last executing test programs: 2m40.12311805s ago: executing program 2 (id=842): getcwd(&(0x7f0000000000)=""/244, 0xf4) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_ASSOCINFO(0xffffffffffffffff, 0x84, 0x1, &(0x7f0000000100)={0x0, 0x401, 0x0, 0x2fc, 0x9, 0xfd8}, &(0x7f0000000140)=0x14) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r0, 0x84, 0x1b, &(0x7f0000000180)={r1, 0x30, "f64a7385025998a56c0f5e0117613b5a293bce6b629b03df13fd97e19cd26ee1d662e651afca2a12cc9df84c0f18284a"}, &(0x7f00000001c0)=0x38) r2 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000200)='syz0\x00', 0x200002, 0x0) r3 = openat$cgroup_ro(r2, &(0x7f0000000240)='cgroup.freeze\x00', 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_STATUS64(0xffffffffffffffff, 0x80984120, &(0x7f0000000280)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)=@mpls_newroute={0x24, 0x18, 0x200, 0x70bd27, 0x25dfdbfd, {0x1c, 0x80, 0x0, 0x3, 0xfe, 0x3, 0x0, 0x7, 0x1100}, [@RTA_TTL_PROPAGATE={0x5, 0x1a, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040}, 0x10) setsockopt$EBT_SO_SET_COUNTERS(r3, 0x0, 0x81, &(0x7f0000000480)={'broute\x00', 0x0, 0x0, 0x0, [0x9, 0x4, 0x7, 0x4, 0xe, 0x7fffffff], 0x4, &(0x7f0000000440)=[{}], 0x0, [{}, {}, {}, {}]}, 0xb8) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000540)=@req3={0x2000000, 0x7, 0x8444, 0x5, 0x3, 0x0, 0x1}, 0x1c) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f00000005c0)={'batadv0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000680)={&(0x7f0000000580)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000640)={&(0x7f0000000600)=@gettclass={0x24, 0x2a, 0x200, 0x70bd26, 0x25dfdbff, {0x0, 0x0, 0x0, r5, {0x5, 0x4}, {0xe, 0x7}, {0x6, 0xd}}, ["", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x40000c4}, 0x20000000) pread64(r2, &(0x7f00000006c0)=""/9, 0x9, 0x4) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000700)={0x0}, &(0x7f0000000740)=0xc) move_pages(r6, 0x0, &(0x7f0000000780), &(0x7f00000007c0)=[0x0, 0x9e], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000940)={@fallback=r4, 0x14, 0x1, 0x800, &(0x7f0000000840)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x0, &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000008c0), &(0x7f0000000900)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x40) ioctl$TIOCMSET(r7, 0x5418, &(0x7f0000000980)=0x3) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r3, 0x84, 0x1d, &(0x7f00000009c0)={0x1, [0x0]}, &(0x7f0000000a00)=0x8) socket$nl_route(0x10, 0x3, 0x0) ptrace(0x10, r6) ioctl$sock_inet_SIOCSARP(r7, 0x8955, &(0x7f0000000a40)={{0x2, 0x4e22, @empty}, {0x306}, 0x20, {0x2, 0x4e24, @rand_addr=0x64010101}, 'caif0\x00'}) sendmsg$FOU_CMD_DEL(r7, &(0x7f0000000b80)={&(0x7f0000000ac0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000b40)={&(0x7f0000000b00)={0x1c, 0x0, 0x300, 0x70bd2a, 0x25dfdbfe, {}, [@FOU_ATTR_LOCAL_V4={0x8, 0x6, @rand_addr=0x64010102}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c044}, 0x4010) ioctl$VIDIOC_S_AUDOUT(r7, 0x40345632, &(0x7f0000000bc0)={0x57, "e6319ab7a99af47835b6b2ede6c9e5abba13da5e88b081f3d5c1db31734e4368", 0x2, 0x1}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000c40)={r6, r7, 0x0, 0xe, &(0x7f0000000c00)='cgroup.freeze\x00'}, 0x30) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000cc0), r7) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r3, &(0x7f0000000dc0)={&(0x7f0000000c80)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f0000000d80)={&(0x7f0000000d00)={0x5c, r8, 0x100, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x6}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_ADDR={0x30, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @rand_addr=0x64010102}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r5}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x4}, 0x4811) sendto$inet6(r3, &(0x7f0000000e00)="166d81036a42e6ecdc6c0ec7cefbcb69f66673edb6a51a8d3c85e6ef4f9168bd0b99e2", 0x23, 0x40, &(0x7f0000000e40)={0xa, 0x4e21, 0x5, @dev={0xfe, 0x80, '\x00', 0x39}, 0xe}, 0x1c) r9 = syz_open_dev$usbfs(&(0x7f0000000e80), 0x2, 0x200800) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x8, 0x40010, r9, 0xbf631000) 2m39.889098624s ago: executing program 2 (id=843): io_setup(0x8, &(0x7f0000000100)=0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000240), 0x4000000044402, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0x200000e, 0x13, r1, 0x0) r2 = syz_io_uring_setup(0x3ce3, &(0x7f0000000140)={0x0, 0x9c58, 0x20, 0x1, 0x216}, &(0x7f00000001c0), &(0x7f0000000200)) r3 = syz_open_dev$vim2m(&(0x7f0000000680), 0x7ff, 0x2) r4 = socket(0x3, 0x4, 0x1) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r5, 0x8933, &(0x7f00000000c0)={'wg1\x00'}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81e8943c, &(0x7f00000005c0)={0x0, ""/256, 0x0, 0x0, 0x0, 0x0, ""/16, ""/16, ""/16, 0x0, 0x0}) ioctl$BTRFS_IOC_SNAP_DESTROY_V2(r4, 0x5000943f, &(0x7f0000000380)={{r5}, r6, 0x4, @unused=[0x2, 0x0, 0x7], @subvolid=0x9}) ioctl$BTRFS_IOC_SUBVOL_CREATE_V2(r2, 0x50009418, &(0x7f0000000340)={{}, r6, 0x8, @inherit={0x90, &(0x7f0000000280)={0x1, 0x9, 0x3, 0xe34a, {0x28, 0x8b80, 0x8, 0x400, 0x7}, [0x1, 0xd5f0, 0x4, 0xe81, 0x7, 0xc32c065, 0x6, 0x7f, 0x2]}}, @subvolid=0xffffffffffffffcb}) io_submit(r0, 0x2, &(0x7f0000000080)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x641a, r1, &(0x7f00000000c0)='\x00', 0x1, 0x10, 0x0, 0x2}, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x1, r1, 0x0, 0x0, 0x1}]) 2m39.63175958s ago: executing program 2 (id=844): syz_usb_connect$cdc_ncm(0x0, 0x72, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = openat$zero(0xffffffffffffff9c, &(0x7f0000000100), 0x400, 0x0) sendfile(r2, r1, &(0x7f00000002c0)=0xb, 0x8) r3 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="180000003c000bab956cb26f8c7d94f90324", 0x12}], 0x1}, 0x40) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e21, 0x63, @loopback, 0x7}, 0x1c) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/fib_triestat\x00') preadv(r5, &(0x7f0000000080)=[{&(0x7f0000000040)=""/46, 0x2e}], 0x1, 0x0, 0x4) getsockopt$inet_sctp6_SCTP_RECVNXTINFO(0xffffffffffffffff, 0x84, 0x21, &(0x7f00000001c0), &(0x7f0000000240)=0x4) connect$inet(0xffffffffffffffff, 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) shutdown(r6, 0x0) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [], {0x14}}, 0x28}}, 0x0) r7 = syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) ioctl$EVIOCGKEYCODE_V2(r7, 0x80284504, &(0x7f0000000040)=""/185) r8 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x2000000, {0x0, 0x0, 0x0, 0x0, {0xf}, {0xf}, {0xe, 0xd}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x8c0}, 0x0) 2m38.079232046s ago: executing program 4 (id=851): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = add_key$user(&(0x7f0000000400), &(0x7f0000000040)={'syz', 0x2}, &(0x7f0000000480)='\n', 0x1, 0xffffffffffffffff) r1 = add_key$user(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x3}, &(0x7f00000001c0)="f40fc24077021c9b084c60ffc26f26db12b9e78d629870bb26edb4a5e1cc0942ed8c58ca4fe84b94a0e31ea64089ee9ca1efb52945ffebbfea11dd3d0df936a10285eccab940ab5c96cb5d81dac1ad2243d878dde6cfd6ea08d5abcb00bb35436929ddabce530b63fab525337057438cf64a506d54d5c83e3e593d1d53ad0e6a44168fe8cfc6ad98b653d80636e4ddc1f2ab58762b3494250b9557f5b606a43e50874c90143034142cd5f7bd9b4dd876b97b7feb75b9138dde818a3c6b96dd80", 0xc0, 0xfffffffffffffffb) r2 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000940)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000013c0), 0x43c}}, 0x0) recvmmsg(r4, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f0000000c40)=[{&(0x7f0000000a80)=""/159, 0x9f}], 0x1}, 0xb1}], 0x1, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f0000000300)={0x58, 0x0, 0x1, 0x304, 0x0, 0x0, {0x5, 0x0, 0x5}, [@CTA_TUPLE_REPLY={0x34, 0x2, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x3a}}, @CTA_TUPLE_ZONE={0x6}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @rand_addr=0x64010100}, {0x8, 0x2, @multicast2}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_STATUS_MASK={0x8, 0x1a, 0x1, 0x0, 0x2}, @CTA_PROTOINFO={0x8, 0x4, 0x0, 0x1, @CTA_PROTOINFO_DCCP={0x4}}]}, 0x58}, 0x1, 0x0, 0x0, 0x2}, 0x40) r5 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) recvfrom(r5, &(0x7f0000000040)=""/18, 0x12, 0x6667b9fe4a5fca3, 0x0, 0x0) getsockopt$inet_sctp_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, 0x0, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x9, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) personality(0x4000009) ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x0, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) syz_emit_ethernet(0x0, 0x0, 0x0) keyctl$dh_compute(0x17, &(0x7f0000000440)={r0, r1, r0}, &(0x7f0000002380)=""/4102, 0x1060, 0x0) 2m37.089268839s ago: executing program 0 (id=854): syz_emit_ethernet(0x6e, &(0x7f0000003580)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x38, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x88, 0x0, 0x0, 0x5, '\x00', @dev={0xfe, 0x80, '\x00', 0x2a}, [{0x2, 0x3, "21c1e05659ae3f48e9296b2beda7add700385601f891"}, {0x2, 0x1, "fef4b66989e6"}]}}}}}}, 0x0) r0 = signalfd(0xffffffffffffffff, &(0x7f0000000080), 0x8) r1 = socket$inet6(0xa, 0x802, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000280)={'vcan0\x00', 0x0}) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000280)={@empty, r3}, 0x14) ioctl$sock_inet6_SIOCSIFADDR(r0, 0x8916, &(0x7f00000000c0)={@mcast1, 0x8, r3}) syz_usb_connect(0x2, 0x62, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000095e7d086d04c308166b0102030109025000010000000009041f0000ff0100000a24010400050201020724070500000508240805040004960d240601010302000100060006092403050503060581092403060103"], 0x0) syz_usb_connect$uac1(0x6, 0xf0, &(0x7f0000000600)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xde, 0x3, 0x1, 0x8, 0x90, 0xd, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xffff}, [@extension_unit={0xd, 0x24, 0x8, 0x6, 0x101, 0x7, "570d394686ac"}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x52, 0x4, 0xf2, 0x2, "d031195a891c8f210f"}, @as_header={0x7, 0x24, 0x1, 0x28, 0xfe, 0x3}, @format_type_ii_discrete={0x9, 0x24, 0x2, 0x2, 0xa7e, 0x3, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x200, 0x0, 0x1, 0x6, {0x7, 0x25, 0x1, 0x80, 0x9, 0xc}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x3e, 0x24, 0x1, 0x6, 0x9, 0x1001}, @format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x9, 0x3, 0x70, 0xc, "dc44e18edd92"}, @format_type_ii_discrete={0x12, 0x24, 0x2, 0x2, 0x7fb, 0x5cd0, 0x0, "464995c97e98710254"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x8001, 0x9, 0xd0, "9ad975a000"}, @format_type_ii_discrete={0xe, 0x24, 0x2, 0x2, 0x21c, 0x6, 0x9, "61042ddf63"}, @format_type_i_continuous={0xe, 0x24, 0x2, 0x1, 0xd, 0x4, 0x0, 0x81, "83e313", "d62e46"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x40, 0x9a, 0xf7, {0x7, 0x25, 0x1, 0x0, 0x2, 0xfff}}}}}}}]}}, &(0x7f0000000580)={0xa, &(0x7f0000000180)={0xa, 0x6, 0x310, 0xf3, 0x0, 0x0, 0xff, 0x7}, 0x34, &(0x7f00000001c0)={0x5, 0xf, 0x34, 0x3, [@ext_cap={0x7, 0x10, 0x2, 0x10, 0x5, 0x9, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "2536e85918c3abaa95a46021e35737ec"}, @ss_container_id={0x14, 0x10, 0x4, 0xa, "d26335c05619627c2c969b1682f8aa33"}]}, 0x4, [{0x5c, &(0x7f0000000200)=@string={0x5c, 0x3, "6499421bffc951d746f941a262fd5308f3725f6cb7077bc78de9995d5ca3934043533cc2d368d6e948be3dfb91fdc1ffc29b4e609a52270afe3c4ee0579cd283f4d1ad5505ab914675c0e621b26f02084c2636a958a03bd0e23b"}}, {0xe1, &(0x7f0000000280)=@string={0xe1, 0x3, "e042886101e3a7ce3aa7f6b4e38f6d0ecf1754d1be28b51e6bd8f6b5328e67c9f996db2648dd049c5c0fd9a79522804227a603f37bfb91404e60a0e7ac5b41f46d7ffd8b1bda8d2a0797f69044d56be7ccd00f5f8595e164755205109c7fe5a8af786d49d9d8027886e1cd69c5e632926a57ba745f211c18a49d2bd5cb3665e2ad6a6ee9a26e7bfc9d2d1af97b144660bdcb52b5c1baf8f91f80e10d8595501ecfd51ed88a21845e7ee687112ac58f54d3698f900c99fae17ab27fad0e18b9b6ef6c8c6f0b7e7c365b1338f712014513bc46333a601996fd44b5c05a6157f7"}}, {0xe5, &(0x7f0000000380)=@string={0xe5, 0x3, "bf1d77970998dcce41579fd423a3cd48f7ea9616f04d73399d48d70cd2205c29e2f0a135044e7aada21c4f676c73576aefa5090d7d455a1dfa14f100566eebefab33c9b5361a6523e9a3761699e3c539662f13aa3d70fa3bacc201e32b7561675b7cd8dbc9323fa61f972b5672ae29f2f87f70f7f51dc5211427e9fe8fe7a63ea6ca14698ff6f8d07ef7086bfdb56ca31605a9cbcde94b4878110223e68dad7feaaf30a1b29445757747d69749a62e3b3d86ee66ee22616b65494d8a7abd0a8b2e09b921f8918a5b49c34c848fd9acbdf2fb021305f053d5d8e1176dbb5eba6a04b1ca"}}, {0xce, &(0x7f0000000480)=@string={0xce, 0x3, "ffb5f22edb2654e587ce2a26cb007359db69383279c03b45602b9219a19f87249022ad119697404ad0d59f6f413d73afb6761d9639bde6e847c03b6e5de98f159c9a9be000457fc8e0ea6b69c3ede7d80a46af8faac0af1a3d587bf3563c8256aff7d6f0c2f1bc4b8afd5bd3b37268467a8575fa0b6b911b3f11c05a1ffd561cee1cc40a3052ac0ac0fbb7a8be04d306a967720b99fa0f2bd69f4eab9febd2a8b08136b816e4b965665be8804286ac2b5ee6c10101d8dbb4801ba105dba791e06bf85429c9e981297a7bf07e"}}]}) 2m36.177477445s ago: executing program 3 (id=859): r0 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000000)=0xc, 0x4) mbind(&(0x7f0000ff6000/0xa000)=nil, 0xa000, 0x4002, &(0x7f0000000000)=0x2, 0x3, 0x0) madvise(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2) mbind(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x2, &(0x7f0000000000)=0x7, 0x37, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000300)=@ipv6_deladdrlabel={0x38, 0x48, 0x1, 0x0, 0x0, {0xa, 0x0, 0x80}, [@IFAL_LABEL={0x8, 0x2, 0x3}, @IFAL_ADDRESS={0x14, 0x1, @loopback}]}, 0x38}}, 0x0) 2m36.113106897s ago: executing program 4 (id=860): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6047, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}}}]}}]}}, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000080)=ANY=[@ANYBLOB="400e160000003607bf44"], 0x0, 0x0, 0x0, 0x0}, 0x0) 2m35.937942298s ago: executing program 1 (id=861): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="5800000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000380012800b0001006272696467650000280002800600060000040000050007000700000005002600010000000c002e000000000001eaff00117f58470b05e8481cbbbb84ff766ca39a3a26ebb04d01752c0a9ed6858c2e0a0db1a12c85a00f05"], 0x58}}, 0x0) (fail_nth: 3) socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[], 0x40}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) shutdown(0xffffffffffffffff, 0x0) accept(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) 2m35.917631016s ago: executing program 3 (id=862): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioprio_set$pid(0x2, 0x0, 0x6000) syz_clone(0x80280, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x6, 0xe, &(0x7f00000001c0)) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x1, 0x14000180, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x3, 0x9, 0x8, 0x6, 0x3}, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000047c0)=ANY=[@ANYBLOB="140000003a00010100000000000204000a"], 0x14}}, 0x0) recvmmsg(r4, &(0x7f0000003780)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)=""/4075, 0xfeb}], 0x1}, 0x2}, {{0x0, 0x0, 0x0}, 0x80d}], 0x2, 0x40010100, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000000)={r5, 0x8}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000400)={r5, 0x6f1}, &(0x7f0000000440)=0x8) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x1f, 0x6, 0x548, 0x2a8, 0xc0, 0x1d8, 0x390, 0x1d8, 0x4b0, 0x4b0, 0x4b0, 0x4b0, 0x4b0, 0x6, &(0x7f0000000280), {[{{@ip={@multicast2, @empty, 0xffffff00, 0xff, 'ip6_vti0\x00', 'team0\x00', {}, {0xff}, 0x0, 0x2, 0x61}, 0x0, 0x98, 0xc0, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x2}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x1a, 0x7}}}, {{@uncond, 0x0, 0xe8, 0x118, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00', 0x0, 0x6, 0x2}}, @inet=@rpfilter={{0x28}, {0x5}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x1000, 0x10, @empty, 0x4e21}}}, {{@ip={@rand_addr=0x64010100, @loopback, 0xffffffff, 0xff000000, 'wg0\x00', 'veth1_macvtap\x00', {}, {}, 0x5e, 0x1, 0x4}, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0xffffffffffffffff, [0x6, 0xc, 0x3, 0x5, 0x4], 0x4, 0x1}, {0x3, [0x1, 0x4, 0x3, 0x4, 0x1, 0x1], 0x2, 0x6}}}}, {{@uncond, 0x0, 0xc0, 0xe8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x6}}, @common=@unspec=@pkttype={{0x28}, {0x3, 0x10}}]}, @TTL={0x28, 'TTL\x00', 0x0, {0x0, 0x2}}}, {{@ip={@multicast2, @dev={0xac, 0x14, 0x14, 0x1a}, 0xff, 0x0, 'xfrm0\x00', 'pimreg0\x00', {}, {0xff}, 0x32, 0x0, 0x4}, 0x0, 0xc0, 0x120, 0x0, {}, [@common=@icmp={{0x28}, {0x11, "33ea", 0x1}}, @inet=@rpfilter={{0x28}, {0x8}}]}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x2, [0x5, 0x6, 0x4, 0x1, 0x4, 0x1], 0x2}, {0x3, [0x4, 0x2, 0x1, 0xc, 0x1, 0x4], 0x5, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x5a8) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) io_setup(0x0, &(0x7f0000000200)=0x0) io_submit(r7, 0x1, &(0x7f0000000040)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, r6, 0x0, 0x0, 0x80000000}]) io_getevents(r7, 0xfffffffffffffff9, 0x6, &(0x7f0000001300)=[{}, {}, {}, {}, {}, {}], 0x0) io_submit(r7, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r6, 0x0}]) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)) 2m35.696311585s ago: executing program 2 (id=863): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x1b) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x600000000000000, 0x0, 0x0, 0x2) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000000)={'bridge_slave_0\x00', 0x401}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x40400, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x24, 0x2, 0x6, 0x5, 0x0, 0x0, {0x5}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}]}, 0x24}, 0x1, 0x0, 0x0, 0x880}, 0x80) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r9 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000600)=[@text16={0x10, &(0x7f0000000080)="360f231b66b80500000066b94d2800000f01d9e32f66b80500000066b9050000000f01c1366566f20f2b5b00ea00908a00baf80c66b8baf0488066efbafc0cb80008ef0f015f023e0fc77e170f07", 0x4e}], 0x1, 0x74, 0x0, 0x0) eventfd2(0x9, 0x80001) r10 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000044082, 0x0) fallocate(r10, 0x11, 0x0, 0x7c000) sendmmsg$inet6(r0, &(0x7f0000000c40)=[{{&(0x7f0000000180)={0xa, 0x4e24, 0x6, @local, 0x4}, 0x1c, &(0x7f0000000200)=[{&(0x7f0000000280)="ab", 0x1}], 0x1}}], 0x1, 0xc851) 2m35.605083562s ago: executing program 1 (id=864): r0 = syz_io_uring_setup(0xcd8, &(0x7f0000000200)={0x0, 0x465e, 0x400, 0x3, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0) io_uring_enter(r0, 0x40f9, 0x217, 0xa5, 0x0, 0x0) 2m34.94240172s ago: executing program 1 (id=865): prctl$PR_GET_TIMERSLACK(0x1e) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000003e000701feffffff00000000017c0000040042800c00018006000600800a0000110002800c00148008001980"], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x2}}, 0x2e) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, r3, {}, 0x2, 0x4}}, 0x26) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000000, 0x7, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) readlinkat(0xffffffffffffffff, &(0x7f00000011c0)='./file0\x00', &(0x7f0000001200)=""/57, 0x39) ioctl$PPPIOCGL2TPSTATS(r3, 0x8004745a, &(0x7f0000000ac0)) r4 = syz_mount_image$fuse(&(0x7f00000021c0), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f0000002200)=ANY=[@ANYRES64=r0, @ANYRESHEX=r0, @ANYRES16=0x0, @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00'], 0x0, 0x0, 0x0) read$FUSE(r0, &(0x7f0000004280)={0x2020, 0x0, 0x0, 0x0}, 0xffffffffffffffe8) write$FUSE_INIT(r0, &(0x7f0000002140)={0x50, 0x0, r5, {0x7, 0x27, 0x0, 0x1dd8a0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0xfffffb96}}, 0x50) read$FUSE(r0, &(0x7f0000000100)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f00000000c0)={@hyper}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r8, 0x7ab, &(0x7f0000000040)={&(0x7f0000000780)={{@host, 0xfed2}, {@hyper}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c51a69bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8babfc02975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f303000000a640f1b04efb38a36e0ed0e2abcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411da80e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e6579c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b97e3f72535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c9"}, 