] ? bpf_jit_dump+0xd0/0xd0 [ 278.304900][ T7026] ? _raw_spin_unlock_irqrestore+0x111/0x120 [ 278.310926][ T7026] ? _raw_spin_unlock+0x40/0x40 [ 278.315833][ T7026] ? dvb_device_open+0xc9/0x360 [ 278.320793][ T7026] check_panic_on_warn+0x84/0xa0 [ 278.325872][ T7026] ? dvb_device_open+0xc9/0x360 [ 278.330768][ T7026] end_report+0x6f/0x130 [ 278.335048][ T7026] kasan_report+0x128/0x150 [ 278.339588][ T7026] ? chrdev_open+0x385/0x600 [ 278.344212][ T7026] ? dvb_device_open+0xc9/0x360 [ 278.349101][ T7026] dvb_device_open+0xc9/0x360 [ 278.353831][ T7026] chrdev_open+0x58c/0x600 [ 278.358282][ T7026] ? cd_forget+0x160/0x160 [ 278.363291][ T7026] do_dentry_open+0x880/0x14b0 [ 278.368129][ T7026] ? cd_forget+0x160/0x160 [ 278.372595][ T7026] path_openat+0x284f/0x3270 [ 278.377418][ T7026] ? do_sys_openat2+0xda/0x1d0 [ 278.382320][ T7026] ? __x64_sys_openat+0x139/0x160 [ 278.387386][ T7026] ? verify_lock_unused+0x140/0x140 [ 278.392645][ T7026] ? do_filp_open+0x430/0x430 [ 278.397449][ T7026] do_filp_open+0x1f2/0x430 [ 278.401986][ T7026] ? vfs_tmpfile+0x620/0x620 [ 278.406658][ T7026] ? _raw_spin_unlock+0x28/0x40 [ 278.411908][ T7026] ? alloc_fd+0x590/0x640 [ 278.416437][ T7026] do_sys_openat2+0x134/0x1d0 [ 278.421185][ T7026] ? do_sys_open+0xe0/0xe0 [ 278.425650][ T7026] ? lockdep_hardirqs_on_prepare+0x44c/0x7d0 [ 278.431848][ T7026] ? lock_chain_count+0x20/0x20 [ 278.436738][ T7026] __x64_sys_openat+0x139/0x160 [ 278.441805][ T7026] do_syscall_64+0x55/0xb0 [ 278.446267][ T7026] ? clear_bhb_loop+0x40/0x90 [ 278.451008][ T7026] ? clear_bhb_loop+0x40/0x90 [ 278.455810][ T7026] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 278.461738][ T7026] RIP: 0033:0x7f74fd35e98e [ 278.466180][ T7026] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 278.485824][ T7026] RSP: 002b:00007f74fe1b4b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 278.494272][ T7026] RAX: ffffffffffffffda RBX: 00007f74fe1b56c0 RCX: 00007f74fd35e98e [ 278.502271][ T7026] RDX: 0000000000084003 RSI: 00007f74fe1b4c00 RDI: ffffffffffffff9c [ 278.510731][ T7026] RBP: 00007f74fe1b4c00 R08: 0000000000000000 R09: 0000000000000000 [ 278.518904][ T7026] R10: 0000000000000000 R11: 0000000000000246 R12: cccccccccccccccd [ 278.526984][ T7026] R13: 00007f74fd626128 R14: 00007f74fd626090 R15: 00007ffc6fb3bf88 [ 278.535044][ T7026] [ 278.538195][ T7026] Kernel Offset: disabled [ 278.542518][ T7026] Rebooting in 86400 seconds..