0x418}) syz_fuse_handle_req(r0, &(0x7f0000008680)="b4b53918b2d3e41567caaf4a40bd0070fa730e5c4fb724862048e7f4565a6d7dd766badb0d4f446a32abffbaf736e8009c4633a0be35241f034b99e605c78212f62dccd38e0d148642585a0c519c2625af11e22a47958358b1d1e629f07d8a952d0d38407a20da1f5ead78ee41ca83173efa1406a286d3516b16b7b3261c6e4ff607d43b0d3cd60b7200322b83e1b5c8a63abcd8449aebc454d41c870a5018bb4f482b4d12a1572c2030a20de882f08183df9b17d05710c58e6905303f83f1832ea6badd66602a51b2701480f255dfe99e654b921a46838767704e6684e340567a91baf56e22198ceb2fd40e8a6089807f95f60da4aa4fb16ea127417b6be58ff57e794230f355cc207398463f727e4c18a748ccaf483f6d8b17c6b8b0a808768a03bfc932da5f1cb146ba2f4031c9ed3c6fb3442ee11976a0985a0220ba4ca51e2ed01c0bb76f37871651c9810c49bc8b8ce840649d0317a9a6e2d0c0593374141f09c03db906489bf42c55d81ef58ac1e574b0610b83aea7ea5384e02a8634de887ad5bab898b4e3a0a9c00c33c00fb8d6d54f89875b6ee5cfeb7286bee2af13c39a0fc09f7f96dce4e2d1195ea656772c9fc5a83f5616f88663f2ff95af70f530b8af78450ebd667ad4afb6577688d4eb05840947a6765a82852e0f96f5a670ab450beec5a9ea7ea0e58e05b20a572c0356df64829e948fb6f56b3359a09889b6b6222d0daa37505036165eb46781c63d4e3abbf2a89fc86c6dafe6d26e551d849b5564aa7b926b66b8be9256061aff88831c4f2b3f31ef25e7abe2621cd646a34f7bfb60badac46e368ce46396fdceab56a817a340a9a361e8d3cfccd5fe72c5a49a1349b26ae159f0228ec1ca2de8237c59776140269082e883af459ccdf07cc182ffa675b559a6a54bbac92b227b1229390aded89c007d87af878f46b63c84a9635d9e0d9ec640dc3d0eace492c0f6ede1a544f83067c30dd34fa3f3d464af6d19e5835eb4c47075a5bc82adee6b09375a364c9779d31d2efbcb25a76c90a92712c1df5218778dad0810c45e9ce02c8489a5da8afdbf9a28efdf1d6e5aa058506981bcafbfc532c4deee23da247825cd86793ed338a05681759a50379627801ab59ae5445b10dced5f05c5bc0dba6917b69be731e203b9cd3da1d2ad81abb97df13e68b72a61c434720c6ce29b6c3cb1f4264a12297becb0b2f7c9f28b7c47ee869c6d70611d3ca727454e18eea5ba9154e352b63d81a811a1ca97375531a8ecaf34d77df16d4bb229b57933d93ca4c0ef63191c164eb4a8c505076f49504c2f35f17a1660b3524609bcd14cd14324c50d0060b5b744a8119d964121f8b2cab72b9bac8c93249418e5f2452db5bad960cf256832069f17f556cf42b78c76e5dff113cf017a1a7ddd3a2f8c345f4265f8b19a1d4e38e862ff34c7f273725f7b3c4529247067e2a16c414d8674e5873f1ef9a8d7d2a7452824c3739d93cf5430d546cc88fb39b3750538cd10d80c822c0423fc405c9fde960bfcf5fa6c2cb9ff75067b45d2b082e848d2efab29da850298e274dcfd47e1572f67cbad056c52225fdf01d182627ab2030f675e4ab8c8cb81a978440d38cd8aec8dfab4a436724110f5fe5ee522a43a66a3f7d1b137ddb4c43cda73096d1655f7948cd14f797d8b20bb501ef3e18585408d299c053df5a6f447d93124bac19b2516d591cfbe97e7bfd856b2ca961035cba05e616f0a1b2e242e8cdbd31d160d18c72b8f121e317c5b5f759a1e8bad4462b020fa65339e9f1eead0ec6b01f7a12d65ca764370e3ecc8564fa7bb1479c49f0de1ab8434684d5de2892155d82af075bce5415ad995f459037d078c9617bbcde146218bfed98b8b0b926301ce57e171d15d747d68b5a93fc5034e59d32c8b9e1cc054974d593e891ae00642914babd727f05e06ca32d56b1a9e249bc279a5351e8aa6d17d911fa9d91dd50a22b9fc279d5f9ef47238e3801c8ebda01d15baeaf153b6c25f9f8af7abdd3040e8db71780876a5535cf05aa602a4929d6a314ac704016e6dbcb52e7f460662476fcd353738571c278284e32d90b4499242f668c36b64ed7f7478283ba22b0df04c3f22d6963796b6a0b208dd580609cc4068c837cd405e684ec3f26cbe7992b06c40550a68b78f44b67fcdd50f65e64c1e533eaae93616478695a8f9c9b6045f00bd8b61364f03a336fe1f78f88e16b57a6d43d5670113f715b2f6c37e6caf0d2cae0d129d24fdad02e4b87d9eda94de1c4c351ca15e92d3c0ceae5bd9e2518741362cbf650f33c6f6c89583b23f516d2533b7ec25ad64448d0a51cf13f170cbe1eb9e68a9bb1e7525ad67667561180fbd97bf34f4ad37ab769f3d077c5cea5d7eb320b6e0ecbfe27b5f159073f0b0e0c3d1244467b3a07fd85e893d1bdfa2d97fc161b293b106dbbfdf140d811788c5c221d0449e97a1d4f04d068da6d5c18260cce2f6bd1f0923f2b5881e3a00112f9486a6c6ce67e9cd93547644b8cb1077e395605dc39e90d7e5dae3aebcdc6c7335f181e33304bdcc3a5c7414ae4189a00dba7954807a06d4df6e5481507b809b7035892bc097be0dbf65224e04d36233cb88850a01f6133129920d5639188b3bbb7010bd329889314ca203a34d8a4695d6bd799be617a203b7ac9704aa819e660005d53aa01194682e4326770dd494299815a873d267083ed98163544c1b7e07e39db980afca471d4fb13872f9d863e7679f099192692ba06120df030acbb6be8a09523d7634830d3cb9e82f707933412c6ea84c34c5ba6ab2aecaa3db3f7a655324f77f3c3983836ddf88ee2b5621ab7ebe486ea33d8c140dd4cd221b6375df971ab7d34a73e168c37cad34fb6a41fa0b05feae3c73bb45bdeefb79e94a697aa82e5d655e310b4d8c145a29b41e24db416a29b93a4f2c3f501d8905c9f7d4cb97767de4b86dfa7b4d07aaf7ac5e6bcdda920b1f63564d5fbfc7437b540da0a29c93bf534b5f5f62f51bfecccfcbc9f77b117a7975c1dd3fb01977120834d765e9146862d2fd5f299960a660bbafe19e248b670b89a3b5ca674ebb1e0623890f97dbeb0f75e55e1ef0d045e1c1fc29aab5f0af56a5ac784a01082ed74d8db77f339cbcaaef253ceb6f107bb8e55c52f7f4b6c9b84caafb79d5d13d9b6fc1e75875e45bcef999094774037dde954b0a5c50f28da03b5aafa830d445fe4f4366df423df23d1cdbe902b44bdb4a7f06c1f392b8d097bf09565dc7d80c2024ab4b05cb2f496662dcf293a4472b16588b24e83c0ae0f016640dca2ca122dc413de3e6fd12afc850dc241c8d57ab2fda8a793498796c3a03c191ec31d625e4f8bd8eff538058da874c24e1b4350cfb4664848438fcf082f2db36443cd8c9bba93b3ffee8fdf4ad7d338d179c252e255491d4e41f6268e9ddd8d13e97eee1f7db3c4b51d3adb727a348b174308a9cbff2685654971de6ec06881787b0fe267ffa4c37e41bc6aee1ef2fdec4ed04ab7b6193228d3cac38a2c19228f3970615263a84c253fdc9f16ac9e0122abdfb494a6f04eb806d1d582d3502d7e3c9d758caf91453eef909723c6b8378fe5a69473ed7b22acd7e4cce84a6477c4a23934ee61535c44bfde5f547cc43179217b0087d9a57ed7874737b7e2c1c46a4426fea0655d3f0770d338a1d2999e77aaab58f4d3263e862a446805205ddf032f15a79c6935069114f4f4db6ade52a5569de0a214f3ab79905522f954d4292e2cfafaef546afdf2db396624eb3fd28c35996017edacd17816911b62efdaa72dd35262af71d285d6c5a9c462156d8531e4641e58e55470926e4dfcc1a7ef1a7703c7405f1cd920bf3e85670314b65ea0ca2afcaf54bc344b3f5953f24a2cc6f8ede6417b3af39f90ba1a50f0ba020bbc1543d66d0d61b22e7df64d57b0e7eab7a78781a506df813825b592dcd139321c7b30fb919c623be09dea86018e9e3ce7907894094cb8e315e6a3af6bdaae332eb5b9f4c3442682cb802c79d41f2c7bcec64544b783e81b0625cd04275173663bba8c04d7f52602f41699ad4c677d942184fefb3df9099422b9f97839c2eefdfa47dcca5f9cc5444fcca20e70dc00443f12d76fe2fcd9b4082c94fb8917140d63729fbc507816a981c37938678b3c1c855657b7243bcbdb4149318d9070a22c70035e0560582975df6e5c7d64ae3e8c484f46b26dd4be3475ca63db95366a2d25ba648704b56521744f0d8d8620c82aa26e46c6a73308bc22cb0e943bd572fe30cb40c8a6b45841d186e0a8eede3715f52b03534420c216df694968c78c3bff3dc0414380cb9c44daba0414533552a1bd2c5d98fb466fe07dacf8d894f47c7a8bb7eb204a228ee1b6e0aa2ddb750d2d7c9f270c686b805bc2a81f332672205f17ae8ae9eba7c2a011e80b4fd7778ee1a2d93008a4793a64e294bdcd73f4af0d89d81962d8a91bb66c1776d1c2ae3aa390337cbb2bb2e90a042e1bf67b350d7965aa136f39886bb14b4f645cde5adb7e518a613021bdb72e2a54fc2b1b0129a3b720af5c9a5a6a420585a146bdfe4fb54b85aafa7ea55eba8ac46337e84300d3d2e63ff8d7618037d4dafd5d20796f984a20a553eb6fb3580cada52278c60354604bde6eb4441480c2b3e67184167ca0d1933de04a794a3f178b4b42be5c53790a59495c38a8a164751d661b00a6a6b2f30500905069fc4b73501107291994036be8190cfda78aab1fd6f0eb12c1cb656871f9566b4db21fabc141aad7dd80b942b0758419ca2daec9b8e576e40e6cd7f6af203fe0cb390ad5d77ad82110a99b6ce3d4c1a516a52af2dd1abf4c1231869df26c12af918c319d0fb6e2bc60e159695a284fff4235b49a2097f015a7b0cc4fbafedae3219371e708438bae51b11738dd9f393557b0ab34c3f2488298955b38a62bdd45a3ee8d0bfefdeb099cec4a0d28400a8743f9ae873cc2d403f8873ff6ba4612e5a125886469c676743476c30ae9dd05cbf219352b85e60cada4d298aab7f3029a702f65da044186f23632eca42f989e4863ff299d6408bff0fce8abc8411bb730f6ed173ee8e8fb417ad3cc6d679c0555b59b608a70eda737f1444671b2aec0400663ad761e7b3cc095bffc30b94aa01ac39f93968c7a20891ef385e44613c9b4ebd0fd180311bd03200daa9837e2b10b7d1003b4d9ebde1d83b256b7ca8cc01804f722d7eba5bfb3c88cbd3e8922b6453e734322473d9267b98e5df8806680bb7f9df85cb963ce6245f6c87ada94ea72b5c1b559e2582af33d4353f068d633a27fbc933fe281763d21961f2342190486615a5a9482c0c09944308c8d89d37bbd705dfdcca3334e190171fcea1a297f9b516260c7c8c6a4c14fb2d85d6c2a0ec37310338a27a0f11dd75899c95a149d5cf4c224eb7b4aff8531fb7e625f1a0743a72e89edf09be0f2f1d0bb91f839e328b12ec1e22c460964b1032ded12bb7775091d981e2fa3566d3b55a48250115304548726615c800f433d36918f6e99852964f2a71ee1df288cdc97fddf2da25c625640561a7e1e2263a9d300af98d8432af7c89363d5d114f7b1872e3ed0c77a7792b006f9c8d6c8717f3df53f37df8df3f74e1f1463f2057ff862d11e7e14705ad92e57b1422057ccdf1ded779b1a85b5bbb0978cd4ca793bacc8b037c52a7b5a47aaaf605aa1dd886ea824118f64b89602a2f75a5b658d217aada9d6a5c9d2bdf324e82e649358e5c9ddc1a7d8e50c913ec349791b5475068256eba5ec955f56742e54f78c602389a322814fe5276a314b81ce13e966548c618bf896a259914b3d45a5b6b0d4afd98a31c775d80b2f944e39932bb8a2ba3deb740e07ca2877798e3e391df43c410b4fd4006c8552bbd333ba513aa2e382357619dab1280cd1e9188e801b1791c0256588503eeae4d3435f7d7f3ef3696f9d377640684bae2e08b6685314517d19163bf808e0ed910770db3026257505975e317b6eae79d7fa41938ae49b8e947b24637e57273237d95c3bd6466ac30f3377da79b6255a5c1602c5cf756178b2d7fcfe03807ac4854280417a728b160a6596152be6ad3435a9f70955c54e87fdcd36afd8a62a4d3675525bfb81919223059eec92489c4cc367c252f42d3bc14657a249d657448c2047df03176e4788f29d551fc245d358e9addb9b962640e4a9ff98ccfe09727a2e0711a93b1258ea0eeda14b872be19f57a670f6bf016bf26d63f9f0b3d17a31c8ebfa89c1c850bee54a2853d99d5a7112bfa09558a5dc759268c420f48c29db3f407917927c80b70894c1f6211a4878de0d9472116fab84fcde109065535313c31337164e7682b7b7da546be08a58f240a56c0801a182b57448c484c30acd47ff015f443a99d67aa71157bc514d84c98eaa2fac81e0b488e562dd5adb195f0dad871dcb69334b428daa99842c4251423f0cd53058744b61de8bd4c41a5b2e8cc239a145286a39309d6db5a980f7144ebd915e80b3acd3b1e9ffd4bcca09e3b6c2792372fa7101f64a81f47afa1e1c7f077a9f89a287b8e9668b0c0d43d3c548117fb07e92f081b671cb6a4666d4bf4c5cdc0a36816986ec32f4a77f0d3f04d6abe8e54440282cb06763f650dc59be1f912f6018dec954b0e26efd4ae5298271eb53fb32537c9f32da1eda40299b3e737c8a8dcebd493d5556d22ef3bda6f253a8725bde154d184e3f3ac994ae7d2d7b9b3ca1755f6c6abf08b32a286c5d0fabbe13d926693c446637b9ceee6f8422ca29e819edc455b1683acc86e00c903869acd1f9ad2bc0d42de882aa439b4364fd2ba63d762e7d84b85b93e6818d0d3ff259afd815668de940f93ccd4022c8c4f68713cd2c39c3e8cdbbb1c133f0a8294c1819cd24c71e6fd2e561da4e62ff644fccd54ee2f86bf9b4de378007fb74d2a1b187cc09fc3d9dc34f0c9027e3f1180af208890643d1787f73a87b42ec9111f5b1af37f5c812fbb9f1d1d149b7a97bc83e7e4bd9617bf9630809bddca820e5de57602277871652475e478ecf80c8726c2fb6ef9158a461493262ebd8599c155c8a8e23c8d106234c32f82db61faf464a0a19690aef713f75b2393b7d6618aef66785c6733da01b50092116f3b5b6de225b6eb931dc35b1e6defbeac36a896f621aa2ffac5a550cba0cfcc2b7fa5519167741540b0cc745d10c09130fa6ee57281062cc8bfca1353c92a00fd70bd60f7097c5b7d9b6e9436d99cdc1805af010c407e65807c6003e9fef137e22717571b7e647b65f057b975545c2bca567b1fd01c6da90a81633ae776f67bbac5a5cb711ae86c8248e479f7c5f23c0aa83028dda34935da1607d1215dd39520c39f0dfdf87002feb929bd4d5b9d68eab43ab604e3161f1465a736233f50c74b7eac49fed58e6f9d50f400fb8d25a44c293560093ebe0258281da5ad314aca942ad18d8622884c4a52267f26630ea773ae51475e222ef5db9330c2196e9a89a07d724283015c7aea53c82610dcef66bfc2d3838b97656911cbe7b788bf5a94c045e990cdbec9861bce597aa639c3bf0705eecb8b188c32f69582505751bc5adc17cd469e254c1d81be867603defbcd87c241b81bd9460fc11160b5f7b1768ac21147dba3aac11c42c5d7778696c75f37ab2b9ef2e89efe4d21fe9998fd7e01647e8ccbf28b7f450cf259afc0a1b55e948a98a5f10c1769c2eb2679898b91c73f373480904fe01bf8765594addd7ae6d52b4534cf7e95424f70a027eca378414e1aaa7eb2d138044e9a24428307b7514702ccd66417524f0e602ad035eb5628238b3bb50f2ac74e679540a49de8b9fef95e3cf1e9a01608a8cb82e11f43812243ee460ecb4607ec8cf252c7f39a097754228bcf28f90484f25cb8ed9cf454db5fcb49fa4686065e7f9b11fc4bafed171a59063e5976a006142c318d3ed5bb9e2002f9536b2caf1de0eda879ac7be473303ea1bdad1782b3515cc03b7695f06b08e32f23ded1c4da2c856c7e22e76f22c16aa83dfc4ed9bbe2e716a2175662f2dfddfcbd0566fddfae19955ca9598faffcd264fe4df8b74804d605ac79eba2b3cf52ea90ae6d679505317f5d522567aaccef3840c00fb4609758793e939e145c0eed8261b233f9fa33a62a167b48ce4398ca3a7b9a207b4286b2d50cb979837116edce3df04d84d497f3da2196272861d054b31959585fa1656e676102717ed9c1986c39e95aa314c2d289cf3cbcab6cd77da44bf1e1651b5134297607436154f6006b8aa5b768a1d4e65cb47ac199a005942c533904895e879c41bf2d957a8242ebe78c61e1c3eb583bac58f14d7d2f4d724958759a228ab111afc2e8460485f1a28125be09916c071a83d01766fcb02edc66bbba443bd5a5143cf43d7d7c3068aafb75fcc6d4f48a3b61bcdcdb156af7cea988d59299f474306aedad66b36cc6c9190324991639068a4c098b75b82975100a0669f57c28a765e6770fc8b029bc13cadbeb822cf6256fcf00d45afe4c083a8c75495132471b3240c213fa4a32c224962c061a658735df6195ae6fd817fcaf92bf4a08b747bfbe6c63ad28ee689805d5446839745718ba03143f7d57530407cc3bb77f9df28562f97573b5fefa8782fb571d2ae6b3b57576ad7dbe95a957c3d7d0a2f7067702feb792a0d1eabc2b414a3b7d0053f0f4c741dfa8e79373e07edcd12d77ea6bb7db1ccb9b736fc01e9380149e7d86af7d03d8a35cf1be59a77d72a91fc38d84c8c0071fc56b425b7b78d7ac41c1a2ba71b71087a32b9596896ee954ec9dcce920bcc9a0929779366cf12115b485b079e11daa176991dae4aa6887c61ba64d6795c7c5c29e7be1c10ca533e9d82ecfa9ad13e3095e7feb71946451c729c43e0ede3b12e757364ddd2a05f791dc4730e061b18eea1ca3a946052623e325be62695e3a8cdb805022a769e73f412cb19ebc783f1bbf8814d2bb57d14696531d990cb092f996b253da664187697f6fb079d099af7975be42f896c4c1fd9577986c6c658a8230260030ab962501c71e26cc9e6bdc204eb9c833ba10df5aa394dda1b95f5b29445126c0550c4db7c62bd08cac3e40aa598747e0473ec2de72f60399d8e3a67adfe7be46b559130818608864626b257482e15e0b48f0a8cb10b1cb1f2a56b3763e1d1daed78271fb4b36af882524cc14baed0fc7c6a8b54997afd70f618a91e0925d6e16cb872b8d45d0ad1254821998dd299b2b0f9e7360ee2d130375bdea082186dbaf531c8fda4d8dfeb9c84a40f7eec26ca044acd38dcd24753ca511cb9f3b50cf0f6f101f2a477d3cf769f4aa431850397997b874eda836a9d945225fb62b88393e8fce22ac31187f13bf7b8092cdf0b1a0e2a0cdfcb2d1a1f79502d9728d6f0875baba5aee04afdc20a14cc720309fff182c5a29e54bd0d56d8b5cd73fcd76a831ccc0e623c3dc0935ba74636f68c1a97ac55dd9886f45c8c3110f37b51e0e864167c93919fb9cdcb74f4e5a53f89e7c689d7831e4aa0f66ff666022b71453cb1b37893ae4491004bc13f198921f25b0918f565e4228c3201b3f004198b02d5dd0e55a29cae81536878d6563343c841cc7be49fad4ac095d31db1489385d486bf7a7877520a2b0d0cd752cce72ac4d1b7139c205e4c6eb59e8da8514e08a863ca30d36cee84252d4ee1dc2bce208cd2ab4b9d897e545edcaa48d30ba6de29331fb863dec5dc6d706528758066815aa73aad2f320e9d6f6568ef2fb8d67e9043d8fcae8985fd8fa0182584791c48e30184f7ae1de3e14c311467edcd9a2a180c1a781149a6a12fc6e92e6ca7897c8e24963889d067c77e07615e64c6df922bc9b0fbc4cc659f81fbf985cc188ad7460071c0628c7cf909409491cdad08b7af9ce28ffc379f902d1dc046b42807071dd87852c16e4de7826b2bd1c6f1adce346e6069ddc0e256df950cc5980ab9b20f80da40ea8399bc1ebae0e6b34df431bfbcbd121d2511235346dc09c00890c19bc54b3e74f5286d16dcffa2328a30c8fcafcf3f3aabd511a76737f0da79acecd994d034bc38066981a613679afa24f4076e4f63be566ddb5f2001f26a6c897967ebf4099f99ddb8bd9db7b0f716127eef059c7c662cd6e76d5af1fd932f37c2a56a5823b9d7565844e36a79424e6cc145e40885f990b25bb50ba7b3a2920f1f2dafa595ff50243a1bbd6b3b54581a31f0120d832aa4a3794f6f4359066df3bead35c7eb08949792a9a17559b3633151d7cd5c1d76117cb7e6db5ab95e4fa002a7911fb8328a8c4c9d83f676143824ee61a0e5346123aa8bb815c6c317fdf839e8cc0ab6476657d6b35bd62db9136c9aaa63a756e47c135389ea2fd5cc587d8e19864694952b6fb229c34d420bfb89e60e4d88b3d22339c96d52ae3ecbcbbc231405b8b4a52ede6143b91b37f4e3f4bfc2b69335d758e687bcea1ef9bdce4dfd45c3ea33f35b913e61324db34b0df26e0017566c80e193f8b5ca650a8dde30d750a619289cc469459d0be89a4ed127d0267f9b2b90a86b8b7593c546a5007ef9a3f12f961f77f511386f448abf496028424d680964c53c81aa80d5d0cbbad964d93acf3cb5394202dea85e6311ecec93f2863266748e922742c1c709c2cfac24535cc50a3b59f2b8e90b333876e869b81ec21930f1d93bac1386a2532d9da4b302f7e97f04c8eb188319642b89e78013f3a9c7df82bcf5d9d2ace1923633eaa2ab1c2409e351752c941e7bfd72d5002d1b0c0632cc34bb8ccfea1a017a130297be76a04a22201acc34993465306989f081747f96858785ae06407eb332aea5f430ad078db97114f5429dd0c237b2000db9f2e5f759048ef4754d3c1dcbebcf9e235b55db61b94ebad5b57ca784bea73d771fe553c461e610acd4fcb303ebce016506a457539701ed2198fb6040da048667e364ddfc7d5354314a61bef738c2c8044656f793427dfa1f5241dcf6de39c86a65a735598c10bf6dd095f18249af81fe4ab9fc4ddae6d70aad3b19583f90f2086be2ceaaedb5b7b490bee5ca76079767c4680891260357697eb206bb47cfa4d5007b0423a8423a87d6727a897d963d59bb84c0641a4faf8b5806a4f57795b2700739aa2b50195c07fec7da4d22e7b7ce3ac438cd58715910c6602e399ef16448a3ab117dccabc2e1fb5c5c6328a362cc9c3ab70cdd6e3909dc6e37c69f394067d7f3ec09dcc49edf6273ad2ab5301983f0877b22b8c6a8b7c28f480945c1dddbbc1f37feab72bc0d73e4386340d1bb333fd48a82a2d329c9c80cf1a708ab90b8083c8ba03a1eced74082a93e8ec74a5a421758399dabb4968f0dacbce996c2ef6aa2d7e9374b23b4746ccfbb37b58a6e839e43f9c2d1bdbb466ae4d2ba19d5f199764a94a9565c6adff3d029d73934f32801f236affefe17092b7e3f3aae59e4cfcddccddda7bdd83f4f8db184aca8df943d304d65bb20d2d6498467661198b38c22095ef63182615261d974919bf91f350165042e0902673b373eb2b6daf689d76bb611f90484dfc3199dcbde51f46c2222afda68d53edc5626e643e34c970c846bbd63f2b730e5fb6ea47bb141e45c9be1d73d7ef968ad4b6", 0x2000, &(0x7f0000006f00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002740)={0x78, 0x0, 0x40000000000000, {0x400, 0x8, 0x0, {0x0, 0xffffffffffffff31, 0x80000000, 0x8e1, 0x5, 0xffffffffffffffff, 0x0, 0x4, 0xfffffc01, 0x1000, 0xffffffff, r6, r7, 0xfffffffb, 0x8}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = syz_open_dev$video4linux(&(0x7f0000000040), 0x7fffffffffffffde, 0x460001) ioctl$VIDIOC_SUBDEV_S_FMT(r9, 0xc0585605, &(0x7f0000000080)={0x1, 0x0, {0x0, 0x0, 0x1004, 0x0, 0xa, 0x410}}) lchown(&(0x7f0000000000)='./file0\x00', 0x0, r7) r10 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_S_SELECTION(r10, 0xc040565f, &(0x7f0000000080)={0x2, 0x0, 0x1, {0x7, 0x0, 0xfffffffd, 0x200}}) getxattr(&(0x7f0000004200)='./file0\x00', &(0x7f0000004240)=@known='user.syz\x00', 0x0, 0x0) munmap(&(0x7f0000ffc000/0x4000)=nil, 0x4000) ioctl$FS_IOC_REMOVE_ENCRYPTION_KEY(r4, 0xc0406618, &(0x7f0000002280)={@id={0x2, 0x0, @b}}) 2m33.7951017s ago: executing program 4 (id=866): syz_emit_ethernet(0x2a, &(0x7f00000005c0)={@local, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x3, 0x26, 0x1c, 0x64, 0x0, 0x33, 0x2, 0x0, @remote, @local}, {0x16, 0x8, 0x0, @dev={0xac, 0x14, 0x14, 0x2a}}}}}}, 0x0) r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x800) ioctl$SNDRV_TIMER_IOCTL_PAUSE(r1, 0x54a3) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r2, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r2, 0xc06864a2, &(0x7f00000002c0)={0x0, 0x0, r3, 0x0, 0x80, 0x5, 0x9, 0x0, {0x9, 0xd6, 0x1c, 0xd, 0x5, 0x401, 0xfff5, 0xa, 0x0, 0x52, 0x8000, 0x7e9, 0x401, 0x9aa1, "cb630dab3a0338057401a192419598961f50dc45c87d55a52a28b8f01c0e0e7a"}}) r4 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r4, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f0000000400)={0x0, 0x0, r3}) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f00000083c0)={{0x3}}) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x5422) r5 = socket$alg(0x26, 0x5, 0x0) r6 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000000600)={0x0, 0x0, r7, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r6, 0xc01864b1, &(0x7f0000000440)={r8, 0x487d60c11958e33, 0x4, 0x0, &(0x7f0000000040)}) bind$alg(r5, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[], 0x44}}, 0x8000) r9 = socket$nl_route(0x10, 0x3, 0x0) r10 = socket(0x11, 0x80a, 0x0) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) sendmsg$nl_route(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="780000001000010400"/20, @ANYRES32=r11, @ANYBLOB="60300300001400005800128009000100626f6e6400000000480002802c"], 0x78}}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000040)={0x82cc, 0x0, 0x4}) 2m33.613011522s ago: executing program 0 (id=867): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000700)=@newsa={0x144, 0x10, 0x1, 0x8000000, 0x0, {{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@empty}, {@in=@broadcast, 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x5680000000}, {0x10, 0x9}, 0x0, 0x0, 0x2, 0x1}, [@offload={0xc, 0x1c, {0x0, 0x1}}, @algo_auth={0x48, 0x1, {{'sha256\x00'}}}]}, 0x144}}, 0x0) (fail_nth: 11) 2m33.010922882s ago: executing program 3 (id=868): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'trusted:', 'syz', 0x20, 0xe8c}, 0x2d, 0xfffffffffffffff9) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_update={'update ', 'default', 0x20, 'trusted:', 'trusted:'}, 0x20, 0xfffffffffffffffd) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) syz_emit_ethernet(0x376, &(0x7f00000003c0)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "0300", 0x340, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, [{0x0, 0xa, "a78ce54006598080a8030003004023493b87aafaffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34066d42ca0a5c15b37adac15084dbaf736b41e5af0502"}, {0x0, 0x1, "000005000000000026000400"}, {0x0, 0x18, "fe906d26efe39393fe08f73eabc5977b1190a3a6ad8338f1511cdd10c35d8f6de79fc7fd175f75649fa368a32c829af02d7f44d92324a7051e460a13ddde25a5b85b9d930914625d8a049b4cf0d129806a610ad8477a2499a9a0527f75b655a6653d0363a979acf93f88eea07d68423e90280409de1657275f716a2bf2915d1783e8eb477b0d1170f0ecbdef4c23e1b76e9ab3d2fbe4b34438d2a77577edd0ebed9682b851b380ae0cab282af9d7ebe668177704c5fd4698c934de4731f3f61effc978"}, {0x0, 0x1d, "06aa85616177c61bc943afcb84619755403946b0730a1800c38cf7dcad830f2dc8674b87ba8b58f81ece27975cc39e595e9af90b4fe92a38d25551c2d9ebfc5dfc5a2a501b7e483de3f808895c5f4a1a2367bc591dd8b094822ff0dea07c9a1f643c822a18b79f7c5eba31fb68b2d734a6671e27182aee4df24a4a5cf390dab23b500b0c0272479611e4f7f4299ec4d926d443367b105185e6ecd9602ba95392343e9bbd047ef6bc1ba42399907ccd0a562db212baa39eb8164e240069f656d3a05fed0e94222a141123f5ac010000000000000090aa235a670670ffc5dc49dfb58d00000000000000"}, {0x0, 0xb, "17dcea46805d4809c20547406b18901b0aeff04c0300f3c75dc2d227a83b89483b1084743475671545e65eb2e9ac946a3f0e2bc4619f91394c02bcfbbb7d71138537d68e2d2c6393a9f3becd1a9f51a948b5b303f4f003"}, {0x19, 0x7, "b8a3e10000a3e1030000000900fec0ffff00000000600000ff0bc0fe000000f5ffffff0000000000d9a0274400"/55}, {0x19, 0x11, "3f14f0e74d2d42cfb3f27fafb60845f90b6dfc2e37bc87c6905bbc94d33e1ea71a28105f543e868a8a53b360a9d33e2b1e2eeb1d18065daa7628cf9ef083611c9f6ae2e1eb3d8bf9c6ab2642c4808288e62afbf03269f1f98aea6ab3beb5fdc5fdaabc2c676d8800871a6aa54155dea2d995cb22c9924e0ad38c6967052cc7786d779b8353aac33a57d79b05"}]}}}}}}, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f00000000c0)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x7, 0x4, 0xffff, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x700, 0x10, 0x4, 0x81}}) bind$packet(r0, &(0x7f0000000200)={0x11, 0x3, r1, 0x1, 0x9, 0x6, @local}, 0x14) r2 = socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=@newlink={0x44, 0x10, 0x401, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_LOCAL={0x8, 0x2, @remote}]}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x44}, 0x1, 0xd, 0x0, 0x4000000}, 0x24040050) 2m32.907933488s ago: executing program 0 (id=869): socket$kcm(0x2, 0x200000000000001, 0x106) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[], 0xb4}}, 0x4004) socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) bind$qrtr(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000100)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x10, 0x7fff0000}]}) migrate_pages(0x0, 0x226c, 0x0, &(0x7f0000000680)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc33, &(0x7f0000000280)=0x2) bind$packet(0xffffffffffffffff, 0x0, 0x0) r5 = inotify_init1(0x0) inotify_add_watch(r5, 0x0, 0x400) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000, &(0x7f0000000480)='\x00\xff\xff\x00\x02@qG\xfb\xc5\x94\xa6\x8fB\xc3\x93\xe5\xc1a\x05!\x9a\x8b\xeb\xceJP\x1e\xf2\x8a\xd4\xaa\x15@>\xdb\xab\x06\x1b\xe2w\xd8\x1e\xda\xc1\x9f\xe9\xc4c\xdd\xf6^\xcb\xec\xab\x82\xcf\x14\xde\xa5\xef\x162bP\x95/\xefMs\xe0%}\xe4\xf1=\x05\xf6l7\xc1\xe9c\xc3\x7f\tg\xf56\xeasl\xbd\x02\xc1\x8a\xa9\x83\xaf\xfa\x95W+N$\x06R\x92\xe5Z\x97\xfb\xb6e}fW\x8bm\x04\'{\xaf\xe2zd\x91+-\xb1\xd8\ftK|\xb8\xd2\xb6\x7f\xf4\x84\v\x1e\xe6R\xfc\xbcg\x81\xbb\xc4\xcd\xe9\xe5.\x9b\x7f\xeb\x04\xe6,N\x00\x9a\x9d\xf8\xd1\x8aR4;\x7f\x8a\x86\xb7\xd7o\x90\xfd\xa9dJ\xd5.\x18F2\x00\x00\x00\xf2y\x99\xfd\xca\xff*\xd3;\x84F\x8f !N\x1c\xfaI\xa5\x85:\xc1\x9ed\x13\xaf\xd0/\x00\x9b\x0e\xb6\xca\xa5X\xb9]<\n\x90Tk\xa4\xb3\xc4\xa4*\xc2\xf6\x1bw\n6^\xfa\xea\r\xf1\xc1\xd0\xd8\xc7B\x1cP\x02\xcfH\x89\x82G\xcf\x1921\x9e\v4Q\xc6\x9c\xc3\xfd\xf3Z1\xef7cK\xd5\xdc\xbf\x00\xe0{\xa0\xf7\xcd\x82\xf6\x99\xcb\x1a\x17\x02\xd1\x9d(\xa2 \x85\x8e 6zL\xeeqG\t~\xafQ(\xc3\xd8\x05\xcb\xbfB\xb0\xe1b\x0f\xa8f\xe6\xb1\xe8\x9aB\x90\x00\x00\x00') sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000040000000060a010400000000000000000100000008000b40000000000900010073797a300000000018000480006c61737400000000040002801400000011000100000000946f595d68bed15b0300"/193], 0xc8}}, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x370, 0xffffffff, 0xb0, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x2d8, 0x2d8, 0x2d8, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0xb0, 0x0, {0x100000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@uncond, 0x0, 0xc8, 0x128, 0x0, {}, [@common=@inet=@socket3={{0x28, 'socket\x00', 0x2}}, @common=@unspec=@cluster={{0x30}, {0x4, 0x4, 0x183e, 0x1}}]}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x0, @remote, 0x4ca, 0xb, [0x10, 0x2a, 0x36, 0xe, 0x7, 0xf, 0xb, 0x22, 0x39, 0x12, 0x17, 0x36, 0x6, 0xe, 0xa, 0x10], 0x0, 0xb, 0x681}}}, {{@ip={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'wlan1\x00', 'pim6reg1\x00', {0xff}}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@set={{0x40}, {{0x2, [0x4, 0x4, 0x4, 0x1, 0x4, 0x7], 0x0, 0x2}}}, @common=@ttl={{0x28}, {0x0, 0x40}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3d0) getsockopt$inet_tcp_buf(r1, 0x6, 0xd, 0x0, &(0x7f00000004c0)) syz_clone(0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000400)={'wlan0\x00', 0x100}) 2m32.749006462s ago: executing program 1 (id=870): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) r1 = syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0xa41) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000000200)={"1a00eaff", 0x839, 0x5, 0x2, 0x207fe, 0x0, "0400b7e7a2aac9779bf500", '\x00', "0100", "e8cc1384", ["8b02000000e45cfe00000d00", "abd28640b6c65cbe45e65670", "020000000000000100008000", "17113605e500"]}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x0, 0x0, 'queue0\x00'}) write$sndseq(r0, &(0x7f0000000180)=[{0x0, 0x83, 0x0, 0x0, @tick, {}, {0x1}, @result={0xffffffe0, 0xfffff001}}], 0x1c) write$sndseq(r0, &(0x7f0000000300)=[{0x84, 0x77, 0x0, 0x0, @tick=0x7, {}, {}, @raw8={"18141d895f984f2199e2cd30"}}], 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="440000001000030400"/20, @ANYRES32=r1, @ANYBLOB="0000050011800200240012800b0001006d61637365630000140002800500080003"], 0x44}, 0x1, 0x0, 0x0, 0x4000055}, 0x0) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000340)=ANY=[@ANYRESHEX=r3, @ANYRESHEX=r2, @ANYBLOB="2c726f6f74896f64653d30303002303030303030303030422900003034303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYRES16=r3, @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r2, &(0x7f00000093c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000004200)={0x50, 0x0, r4, {0x7, 0x1f, 0x0, 0x2066012}}, 0x50) r5 = request_key(&(0x7f00000002c0)='id_resolver\x00', &(0x7f0000000400)={'syz', 0x2}, &(0x7f0000000440)='^\x00', 0xfffffffffffffffd) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x3}, &(0x7f0000000380), 0x0, r5) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r8, 0xc0405602, &(0x7f0000000000)={0x51, 0x1, 0x1, "fbe237e7f323890000df4832c30600"}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x448c0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x5, 0x0, 0x3, 0x0, 0x3, 0x40000b, 0x8, 0x50007}, 0x0) syz_open_dev$media(0x0, 0x0, 0x101d01) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r9, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(0xffffffffffffffff, 0x84, 0x1c, &(0x7f0000000040), 0x0) 2m32.741852052s ago: executing program 4 (id=871): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000eaffffff83000040", @ANYRESHEX=r1]) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd0900010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)={@local, @broadcast, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x0, 0x0, 0x0, 0x6, 0x0, @empty, @empty}, {{0x0, 0x4e29, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x16, 0x1}}}}}}, 0x0) 2m32.735302484s ago: executing program 3 (id=872): socket$packet(0x11, 0x2, 0x300) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc0008000500040000001400040073"], 0x58}}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000100)=0x6, 0x4) memfd_create(&(0x7f0000000140)='().\x00', 0x1) sendmsg$inet6(r3, &(0x7f00000000c0)={&(0x7f0000000000)={0xa, 0x4e21, 0xff, @ipv4={'\x00', '\xff\xff', @local}, 0xff}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000002c0)="1f278c64d633", 0x6}], 0x1}, 0x60) syz_emit_ethernet(0x3e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0008000500dc2ec2d5e72345000030000000000002907800000000e000000114009078e0000001a9598e73e3fb5f1f5ec74ce2"], 0x0) syz_emit_ethernet(0x56, &(0x7f0000000b80)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaa00000d04000020230100000013884ededb4d626e51c06be6645ddccfb43d89b69b81662fe56a61d42b0c7a6349e14943ab8f28f8f5671c48f4e159a00e3d65c158b37475f1029ddcf9d24b3258c5b8b362331e4e2c44e7853c2568e04f4a57c537ff5adc021145470d2fa70549b9a6f9964b6c84b84e899f04dcbecb1274a15ee9a2e63a5acb284ebd72b0cffe053e224c3bbc9e3d6d0cbd43b36c5949f6b23e2e015377f3d0e55ac1128a401fba5d394cd2f6883e6f69858a693d6222f8f51c27c630ed959aa9ad"], 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x17, 0x200, 0x6, 0xfffa}, 0x1d, [0x1, 0xc95a, 0xfffffff3, 0xb, 0x80, 0x2, 0xbe3, 0x7f, 0x6, 0x4d, 0x39cc191a, 0x5f, 0x83f, 0x5, 0xffff2d33, 0xffffff01, 0x6, 0x400, 0x0, 0x5, 0x4, 0x7, 0x4, 0x3c5b, 0x1, 0x24, 0x9, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x7fff, 0xb, 0x3, 0x7fff, 0x4c74, 0x80000000, 0x242, 0x3, 0xe, 0x0, 0x71, 0x2, 0x6, 0x3, 0x2002, 0x5, 0x3e, 0x8f, 0x6, 0x6, 0x0, 0x92a3, 0x4, 0x1, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000004, 0x100004, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x9, 0x6c4, 0x1000, 0xc0fe626c, 0x3, 0x0, 0x2007, 0x492e0401, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x4, 0x8000, 0x9, 0x3fe, 0x401, 0x6, 0x1, 0x9c17e9f, 0x5, 0x5, 0x5f31, 0x0, 0x0, 0x2, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x7, 0x8000, 0x1, 0xfe000000, 0xa, 0x2, 0x7f, 0x9, 0x3, 0x3, 0x9, 0x1, 0x7, 0x9, 0x9, 0x48c93690, 0x42, 0x2], [0x4, 0x6, 0x0, 0x5, 0xfffffffa, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x1, 0xb, 0x4, 0x4, 0x5, 0x0, 0x1ef, 0x1, 0x8, 0x86, 0x3, 0x9, 0x3e7, 0x9, 0x5, 0x2, 0x2, 0x3, 0x8, 0x4, 0x8001, 0x9, 0x38, 0x8, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x10, 0x53cf697b, 0x5, 0x6, 0xac8, 0xbf, 0x10002, 0x13, 0x7ff, 0xfffffff9, 0x0, 0x1, 0xffff, 0x0, 0x6, 0x1c, 0x120000, 0x3, 0x6, 0xaaeb, 0x4, 0x8], [0x9, 0xbb31, 0x6, 0xb, 0x5, 0x1, 0x3d9, 0x6, 0x0, 0x5, 0xce7, 0x1ff, 0x2, 0x1000, 0x7, 0x1003, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x806, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0x101, 0x0, 0xffff, 0x3, 0x7f, 0x100, 0x9602, 0xb, 0x2, 0x4, 0x6, 0x4, 0x10080, 0x3, 0x8, 0x30b1d693, 0xa1f, 0x4, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1c, 0x1, 0x200, 0x9, 0xfff]}, 0x45c) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x19) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) ppoll(&(0x7f00000000c0)=[{0xffffffffffffffff, 0xa}, {}], 0x2, 0x0, 0x0, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x8fa94f5447c74de4, 0x1c, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000004000000000000000000000001847000002000000000000000000000005d8050001000000180000000000000000000000ff0f0000b7080000000000007b8af8ff00000000b7080000090000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000003000000b70500000800000085000000a50000009500000000000000950000000000000018120000", @ANYRES32, @ANYBLOB="00000000000000009500000000000000183200000400000000000000000000009500000000000000"], &(0x7f00000009c0)='GPL\x00', 0x7, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000a00)={0x5, 0xb, 0x8, 0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000a40)=[0x1, 0x1, 0xffffffffffffffff, 0x1, 0x1, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0xffffffffffffffff], 0x0, 0x10, 0x7fffffff, @void, @value}, 0x94) setsockopt$sock_attach_bpf(r5, 0x1, 0x32, &(0x7f0000000b40)=r6, 0x4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000000340)={r0}) getsockopt$IP_SET_OP_GET_BYINDEX(r8, 0x1, 0x53, &(0x7f0000000380)={0x7, 0x7, 0x1}, &(0x7f0000000880)=0x28) r9 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r9, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r10, 0x4018aee1, &(0x7f0000000740)=@attr_other={0x0, 0x1, 0x1, &(0x7f0000000180)=0x6}) openat$sw_sync_info(0xffffffffffffff9c, &(0x7f00000001c0), 0x82340, 0x0) syz_io_uring_setup(0x268b, &(0x7f0000000200)={0x0, 0x3fa9, 0x40, 0x1, 0x18e, 0x0, r5}, &(0x7f0000000280), &(0x7f0000000300)) 2m31.069077977s ago: executing program 1 (id=873): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000480)=[@in6={0xa, 0x4e20, 0x0, @loopback}], 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x2c, &(0x7f0000000900)=[@in6={0xa, 0x4e20, 0x0, @loopback={0x102}}, @in={0x2, 0x4e20, @loopback}]}, &(0x7f00000002c0)=0x10) 2m30.431443412s ago: executing program 1 (id=874): r0 = openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x80800, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) unshare(0x6a040000) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f0000003040), 0x0, 0x2043, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x83, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000080)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000180)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r0, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r7, 0xc0383e04, &(0x7f0000000000)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="0106000000000000000009000000240004801300010062726f6164636173742d6c696e6b00000c0007"], 0x38}}, 0x0) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r10, 0x4610, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3000000000351cc445acafd6f7ee746f51c5000808000640000000080800064000000018f400"], 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4060) write$uinput_user_dev(r4, &(0x7f0000000500)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0xcdc, 0x5, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdffffff, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, 0x45c) ioctl$UI_DEV_SETUP(r4, 0x5501, 0x0) ioctl$UI_GET_SYSNAME(r4, 0x8040552c, &(0x7f0000006480)) open_tree(0xffffffffffffff9c, 0x0, 0x89901) 2m26.696438115s ago: executing program 4 (id=875): r0 = syz_io_uring_setup(0xcd8, &(0x7f0000000200)={0x0, 0x465e, 0x400, 0x3, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, 0x0) io_uring_enter(r0, 0x40f9, 0x217, 0xa5, 0x0, 0x0) 2m25.752119589s ago: executing program 2 (id=876): r0 = socket$inet6(0xa, 0x2, 0x0) r1 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) write$uinput_user_dev(r1, &(0x7f00000005c0)={'syz1\x00', {0x1, 0x8, 0xd}, 0xfffffffe, [0x0, 0x0, 0x0, 0xdb, 0x0, 0x0, 0x101, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x47b07c7d, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3, 0x0, 0x0, 0x0, 0xf60d, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0xfffffffb, 0x0, 0x2], [0x0, 0x5, 0x0, 0x0, 0x0, 0xd1, 0x0, 0x80000000, 0x0, 0x0, 0x10000, 0xc157, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x80, 0x5, 0xffffffff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x4, 0x0, 0x0, 0x0, 0xf9, 0x0, 0x0, 0x0, 0x0, 0x6], [0x0, 0xa6d3, 0x3, 0x97aa, 0xfffffffc, 0x101, 0x80002, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x69, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb10, 0x0, 0x0, 0xae5, 0x0, 0x100000, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x400001, 0x0, 0x9, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x70bb], [0x3, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0x0, 0x0, 0x6, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400000, 0x0, 0xfffffffe, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000]}, 0x45c) r2 = dup(r1) ioctl$UI_DEV_CREATE(r2, 0x5501) r3 = syz_io_uring_setup(0xbde, &(0x7f0000000540)={0x0, 0xec25, 0x400, 0x3d, 0x40000337}, &(0x7f0000000dc0)=0x0, &(0x7f0000000a40)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_setup(0x3b, &(0x7f0000000080)={0x0, 0x0, 0x2}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r4, r7, &(0x7f0000000440)=@IORING_OP_OPENAT2={0x1c, 0x0, 0x0, 0xffffffffffffffff, &(0x7f0000000040)={0x101000, 0x81, 0x11}, &(0x7f0000000200)='./file0\x00', 0x18, 0x0, 0x23456}) syz_memcpy_off$IO_URING_METADATA_FLAGS(r6, 0x0, &(0x7f00000001c0)=0x1, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x18) recvmmsg(r0, &(0x7f0000000e00)=[{{0x0, 0x0, &(0x7f0000000980)=[{0x0}, {&(0x7f0000000840)=""/204, 0xffffffffffffff77}], 0x2, 0x0, 0x2a}, 0xa8}], 0x1, 0x2, 0x0) r8 = socket$inet6(0xa, 0x3, 0xe8) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r8, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x800, 0x0, 0x103, 0x1}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) getsockopt$bt_hci(0xffffffffffffffff, 0x0, 0x2, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r9 = getpid() sched_setscheduler(r9, 0x2, 0x0) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r10, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) socket$nl_route(0x10, 0x3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r10, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x3}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r10, 0x84, 0x9, &(0x7f0000000840)={r11, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x614, 0xfffffffd, 0xd, 0x7, 0x4}, 0x9c) syz_emit_ethernet(0x76, &(0x7f0000000300)=ANY=[@ANYBLOB="bbbbbbbbbbbbc6aaaaaaaabb86dd6000021000403a00fe8000000000000000000000000000bbff02fd0000271f000000000000000001040090780000000060b5a439000200fffe880000000000000000000000000101fe8000000000000000000000000000012f11000000000000000004007f300400f02ec0f795d8c13c2b15e8b846c746e09d182f55442b3230e066183804ae34c2d10db7c4a40996a3c5243a410a83bb32552089959cef0b853d667105157cc4e87fb1f38915664cc561468ebe21f89624a0ecac14624e95f8a02100db710c"], 0x0) setsockopt$inet6_int(r8, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4) 2m23.361964983s ago: executing program 0 (id=877): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20}, 0x1c) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @local, 0x2}, 0x1c) r1 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_RECV_OWN_MSGS(r1, 0x65, 0x4, &(0x7f0000000580)=0x1, 0x4) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r4 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r4, &(0x7f0000001900)=[{&(0x7f0000001600)=""/247, 0xf7}], 0x1, &(0x7f0000001e40), 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet_tcp(0x2, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="34000000020605000000000000070000000000000c000300686173683a6970000900020073797a3100000000003978e5b95a781143945a5ef71c4a648653796b12299c42fb21a23480cf5f47d42217c1acb1bb334e2143accf6e000000000000006beccd7eb96f5dd5f1ef1507b51c326164862ce5daf0b2f4648874685a65dd87da902d0c05814364e33bbdbaf4bb784b7ae277a8a4a78e8ab26affea88b326fd8e3513aa95d2b8ddb8d5a83d9c8532bfddded73f6f50eafe4633"], 0x34}}, 0x0) r5 = socket(0x10, 0x803, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0x7}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) r9 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000ec0)=@newtfilter={0x70, 0x2c, 0xd27, 0x70bd27, 0x25dfdbfd, {0x0, 0x0, 0x0, r8, {0xb, 0xfff2}, {}, {0x7}}, [@filter_kind_options=@f_basic={{0xa}, {0x40, 0x2, [@TCA_BASIC_ACT={0x3c, 0x3, [@m_mpls={0x38, 0x1, 0x0, 0x0, {{0x9}, {0xc, 0x2, 0x0, 0x1, [@TCA_MPLS_PROTO={0x6, 0x8848, 0x4}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x20000040) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB="2c000000090601020000000000000000000000000500010007000000100007800c0000000000000000004001"], 0x2c}, 0x1, 0x0, 0x0, 0x10000047}, 0x0) sendmsg$IPSET_CMD_DESTROY(r10, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x4000080) 2m22.993056668s ago: executing program 3 (id=878): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x7, &(0x7f0000000100)=0x4000200, 0x4) setsockopt$packet_tx_ring(r0, 0x107, 0x5, &(0x7f0000000080)=@req3={0x8000, 0x6, 0x300, 0xfc}, 0x1c) ioctl$FIGETBSZ(r0, 0x2, &(0x7f0000000280)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x12, &(0x7f0000000040)=0x80000001, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$netlink(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="e4000000", @ANYRES16=r5, @ANYBLOB="07002abd5248ffdbdf2507ff000008000300", @ANYRES32=r6, @ANYBLOB="0c00990001000c0069000000140004002f6163766c616e3100000000000000000400cc00080005000a"], 0xe4}}, 0x0) sendmsg$NL80211_CMD_CHANGE_NAN_CONFIG(r2, &(0x7f0000000240)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000200)={&(0x7f0000000340)={0x4c, 0x0, 0x400, 0x70bd27, 0x25dfdbfa, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_BANDS={0x8, 0xef, 0x2}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0x9}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xe}, @NL80211_ATTR_BANDS={0x8, 0xef, 0xd}, @NL80211_ATTR_NAN_MASTER_PREF={0x5, 0xee, 0xe}, @NL80211_ATTR_BANDS={0x8}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40000}, 0x44080) sendto$inet6(r1, 0x0, 0x1e, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f00000000c0)="4435c61bc9a1f1ed51c7b06188c682bd59fde0261c9bc2b1f66724ea0287fb6effd2c318abfa442135afa8ca2b68dacbb4a1aa65f9c177dc50967e99edcce6e8900d450fcd9980371cd431b9c1ad0766a9cb142c1ac79715905c856c9e549753967a92c7024ac039", 0xffffffffffffff1d, 0x850, 0x0, 0x0) r7 = bpf$ITER_CREATE(0x21, &(0x7f00000002c0), 0x8) ioctl$sock_inet6_udp_SIOCOUTQ(r7, 0x5411, &(0x7f0000000300)) 2m22.136146091s ago: executing program 4 (id=879): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x800, 0x0) bpf$MAP_CREATE(0xb00000000000000, &(0x7f0000004080)=@base={0x8, 0x4, 0x4, 0xbf22, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd, 0x4, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1004000, 0x0, 0xb49, 0x9, 0x6, 0x0, 0x3}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r3 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000180000000001000000b7080000000010007baa00fe00000000b5080200000000007b8af0ff00000000bf8100000000000007010000a8d5b100bfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000080000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x3, 0x10, &(0x7f0000001e00)=""/4087, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) syz_emit_ethernet(0x3e, &(0x7f0000001200)={@local, @broadcast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x8, 0x0, 0x0, @local, @local, {[@dstopts]}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000440)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b, 0x0, 0x0, 0x0, 0x20000, 0x8, 0x0, 0x0}}, 0x10) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x2, 0x0) sendfile(r5, r5, 0x0, 0x1) 2m17.805156785s ago: executing program 0 (id=880): r0 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x2000000f5, 0x2) r1 = socket(0x29, 0x80805, 0x0) sendmmsg$inet_sctp(r1, &(0x7f00000032c0)=[{&(0x7f00000000c0)=@in={0x2, 0x2000, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="30000000000000008400000001000000000000000c00"/44, @ANYRES8=r1], 0x30}], 0x1, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000400)={0xf0f03f, 0x4}) (async) ioctl$vim2m_VIDIOC_S_CTRL(r0, 0xc008561c, &(0x7f0000000400)={0xf0f03f, 0x4}) 2m13.801750206s ago: executing program 32 (id=874): r0 = openat$hwrng(0xffffff9c, &(0x7f0000000000), 0x80800, 0x0) ioctl$TCGETA(r0, 0x5405, &(0x7f0000000080)) unshare(0x6a040000) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f0000003040), 0x0, 0x2043, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x83, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000080)={0x0, "4fcb813dd28b42bee2b094a3de6dbfd30a74457bcd1cfd5feffe5c019f45d57f", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000180)={"000000149c0286e08ffad43c40fc0a000000ab65a29e23546aad0281b3aff5eb", r0, 0xffffffffffffffff}) ioctl$SYNC_IOC_FILE_INFO(r7, 0xc0383e04, &(0x7f0000000000)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r8, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=ANY=[@ANYBLOB, @ANYRES16=r9, @ANYBLOB="0106000000000000000009000000240004801300010062726f6164636173742d6c696e6b00000c0007"], 0x38}}, 0x0) r10 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_CON2FBMAP(r10, 0x4610, 0x0) sendmsg$IPSET_CMD_LIST(r0, &(0x7f0000000200)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="3000000000351cc445acafd6f7ee746f51c5000808000640000000080800064000000018f400"], 0x30}, 0x1, 0x0, 0x0, 0x4000}, 0x4060) write$uinput_user_dev(r4, &(0x7f0000000500)={'syz0\x00', {}, 0x0, [0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0xcdc, 0x5, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfdffffff, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x55f8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7], [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffffff], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}, 0x45c) ioctl$UI_DEV_SETUP(r4, 0x5501, 0x0) ioctl$UI_GET_SYSNAME(r4, 0x8040552c, &(0x7f0000006480)) open_tree(0xffffffffffffff9c, 0x0, 0x89901) 2m13.719543853s ago: executing program 2 (id=882): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2458a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ACTIVE_SLAVE={0x8}]}}}]}, 0x44}}, 0x40) (fail_nth: 17) 2m13.277092119s ago: executing program 3 (id=883): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000200), 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x6) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f8, 0x0, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x318, 0x20a, 0x278, 0x318, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@loopback, @private1, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181004000000000a1ffffff0000000e000a000d00000002800000121f", 0x2e}], 0x1}, 0x0) socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="211000005200010000000000040000000a0000000c000100feffffff000000008f2cac09f4668a33416408254c80a00280ee38d29b33a63a9f8d9c8aa9026c4df66abd3991b13668ec4e7f4df3ad16ea3b0b6138dfbea9f64b9c2026b92af68089086ee88e72e2b1b567a5a13548bc4d24b3844166b3b7590e0c3ba1b6596eb640df28f1ff406909671d9f903658f8e45091afedd1f40a3422331b585012575dc5883f5144863c26095304ed1ed0d6e645bf564789d51da5ebdf7e12d6577cbcbec6332dcd34522d6a125937027daa3e62533eab06db93c14462c79d53ff1e7d29fa1f454e776938a0a69e8b0aa38de8401d87dd72055337872c8e3f4640529ccefe420f4efd0cd5f4f03122e29082acde840cf109ebddf282583027a414cb4f3580cd8f8bbbe1e79a028312ea30a9e6a1c4f4a81cf1c5be689dfa5d57c6057ae4a651ee7d2c469dd64dae42c9e6ed367e193480ae254b189b1e65a2b2ccd7b55239d0f8f915ca806325ddc4475c34f37873efdf3c8513747dbd0fbe30fc271fee146efb9f8c0ef91879f1b989e880dfdd4fde7661f24c9e92f20290ca934b345960ebdcb4b2886c5488749e", @ANYBLOB="566ab468cc608423465ecf72636a253e28120638486517d064823d90a51083733f8beebebc085dd277e02c9d9f81282892c5149cd8e6a781f61314679aeb3219beb02f8a8fc91c"], 0x20}}, 0x4000044) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011003e236bb40f00a57d30000010203010902"], &(0x7f0000000040)={0x0, 0x0, 0x23, &(0x7f0000000140)=ANY=[@ANYBLOB="040f"]}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x34, 0x24, 0x557fa61d162d184c, 0x100, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x14}, 0x40040) r7 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r7, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef9, 0x0, 0x0, 0x884], [0x1000000], [0xfb]], '\x00', [{0x8001}, {0x0, 0x100}, {0xffffffff}, {0x0, 0x1, 0x0, 0x1}, {}, {0x6}, {}, {}, {0xfffffffc}, {0x0, 0x2}]}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'ipvlan0\x00', 0x0}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r11, @ANYBLOB="08000100", @ANYRES32=r10], 0x90}}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xff25, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[], 0x1c0}, 0x1, 0x0, 0x0, 0x240080d4}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) rseq(&(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x4, 0x5, 0x1, 0x6}}, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) 2m13.128946907s ago: executing program 0 (id=884): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000001300)=""/244, 0xfdef}], 0x1) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000640), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, 0x0, 0x0) r4 = syz_io_uring_setup(0x1e, 0x0, 0x0, &(0x7f0000000680)) r5 = openat$qat_adf_ctl(0xffffff9c, &(0x7f0000000040), 0x4000, 0x0) ioctl$IOCTL_START_ACCEL_DEV(r5, 0x40096102, &(0x7f0000000100)={{}, 0x1}) io_uring_enter(r4, 0x47f6, 0x0, 0x0, 0x0, 0x0) timer_create(0x5, 0x0, &(0x7f00000002c0)) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, 0x0, 0x80c0) fsopen(&(0x7f0000000700)='affs\x00', 0x1) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x200000c, 0x20, 0x0) madvise(&(0x7f000078e000/0x1000)=nil, 0x1000, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001240)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f00000000c0)={0x0}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000001200)={0x0, 0xffffff1e, 0x400000, 0x2810, 0x2, "001bf100eeff0000a2c2000100000000002000"}) ioctl$TCGETS2(r0, 0x802c542a, &(0x7f0000000080)) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x9, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) dup3(0xffffffffffffffff, r0, 0x0) 2m2.322075073s ago: executing program 33 (id=879): r0 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000000)={0xa, 0xe22, 0x0, @empty}, 0x1c) connect$pppl2tp(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mknodat(0xffffffffffffffff, 0x0, 0x800, 0x0) bpf$MAP_CREATE(0xb00000000000000, &(0x7f0000004080)=@base={0x8, 0x4, 0x4, 0xbf22, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0xfffffffd, 0x4, 0x0, 0x0, @void, @value, @void, @value}, 0x50) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1004000, 0x0, 0xb49, 0x9, 0x6, 0x0, 0x3}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r3 = openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000040), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r3, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000a0000180000000001000000b7080000000010007baa00fe00000000b5080200000000007b8af0ff00000000bf8100000000000007010000a8d5b100bfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000080000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x3, 0x10, &(0x7f0000001e00)=""/4087, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) syz_emit_ethernet(0x3e, &(0x7f0000001200)={@local, @broadcast, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "b81923", 0x8, 0x0, 0x0, @local, @local, {[@dstopts]}}}}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000400)={0xffffffffffffffff, 0xe0, &(0x7f0000000b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000440)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4b, 0x0, 0x0, 0x0, 0x20000, 0x8, 0x0, 0x0}}, 0x10) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x2, 0x0) sendfile(r5, r5, 0x0, 0x1) 1m48.733958054s ago: executing program 34 (id=884): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) readv(r0, &(0x7f0000000000)=[{&(0x7f0000001300)=""/244, 0xfdef}], 0x1) r1 = syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008031, 0xffffffffffffffff, 0x0) syz_open_dev$radio(0x0, 0x0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f0000000640), 0x2, 0x141101) r3 = dup(r2) write$6lowpan_enable(r3, 0x0, 0x0) r4 = syz_io_uring_setup(0x1e, 0x0, 0x0, &(0x7f0000000680)) r5 = openat$qat_adf_ctl(0xffffff9c, &(0x7f0000000040), 0x4000, 0x0) ioctl$IOCTL_START_ACCEL_DEV(r5, 0x40096102, &(0x7f0000000100)={{}, 0x1}) io_uring_enter(r4, 0x47f6, 0x0, 0x0, 0x0, 0x0) timer_create(0x5, 0x0, &(0x7f00000002c0)) socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(0xffffffffffffffff, 0x0, 0x80c0) fsopen(&(0x7f0000000700)='affs\x00', 0x1) remap_file_pages(&(0x7f00002ec000/0x200000)=nil, 0x200000, 0x200000c, 0x20, 0x0) madvise(&(0x7f000078e000/0x1000)=nil, 0x1000, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000001240)={'wlan1\x00'}) sendmsg$NL80211_CMD_SET_TID_CONFIG(r6, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f00000000c0)={0x0}) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000001200)={0x0, 0xffffff1e, 0x400000, 0x2810, 0x2, "001bf100eeff0000a2c2000100000000002000"}) ioctl$TCGETS2(r0, 0x802c542a, &(0x7f0000000080)) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x9, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) dup3(0xffffffffffffffff, r0, 0x0) 1m47.871144946s ago: executing program 35 (id=882): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000140)=@newlink={0x44, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2458a}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ACTIVE_SLAVE={0x8}]}}}]}, 0x44}}, 0x40) (fail_nth: 17) 1m42.725142112s ago: executing program 36 (id=883): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe2$watch_queue(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f0000000200), 0x4) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x6) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000840)=@raw={'raw\x00', 0x3c1, 0x3, 0x2f8, 0x0, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x318, 0x20a, 0x278, 0x318, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0xa8, 0xd0}, @common=@inet=@TCPMSS={0x28}}, {{@ipv6={@loopback, @private1, [], [], 'veth1_to_hsr\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz0\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x358) r3 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) r5 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r5, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a181004000000000a1ffffff0000000e000a000d00000002800000121f", 0x2e}], 0x1}, 0x0) socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="211000005200010000000000040000000a0000000c000100feffffff000000008f2cac09f4668a33416408254c80a00280ee38d29b33a63a9f8d9c8aa9026c4df66abd3991b13668ec4e7f4df3ad16ea3b0b6138dfbea9f64b9c2026b92af68089086ee88e72e2b1b567a5a13548bc4d24b3844166b3b7590e0c3ba1b6596eb640df28f1ff406909671d9f903658f8e45091afedd1f40a3422331b585012575dc5883f5144863c26095304ed1ed0d6e645bf564789d51da5ebdf7e12d6577cbcbec6332dcd34522d6a125937027daa3e62533eab06db93c14462c79d53ff1e7d29fa1f454e776938a0a69e8b0aa38de8401d87dd72055337872c8e3f4640529ccefe420f4efd0cd5f4f03122e29082acde840cf109ebddf282583027a414cb4f3580cd8f8bbbe1e79a028312ea30a9e6a1c4f4a81cf1c5be689dfa5d57c6057ae4a651ee7d2c469dd64dae42c9e6ed367e193480ae254b189b1e65a2b2ccd7b55239d0f8f915ca806325ddc4475c34f37873efdf3c8513747dbd0fbe30fc271fee146efb9f8c0ef91879f1b989e880dfdd4fde7661f24c9e92f20290ca934b345960ebdcb4b2886c5488749e", @ANYBLOB="566ab468cc608423465ecf72636a253e28120638486517d064823d90a51083733f8beebebc085dd277e02c9d9f81282892c5149cd8e6a781f61314679aeb3219beb02f8a8fc91c"], 0x20}}, 0x4000044) syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="12011003e236bb40f00a57d30000010203010902"], &(0x7f0000000040)={0x0, 0x0, 0x23, &(0x7f0000000140)=ANY=[@ANYBLOB="040f"]}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f00000000c0)={'gretap0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newqdisc={0x34, 0x24, 0x557fa61d162d184c, 0x100, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_blackhole={0xe}]}, 0x34}, 0x1, 0x0, 0x0, 0x14}, 0x40040) r7 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r7, 0xc2604110, &(0x7f0000000040)={0x0, [[0x9ef9, 0x0, 0x0, 0x884], [0x1000000], [0xfb]], '\x00', [{0x8001}, {0x0, 0x100}, {0xffffffff}, {0x0, 0x1, 0x0, 0x1}, {}, {0x6}, {}, {}, {0xfffffffc}, {0x0, 0x2}]}) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f00000002c0)={'ipvlan0\x00', 0x0}) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r11, @ANYBLOB="08000100", @ANYRES32=r10], 0x90}}, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0xff25, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[], 0x1c0}, 0x1, 0x0, 0x0, 0x240080d4}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) rseq(&(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x4, 0x5, 0x1, 0x6}}, 0x20, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) 1m0.770153565s ago: executing program 6 (id=885): bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="08001c0004000000040000000700000000000000", @ANYRES32, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000e8ffffff00020000000003"], 0x48) 1m0.461915541s ago: executing program 6 (id=889): r0 = syz_io_uring_setup(0xcd8, &(0x7f0000000200)={0x0, 0x465e, 0x400, 0x3, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_RENAMEAT={0x23, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)='./file0\x00'}) io_uring_enter(r0, 0x40f9, 0x217, 0xa5, 0x0, 0x0) 1m0.074107806s ago: executing program 6 (id=890): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x400000, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0) accept$alg(r2, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$tipc(0x1e, 0x5, 0x0) r4 = dup(r3) pread64(r3, &(0x7f0000000080)=""/86, 0x56, 0x7) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) ioctl$KVM_RUN(r5, 0xae80, 0x0) 59.666317092s ago: executing program 8 (id=887): r0 = socket$igmp(0x2, 0x3, 0x2) getsockopt$MRT(r0, 0xffffffa4, 0xce, 0x0, &(0x7f0000000040)) 55.126411035s ago: executing program 9 (id=888): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) prctl$PR_SET_KEEPCAPS(0x8, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x700, 0x4, 0x7f, 0x2}, {0x9, 0x2, 0x40, 0xfffff288}]}) prctl$PR_SET_KEEPCAPS(0x8, 0x1) (async) prctl$PR_SET_KEEPCAPS(0x8, 0x0) (async, rerun: 32) r1 = add_key$fscrypt_v1(&(0x7f0000000080), &(0x7f00000000c0)={'fscrypt:', @desc4}, &(0x7f0000000100)={0x0, "bbe73aa53d1f3f45c3a5196fd195c9d24926c978683d1cc94578584db23176717d4e5eb3f34bdd0de606d4709764f1a26eb22a5a332199444a329298791b92db", 0x39}, 0x48, 0xfffffffffffffff8) (rerun: 32) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000180)='asymmetric\x00', &(0x7f00000001c0)) (async, rerun: 64) r2 = add_key$fscrypt_v1(&(0x7f0000000200), &(0x7f0000000240)={'fscrypt:', @desc3}, &(0x7f0000000280)={0x0, "557dacb67d18b9f20c7071595a131d936552261a01a991ee7ca50d4bc3388b95a2a59c95581f198bbd7a44f0ba38416f048fb8523170c915de9b7148e48b28db", 0x40}, 0x48, 0x0) (rerun: 64) r3 = socket$packet(0x11, 0x3, 0x300) (async) execve(&(0x7f0000000300)='./file0\x00', &(0x7f00000003c0)={[&(0x7f0000000340)='85baa174f0cb1142', &(0x7f0000000380)='asymmetric\x00']}, &(0x7f0000000640)={[&(0x7f0000000400)='asymmetric\x00', &(0x7f0000000440)='{\x00', &(0x7f0000000480)='\xc8)]\xb1\x00', &(0x7f00000004c0)='logon\x00', &(0x7f0000000500)='$(-\x00', &(0x7f0000000540)='fscrypt:', &(0x7f0000000580)='builtin_trusted\x00', &(0x7f00000005c0)='*\\\\\x00', &(0x7f0000000600)='85baa174f0cb1142']}) rename(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)='./file0\x00') r4 = add_key$fscrypt_provisioning(&(0x7f0000000740), &(0x7f0000000780)={'syz', 0x0}, &(0x7f00000007c0)={0x3, 0x0, @b}, 0x48, r1) keyctl$link(0x8, r4, r1) (async) keyctl$clear(0x7, r2) (async) syz_usb_connect(0x0, 0x601, &(0x7f0000000840)={{0x12, 0x1, 0x201, 0x30, 0xdb, 0x46, 0x8, 0x19d2, 0x1062, 0x3743, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5ef, 0x4, 0xf8, 0x8, 0xa0, 0x97, [{{0x9, 0x4, 0xc8, 0x8, 0x5, 0xff, 0xff, 0xff, 0x63, [@hid_hid={0x9, 0x21, 0x2e, 0x0, 0x1, {0x22, 0x3f7}}], [{{0x9, 0x5, 0xa, 0xc, 0x200, 0xff, 0x6, 0x2}}, {{0x9, 0x5, 0xc, 0x0, 0x40, 0x6, 0xf9, 0x96, [@generic={0x2d, 0x5, "f9fdcf7391a2e08270659174b76f21c16d28fcfd3ecf6897195edf1354bf4edaa0e30bd1074fc561698064"}]}}, {{0x9, 0x5, 0xc, 0x1, 0x10, 0x0, 0xa, 0x7, [@generic={0x62, 0x10, "5cd7d876aeccbf5a2239e2ec82ad57417a48bda4fee8e70356b5f07e4391f219b651eed9b6c9a69fed8f6b9336f5883e46faca1e4640565e2d0c5ec9c36ebf65fa94d645137ce9aebe85513dc764ea4267ad987f093580c698463e7cca433164"}, @uac_iso={0x7, 0x25, 0x1, 0x3d304567d9766bf, 0x94, 0x3ff}]}}, {{0x9, 0x5, 0xa, 0x0, 0x3ff, 0xf, 0x88, 0xac}}, {{0x9, 0x5, 0x8, 0x4, 0x10, 0x5, 0x4, 0x1}}]}}, {{0x9, 0x4, 0x50, 0xdf, 0xa, 0xff, 0x2f, 0xa7, 0x7, [], [{{0x9, 0x5, 0x4, 0xc, 0x40, 0x10, 0x7, 0xf8, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x1, 0x7fff}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0xff, 0xe88}]}}, {{0x9, 0x5, 0xb, 0x4, 0x3ff, 0x2, 0x80, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x86, 0x90, 0x7}, @generic={0x31, 0x21, "7993256c8f3b96b72b16f335d4eb741f05447027783bcf8dbb00fa9c2236a4109154792032147a9bf976ca2bc4a155"}]}}, {{0x9, 0x5, 0xc, 0x10, 0x20, 0x8, 0x5, 0x4}}, {{0x9, 0x5, 0xb, 0x0, 0x200, 0x6d, 0x2, 0xa, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xff, 0x3}, @generic={0xb0, 0xf, "114721c4af0c042ed4dcf52d60494219e6edcbee20d38851baaccbff860e458c15c22282966b7f408334919ea17bb801c74903b442b74c52840f89c393010a1da8cd149349f75fbaa452cd9badec8c512fd40697971dccbba7dcf84e5f74acca797d99cf5f181fe25c591df1a338728e7540b4d46f388c7d30e4134545043c5719a55fc90ae0fd5d4c3e3a45bf7b26ebe80c5966e6a563758be94f6646916449b7fc1b688b06409330387b1436e0"}]}}, {{0x9, 0x5, 0x1e770ebeabec58c, 0x0, 0x0, 0x5, 0x6, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0xf7, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x100, 0x9, 0x3ff}]}}, {{0x9, 0x5, 0x1, 0xc, 0x230, 0x87, 0x1, 0x6, [@generic={0xb7, 0x7, "f45468e7a734983bb4a40849c97ada34d8cb8fe74489f77884927c862dd9c9c40688510c2e52a2aef35db3b6d3e3a34c24f2f7acb863656879b6b7197e6509551c21d7d39d34f1fbe04e79d216efc6a2563a5a28aa1e7274b622bd386156437f7b35fc8c2ba37211b6f2c9a80ee0954896eaf04ea7d542cb8aef6795639af753b5e9a9009bd986302de851f37cdecb9fc1ff9cafd416b3102df1fd3d335b8114c5009f369da24c9edb7e21db129b9b0fb28c452c5f"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x8, 0x4, 0x14, 0x3}}, {{0x9, 0x5, 0xc, 0x4, 0x200, 0x3, 0x4, 0xd}}, {{0x9, 0x5, 0x8, 0x10, 0x20, 0x8, 0x80, 0x67}}, {{0x9, 0x5, 0xf, 0x1, 0x0, 0x2, 0xc, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xff}, @generic={0xda, 0x3, "ac0044ec8e3ed9e578a78339f0ca7164e57eeb179ba93699f520cb5d7b20d1ae63b491425b5801a32c5f602ac108a7ccc225e9448a98dec9a1bfed697171961b75a98d82d4e71ac4553f6d60974697438eb1f96bff8063279a6b389f4f0f44ab106e8204125074dd63a985ec9caa21e15179a186501d19459666ad2c9b39ca5f16585a17359e755285c5cc7c8007671b0c5ca0c1d378b7c76587c8fc894821f4df705007820fa4417a8b845d2068b549c250c28af3df00c6bbd7702226092888a13e9bf3665537c3695244beb14581a9ccbac62a9b552379"}]}}]}}, {{0x9, 0x4, 0xc5, 0x6, 0x0, 0xff, 0xff, 0xff, 0x5}}, {{0x9, 0x4, 0xf2, 0x80, 0xf, 0xfc, 0x71, 0xf3, 0x8, [@uac_as={[@format_type_ii_discrete={0xd, 0x24, 0x2, 0x2, 0x3, 0x2, 0x1, "a6b89b1d"}]}], [{{0x9, 0x5, 0x5, 0x0, 0x40, 0x9, 0x3, 0x75}}, {{0x9, 0x5, 0x0, 0x0, 0x8, 0x2, 0x3, 0x10, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0xfb, 0xffff}, @generic={0xa9, 0x21, "015b8b6619edc9e25b9ad610d83e6c781efbd61d3c0f59e3823894f91cbc4caa45e90878641f64e2d940aba0f10226ec1d28c890576ce89dcab503b056aa7d7952a0ecb8f5e4db3b9ed2ab1012061ebf79582e9bb24e1da6e8a54465888b93159e6908754ca148e43b243d4e4e7fab8297aa4070d69ae3027703fc29f52a669f42b629420e866335f9f4bd0bb6a5006a450564d9eafb4f25faf90d1f65d96ab935153f07067964"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x400, 0x9, 0x72}}, {{0x9, 0x5, 0x8, 0x10, 0x8, 0x9, 0x8}}, {{0x9, 0x5, 0x5, 0x0, 0x3ff, 0x80, 0x3, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x6, 0xb, 0x7}]}}, {{0x9, 0x5, 0x6, 0x10, 0x18, 0x8, 0xb1, 0x7}}, {{0x9, 0x5, 0xf, 0xc, 0x10, 0x2, 0xaf, 0xb}}, {{0x9, 0x5, 0xb, 0x3, 0x10, 0x4, 0xb, 0xae, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3, 0x6}]}}, {{0x9, 0x5, 0x80, 0x8, 0x40, 0x9, 0x8, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x80, 0x7}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0xd, 0x7}]}}, {{0x9, 0x5, 0xf, 0x10, 0x400, 0x10, 0x7, 0x19, [@generic={0x7f, 0x23, "ad0e951c070f29edf99a96c11af988352f11fca1a1243176c5049ac9faada19c44d5751aa54fa03ed87ca6ea64a45aa083f895265670863ec95541bd1cd38bcb319213a5605ba7328f71b8390ffd1f7f717880a4406eef13fc057b4076fe19d5c282c5fc872a0eff9f24f378d1e78321221c2dee8fdb9af8f9401a2a91"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x400, 0x1, 0x4, 0x6}}, {{0x9, 0x5, 0xc, 0x1, 0x0, 0x3, 0x3, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f, 0x7}, @generic={0x13, 0x4e, "f9a3724dcd5774404c3ce15b8ed258f550"}]}}, {{0x9, 0x5, 0x0, 0x10, 0x400, 0xf, 0xe, 0xfa}}, {{0x9, 0x5, 0x2, 0x10, 0x8, 0x8, 0x9d, 0x7f}}, {{0x9, 0x5, 0x9, 0x0, 0x3ff, 0x5, 0x4, 0x7f}}]}}]}}]}}, &(0x7f0000001000)={0xa, &(0x7f0000000e80)={0xa, 0x6, 0x110, 0xff, 0x4, 0x4, 0x1f, 0xf9}, 0x39, &(0x7f0000000ec0)={0x5, 0xf, 0x39, 0x2, [@ssp_cap={0x20, 0x10, 0xa, 0x2, 0x5, 0x7, 0xf0f, 0x9, [0x3f00, 0xffc0, 0x7e30, 0xff3f00, 0xfffff0]}, @ss_container_id={0x14, 0x10, 0x4, 0xc1, "96f494f5c5d397e6bc9be2ed3cd2742f"}]}, 0x1, [{0xdc, &(0x7f0000000f00)=@string={0xdc, 0x3, "2bbd732055cba66f753824a862ef0c632ea254e6f34b1d75849d1b640c3e2ad3a90d61f055ca8f3c6ece8cc1248eaf8c71d7129058c3e4f4664b1bd8391806263981d4d66b67b63a1cea59cf7b9089555d60fd2c35c22841e743acb7bbfa019cbe189d962569406e5aba98da6ac58883e08bcad461374daccc726ad193e8b08ce262dfceb5de4a6d95b83b326c83172e6d0c4072c84b2a605360764e297532413779e9b862a9187436398a6b47dc68cc297ebbfb841e9a169bf55b60b64f006fad5c2b94e1a1a326925936d9734f7f58e67d6939b342bbfb2d06"}}]}) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000001040), 0x802, 0x0) ioctl$UI_SET_PHYS(r5, 0x4008556c, &(0x7f0000001080)='syz1\x00') (async) r6 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f00000010c0), 0x200802, 0x0) sendmsg$OSF_MSG_REMOVE(r6, &(0x7f00000018c0)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000001880)={&(0x7f0000001140)={0x710, 0x1, 0x5, 0x5, 0x0, 0x0, {0x0, 0x0, 0x1}, [{{0x254, 0x1, {{0x2, 0x2}, 0x2, 0x6, 0x188e, 0x4, 0x23, 'syz1\x00', "b1557fa52b70547ac04f225faf34345efedbff867219e39b1a7aa456726c06d4", "573af32f11374eba45123cb78cc1f74b9f3f5cde03f6a37861fd4befb579c354", [{0x0, 0x0, {0x0, 0xffffffff}}, {0xb, 0x6, {0x0, 0x1ff}}, {0x6b7, 0x6, {0x2}}, {0x7, 0xff, {0x2, 0xc}}, {0x400, 0x4, {0x3, 0x6}}, {0x6, 0x0, {0x2, 0x4cfe}}, {0xf, 0x8, {0x2, 0x9}}, {0x0, 0xd, {0x0, 0xf1eec501}}, {0x4, 0x9, {0x2, 0x8}}, {0x800, 0x8, {0x3}}, {0x1, 0x6, {0x1, 0x3a}}, {0xffff, 0xd, {0x1, 0xffffffff}}, {0x2, 0x401, {0x3}}, {0x2, 0x4, {0x2, 0x10}}, {0x80, 0x6, {0x2, 0x5}}, {0x9, 0x1a7, {0x2, 0x7fffffff}}, {0xfd11, 0x0, {0x0, 0x101}}, {0x3, 0x3a2d, {0x3, 0x6400}}, {0x2c2e, 0x8, {0x2, 0x80}}, {0x6, 0x8001, {0x1, 0x7fff}}, {0x3, 0x5, {0x1, 0x7f}}, {0x301, 0xffff, {0x3, 0x9}}, {0x1, 0x4, {0x1, 0x6}}, {0x3, 0x3, {0x1, 0xc0e}}, {0x0, 0x3, {0x0, 0x93}}, {0xffff, 0x9, {0x3, 0x6}}, {0x9, 0x8fb4, {0x2, 0x3}}, {0x809e, 0x800, {0x3, 0x6}}, {0x0, 0x400, {0x3}}, {0x7, 0x6, {0x3, 0x8}}, {0x1, 0xf, {0x0, 0x5}}, {0x1, 0x1, {0x0, 0x166}}, {0x100, 0x400, {0x2, 0x4}}, {0x200, 0xf, {0x2}}, {0x8, 0x6, {0x1}}, {0x0, 0x4, {0x1, 0x10001}}, {0x5, 0x31, {0x2, 0x10}}, {0x0, 0x1, {0x0, 0x26ac}}, {0x7, 0x3, {0x3, 0x9}}, {0x800, 0x8001, {0x1, 0x81}}]}}}, {{0x254, 0x1, {{0x0, 0x7}, 0x49, 0x1, 0x0, 0x0, 0x27, 'syz0\x00', "67de89ee9b9108274c103fa624d9dfe457af5f91c28991caf481e0bd44d800e4", "ac1ebd46c7b1668e82dfccd54e7eeeec5e82309d6de41ac670f9e6a4d842396e", [{0x7, 0x7, {0x3, 0xffff}}, {0x5, 0x4, {0x1, 0x8}}, {0x9, 0xe, {0x1, 0x1}}, {0x82c, 0xc8, {0x1, 0x8}}, {0x6, 0x4, {0x2, 0x8}}, {0x0, 0x8}, {0xfdc7, 0x7, {0x3, 0xfffffff9}}, {0x4, 0x4ef2, {0x3, 0xb}}, {0x77, 0x400, {0x3}}, {0x0, 0xfffc, {0x1, 0x8}}, {0x7, 0x3, {0x1, 0x9}}, {0x9, 0x7, {0x1, 0xc48}}, {0x4, 0x5, {0x0, 0x3a}}, {0xffff, 0x200, {0x2, 0x7}}, {0x4, 0x8000, {0x2, 0xc}}, {0x5, 0x2, {0x0, 0x9aa}}, {0x5, 0x3, {0x0, 0x7}}, {0x1, 0x5, {0x3, 0x6fa1}}, {0x5c, 0x10, {0x3, 0x9}}, {0x7, 0x400, {0x0, 0xea9f}}, {0x3, 0x3, {0x3, 0x6}}, {0x9, 0x1, {0x3, 0x480}}, {0x5, 0xf69b, {0x3, 0x1}}, {0x6, 0x4, {0x3, 0xc}}, {0x9, 0x6, {0x2, 0x8000}}, {0x5, 0x4, {0x3, 0xbce0}}, {0x3, 0x4, {0x1, 0x10}}, {0x8, 0x2, {0x2, 0x8}}, {0x4, 0x2, {0x2, 0x3}}, {0x3, 0xee8, {0x2, 0x9}}, {0xe37, 0x3eb, {0x3, 0x9}}, {0xff97, 0xa8, {0x2, 0x1}}, {0x8, 0x45, {0x0, 0xeed}}, {0x3, 0xfffc, {0x5, 0x80000001}}, {0x777, 0xd54, {0x0, 0x6}}, {0x0, 0x1000, {0x1}}, {0x2, 0x7f, {0x0, 0x2}}, {0xb2, 0xff, {0x1, 0x2}}, {0x2, 0x10, {0x2, 0x7acc}}, {0x3ff, 0x2, {0x2, 0x8}}]}}}, {{0x254, 0x1, {{0x0, 0xf}, 0x7, 0x9, 0x1, 0x8911, 0x1, 'syz1\x00', "b189d6d6b689bea26e2289d302a73915c2d6a706bbe035965e8a1deca4693fe2", "18864b33c98e7496fa2b136729c40556babd4e9f1e8ffb1883aba2c926c63d1d", [{0x200, 0x2, {0x2, 0x2}}, {0xb, 0x100, {0x0, 0x1}}, {0x40, 0x100, {0x0, 0x8}}, {0x8000, 0x10, {0x1, 0x6}}, {0x5, 0xfff8, {0x1}}, {0x9, 0x5, {0x3, 0x9}}, {0x7, 0x3ff, {0x3, 0x8}}, {0x3800, 0x2, {0x1, 0x5331eb28}}, {0x78, 0x9, {0x0, 0x5de1}}, {0xa, 0xfb22, {0x0, 0x5a35}}, {0x6, 0xff, {0x1, 0xffff}}, {0xff80, 0x8000, {0x0, 0x8}}, {0x7, 0x9, {0x3, 0x9}}, {0x7, 0x1d, {0x0, 0xd}}, {0x0, 0x9, {0x2}}, {0x2, 0x5e6, {0x3, 0x8}}, {0x200, 0x7fff, {0x3, 0xfffffbff}}, {0x9, 0x7, {0x2, 0x9}}, {0x5, 0x92e, {0x3, 0xeaf}}, {0x0, 0x9, {0x3, 0x5}}, {0xffff, 0xb2e3, {0x1, 0x7}}, {0x2, 0x81, {0x1, 0x5848}}, {0x6, 0x0, {0x3, 0x2}}, {0x0, 0x7, {0x1, 0x1}}, {0x0, 0x2, {0x2, 0xa1bb}}, {0x9, 0xf001, {0x0, 0x9}}, {0x7, 0x7, {0x2, 0x5}}, {0xe79, 0xa, {0x1, 0x6}}, {0xab, 0x0, {0x2, 0x7}}, {0xfff9, 0xc, {0x3, 0x5}}, {0x2, 0x0, {0x3, 0x3}}, {0x97a4, 0xffff, {0x2, 0xffff}}, {0xd, 0x994, {0x3, 0x1}}, {0x8, 0x2, {0x0, 0xffffffff}}, {0xc5d2, 0x101, {0x1, 0xfa}}, {0x8, 0x6, {0x1, 0x5}}, {0x1, 0x400, {0x3, 0x6}}, {0x1a40, 0x4, {0x0, 0x7}}, {0x4, 0x85b, {0x0, 0x6}}, {0x7, 0x7, {0x1, 0x70}}]}}}]}, 0x710}, 0x1, 0x0, 0x0, 0x40040}, 0x4) request_key(&(0x7f0000001900)='rxrpc\x00', &(0x7f0000001940)={'syz', 0x0}, &(0x7f0000001980)='/dev/uinput\x00', r2) (async) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000001a00)={0x8, &(0x7f00000019c0)=[{0x9, 0x5, 0x1, 0x4}, {0x7, 0xf7, 0x6, 0x6}, {0xc522, 0xd, 0x5, 0xdd}, {0x6, 0xfa, 0x5, 0xa}, {0x4, 0x5, 0x7, 0x5}, {0x2, 0x4, 0x21, 0x7}, {0x0, 0x51, 0x9, 0x10}, {0x1000, 0x9, 0xc1, 0x2}]}, 0x10) mprotect(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000005) clock_gettime(0x0, &(0x7f0000001a80)={0x0, 0x0}) utimensat(r6, &(0x7f0000001a40)='./file0\x00', &(0x7f0000001ac0)={{r7, r8/1000+10000}, {0x77359400}}, 0x0) keyctl$KEYCTL_PKEY_VERIFY(0x1c, &(0x7f0000001b00)={r4, 0x28, 0x42}, &(0x7f0000001b40)={'enc=', 'pkcs1', ' hash=', {'blake2s-128-generic\x00'}}, &(0x7f0000001bc0)="f119de006337e2a3883a061f23d2d9f2d928089b6bfcd5444061c26001f6f5791b462650d34c9bbc", &(0x7f0000001c00)="a80ec25cc721e60ac711d7625380a7e6bbe40db9fb44b006e81e079ad878f00f953b940260084b9cea9f41bede5f72d7a6cc6794c2ebc69cdcaa604a04b2dba306b3") (async) keyctl$invalidate(0x15, r1) ioctl$VIDIOC_DBG_S_REGISTER(r6, 0x4038564f, &(0x7f0000001c80)={{0x0, @addr=0x4}, 0x8, 0xe400000000, 0x2}) (async) ioctl$UI_SET_LEDBIT(r6, 0x40045569, 0x3) (async, rerun: 32) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000001d00)={{0x1, 0xf0, 0x3ff, 0x6}, 'syz1\x00', 0x21}) (rerun: 32) 54.876930556s ago: executing program 8 (id=891): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = socket$inet6(0xa, 0x3, 0x4) setsockopt$inet6_opts(r2, 0x29, 0x3b, &(0x7f00000000c0)=@srh={0x89, 0x0, 0x4, 0x0, 0x3, 0x8, 0xc}, 0x8) sendto$inet6(r2, 0x0, 0x0, 0xfffffefffbfbbfbe, &(0x7f0000000100)={0xa, 0x4e20, 0x1, @empty, 0x6}, 0x1c) r3 = dup3(r1, 0xffffffffffffffff, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r4, r0, &(0x7f0000000040)=0x64, 0x23b) r5 = socket$inet(0x2, 0x4000000000000001, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000ac0)="ee", 0x1}], 0x1, 0x0, 0x10b8}, 0x0) recvmsg$kcm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0xfffffd02, 0x0, 0x0, &(0x7f0000000140)=""/55, 0x37}, 0x202) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bind$inet(r5, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) setxattr$system_posix_acl(&(0x7f0000000480)='./file0\x00', &(0x7f00000004c0)='system.posix_acl_access\x00', &(0x7f0000000680)={{}, {0x1, 0x4}, [], {0x4, 0x2}, [{0x20}], {0x10, 0x4}, {0x20, 0x1}}, 0x2c, 0x3) sendto$inet(r5, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r5, &(0x7f00000012c0)='\f', 0x1, 0x0, 0x0, 0x0) io_uring_setup(0x3819, &(0x7f00000003c0)) syz_emit_ethernet(0x3b6, &(0x7f00000000c0)=ANY=[@ANYBLOB], 0x0) 54.599128394s ago: executing program 9 (id=892): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000640)='/sys/power/pm_test', 0x42, 0x0) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r1, 0x1, &(0x7f00000001c0)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r0, &(0x7f0000000080)="0d32818e", 0x4, 0x40000000}]) 53.976284013s ago: executing program 7 (id=886): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x80002, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x3, 0x0, 0x1f) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r3, 0xc0045627, &(0x7f00000000c0)=0x3) syz_io_uring_submit(0x0, 0x0, 0x0) pselect6(0x40, &(0x7f0000000140)={0x3ff, 0x80000000, 0x8, 0x101, 0x9577811, 0x7fff, 0xffffffffffffffff, 0x1}, &(0x7f0000000180)={0x2, 0xffff, 0x10, 0x4, 0x582, 0x7f, 0x5, 0xd}, &(0x7f00000001c0)={0xd, 0x0, 0x5, 0x8, 0x3, 0x100, 0x3, 0x8000}, &(0x7f00000002c0), &(0x7f0000000340)={&(0x7f0000000300)={[0x8]}, 0x8}) io_uring_enter(0xffffffffffffffff, 0x2def, 0x2e0e, 0x0, 0x0, 0xffffffffffffffa2) mkdirat(r2, 0x0, 0x52f875f68df8e9fb) r4 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0xc01, 0x0) write$rfkill(r4, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) syz_usb_connect(0x2, 0x24, 0x0, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000200), 0x4000000004002, 0x0) ioctl$DRM_IOCTL_RM_MAP(r2, 0x4028641b, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, &(0x7f0000751000/0x2000)=nil}) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000007, 0x38011, r6, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000080)='disBard', &(0x7f0000000200)='\x00', 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) syz_clone(0x85240000, 0x0, 0x0, 0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='net/arp\x00') r7 = mmap$IORING_OFF_SQ_RING(&(0x7f000062a000/0x1000)=nil, 0x1000, 0x1000000, 0x12, r6, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES64=r7, @ANYBLOB="08001b"], 0x30}}, 0x0) 53.753393316s ago: executing program 9 (id=893): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000280), 0x40900, 0x0) r2 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4007, @fd_index=0x3, 0x6, &(0x7f0000000580)=""/207, 0xcf, 0x2, 0x1}) io_uring_enter(r2, 0x74d1, 0x4c3, 0x43, 0x0, 0xfffffffffffffd1d) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r1, {0x0, 0xf}, {0x3, 0xffff}, {0x0, 0xfff1}}}, 0x24}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x4c881}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0x8, 0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_CT_STATE_MASK={0x6}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4080}, 0x20000004) r5 = socket$inet6(0xa, 0x2, 0x0) getsockopt$inet6_int(r5, 0x29, 0x50, 0x0, &(0x7f0000000a80)) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x24020400) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0xcc) inotify_rm_watch(r8, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="700000001200030429bd7000e100000000000000", @ANYBLOB="0000000000000000500012800800010067726500440002"], 0x70}}, 0x0) close(r7) r10 = socket$nl_generic(0x10, 0x3, 0x10) getsockopt$sock_int(r0, 0x1, 0xb, &(0x7f0000000080), &(0x7f0000000100)=0x4) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x18, 0x3c, 0x107, 0xfffffffc, 0x0, {0x4, 0x7c}, [@typed={0x4, 0x0, 0x0, 0x0, @binary}]}, 0x18}}, 0xc000) r11 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r7, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000140)={0x101fd, 0x4, 0x2000, 0x2000, &(0x7f0000ffb000/0x2000)=nil}) listen(r11, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xdd, 0x18, 0xb2, 0x10, 0x4e8, 0x6889, 0x779, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0x0, 0x0, 0x1, [{{0x9, 0x4, 0xe3, 0x0, 0x0, 0x53, 0x95, 0x8c}}]}}]}}, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000280)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1a}, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "c105f5", 0x18, 0x6, 0x0, @local, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x6, 0x2, 0x0, 0x0, 0x0, {[@fastopen={0x1e, 0x3, 'U'}]}}}}}}}}, 0x0) 52.338134357s ago: executing program 8 (id=894): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'gre0\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r3, 0x40045402, &(0x7f0000000140)=0x1) r4 = socket$unix(0x1, 0x5, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) semop(0x0, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1) semop(0x0, &(0x7f00000000c0)=[{0x3, 0xa78d, 0x1000}], 0x1) semctl$IPC_RMID(0x0, 0x0, 0x0) connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10) sendmsg$can_bcm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r4, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)={0x1f, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@ETHTOOL_A_WOL_SOPASS={0x31, 0x3, "79fd8807ab9caa92b278d26bb76e16ad8a47d0b47844a47a0efdb594ad8331cb353ea92aa31bb91d5d2bee2c6d"}]}, 0x48}, 0x1, 0x0, 0x0, 0x240048b0}, 0x40c0) sendmsg$can_bcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x4640}, 0x2}, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84242, 0x0) r8 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001ac0)={r7, 0x4000, {0x0, 0x0, 0x0, 0x2ead, 0x7fff, 0x0, 0x0, 0x2000000, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174ff10000000000000010e200"}}) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0910000000000035090100700000000600000003000000bf9800000000000076080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000180)={'tunl0\x00', r2, 0x8001, 0x8, 0x4, 0xffffffff, {{0xa, 0x4, 0x1, 0x2, 0x28, 0x66, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, {[@ssrr={0x89, 0xb, 0x21, [@loopback, @broadcast]}, @rr={0x7, 0x7, 0x6a, [@remote]}]}}}}}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3ff, '\x00', r10, r5, 0x1, 0x1, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r11, 0x1, 0xb, 0x0, 0x0) sendto$packet(r1, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 41.393950743s ago: executing program 37 (id=890): openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x400000, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r2 = creat(&(0x7f0000000140)='./file0\x00', 0x0) accept$alg(r2, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) socket$tipc(0x1e, 0x5, 0x0) r4 = dup(r3) pread64(r3, &(0x7f0000000080)=""/86, 0x56, 0x7) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) ioctl$KVM_RUN(r5, 0xae80, 0x0) 25.15051409s ago: executing program 7 (id=896): r0 = syz_io_uring_setup(0xcd8, &(0x7f0000000200)={0x0, 0x465e, 0x400, 0x3, 0x234}, &(0x7f0000000340)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_RENAMEAT={0x23, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000180)='./file0\x00'}) io_uring_enter(r0, 0x40f9, 0x217, 0xa5, 0x0, 0x0) 22.977665015s ago: executing program 9 (id=897): syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) (async) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r1 = socket$inet(0x2, 0x4000000805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e24, 0x4, @mcast1, 0x3}}}, &(0x7f0000000040)=0x84) (async) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e24, 0x4, @mcast1, 0x3}}}, &(0x7f0000000040)=0x84) listen(r1, 0x7) (async) listen(r1, 0x7) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000180)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)}}) (async) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000180)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)}}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000000380)={0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x100000, 0x0, {0x0, 0x0, 0x0, r9, {}, {0x0, 0xe}, {0x0, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x80082102, &(0x7f0000000240)={r7, 0x1, r6, 0x6}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x80082102, &(0x7f0000000240)={r7, 0x1, r6, 0x6}) r10 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r11 = timerfd_create(0x3, 0x0) timerfd_gettime(r11, &(0x7f0000000100)) r12 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x140, 0x0) epoll_create(0x4000100) (async) r13 = epoll_create(0x4000100) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES64=r6, @ANYRES32, @ANYRES32=r4, @ANYRES32=r5, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES64=r6, @ANYRES32, @ANYRES32=r4, @ANYRES32=r5, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r14, 0x0, 0x0}, 0x20) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r12, &(0x7f0000000300)={0xb0000004}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000095}, 0x4009) 22.562844377s ago: executing program 38 (id=894): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xa006}, 0x4) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'gre0\x00', 0x0}) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000140)=0x8, 0x4) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r3, 0x40045402, &(0x7f0000000140)=0x1) r4 = socket$unix(0x1, 0x5, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) semop(0x0, &(0x7f0000000000)=[{0x3, 0xfff7, 0x1000}], 0x1) semop(0x0, &(0x7f00000000c0)=[{0x3, 0xa78d, 0x1000}], 0x1) semctl$IPC_RMID(0x0, 0x0, 0x0) connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r6}, 0x10) sendmsg$can_bcm(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r4, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$ETHTOOL_MSG_WOL_SET(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)={0x1f, 0x0, 0x800, 0x70bd27, 0x25dfdbff, {}, [@ETHTOOL_A_WOL_SOPASS={0x31, 0x3, "79fd8807ab9caa92b278d26bb76e16ad8a47d0b47844a47a0efdb594ad8331cb353ea92aa31bb91d5d2bee2c6d"}]}, 0x48}, 0x1, 0x0, 0x0, 0x240048b0}, 0x40c0) sendmsg$can_bcm(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0x4640}, 0x2}, 0x0) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84242, 0x0) r8 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) ioctl$LOOP_CONFIGURE(r8, 0x4c0a, &(0x7f0000001ac0)={r7, 0x4000, {0x0, 0x0, 0x0, 0x2ead, 0x7fff, 0x0, 0x0, 0x2000000, 0x4, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174ff10000000000000010e200"}}) r9 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x8, 0xf, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000000000000000000000000000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000008000000bf0910000000000035090100700000000600000003000000bf9800000000000076080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$SNDRV_TIMER_IOCTL_SELECT(r3, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r3, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r3, 0x54a2) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000280)={'syztnl2\x00', &(0x7f0000000180)={'tunl0\x00', r2, 0x8001, 0x8, 0x4, 0xffffffff, {{0xa, 0x4, 0x1, 0x2, 0x28, 0x66, 0x0, 0x0, 0x29, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, {[@ssrr={0x89, 0xb, 0x21, [@loopback, @broadcast]}, @rr={0x7, 0x7, 0x6a, [@remote]}]}}}}}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000380)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x3ff, '\x00', r10, r5, 0x1, 0x1, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r11 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$sock_int(r11, 0x1, 0xb, 0x0, 0x0) sendto$packet(r1, &(0x7f0000000340)="05030006e8fe091c6202a0ffffffff006003000000007f141434e3177f43055762cb80948864113b022543424aa608", 0xfef2, 0x0, &(0x7f0000000a80)={0x11, 0x88a8, r2, 0x1, 0x0, 0x6, @multicast}, 0x14) 22.291742153s ago: executing program 5 (id=881): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x400000, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {@in6=@remote, 0x0, 0x32}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x0, 0x0, 0x7fffffe}, {}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x20}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}]}, 0x138}, 0x1, 0xe}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) ioctl$KVM_RUN(r5, 0xae80, 0xfd7f) 21.573866119s ago: executing program 7 (id=899): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = syz_io_uring_setup(0x4ed, &(0x7f0000000140)={0x0, 0xfec9, 0x0, 0x0, 0x20024c}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x9, 0x0, 0x1, 0x40, 0x1}) io_uring_enter(r2, 0xdb4, 0x0, 0x0, 0x0, 0x0) 2.690485726s ago: executing program 39 (id=899): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r2 = syz_io_uring_setup(0x4ed, &(0x7f0000000140)={0x0, 0xfec9, 0x0, 0x0, 0x20024c}, &(0x7f00000001c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x1, 0x0, 0x0, 0x9, 0x0, 0x1, 0x40, 0x1}) io_uring_enter(r2, 0xdb4, 0x0, 0x0, 0x0, 0x0) 765.715494ms ago: executing program 40 (id=881): openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x275a, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000100)={@local}) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3fd, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd68, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x1, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x400000, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f0000000340)=@newsa={0x138, 0x10, 0x713, 0x0, 0x0, {{@in=@broadcast, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20}, {@in6=@remote, 0x0, 0x32}, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x0, 0x0, 0x7fffffe}, {}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x20}, [@algo_auth={0x48, 0x1, {{'hmac(sha1)\x00'}}}]}, 0x138}, 0x1, 0xe}, 0x10) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r4 = dup(r3) bpf$PROG_LOAD(0x5, 0x0, 0x0) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) ioctl$KVM_RUN(r5, 0xae80, 0xfd7f) 0s ago: executing program 41 (id=897): syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) (async) r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) r1 = socket$inet(0x2, 0x4000000805, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e24, 0x4, @mcast1, 0x3}}}, &(0x7f0000000040)=0x84) (async) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e24, 0x4, @mcast1, 0x3}}}, &(0x7f0000000040)=0x84) listen(r1, 0x7) (async) listen(r1, 0x7) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000180)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)}}) (async) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205647, &(0x7f0000000180)={0xf000000, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000080)={0x98f90e, 0xffffbfff, '\x00', @p_u32=&(0x7f0000000040)}}) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x40000) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, 0x0) (async) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r6, 0xc0502100, &(0x7f0000000380)={0x0}) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x100000, 0x0, {0x0, 0x0, 0x0, r9, {}, {0x0, 0xe}, {0x0, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x800}, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x80082102, &(0x7f0000000240)={r7, 0x1, r6, 0x6}) (async) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r6, 0x80082102, &(0x7f0000000240)={r7, 0x1, r6, 0x6}) r10 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) r11 = timerfd_create(0x3, 0x0) timerfd_gettime(r11, &(0x7f0000000100)) r12 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000002c0), 0x140, 0x0) epoll_create(0x4000100) (async) r13 = epoll_create(0x4000100) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES64=r6, @ANYRES32, @ANYRES32=r4, @ANYRES32=r5, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) (async) r14 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYRES64=r6, @ANYRES32, @ANYRES32=r4, @ANYRES32=r5, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000240)={r14, 0x0, 0x0}, 0x20) epoll_ctl$EPOLL_CTL_ADD(r13, 0x1, r12, &(0x7f0000000300)={0xb0000004}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r10, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000095}, 0x4009) kernel console output (not intermixed with test programs): ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 293.342533][ T8135] RSP: 002b:00007f5707fb4038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 293.342562][ T8135] RAX: ffffffffffffffda RBX: 00007f570a3b6160 RCX: 00007f570a18e929 [ 293.342582][ T8135] RDX: 0000000000000000 RSI: 00000000000847ba RDI: 0000000000000007 [ 293.342594][ T8135] RBP: 00007f5707fb4090 R08: 0000000000000000 R09: 0000000000000000 [ 293.342605][ T8135] R10: 000000000000000e R11: 0000000000000246 R12: 0000000000000001 [ 293.342623][ T8135] R13: 0000000000000000 R14: 00007f570a3b6160 R15: 00007f570a4dfa28 [ 293.342656][ T8135] [ 293.641907][ C0] vkms_vblank_simulate: vblank timer overrun [ 294.336226][ T5873] usb 5-1: USB disconnect, device number 48 [ 294.753136][ T8144] ip6erspan0: entered promiscuous mode [ 294.867569][ T8149] netlink: 28 bytes leftover after parsing attributes in process `syz.0.617'. [ 295.614547][ T5920] usb 4-1: new low-speed USB device number 38 using dummy_hcd [ 295.764559][ T5906] usb 2-1: unable to get BOS descriptor or descriptor too short [ 295.779310][ T5920] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 295.786909][ T5906] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 295.814485][ T5906] usb 2-1: can't read configurations, error -71 [ 295.825655][ T5920] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 295.869020][ T5920] usb 4-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 295.884501][ T5920] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 295.894678][ T5920] usb 4-1: config 0 descriptor?? [ 296.115216][ T8151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.124216][ T8151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 296.149160][ T8151] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 296.158337][ T8151] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 296.286860][ T5920] usb 4-1: string descriptor 0 read error: -71 [ 296.537767][ T5920] input: bcm5974 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/input/input32 [ 296.756121][ T5187] bcm5974 4-1:0.0: could not read from device [ 296.974474][ T5906] usb 2-1: new high-speed USB device number 39 using dummy_hcd [ 297.012140][ T5920] usb 4-1: USB disconnect, device number 38 [ 297.194589][ T5873] usb 3-1: new full-speed USB device number 45 using dummy_hcd [ 297.204085][ T5906] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 297.232785][ T5906] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 297.264165][ T5906] usb 2-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 297.286321][ T5906] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 297.302540][ T5906] usb 2-1: SerialNumber: syz [ 297.381223][ T5873] usb 3-1: config 0 has no interfaces? [ 297.398010][ T5873] usb 3-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 297.414170][ T5873] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 297.429262][ T5873] usb 3-1: Product: syz [ 297.449859][ T5873] usb 3-1: Manufacturer: syz [ 297.458005][ T5873] usb 3-1: SerialNumber: syz [ 297.468295][ T5873] usb 3-1: config 0 descriptor?? [ 297.664633][ T5920] usb 4-1: new high-speed USB device number 39 using dummy_hcd [ 297.804498][ T5920] usb 4-1: device descriptor read/64, error -71 [ 298.125700][ T5920] usb 4-1: new high-speed USB device number 40 using dummy_hcd [ 298.266779][ T8184] loop4: detected capacity change from 0 to 524255231 [ 298.275210][ T5920] usb 4-1: device descriptor read/64, error -71 [ 298.394779][ T5920] usb usb4-port1: attempt power cycle [ 298.492038][ T8185] netlink: 44 bytes leftover after parsing attributes in process `syz.0.628'. [ 298.797385][ T8190] usb usb8: usbfs: process 8190 (syz.4.630) did not claim interface 0 before use [ 298.855089][ T5920] usb 4-1: new high-speed USB device number 41 using dummy_hcd [ 298.887505][ T5920] usb 4-1: device descriptor read/8, error -71 [ 299.126696][ T5920] usb 4-1: new high-speed USB device number 42 using dummy_hcd [ 299.158624][ T5920] usb 4-1: device descriptor read/8, error -71 [ 299.275410][ T5920] usb usb4-port1: unable to enumerate USB device [ 299.402144][ T5906] usb 2-1: 0:2 : does not exist [ 299.465411][ T5906] usb 2-1: USB disconnect, device number 39 [ 299.624502][ T5953] udevd[5953]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 299.696692][ T8192] netlink: 12 bytes leftover after parsing attributes in process `syz.1.631'. [ 300.482177][ T5919] usb 3-1: USB disconnect, device number 45 [ 300.754516][ T5836] usb 4-1: new high-speed USB device number 43 using dummy_hcd [ 301.024480][ T5919] usb 2-1: new high-speed USB device number 40 using dummy_hcd [ 301.034101][ T5836] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 301.064077][ T5836] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 301.101291][ T5836] usb 4-1: Product: syz [ 301.117930][ T5836] usb 4-1: Manufacturer: syz [ 301.141965][ T5836] usb 4-1: SerialNumber: syz [ 301.231184][ T5836] usb 4-1: config 0 descriptor?? [ 301.444668][ T5836] usb-storage 4-1:0.0: USB Mass Storage device detected [ 301.691405][ T8194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 301.703263][ T8209] netlink: 'syz.2.637': attribute type 3 has an invalid length. [ 301.726158][ T8194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 301.838981][ T5836] usb 4-1: USB disconnect, device number 43 [ 302.169844][ T8218] loop4: detected capacity change from 0 to 524255231 [ 302.353118][ T30] audit: type=1800 audit(1750718500.906:105): pid=8222 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.639" name="SYSV00000000" dev="hugetlbfs" ino=6 res=0 errno=0 [ 302.864519][ T5920] usb 4-1: new high-speed USB device number 44 using dummy_hcd [ 303.054749][ T5920] usb 4-1: device descriptor read/64, error -71 [ 303.307550][ T5920] usb 4-1: new high-speed USB device number 45 using dummy_hcd [ 303.377553][ T5906] usb 3-1: new full-speed USB device number 46 using dummy_hcd [ 303.474616][ T5920] usb 4-1: device descriptor read/64, error -71 [ 303.595860][ T5920] usb usb4-port1: attempt power cycle [ 303.601202][ T5906] usb 3-1: config 0 has no interfaces? [ 303.614928][ T5906] usb 3-1: New USB device found, idVendor=045e, idProduct=0284, bcdDevice=a4.8f [ 303.634544][ T5906] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 303.645685][ T5906] usb 3-1: Product: syz [ 303.649885][ T5906] usb 3-1: Manufacturer: syz [ 303.814441][ T5906] usb 3-1: SerialNumber: syz [ 303.834160][ T5919] usb 2-1: unable to get BOS descriptor or descriptor too short [ 303.853894][ T5906] usb 3-1: config 0 descriptor?? [ 303.881259][ T5919] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 303.889190][ T5919] usb 2-1: can't read configurations, error -71 [ 304.204509][ T5920] usb 4-1: new high-speed USB device number 46 using dummy_hcd [ 304.260859][ T8241] netlink: 8 bytes leftover after parsing attributes in process `syz.4.645'. [ 304.275585][ T5920] usb 4-1: device descriptor read/8, error -71 [ 304.313122][ T8233] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 304.371862][ T8233] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 304.540957][ T5920] usb 4-1: new high-speed USB device number 47 using dummy_hcd [ 304.568617][ T5920] usb 4-1: device descriptor read/8, error -71 [ 304.687193][ T5920] usb usb4-port1: unable to enumerate USB device [ 305.723638][ T8251] tipc: Started in network mode [ 305.770300][ T8251] tipc: Node identity 2, cluster identity 4711 [ 305.784541][ T8251] tipc: Node number set to 2 [ 305.807372][ T8251] tipc: Cannot configure node identity twice [ 305.978212][ T8258] loop4: detected capacity change from 0 to 524255231 [ 306.834574][ T10] usb 3-1: USB disconnect, device number 46 [ 307.174704][ T5920] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 307.435534][ T5920] usb 5-1: config index 0 descriptor too short (expected 8192, got 77) [ 307.542600][ T5920] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 307.696483][ T5920] usb 5-1: config 0 has no interfaces? [ 307.764539][ T5920] usb 5-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 307.799733][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.871425][ T5920] usb 5-1: Product: syz [ 307.881779][ T5920] usb 5-1: Manufacturer: syz [ 307.886671][ T5920] usb 5-1: SerialNumber: syz [ 307.945582][ T5920] usb 5-1: config 0 descriptor?? [ 308.074450][ T10] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 308.204466][ T10] usb 3-1: device descriptor read/64, error -71 [ 308.444991][ T10] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 308.744689][ T10] usb 3-1: device descriptor read/64, error -71 [ 308.794556][ T5906] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 308.861306][ T10] usb usb3-port1: attempt power cycle [ 309.004524][ T5906] usb 2-1: device descriptor read/64, error -71 [ 309.214709][ T5873] usb 4-1: new high-speed USB device number 48 using dummy_hcd [ 309.244505][ T5906] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 309.264536][ T10] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 309.285453][ T10] usb 3-1: device descriptor read/8, error -71 [ 309.344782][ T5873] usb 4-1: device descriptor read/64, error -71 [ 309.374579][ T5906] usb 2-1: device descriptor read/64, error -71 [ 309.485049][ T5906] usb usb2-port1: attempt power cycle [ 309.534655][ T10] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 309.556842][ T10] usb 3-1: device descriptor read/8, error -71 [ 309.584568][ T5873] usb 4-1: new high-speed USB device number 49 using dummy_hcd [ 309.664843][ T10] usb usb3-port1: unable to enumerate USB device [ 309.715408][ T5873] usb 4-1: device descriptor read/64, error -71 [ 309.825165][ T5873] usb usb4-port1: attempt power cycle [ 309.834919][ T5906] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 309.856383][ T5906] usb 2-1: device descriptor read/8, error -71 [ 309.920573][ T5920] usb 5-1: USB disconnect, device number 49 [ 310.077086][ T8300] loop4: detected capacity change from 0 to 524255231 [ 310.094579][ T5906] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 310.129406][ T5906] usb 2-1: device descriptor read/8, error -71 [ 310.164570][ T5873] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 310.205280][ T5873] usb 4-1: device descriptor read/8, error -71 [ 310.245277][ T5906] usb usb2-port1: unable to enumerate USB device [ 310.444513][ T5873] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 310.475502][ T5873] usb 4-1: device descriptor read/8, error -71 [ 310.585265][ T5873] usb usb4-port1: unable to enumerate USB device [ 311.246339][ T8313] netlink: 'syz.2.667': attribute type 1 has an invalid length. [ 311.273347][ T8313] 8021q: adding VLAN 0 to HW filter on device bond1 [ 311.295599][ T8313] gretap1: entered promiscuous mode [ 311.303333][ T8313] bond1: (slave gretap1): making interface the new active one [ 311.313538][ T8313] bond1: (slave gretap1): Enslaving as an active interface with an up link [ 311.338363][ T8313] bond1: (slave vlan3): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 311.634798][ T5873] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 311.820750][ T5873] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 311.858068][ T5873] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 311.883072][ T5873] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 311.912973][ T5873] usb 3-1: config 0 descriptor?? [ 311.925826][ T5873] pwc: Askey VC010 type 2 USB webcam detected. [ 311.934971][ T8325] usb usb8: usbfs: process 8325 (syz.1.670) did not claim interface 0 before use [ 312.355786][ T5873] pwc: recv_control_msg error -32 req 02 val 2b00 [ 312.364465][ T5873] pwc: recv_control_msg error -32 req 02 val 2700 [ 312.583232][ T5873] pwc: recv_control_msg error -32 req 04 val 1000 [ 312.696828][ T5873] pwc: recv_control_msg error -71 req 04 val 1300 [ 312.712387][ T5873] pwc: recv_control_msg error -71 req 04 val 1400 [ 312.724132][ T5873] pwc: recv_control_msg error -71 req 02 val 2000 [ 313.393161][ T5873] pwc: recv_control_msg error -71 req 02 val 2100 [ 313.503081][ T5836] usb 4-1: new high-speed USB device number 52 using dummy_hcd [ 313.861852][ T5873] pwc: recv_control_msg error -71 req 04 val 1500 [ 313.999265][ T5873] pwc: recv_control_msg error -71 req 02 val 2500 [ 314.400663][ T5836] usb 4-1: unable to get BOS descriptor or descriptor too short [ 314.413603][ T5873] pwc: recv_control_msg error -71 req 02 val 2400 [ 314.489846][ T5836] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 314.502999][ T5873] pwc: recv_control_msg error -71 req 02 val 2600 [ 314.556004][ T5873] pwc: recv_control_msg error -71 req 02 val 2900 [ 314.563121][ T5836] usb 4-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 314.589268][ T5873] pwc: recv_control_msg error -71 req 02 val 2800 [ 314.771711][ T5836] usb 4-1: config 1 interface 0 has no altsetting 1 [ 314.813731][ T5873] pwc: recv_control_msg error -71 req 04 val 1100 [ 314.873460][ T5836] usb 4-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 314.905348][ T5873] pwc: recv_control_msg error -71 req 04 val 1200 [ 314.956974][ T5836] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 314.985514][ T5873] pwc: Registered as video103. [ 314.990441][ T5836] usb 4-1: Product: syz [ 315.002974][ T5836] usb 4-1: Manufacturer: syz [ 315.010314][ T5873] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input33 [ 315.050529][ T5836] usb 4-1: SerialNumber: syz [ 315.092973][ T5836] smsusb:smsusb_probe: board id=8, interface number 0 [ 315.109937][ T5873] usb 3-1: USB disconnect, device number 51 [ 315.165515][ T8351] loop4: detected capacity change from 0 to 524255231 [ 316.580269][ T8361] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 317.229084][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.236052][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.797286][ T5873] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 317.964626][ T5873] usb 2-1: Using ep0 maxpacket: 32 [ 317.977185][ T5873] usb 2-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 317.994498][ T5919] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 318.014610][ T5873] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 318.076920][ T5873] usb 2-1: config 0 descriptor?? [ 318.109940][ T5873] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 318.144504][ T5919] usb 3-1: Using ep0 maxpacket: 32 [ 318.156730][ T5919] usb 3-1: config 0 interface 0 has no altsetting 0 [ 318.167097][ T5919] usb 3-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 318.176305][ T5919] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.194438][ T5919] usb 3-1: Product: syz [ 318.216739][ T5919] usb 3-1: Manufacturer: syz [ 318.221407][ T5919] usb 3-1: SerialNumber: syz [ 318.258628][ T5919] usb 3-1: config 0 descriptor?? [ 318.676386][ T5919] gs_usb 3-1:0.0: Configuring for 1 interfaces [ 319.317028][ T5873] gspca_vc032x: reg_w err -71 [ 319.322124][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.342256][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.371541][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.394685][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.425253][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.441053][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.451210][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.466871][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.482609][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.492551][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.513127][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.541771][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.567767][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.598350][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.628666][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.655237][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.660641][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.673730][ T5873] gspca_vc032x: I2c Bus Busy Wait 00 [ 319.689109][ T5873] gspca_vc032x: Unknown sensor... [ 319.694826][ T5873] vc032x 2-1:0.0: probe with driver vc032x failed with error -22 [ 319.755855][ T5873] usb 2-1: USB disconnect, device number 46 [ 319.947121][ T5919] gs_usb 3-1:0.0: Disabling termination support for channel 0 (-ETIMEDOUT) [ 320.190568][ T5836] smsusb:smsusb_probe: usb_set_interface failed, rc -110 [ 320.214942][ T5836] smsusb 4-1:1.0: probe with driver smsusb failed with error -110 [ 320.439137][ T5919] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 320.594971][ T5919] usb 2-1: device descriptor read/64, error -71 [ 320.874651][ T5919] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 321.024958][ T5919] usb 2-1: device descriptor read/64, error -71 [ 321.223893][ T5919] usb usb2-port1: attempt power cycle [ 321.267506][ T5497] gs_usb 3-1:0.0 can0: bit-timing not yet defined [ 321.516405][ T10] usb 4-1: USB disconnect, device number 52 [ 321.644529][ T5919] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 321.680489][ T5919] usb 2-1: device descriptor read/8, error -71 [ 321.733398][ T8416] vlan2: entered allmulticast mode [ 321.738761][ T8416] bond0: entered allmulticast mode [ 321.744088][ T8416] bond_slave_0: entered allmulticast mode [ 321.758141][ T8416] bond_slave_1: entered allmulticast mode [ 321.771906][ T8416] bridge0: port 3(vlan2) entered blocking state [ 321.807198][ T8416] bridge0: port 3(vlan2) entered disabled state [ 321.821937][ T8416] vlan2: entered promiscuous mode [ 321.827834][ T8416] bond0: entered promiscuous mode [ 321.832891][ T8416] bond_slave_0: entered promiscuous mode [ 321.839120][ T8416] bond_slave_1: entered promiscuous mode [ 321.935199][ T5919] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 321.978721][ T5919] usb 2-1: device descriptor read/8, error -71 [ 322.114882][ T5919] usb usb2-port1: unable to enumerate USB device [ 322.490731][ T5906] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 322.582481][ T10] usb 3-1: USB disconnect, device number 52 [ 322.644496][ T5906] usb 4-1: Using ep0 maxpacket: 32 [ 322.720688][ T5906] usb 4-1: unable to get BOS descriptor or descriptor too short [ 322.791968][ T5906] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 322.875623][ T5906] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 322.948180][ T5906] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 322.993467][ T5906] usb 4-1: config 128 has no interface number 0 [ 323.003091][ T5906] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 323.017854][ T5906] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 323.028531][ T5906] usb 4-1: config 128 interface 127 has no altsetting 0 [ 323.077717][ T5906] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 323.205469][ T5906] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 323.320895][ T5906] usb 4-1: Product: syz [ 323.434630][ T5906] usb 4-1: Manufacturer: syz [ 323.478503][ T5906] usb 4-1: SerialNumber: syz [ 323.614697][ T10] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 323.799932][ T10] usb 2-1: Using ep0 maxpacket: 16 [ 323.857382][ T10] usb 2-1: config 5 has an invalid interface number: 206 but max is 0 [ 323.913996][ T10] usb 2-1: config 5 has no interface number 0 [ 323.940753][ T10] usb 2-1: config 5 interface 206 has no altsetting 0 [ 323.976551][ T10] usb 2-1: New USB device found, idVendor=1a0a, idProduct=0103, bcdDevice=60.44 [ 323.994503][ T10] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 324.024491][ T10] usb 2-1: Product: syz [ 324.028802][ T10] usb 2-1: Manufacturer: syz [ 324.053822][ T10] usb 2-1: SerialNumber: syz [ 324.280111][ T8447] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 324.330195][ T8447] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 324.437969][ T10] usb_ehset_test 2-1:5.206: probe with driver usb_ehset_test failed with error -32 [ 324.486010][ T10] usb 2-1: USB disconnect, device number 51 [ 325.635992][ T8481] netlink: 'syz.3.706': attribute type 3 has an invalid length. [ 325.722770][ T5906] usb 4-1: USB disconnect, device number 53 [ 325.853574][ T5953] udevd[5953]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 326.728969][ T9] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 327.024450][ T9] usb 2-1: Using ep0 maxpacket: 8 [ 327.174260][ T30] audit: type=1800 audit(1750718525.816:106): pid=8499 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.710" name="SYSV00000000" dev="hugetlbfs" ino=2 res=0 errno=0 [ 327.371330][ T5906] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 327.560448][ T9] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 327.569972][ T9] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 327.621287][ T5906] usb 5-1: Using ep0 maxpacket: 8 [ 327.634868][ T5906] usb 5-1: New USB device found, idVendor=10c4, idProduct=8244, bcdDevice=dc.00 [ 327.682113][ T9] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 327.700864][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.732250][ T9] usb 2-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 327.741463][ T5906] usb 5-1: Product: syz [ 327.741487][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.750481][ T5906] usb 5-1: Manufacturer: syz [ 327.774109][ T5906] usb 5-1: SerialNumber: syz [ 327.796375][ T5906] usb 5-1: config 0 descriptor?? [ 327.804685][ T9] usb 2-1: Product: syz [ 327.809947][ T9] usb 2-1: Manufacturer: syz [ 327.832423][ T9] usb 2-1: SerialNumber: syz [ 327.865566][ T9] usb 2-1: config 0 descriptor?? [ 327.865643][ T5906] radio-usb-si4713 5-1:0.0: Si4713 development board discovered: (10C4:8244) [ 327.947743][ T9] powermate 2-1:0.0: probe with driver powermate failed with error -5 [ 328.009363][ T8514] netlink: 8 bytes leftover after parsing attributes in process `syz.2.714'. [ 328.536748][ T5906] radio-usb-si4713 5-1:0.0: probe with driver radio-usb-si4713 failed with error -71 [ 328.552068][ T5906] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 328.584538][ T5873] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 328.612057][ T5906] usb 5-1: USB disconnect, device number 50 [ 328.754604][ T5873] usb 4-1: Using ep0 maxpacket: 32 [ 328.959692][ T5873] usb 4-1: unable to get BOS descriptor or descriptor too short [ 328.997053][ T5873] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 329.029648][ T5873] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 329.093310][ T5873] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 329.113335][ T5873] usb 4-1: config 128 has no interface number 0 [ 329.125469][ T5873] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 329.228135][ T5873] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 329.272419][ T5873] usb 4-1: config 128 interface 127 has no altsetting 0 [ 329.341072][ T5873] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 329.383708][ T5873] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 329.442994][ T5873] usb 4-1: Product: syz [ 329.460143][ T5873] usb 4-1: Manufacturer: syz [ 329.484528][ T5873] usb 4-1: SerialNumber: syz [ 329.814548][ T5906] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 329.967665][ T5906] usb 5-1: Using ep0 maxpacket: 32 [ 330.039903][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 330.114867][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 330.249329][ T5906] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 330.320393][ T5906] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 330.338856][ T5906] usb 5-1: config 0 descriptor?? [ 330.359205][ T5906] hub 5-1:0.0: USB hub found [ 330.584763][ T5906] hub 5-1:0.0: 1 port detected [ 330.635220][ T43] usb 2-1: USB disconnect, device number 52 [ 331.088297][ T8527] input: syz1 as /devices/virtual/input/input34 [ 331.110685][ T5906] usb 5-1: USB disconnect, device number 51 [ 331.769714][ T5873] usb 4-1: USB disconnect, device number 54 [ 331.862061][ T5953] udevd[5953]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 332.330506][ T30] audit: type=1800 audit(1750718530.956:107): pid=8551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.727" name="SYSV00000000" dev="hugetlbfs" ino=4 res=0 errno=0 [ 333.770210][ T8573] netlink: 1688 bytes leftover after parsing attributes in process `syz.1.733'. [ 334.254714][ T43] usb 3-1: new full-speed USB device number 53 using dummy_hcd [ 334.437803][ T43] usb 3-1: config 0 has an invalid interface number: 230 but max is 0 [ 334.446734][ T43] usb 3-1: config 0 has no interface number 0 [ 334.453238][ T43] usb 3-1: config 0 interface 230 altsetting 2 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 334.465425][ T43] usb 3-1: config 0 interface 230 altsetting 2 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 334.476589][ T43] usb 3-1: config 0 interface 230 has no altsetting 0 [ 334.487198][ T43] usb 3-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 334.496664][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 334.512562][ T43] usb 3-1: Product: syz [ 334.525650][ T43] usb 3-1: Manufacturer: syz [ 334.543795][ T43] usb 3-1: SerialNumber: syz [ 334.601077][ T43] usb 3-1: config 0 descriptor?? [ 334.646239][ T5873] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 334.656067][ T8578] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 334.663307][ T8578] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 334.679441][ T43] ums-usbat 3-1:0.230: USB Mass Storage device detected [ 334.701756][ T43] ums-usbat 3-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 334.754595][ T5920] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 334.784482][ T5873] usb 5-1: device descriptor read/64, error -71 [ 334.985701][ T5920] usb 2-1: Using ep0 maxpacket: 16 [ 335.054483][ T5873] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 335.194467][ T5873] usb 5-1: device descriptor read/64, error -71 [ 335.315069][ T5873] usb usb5-port1: attempt power cycle [ 335.419035][ T8590] netlink: 12 bytes leftover after parsing attributes in process `syz.0.739'. [ 335.452060][ T8591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 335.461213][ T8591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 335.664711][ T5873] usb 5-1: new high-speed USB device number 54 using dummy_hcd [ 335.705478][ T5873] usb 5-1: device descriptor read/8, error -71 [ 335.954834][ T5873] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 336.083890][ T8592] ======================================================= [ 336.083890][ T8592] WARNING: The mand mount option has been deprecated and [ 336.083890][ T8592] and is ignored by this kernel. Remove the mand [ 336.083890][ T8592] option from the mount to silence this warning. [ 336.083890][ T8592] ======================================================= [ 336.150095][ T5873] usb 5-1: device descriptor read/8, error -71 [ 336.265291][ T5873] usb usb5-port1: unable to enumerate USB device [ 337.017848][ T43] ums-usbat 3-1:0.230: probe with driver ums-usbat failed with error -5 [ 337.304773][ T9] usb 3-1: USB disconnect, device number 53 [ 337.790886][ T5920] usb 2-1: unable to get BOS descriptor or descriptor too short [ 337.821797][ T5920] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 337.867960][ T5920] usb 2-1: can't read configurations, error -71 [ 338.163057][ T30] audit: type=1800 audit(1750718536.776:108): pid=8618 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.744" name="SYSV00000000" dev="hugetlbfs" ino=7 res=0 errno=0 [ 340.064068][ T5873] usb 5-1: new full-speed USB device number 56 using dummy_hcd [ 340.257439][ T5873] usb 5-1: config 0 has an invalid interface number: 237 but max is 0 [ 340.265873][ T5873] usb 5-1: config 0 has no interface number 0 [ 340.272307][ T5873] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 10 [ 340.283526][ T5944] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 340.299951][ T5873] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 340.315741][ T5873] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 10 [ 340.328439][ T5873] usb 5-1: config 0 interface 237 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 340.348768][ T5873] usb 5-1: New USB device found, idVendor=045e, idProduct=84bd, bcdDevice=89.be [ 340.358455][ T5873] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.367875][ T5873] usb 5-1: Product: syz [ 340.378902][ T5873] usb 5-1: Manufacturer: syz [ 340.383601][ T5873] usb 5-1: SerialNumber: syz [ 340.465539][ T5873] usb 5-1: config 0 descriptor?? [ 340.474608][ T5944] usb 4-1: Using ep0 maxpacket: 32 [ 340.481991][ T5873] xpad 5-1:0.237: probe with driver xpad failed with error -5 [ 340.502697][ T5944] usb 4-1: unable to get BOS descriptor or descriptor too short [ 340.514514][ T43] usb 3-1: new full-speed USB device number 54 using dummy_hcd [ 340.530651][ T5944] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 340.540035][ T5944] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 340.551568][ T5944] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 340.561034][ T5944] usb 4-1: config 128 has no interface number 0 [ 340.568536][ T5944] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 340.590369][ T5944] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 340.616703][ T5944] usb 4-1: config 128 interface 127 has no altsetting 0 [ 340.630368][ T5944] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 340.639916][ T5944] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.648698][ T5944] usb 4-1: Product: syz [ 340.653065][ T5944] usb 4-1: Manufacturer: syz [ 340.658761][ T5944] usb 4-1: SerialNumber: syz [ 340.676599][ T43] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 340.688345][ T43] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 340.702848][ T43] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 340.714143][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 340.722767][ T43] usb 3-1: SerialNumber: syz [ 340.751331][ T43] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 340.762760][ T43] usb-storage 3-1:1.0: USB Mass Storage device detected [ 340.781065][ T43] usb-storage 3-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 340.793482][ T43] scsi host1: usb-storage 3-1:1.0 [ 341.313990][ T8652] netlink: 'syz.2.754': attribute type 10 has an invalid length. [ 341.351428][ T8652] netlink: 40 bytes leftover after parsing attributes in process `syz.2.754'. [ 341.466102][ T8652] team0: Port device geneve0 added [ 341.505469][ T5944] usb 4-1: USB disconnect, device number 55 [ 341.581226][ T5953] udevd[5953]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 342.242713][ T8661] FAULT_INJECTION: forcing a failure. [ 342.242713][ T8661] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 342.310223][ T8661] CPU: 0 UID: 0 PID: 8661 Comm: syz.0.758 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 342.310250][ T8661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 342.310261][ T8661] Call Trace: [ 342.310268][ T8661] [ 342.310276][ T8661] dump_stack_lvl+0x189/0x250 [ 342.310310][ T8661] ? __pfx____ratelimit+0x10/0x10 [ 342.310336][ T8661] ? __pfx_dump_stack_lvl+0x10/0x10 [ 342.310362][ T8661] ? __pfx__printk+0x10/0x10 [ 342.310396][ T8661] should_fail_ex+0x414/0x560 [ 342.310425][ T8661] _copy_to_user+0x31/0xb0 [ 342.310446][ T8661] simple_read_from_buffer+0xe1/0x170 [ 342.310470][ T8661] proc_fail_nth_read+0x1df/0x250 [ 342.310494][ T8661] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 342.310519][ T8661] ? rw_verify_area+0x258/0x650 [ 342.310543][ T8661] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 342.310567][ T8661] vfs_read+0x1fd/0x980 [ 342.310599][ T8661] ? __pfx___mutex_lock+0x10/0x10 [ 342.310625][ T8661] ? __pfx_vfs_read+0x10/0x10 [ 342.310666][ T8661] ? __fget_files+0x2a/0x420 [ 342.310691][ T8661] ? __fget_files+0x3a0/0x420 [ 342.310708][ T8661] ? __fget_files+0x2a/0x420 [ 342.310737][ T8661] ksys_read+0x145/0x250 [ 342.310766][ T8661] ? __pfx_ksys_read+0x10/0x10 [ 342.310788][ T8661] ? rcu_is_watching+0x15/0xb0 [ 342.310820][ T8661] ? do_syscall_64+0xbe/0x3b0 [ 342.310842][ T8661] do_syscall_64+0xfa/0x3b0 [ 342.310856][ T8661] ? lockdep_hardirqs_on+0x9c/0x150 [ 342.310882][ T8661] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.310898][ T8661] ? clear_bhb_loop+0x60/0xb0 [ 342.310920][ T8661] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.310937][ T8661] RIP: 0033:0x7f0374d8d33c [ 342.310954][ T8661] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 342.310970][ T8661] RSP: 002b:00007f0375b6a030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 342.310991][ T8661] RAX: ffffffffffffffda RBX: 00007f0374fb6080 RCX: 00007f0374d8d33c [ 342.311004][ T8661] RDX: 000000000000000f RSI: 00007f0375b6a0a0 RDI: 0000000000000005 [ 342.311015][ T8661] RBP: 00007f0375b6a090 R08: 0000000000000000 R09: 0000000000000000 [ 342.311025][ T8661] R10: 0000200000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.311036][ T8661] R13: 0000000000000001 R14: 00007f0374fb6080 R15: 00007f03750dfa28 [ 342.311066][ T8661] [ 342.630388][ T8662] Cannot find del_set index 0 as target [ 342.772549][ T9] usb 5-1: USB disconnect, device number 56 [ 342.909064][ T8668] FAULT_INJECTION: forcing a failure. [ 342.909064][ T8668] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 342.928538][ T8668] CPU: 0 UID: 0 PID: 8668 Comm: syz.0.760 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 342.928598][ T8668] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 342.928608][ T8668] Call Trace: [ 342.928616][ T8668] [ 342.928624][ T8668] dump_stack_lvl+0x189/0x250 [ 342.928656][ T8668] ? __pfx____ratelimit+0x10/0x10 [ 342.928684][ T8668] ? __pfx_dump_stack_lvl+0x10/0x10 [ 342.928712][ T8668] ? __pfx__printk+0x10/0x10 [ 342.928732][ T8668] ? __might_fault+0xb0/0x130 [ 342.928761][ T8668] should_fail_ex+0x414/0x560 [ 342.928789][ T8668] _copy_from_user+0x2d/0xb0 [ 342.928809][ T8668] ___sys_sendmsg+0x158/0x2a0 [ 342.928836][ T8668] ? __pfx____sys_sendmsg+0x10/0x10 [ 342.928897][ T8668] ? __fget_files+0x2a/0x420 [ 342.928915][ T8668] ? __fget_files+0x3a0/0x420 [ 342.928946][ T8668] __x64_sys_sendmsg+0x19b/0x260 [ 342.928973][ T8668] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 342.929006][ T8668] ? __pfx_ksys_write+0x10/0x10 [ 342.929021][ T8668] ? rcu_is_watching+0x15/0xb0 [ 342.929052][ T8668] ? do_syscall_64+0xbe/0x3b0 [ 342.929072][ T8668] do_syscall_64+0xfa/0x3b0 [ 342.929087][ T8668] ? lockdep_hardirqs_on+0x9c/0x150 [ 342.929113][ T8668] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.929131][ T8668] ? clear_bhb_loop+0x60/0xb0 [ 342.929153][ T8668] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.929171][ T8668] RIP: 0033:0x7f0374d8e929 [ 342.929188][ T8668] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 342.929203][ T8668] RSP: 002b:00007f0375b8b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 342.929225][ T8668] RAX: ffffffffffffffda RBX: 00007f0374fb5fa0 RCX: 00007f0374d8e929 [ 342.929238][ T8668] RDX: 0000000004000810 RSI: 0000200000000540 RDI: 0000000000000006 [ 342.929250][ T8668] RBP: 00007f0375b8b090 R08: 0000000000000000 R09: 0000000000000000 [ 342.929261][ T8668] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.929272][ T8668] R13: 0000000000000000 R14: 00007f0374fb5fa0 R15: 00007f03750dfa28 [ 342.929303][ T8668] [ 343.002376][ T43] usb 2-1: new high-speed USB device number 55 using dummy_hcd [ 343.245574][ T9] usb 3-1: USB disconnect, device number 54 [ 343.414508][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 343.430243][ T43] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x73, changing to 0x3 [ 343.573138][ T43] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 343.584743][ T30] audit: type=1800 audit(1750718542.226:109): pid=8678 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.762" name="SYSV00000000" dev="hugetlbfs" ino=3 res=0 errno=0 [ 343.664566][ T5906] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 343.711147][ T43] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 343.726909][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 343.757528][ T43] usb 2-1: Product: syz [ 343.804683][ T43] usb 2-1: Manufacturer: syz [ 343.822115][ T43] usb 2-1: SerialNumber: syz [ 343.952307][ T43] usb 2-1: config 0 descriptor?? [ 343.985616][ T43] streamzap 2-1:0.0: streamzap_probe: endpoint doesn't match input device 0203 [ 344.221737][ T43] usb 2-1: USB disconnect, device number 55 [ 345.007345][ T5920] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 345.274574][ T5920] usb 4-1: Using ep0 maxpacket: 32 [ 345.458447][ T5920] usb 4-1: unable to get BOS descriptor or descriptor too short [ 345.726396][ T5920] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 345.743294][ T5920] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 346.033933][ T5920] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 346.134311][ T5920] usb 4-1: config 128 has no interface number 0 [ 346.184788][ T5920] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 346.260531][ T5920] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 346.394425][ T5920] usb 4-1: config 128 interface 127 has no altsetting 0 [ 346.681721][ T5920] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 346.771310][ T5920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 346.818708][ T5920] usb 4-1: Product: syz [ 346.837700][ T5906] usb 5-1: unable to get BOS descriptor or descriptor too short [ 346.845801][ T5920] usb 4-1: Manufacturer: syz [ 346.854635][ T43] usb 3-1: new high-speed USB device number 55 using dummy_hcd [ 346.886279][ T5906] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 346.887966][ T5920] usb 4-1: SerialNumber: syz [ 346.971843][ T5906] usb 5-1: can't read configurations, error -71 [ 347.045407][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 347.115382][ T43] usb 3-1: too many endpoints for config 0 interface 0 altsetting 64: 255, using maximum allowed: 30 [ 347.143827][ T43] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 108, changing to 10 [ 347.243025][ T43] usb 3-1: config 0 interface 0 altsetting 64 endpoint 0x81 has invalid wMaxPacketSize 0 [ 347.340319][ T43] usb 3-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 255 [ 347.444882][ T43] usb 3-1: config 0 interface 0 has no altsetting 0 [ 347.464117][ T43] usb 3-1: New USB device found, idVendor=172f, idProduct=0038, bcdDevice= 0.00 [ 347.517651][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 347.559045][ T43] usb 3-1: config 0 descriptor?? [ 347.858766][ T5906] usb 5-1: new high-speed USB device number 58 using dummy_hcd [ 348.077451][ T8705] net_ratelimit: 11 callbacks suppressed [ 348.077467][ T8705] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:0) [ 348.180604][ T43] waltop 0003:172F:0038.0011: unknown main item tag 0x0 [ 348.198576][ T5906] usb 5-1: config 0 has an invalid interface number: 114 but max is 0 [ 348.217103][ T5906] usb 5-1: config 0 has no interface number 0 [ 348.224082][ T43] waltop 0003:172F:0038.0011: hidraw0: USB HID v0.07 Device [HID 172f:0038] on usb-dummy_hcd.2-1/input0 [ 348.238869][ T5906] usb 5-1: New USB device found, idVendor=0547, idProduct=2720, bcdDevice=13.67 [ 348.248598][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 348.262122][ T5906] usb 5-1: Product: syz [ 348.276027][ T5906] usb 5-1: Manufacturer: syz [ 348.280760][ T5906] usb 5-1: SerialNumber: syz [ 348.292742][ T5906] usb 5-1: config 0 descriptor?? [ 348.491024][ T8700] netlink: 'syz.2.770': attribute type 1 has an invalid length. [ 348.709493][ T5836] usb 3-1: USB disconnect, device number 55 [ 348.724805][ T5906] cdc_subset 5-1:0.114: probe with driver cdc_subset failed with error -71 [ 348.832183][ T5906] usb 5-1: USB disconnect, device number 58 [ 348.978016][ T8719] fido_id[8719]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.2/usb3/report_descriptor': No such file or directory [ 349.192903][ T5920] usb 4-1: USB disconnect, device number 56 [ 349.273068][ T5959] udevd[5959]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 350.954851][ T30] audit: type=1800 audit(1750718549.596:110): pid=8742 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.783" name="SYSV00000000" dev="hugetlbfs" ino=8 res=0 errno=0 [ 351.450544][ T8751] netlink: 8 bytes leftover after parsing attributes in process `syz.1.785'. [ 352.264609][ T5920] usb 4-1: new high-speed USB device number 57 using dummy_hcd [ 352.586189][ T5920] usb 4-1: Using ep0 maxpacket: 32 [ 352.609981][ T5920] usb 4-1: unable to get BOS descriptor or descriptor too short [ 352.620960][ T5920] usb 4-1: config 128 has an invalid interface number: 127 but max is 3 [ 352.654084][ T5920] usb 4-1: config 128 has an invalid descriptor of length 0, skipping remainder of the config [ 352.671793][ T5920] usb 4-1: config 128 has 1 interface, different from the descriptor's value: 4 [ 352.690894][ T5920] usb 4-1: config 128 has no interface number 0 [ 352.895279][ T5920] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has an invalid bInterval 0, changing to 7 [ 353.085929][ T8763] ptrace attach of "./syz-executor exec"[5832] was attempted by "./syz-executor exec"[8763] [ 353.103446][ T8763] dns_resolver: Unsupported server list version (0) [ 353.351720][ T5920] usb 4-1: config 128 interface 127 altsetting 14 endpoint 0x5 has invalid wMaxPacketSize 0 [ 353.453802][ T5920] usb 4-1: config 128 interface 127 has no altsetting 0 [ 353.553959][ T5920] usb 4-1: New USB device found, idVendor=0582, idProduct=295c, bcdDevice=d4.55 [ 353.599474][ T5920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 353.667508][ T5920] usb 4-1: Product: syz [ 353.672753][ T5920] usb 4-1: Manufacturer: syz [ 353.724451][ T5920] usb 4-1: SerialNumber: syz [ 354.021015][ T5921] usb 2-1: new high-speed USB device number 56 using dummy_hcd [ 354.277705][ T5921] usb 2-1: Using ep0 maxpacket: 16 [ 354.288688][ T5921] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 354.310311][ T5921] usb 2-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 354.380826][ T5921] usb 2-1: config 0 interface 0 has no altsetting 0 [ 354.403085][ T5921] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 354.420414][ T5921] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 354.435886][ T5921] usb 2-1: config 0 descriptor?? [ 354.454731][ T5921] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 354.531932][ T8804] netlink: 8 bytes leftover after parsing attributes in process `syz.2.797'. [ 354.657585][ T8787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 354.674114][ T8787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 354.824311][ T30] audit: type=1800 audit(1750718553.436:111): pid=8813 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.800" name="SYSV00000000" dev="hugetlbfs" ino=9 res=0 errno=0 [ 356.241075][ T5920] usb 4-1: USB disconnect, device number 57 [ 356.396470][ T5953] udevd[5953]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:128.127/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 356.784936][ T5906] usb 2-1: USB disconnect, device number 56 [ 357.208267][ T5920] usb 4-1: new high-speed USB device number 58 using dummy_hcd [ 357.451724][ T5920] usb 4-1: config 0 has no interfaces? [ 357.469398][ T5920] usb 4-1: New USB device found, idVendor=091e, idProduct=0003, bcdDevice=d7.3b [ 357.481184][ T5920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.496495][ T5920] usb 4-1: Product: syz [ 357.501957][ T5920] usb 4-1: Manufacturer: syz [ 357.531361][ T5920] usb 4-1: SerialNumber: syz [ 357.760434][ T5920] usb 4-1: config 0 descriptor?? [ 358.764585][ T43] usb 5-1: new high-speed USB device number 59 using dummy_hcd [ 358.814535][ T5836] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 358.926304][ T30] audit: type=1800 audit(1750718557.546:112): pid=8858 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.813" name="SYSV00000000" dev="hugetlbfs" ino=3 res=0 errno=0 [ 358.946731][ C1] vkms_vblank_simulate: vblank timer overrun [ 358.974441][ T43] usb 5-1: Using ep0 maxpacket: 16 [ 358.982712][ T43] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 358.994854][ T43] usb 5-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 359.005983][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.026926][ T43] usb 5-1: config 0 descriptor?? [ 359.043268][ T5836] usb 2-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 359.055837][ T5836] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.093322][ T5836] usb 2-1: config 0 descriptor?? [ 359.316877][ T5836] udl 2-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 359.448014][ T43] logitech-djreceiver 0003:046D:C513.0012: unknown main item tag 0x0 [ 359.523637][ T8850] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 359.534684][ T43] logitech-djreceiver 0003:046D:C513.0012: unknown main item tag 0x0 [ 359.538748][ T8850] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 359.559305][ T43] logitech-djreceiver 0003:046D:C513.0012: unknown main item tag 0x0 [ 359.575332][ T43] logitech-djreceiver 0003:046D:C513.0012: unknown main item tag 0x0 [ 359.588747][ T5836] [drm:udl_init] *ERROR* Selecting channel failed [ 359.617242][ T43] logitech-djreceiver 0003:046D:C513.0012: unknown main item tag 0x0 [ 359.641265][ T5836] [drm] Initialized udl 0.0.1 for 2-1:0.0 on minor 2 [ 359.687942][ T5836] [drm] Initialized udl on minor 2 [ 359.703657][ T43] usb 5-1: USB disconnect, device number 59 [ 359.789694][ T5836] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 359.814879][ T5836] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 359.825094][ T5906] udl 2-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 359.834135][ T5906] udl 2-1:0.0: [drm] Cannot find any crtc or sizes [ 359.843513][ T5836] usb 2-1: USB disconnect, device number 57 [ 360.031743][ T43] usb 4-1: USB disconnect, device number 58 [ 360.510419][ T8870] input: syz1 as /devices/virtual/input/input35 [ 360.524651][ T9] usb 4-1: new high-speed USB device number 59 using dummy_hcd [ 360.554883][ T43] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 360.564523][ T5836] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 360.724532][ T5836] usb 2-1: Using ep0 maxpacket: 16 [ 360.734558][ T43] usb 5-1: config 0 has an invalid interface number: 156 but max is 1 [ 360.742959][ T5836] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 360.772573][ T43] usb 5-1: config 0 has no interface number 1 [ 360.783669][ T5836] usb 2-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 360.797171][ T43] usb 5-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 360.843223][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.861323][ T5836] usb 2-1: config 0 interface 0 has no altsetting 0 [ 360.888476][ T5836] usb 2-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 360.901948][ T43] usb 5-1: config 0 descriptor?? [ 360.914088][ T5836] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 360.931162][ T43] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 360.951775][ T5836] usb 2-1: config 0 descriptor?? [ 360.961096][ T43] usb 5-1: MIDIStreaming interface descriptor not found [ 360.982905][ T5836] usbhid 2-1:0.0: couldn't find an input interrupt endpoint [ 361.153085][ T8865] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.162416][ T8865] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.171215][ T8865] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.179961][ T8865] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 361.256633][ T8866] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 361.284511][ T8877] netlink: 8 bytes leftover after parsing attributes in process `syz.0.818'. [ 361.300399][ T43] gspca_main: spca561-2.14.0 probing abcd:cdee [ 361.313573][ T8865] team0: Port device vxlan0 added [ 361.331077][ T8866] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 361.500632][ T43] spca561 5-1:0.0: probe with driver spca561 failed with error -22 [ 361.558279][ T43] usb 5-1: USB disconnect, device number 60 [ 361.814694][ T8884] netlink: 8 bytes leftover after parsing attributes in process `syz.2.819'. [ 363.394708][ T5836] usb 2-1: USB disconnect, device number 58 [ 363.746854][ T9] usb 4-1: unable to get BOS descriptor or descriptor too short [ 363.778339][ T9] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 363.816063][ T9] usb 4-1: can't read configurations, error -71 [ 363.828509][ T8901] netlink: 24 bytes leftover after parsing attributes in process `syz.0.825'. [ 363.854543][ T5836] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 363.893296][ T8903] netlink: 212376 bytes leftover after parsing attributes in process `syz.3.826'. [ 364.014506][ T5836] usb 2-1: Using ep0 maxpacket: 32 [ 364.065130][ T5836] usb 2-1: New USB device found, idVendor=0cf2, idProduct=6250, bcdDevice=10.ae [ 364.091427][ T5836] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.122952][ T5836] usb 2-1: Product: syz [ 364.132829][ T5836] usb 2-1: Manufacturer: syz [ 364.139502][ T5836] usb 2-1: SerialNumber: syz [ 364.151666][ T5836] usb 2-1: config 0 descriptor?? [ 364.178921][ T5836] ums_eneub6250 2-1:0.0: USB Mass Storage device detected [ 364.413023][ T10] usb 2-1: USB disconnect, device number 59 [ 364.684492][ T5920] usb 5-1: new high-speed USB device number 61 using dummy_hcd [ 364.784509][ T9] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 364.869729][ T5920] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 364.924682][ T5920] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 364.954444][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 364.960466][ T5920] usb 5-1: Product: syz [ 364.967878][ T9] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 365.002188][ T9] usb 4-1: New USB device found, idVendor=046d, idProduct=c513, bcdDevice= 0.00 [ 365.045002][ T5920] usb 5-1: Manufacturer: syz [ 365.049868][ T9] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 365.074611][ T5920] usb 5-1: SerialNumber: syz [ 365.077997][ T8922] netlink: 44 bytes leftover after parsing attributes in process `syz.1.831'. [ 365.085651][ T5920] usb 5-1: config 0 descriptor?? [ 365.114841][ T9] usb 4-1: config 0 descriptor?? [ 365.334152][ T8922] netlink: 43 bytes leftover after parsing attributes in process `syz.1.831'. [ 365.415190][ T8922] netlink: 'syz.1.831': attribute type 6 has an invalid length. [ 365.434598][ T8922] netlink: 'syz.1.831': attribute type 5 has an invalid length. [ 365.442534][ T8922] netlink: 43 bytes leftover after parsing attributes in process `syz.1.831'. [ 365.810955][ T9] logitech-djreceiver 0003:046D:C513.0013: unknown main item tag 0x0 [ 365.822370][ T9] logitech-djreceiver 0003:046D:C513.0013: unknown main item tag 0x0 [ 365.832744][ T9] logitech-djreceiver 0003:046D:C513.0013: unknown main item tag 0x0 [ 365.842910][ T9] logitech-djreceiver 0003:046D:C513.0013: unknown main item tag 0x0 [ 365.851626][ T9] logitech-djreceiver 0003:046D:C513.0013: unknown main item tag 0x0 [ 365.865172][ T5906] usb 2-1: new full-speed USB device number 60 using dummy_hcd [ 366.013609][ T8929] netlink: 8 bytes leftover after parsing attributes in process `syz.2.833'. [ 366.036666][ T5906] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 366.048233][ T5906] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 366.070981][ T5836] usb 4-1: USB disconnect, device number 60 [ 366.082548][ T5906] usb 2-1: config 1 interface 1 altsetting 1 has an invalid descriptor for endpoint zero, skipping [ 366.112165][ T5906] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 366.123314][ T5906] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 366.133724][ T5906] usb 2-1: Product: syz [ 366.143796][ T5906] usb 2-1: Manufacturer: syz [ 366.150310][ T5906] usb 2-1: SerialNumber: syz [ 366.178835][ T8924] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 366.179126][ T5920] usb 5-1: non-Atmel transceiver xxxx0008 [ 366.463245][ T5920] usb 5-1: Firmware version (0.0) predates our first public release. [ 366.480698][ T5920] usb 5-1: Please update to version 0.2 or newer [ 366.489945][ T5920] usb 5-1: atusb_probe: initialization failed, error = -19 [ 366.518395][ T5920] usb 5-1: USB disconnect, device number 61 [ 367.035402][ C1] sd 0:0:1:0: [sda] tag#83 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK cmd_age=0s [ 367.045998][ C1] sd 0:0:1:0: [sda] tag#83 CDB: Read(6) 08 00 9f d1 fe de [ 367.256632][ T5906] cdc_ncm 2-1:1.0: bind() failure [ 368.011812][ T5906] usb 5-1: new full-speed USB device number 62 using dummy_hcd [ 368.296794][ T5906] usb 5-1: unable to get BOS descriptor or descriptor too short [ 368.322348][ T5906] usb 5-1: not running at top speed; connect to a high speed hub [ 368.331520][ T5906] usb 5-1: config 1 has an invalid descriptor of length 128, skipping remainder of the config [ 368.342335][ T5906] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 368.355409][ T5906] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 368.368638][ T5906] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 368.384671][ T5906] usb 5-1: Product: syz [ 368.389074][ T5906] usb 5-1: Manufacturer: syz [ 368.393708][ T5906] usb 5-1: SerialNumber: syz [ 368.790288][ T5906] usb 5-1: 0:2 : does not exist [ 368.792960][ T9] usb 2-1: USB disconnect, device number 60 [ 368.894644][ T43] usb 3-1: new full-speed USB device number 56 using dummy_hcd [ 368.957006][ T5906] usb 5-1: USB disconnect, device number 62 [ 369.057608][ T43] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 369.070302][ T43] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 369.088252][ T43] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 369.117118][ T5953] udevd[5953]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 369.231792][ T43] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 369.381923][ T43] usb 3-1: config 0 descriptor?? [ 369.560025][ T43] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 369.652900][ T43] dvb-usb: bulk message failed: -22 (3/0) [ 369.756921][ T43] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 369.851521][ T43] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 369.888288][ T8977] netlink: 4 bytes leftover after parsing attributes in process `syz.0.850'. [ 369.939055][ T8976] netlink: 12 bytes leftover after parsing attributes in process `syz.0.850'. [ 370.013010][ T43] usb 3-1: media controller created [ 370.150868][ T8961] netlink: 'syz.2.844': attribute type 13 has an invalid length. [ 370.170555][ T8961] bridge0: port 2(bridge_slave_1) entered blocking state [ 370.178066][ T8961] bridge0: port 2(bridge_slave_1) entered listening state [ 370.185593][ T8961] bridge0: port 1(bridge_slave_0) entered blocking state [ 370.192789][ T8961] bridge0: port 1(bridge_slave_0) entered listening state [ 370.248709][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 370.306994][ T8961] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 370.371498][ T43] dvb-usb: bulk message failed: -22 (6/0) [ 370.410860][ T43] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 370.456694][ T43] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input36 [ 370.669516][ T43] dvb-usb: schedule remote query interval to 150 msecs. [ 370.743403][ T43] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 371.025475][ T5899] dvb-usb: bulk message failed: -22 (1/0) [ 371.031672][ T5899] dvb-usb: error while querying for an remote control event. [ 371.305927][ T5899] dvb-usb: bulk message failed: -22 (1/0) [ 371.311776][ T5899] dvb-usb: error while querying for an remote control event. [ 371.536065][ T5906] dvb-usb: bulk message failed: -22 (1/0) [ 371.554981][ T5906] dvb-usb: error while querying for an remote control event. [ 371.734559][ T5899] dvb-usb: bulk message failed: -22 (1/0) [ 371.768136][ T5899] dvb-usb: error while querying for an remote control event. [ 371.944851][ T5899] dvb-usb: bulk message failed: -22 (1/0) [ 371.952145][ T5899] dvb-usb: error while querying for an remote control event. [ 372.141510][ T5906] usb 5-1: new low-speed USB device number 63 using dummy_hcd [ 372.150998][ T43] dvb-usb: bulk message failed: -22 (1/0) [ 372.157085][ T43] dvb-usb: error while querying for an remote control event. [ 372.187653][ T5899] usb 3-1: USB disconnect, device number 56 [ 372.306447][ T5899] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 372.330106][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 372.456279][ T5906] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 372.510992][ T5906] usb 5-1: New USB device found, idVendor=17ef, idProduct=6047, bcdDevice= 0.00 [ 372.704604][ T5906] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 372.718596][ T5906] usb 5-1: config 0 descriptor?? [ 373.441762][ T5906] usbhid 5-1:0.0: can't add hid device: -71 [ 373.491005][ T5906] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 373.511362][ T5906] usb 5-1: USB disconnect, device number 63 [ 374.315128][ T9031] FAULT_INJECTION: forcing a failure. [ 374.315128][ T9031] name failslab, interval 1, probability 0, space 0, times 0 [ 374.355359][ T9031] CPU: 0 UID: 0 PID: 9031 Comm: syz.0.867 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 374.355384][ T9031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 374.355391][ T9031] Call Trace: [ 374.355398][ T9031] [ 374.355404][ T9031] dump_stack_lvl+0x189/0x250 [ 374.355425][ T9031] ? __pfx____ratelimit+0x10/0x10 [ 374.355442][ T9031] ? __pfx_dump_stack_lvl+0x10/0x10 [ 374.355458][ T9031] ? __pfx__printk+0x10/0x10 [ 374.355473][ T9031] ? __pfx___might_resched+0x10/0x10 [ 374.355488][ T9031] ? fs_reclaim_acquire+0x7d/0x100 [ 374.355504][ T9031] should_fail_ex+0x414/0x560 [ 374.355520][ T9031] should_failslab+0xa8/0x100 [ 374.355533][ T9031] __kmalloc_node_noprof+0xd1/0x4e0 [ 374.355543][ T9031] ? crypto_create_tfm_node+0x83/0x3f0 [ 374.355558][ T9031] crypto_create_tfm_node+0x83/0x3f0 [ 374.355578][ T9031] crypto_ahash_init_tfm+0x162/0x770 [ 374.355594][ T9031] ? __kmalloc_node_noprof+0x293/0x4e0 [ 374.355609][ T9031] crypto_create_tfm_node+0x189/0x3f0 [ 374.355623][ T9031] crypto_alloc_tfm_node+0x172/0x3f0 [ 374.355639][ T9031] ah_init_state+0x140/0x650 [ 374.355659][ T9031] __xfrm_init_state+0xa73/0x13f0 [ 374.355672][ T9031] ? __xfrm_init_state+0x7ef/0x13f0 [ 374.355687][ T9031] xfrm_add_sa+0x2f5d/0x4050 [ 374.355705][ T9031] ? __pfx_xfrm_add_sa+0x10/0x10 [ 374.355716][ T9031] ? apparmor_capable+0x137/0x1b0 [ 374.355735][ T9031] ? __nla_parse+0x40/0x60 [ 374.355752][ T9031] xfrm_user_rcv_msg+0x7a0/0xab0 [ 374.355769][ T9031] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 374.355800][ T9031] ? __mutex_trylock_common+0x153/0x260 [ 374.355814][ T9031] ? __pfx___mutex_trylock_common+0x10/0x10 [ 374.355830][ T9031] ? rcu_is_watching+0x15/0xb0 [ 374.355845][ T9031] ? trace_contention_end+0x39/0x120 [ 374.355860][ T9031] netlink_rcv_skb+0x208/0x470 [ 374.355874][ T9031] ? __pfx_xfrm_user_rcv_msg+0x10/0x10 [ 374.355887][ T9031] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 374.355909][ T9031] ? netlink_deliver_tap+0x2e/0x1b0 [ 374.355920][ T9031] ? netlink_deliver_tap+0x2e/0x1b0 [ 374.355934][ T9031] xfrm_netlink_rcv+0x79/0x90 [ 374.355946][ T9031] netlink_unicast+0x75b/0x8d0 [ 374.355964][ T9031] netlink_sendmsg+0x805/0xb30 [ 374.355982][ T9031] ? __pfx_netlink_sendmsg+0x10/0x10 [ 374.355997][ T9031] ? aa_sock_msg_perm+0x94/0x160 [ 374.356011][ T9031] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 374.356024][ T9031] ? __pfx_netlink_sendmsg+0x10/0x10 [ 374.356037][ T9031] __sock_sendmsg+0x21c/0x270 [ 374.356055][ T9031] ____sys_sendmsg+0x505/0x830 [ 374.356073][ T9031] ? __pfx_____sys_sendmsg+0x10/0x10 [ 374.356091][ T9031] ? import_iovec+0x74/0xa0 [ 374.356104][ T9031] ___sys_sendmsg+0x21f/0x2a0 [ 374.356118][ T9031] ? __pfx____sys_sendmsg+0x10/0x10 [ 374.356153][ T9031] ? __fget_files+0x2a/0x420 [ 374.356164][ T9031] ? __fget_files+0x3a0/0x420 [ 374.356182][ T9031] __x64_sys_sendmsg+0x19b/0x260 [ 374.356197][ T9031] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 374.356216][ T9031] ? __pfx_ksys_write+0x10/0x10 [ 374.356227][ T9031] ? rcu_is_watching+0x15/0xb0 [ 374.356245][ T9031] ? do_syscall_64+0xbe/0x3b0 [ 374.356257][ T9031] do_syscall_64+0xfa/0x3b0 [ 374.356266][ T9031] ? lockdep_hardirqs_on+0x9c/0x150 [ 374.356280][ T9031] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.356291][ T9031] ? clear_bhb_loop+0x60/0xb0 [ 374.356304][ T9031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 374.356321][ T9031] RIP: 0033:0x7f0374d8e929 [ 374.356332][ T9031] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 374.356341][ T9031] RSP: 002b:00007f0375b8b038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 374.356355][ T9031] RAX: ffffffffffffffda RBX: 00007f0374fb5fa0 RCX: 00007f0374d8e929 [ 374.356362][ T9031] RDX: 0000000000000000 RSI: 0000200000000540 RDI: 0000000000000003 [ 374.356369][ T9031] RBP: 00007f0375b8b090 R08: 0000000000000000 R09: 0000000000000000 [ 374.356376][ T9031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 374.356383][ T9031] R13: 0000000000000000 R14: 00007f0374fb5fa0 R15: 00007f03750dfa28 [ 374.356400][ T9031] [ 374.769047][ T9027] netlink: 24 bytes leftover after parsing attributes in process `syz.4.866'. [ 374.892822][ T9035] IPv6: addrconf: prefix option has invalid lifetime [ 374.963374][ T9025] fuse: Unknown parameter '' [ 375.336117][ T9041] netlink: 8 bytes leftover after parsing attributes in process `syz.1.870'. [ 375.379653][ T9041] fuse: Unknown parameter '0x00000000000000060x0000000000000005' [ 375.394199][ T9043] netlink: 'syz.3.872': attribute type 11 has an invalid length. [ 378.685058][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.691637][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 384.842528][ T9066] input input37: cannot allocate more than FF_MAX_EFFECTS effects [ 385.445298][ T9073] netlink: 156 bytes leftover after parsing attributes in process `syz.3.878'. [ 395.819456][ T9096] FAULT_INJECTION: forcing a failure. [ 395.819456][ T9096] name failslab, interval 1, probability 0, space 0, times 0 [ 395.889871][ T9096] CPU: 0 UID: 0 PID: 9096 Comm: syz.2.882 Not tainted 6.16.0-rc3-syzkaller #0 PREEMPT(full) [ 395.889900][ T9096] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 395.889912][ T9096] Call Trace: [ 395.889920][ T9096] [ 395.889929][ T9096] dump_stack_lvl+0x189/0x250 [ 395.889962][ T9096] ? __pfx____ratelimit+0x10/0x10 [ 395.889990][ T9096] ? __pfx_dump_stack_lvl+0x10/0x10 [ 395.890017][ T9096] ? __pfx__printk+0x10/0x10 [ 395.890040][ T9096] ? __pfx___might_resched+0x10/0x10 [ 395.890068][ T9096] ? fs_reclaim_acquire+0x7d/0x100 [ 395.890096][ T9096] should_fail_ex+0x414/0x560 [ 395.890125][ T9096] should_failslab+0xa8/0x100 [ 395.890147][ T9096] __kmalloc_cache_noprof+0x70/0x3d0 [ 395.890165][ T9096] ? __alloc_workqueue+0x166/0x1b70 [ 395.890192][ T9096] __alloc_workqueue+0x166/0x1b70 [ 395.890213][ T9096] ? rtnl_newlink+0x16d6/0x1c70 [ 395.890229][ T9096] ? rtnetlink_rcv_msg+0x7cc/0xb70 [ 395.890252][ T9096] ? __lock_acquire+0xab9/0xd20 [ 395.890294][ T9096] alloc_workqueue+0xd4/0x210 [ 395.890317][ T9096] ? net_generic+0x1e/0x240 [ 395.890334][ T9096] ? net_generic+0x1e/0x240 [ 395.890350][ T9096] ? __pfx_alloc_workqueue+0x10/0x10 [ 395.890374][ T9096] ? net_generic+0x1e/0x240 [ 395.890390][ T9096] ? net_generic+0x1e/0x240 [ 395.890415][ T9096] bond_init+0xd4/0x860 [ 395.890444][ T9096] ? register_netdevice+0x58b/0x1ae0 [ 395.890470][ T9096] ? __pfx_bond_init+0x10/0x10 [ 395.890492][ T9096] ? __kasan_kmalloc+0x93/0xb0 [ 395.890522][ T9096] register_netdevice+0x6bf/0x1ae0 [ 395.890560][ T9096] ? __kvmalloc_node_noprof+0x331/0x5f0 [ 395.890578][ T9096] ? alloc_netdev_mqs+0xc9e/0x11e0 [ 395.890604][ T9096] ? __pfx_register_netdevice+0x10/0x10 [ 395.890630][ T9096] ? validate_linkmsg+0x765/0x950 [ 395.890670][ T9096] bond_newlink+0x60/0xb0 [ 395.890686][ T9096] ? __pfx_bond_newlink+0x10/0x10 [ 395.890705][ T9096] rtnl_newlink_create+0x30d/0xb00 [ 395.890733][ T9096] ? __mutex_lock+0x51b/0xe80 [ 395.890767][ T9096] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 395.890786][ T9096] ? rtnl_newlink+0x8db/0x1c70 [ 395.890808][ T9096] ? __pfx___mutex_lock+0x10/0x10 [ 395.890847][ T9096] ? ns_capable+0x8a/0xf0 [ 395.890879][ T9096] rtnl_newlink+0x16d6/0x1c70 [ 395.890900][ T9096] ? netlink_sendmsg+0x805/0xb30 [ 395.890936][ T9096] ? __pfx_rtnl_newlink+0x10/0x10 [ 395.890983][ T9096] ? kasan_quarantine_put+0xdd/0x220 [ 395.891008][ T9096] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.891042][ T9096] ? nlmon_xmit+0xb0/0x100 [ 395.891065][ T9096] ? kmem_cache_free+0x18f/0x400 [ 395.891092][ T9096] ? __local_bh_enable_ip+0x12d/0x1c0 [ 395.891120][ T9096] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.891146][ T9096] ? __local_bh_enable_ip+0x12d/0x1c0 [ 395.891173][ T9096] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 395.891204][ T9096] ? __dev_queue_xmit+0x27e/0x3a70 [ 395.891244][ T9096] ? __lock_acquire+0xab9/0xd20 [ 395.891307][ T9096] ? __pfx_rtnl_newlink+0x10/0x10 [ 395.891325][ T9096] rtnetlink_rcv_msg+0x7cc/0xb70 [ 395.891349][ T9096] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 395.891367][ T9096] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 395.891384][ T9096] ? ref_tracker_free+0x63a/0x7d0 [ 395.891405][ T9096] ? __copy_skb_header+0xa7/0x550 [ 395.891431][ T9096] ? __pfx_ref_tracker_free+0x10/0x10 [ 395.891468][ T9096] netlink_rcv_skb+0x208/0x470 [ 395.891490][ T9096] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 395.891512][ T9096] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 395.891549][ T9096] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.891570][ T9096] ? netlink_deliver_tap+0x2e/0x1b0 [ 395.891597][ T9096] netlink_unicast+0x75b/0x8d0 [ 395.891630][ T9096] netlink_sendmsg+0x805/0xb30 [ 395.891664][ T9096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.891690][ T9096] ? aa_sock_msg_perm+0x94/0x160 [ 395.891715][ T9096] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 395.891739][ T9096] ? __pfx_netlink_sendmsg+0x10/0x10 [ 395.891762][ T9096] __sock_sendmsg+0x21c/0x270 [ 395.891793][ T9096] ____sys_sendmsg+0x505/0x830 [ 395.891823][ T9096] ? __pfx_____sys_sendmsg+0x10/0x10 [ 395.891857][ T9096] ? import_iovec+0x74/0xa0 [ 395.891881][ T9096] ___sys_sendmsg+0x21f/0x2a0 [ 395.891907][ T9096] ? __pfx____sys_sendmsg+0x10/0x10 [ 395.891975][ T9096] ? __fget_files+0x2a/0x420 [ 395.891994][ T9096] ? __fget_files+0x3a0/0x420 [ 395.892026][ T9096] __x64_sys_sendmsg+0x19b/0x260 [ 395.892053][ T9096] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 395.892088][ T9096] ? __pfx_ksys_write+0x10/0x10 [ 395.892103][ T9096] ? rcu_is_watching+0x15/0xb0 [ 395.892137][ T9096] ? do_syscall_64+0xbe/0x3b0 [ 395.892159][ T9096] do_syscall_64+0xfa/0x3b0 [ 395.892174][ T9096] ? lockdep_hardirqs_on+0x9c/0x150 [ 395.892198][ T9096] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.892217][ T9096] ? clear_bhb_loop+0x60/0xb0 [ 395.892241][ T9096] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 395.892265][ T9096] RIP: 0033:0x7f570a18e929 [ 395.892283][ T9096] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 395.892299][ T9096] RSP: 002b:00007f5707ff6038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 395.892320][ T9096] RAX: ffffffffffffffda RBX: 00007f570a3b5fa0 RCX: 00007f570a18e929 [ 395.892333][ T9096] RDX: 0000000000000040 RSI: 0000200000000280 RDI: 0000000000000003 [ 395.892346][ T9096] RBP: 00007f5707ff6090 R08: 0000000000000000 R09: 0000000000000000 [ 395.892357][ T9096] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 395.892369][ T9096] R13: 0000000000000000 R14: 00007f570a3b5fa0 R15: 00007f570a4dfa28 [ 395.892402][ T9096] [ 395.928373][ T9100] netlink: 'syz.3.883': attribute type 10 has an invalid length. [ 400.425214][ C1] bridge0: port 1(bridge_slave_0) entered learning state [ 400.433611][ C1] bridge0: port 2(bridge_slave_1) entered learning state [ 402.044356][ C0] sched: DL replenish lagged too much [ 412.865057][ T9100] veth1_macvtap: left promiscuous mode [ 425.491604][ T9100] bridge0: port 4(macsec0) entered blocking state [ 425.664797][ T9100] bridge0: port 4(macsec0) entered disabled state [ 425.671827][ T9100] macsec0: entered allmulticast mode [ 426.050134][ T9100] macsec0: entered promiscuous mode [ 430.504495][ C1] bridge0: port 2(bridge_slave_1) entered forwarding state [ 430.511781][ C1] bridge0: topology change detected, propagating [ 430.518964][ C1] bridge0: port 1(bridge_slave_0) entered forwarding state [ 430.526239][ C1] bridge0: topology change detected, propagating [ 438.316899][ T5835] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 438.516508][ T5831] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 438.535701][ T5831] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 438.544104][ T5831] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 438.553461][ T5831] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 438.562162][ T5831] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 438.572588][ T5831] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 438.581716][ T5831] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 438.594976][ T5831] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 438.629774][ T5831] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 439.515846][ T5835] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 439.994495][ T5835] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 440.013673][ T9114] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 440.026383][ T9114] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 440.035299][ T9114] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 440.055729][ T9114] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 440.064034][ T9114] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 440.134781][ T9114] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 440.149578][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.190794][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.244906][ T9114] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 440.290075][ T9114] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 440.674397][ T9115] Bluetooth: hci2: command tx timeout [ 440.744622][ T9115] Bluetooth: hci0: command tx timeout [ 440.824459][ T9114] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 440.834057][ T9114] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 440.843528][ T9114] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 440.852576][ T9114] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 440.877902][ T9114] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 442.265238][ T9115] Bluetooth: hci6: command tx timeout [ 442.537151][ T9115] Bluetooth: hci5: command tx timeout [ 442.747021][ T9115] Bluetooth: hci2: command tx timeout [ 442.824938][ T9115] Bluetooth: hci0: command tx timeout [ 443.225411][ T9115] Bluetooth: hci1: command tx timeout [ 444.344521][ T9115] Bluetooth: hci6: command tx timeout [ 444.584564][ T9115] Bluetooth: hci5: command tx timeout [ 444.680873][ T9117] chnl_net:caif_netlink_parms(): no params data found [ 444.704852][ T9125] chnl_net:caif_netlink_parms(): no params data found [ 444.824835][ T9115] Bluetooth: hci2: command tx timeout [ 444.905641][ T9115] Bluetooth: hci0: command tx timeout [ 444.931520][ T9128] chnl_net:caif_netlink_parms(): no params data found [ 445.304770][ T9115] Bluetooth: hci1: command tx timeout [ 445.404772][ T9118] chnl_net:caif_netlink_parms(): no params data found [ 445.863292][ T9123] chnl_net:caif_netlink_parms(): no params data found [ 446.159739][ T9117] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.178584][ T9117] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.195584][ T9117] bridge_slave_0: entered allmulticast mode [ 446.211722][ T9117] bridge_slave_0: entered promiscuous mode [ 446.425837][ T9115] Bluetooth: hci6: command tx timeout [ 446.439192][ T9125] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.453924][ T9125] bridge0: port 1(bridge_slave_0) entered disabled state [ 446.471069][ T9125] bridge_slave_0: entered allmulticast mode [ 446.483258][ T9125] bridge_slave_0: entered promiscuous mode [ 446.526793][ T9117] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.533995][ T9117] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.543184][ T9117] bridge_slave_1: entered allmulticast mode [ 446.552969][ T9117] bridge_slave_1: entered promiscuous mode [ 446.628275][ T9125] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.636215][ T9125] bridge0: port 2(bridge_slave_1) entered disabled state [ 446.643916][ T9125] bridge_slave_1: entered allmulticast mode [ 446.656474][ T9125] bridge_slave_1: entered promiscuous mode [ 446.670669][ T9115] Bluetooth: hci5: command tx timeout [ 446.906709][ T9115] Bluetooth: hci2: command tx timeout [ 446.985692][ T9115] Bluetooth: hci0: command tx timeout [ 447.151625][ T9117] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 447.164550][ T9128] bridge0: port 1(bridge_slave_0) entered blocking state [ 447.191351][ T9128] bridge0: port 1(bridge_slave_0) entered disabled state [ 447.201550][ T9128] bridge_slave_0: entered allmulticast mode [ 447.227151][ T9128] bridge_slave_0: entered promiscuous mode [ 447.245963][ T9128] bridge0: port 2(bridge_slave_1) entered blocking state [ 447.253166][ T9128] bridge0: port 2(bridge_slave_1) entered disabled state [ 447.272493][ T9128] bridge_slave_1: entered allmulticast mode [ 447.284229][ T9128] bridge_slave_1: entered promiscuous mode [ 447.384874][ T9115] Bluetooth: hci1: command tx timeout [ 447.432102][ T9125] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 447.460011][ T9117] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 447.847209][ T9125] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.058002][ T9128] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 448.092832][ T9118] bridge0: port 1(bridge_slave_0) entered blocking state [ 448.109784][ T9118] bridge0: port 1(bridge_slave_0) entered disabled state [ 448.123343][ T9118] bridge_slave_0: entered allmulticast mode [ 448.145200][ T9118] bridge_slave_0: entered promiscuous mode [ 448.269886][ T9125] team0: Port device team_slave_0 added [ 448.392473][ T9117] team0: Port device team_slave_0 added [ 448.427001][ T9128] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 448.504909][ T9115] Bluetooth: hci6: command tx timeout [ 448.521060][ T9118] bridge0: port 2(bridge_slave_1) entered blocking state [ 448.539667][ T9118] bridge0: port 2(bridge_slave_1) entered disabled state [ 448.553457][ T9118] bridge_slave_1: entered allmulticast mode [ 448.573850][ T9118] bridge_slave_1: entered promiscuous mode [ 448.698917][ T9125] team0: Port device team_slave_1 added [ 448.745328][ T9115] Bluetooth: hci5: command tx timeout [ 448.836709][ T9117] team0: Port device team_slave_1 added [ 449.300109][ T9118] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 449.464834][ T9115] Bluetooth: hci1: command tx timeout [ 449.527880][ T9123] bridge0: port 1(bridge_slave_0) entered blocking state [ 449.547745][ T9123] bridge0: port 1(bridge_slave_0) entered disabled state [ 449.569348][ T9123] bridge_slave_0: entered allmulticast mode [ 449.582468][ T9123] bridge_slave_0: entered promiscuous mode [ 449.602498][ T9118] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 449.612948][ T9125] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 449.620932][ T9125] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 449.652221][ T9125] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 449.727681][ T9128] team0: Port device team_slave_0 added [ 449.734142][ T9123] bridge0: port 2(bridge_slave_1) entered blocking state [ 449.743979][ T9123] bridge0: port 2(bridge_slave_1) entered disabled state [ 449.752522][ T9123] bridge_slave_1: entered allmulticast mode [ 449.765089][ T9123] bridge_slave_1: entered promiscuous mode [ 449.968718][ T9125] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 449.992634][ T9125] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 450.028493][ T9125] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 450.065593][ T9117] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 450.072611][ T9117] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 450.123549][ T9117] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 450.151191][ T9128] team0: Port device team_slave_1 added [ 450.395858][ T9118] team0: Port device team_slave_0 added [ 450.623206][ T9117] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 450.632965][ T9117] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 450.677051][ T9117] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 450.898671][ T9123] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 450.938354][ T9118] team0: Port device team_slave_1 added [ 451.061316][ T9125] hsr_slave_0: entered promiscuous mode [ 451.081476][ T9125] hsr_slave_1: entered promiscuous mode [ 451.092899][ T9125] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 451.114744][ T9125] Cannot create hsr debugfs directory [ 451.139383][ T9128] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 451.164468][ T9128] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.208529][ T9128] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 451.225291][ T9123] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 451.362158][ T9128] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 451.374822][ T9128] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.413066][ T9128] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 451.835566][ T9118] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 451.842583][ T9118] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 451.953358][ T9118] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 452.229202][ T9117] hsr_slave_0: entered promiscuous mode [ 452.261124][ T9117] hsr_slave_1: entered promiscuous mode [ 452.285346][ T9117] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 452.292970][ T9117] Cannot create hsr debugfs directory [ 452.418884][ T9123] team0: Port device team_slave_0 added [ 452.459696][ T9123] team0: Port device team_slave_1 added [ 452.626968][ T9118] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 452.644430][ T9118] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 452.773561][ T9118] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 453.246652][ T9128] hsr_slave_0: entered promiscuous mode [ 453.263982][ T9128] hsr_slave_1: entered promiscuous mode [ 453.271151][ T9128] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 453.298510][ T9128] Cannot create hsr debugfs directory [ 453.336218][ T9123] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 453.343422][ T9123] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 453.381003][ T9123] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 453.642851][ T9123] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 453.674501][ T9123] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 453.711506][ T9123] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 453.901900][ T9118] hsr_slave_0: entered promiscuous mode [ 453.924219][ T9118] hsr_slave_1: entered promiscuous mode [ 453.941895][ T9118] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 453.961255][ T9118] Cannot create hsr debugfs directory [ 454.628927][ T9123] hsr_slave_0: entered promiscuous mode [ 454.650160][ T9123] hsr_slave_1: entered promiscuous mode [ 454.695510][ T9123] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 454.703143][ T9123] Cannot create hsr debugfs directory [ 455.962989][ T9114] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 455.985145][ T9114] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 455.993574][ T9114] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 456.002484][ T9114] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 456.010606][ T9114] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 457.229879][ T9125] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 457.302343][ T9125] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 457.417748][ T9125] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 457.470497][ T9125] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 457.790059][ T9117] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 457.938995][ T9117] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 458.007314][ T9117] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 458.024921][ T9114] Bluetooth: hci4: command tx timeout [ 458.181513][ T9117] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 458.241723][ T9165] chnl_net:caif_netlink_parms(): no params data found [ 458.607126][ T9128] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 458.863253][ T9128] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 458.967363][ T9165] bridge0: port 1(bridge_slave_0) entered blocking state [ 458.996002][ T9165] bridge0: port 1(bridge_slave_0) entered disabled state [ 459.003335][ T9165] bridge_slave_0: entered allmulticast mode [ 459.021900][ T9165] bridge_slave_0: entered promiscuous mode [ 459.044663][ T9128] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 459.071573][ T9128] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 459.162001][ T9165] bridge0: port 2(bridge_slave_1) entered blocking state [ 459.182004][ T9165] bridge0: port 2(bridge_slave_1) entered disabled state [ 459.195335][ T9165] bridge_slave_1: entered allmulticast mode [ 459.203608][ T9165] bridge_slave_1: entered promiscuous mode [ 459.457495][ T9165] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 459.582958][ T9165] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 459.789582][ T9123] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 459.959698][ T9123] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 459.996640][ T9123] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 460.067263][ T9165] team0: Port device team_slave_0 added [ 460.087473][ T9123] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 460.105076][ T9114] Bluetooth: hci4: command tx timeout [ 460.198375][ T9165] team0: Port device team_slave_1 added [ 460.448686][ T9125] 8021q: adding VLAN 0 to HW filter on device bond0 [ 460.496259][ T9117] 8021q: adding VLAN 0 to HW filter on device bond0 [ 460.516013][ T9165] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 460.534385][ T9165] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 460.562737][ T9165] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 460.620223][ T9165] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 460.635810][ T9165] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 460.690310][ T9165] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 460.802103][ T9125] 8021q: adding VLAN 0 to HW filter on device team0 [ 460.944240][ T9117] 8021q: adding VLAN 0 to HW filter on device team0 [ 460.987521][ T59] bridge0: port 1(bridge_slave_0) entered blocking state [ 460.994990][ T59] bridge0: port 1(bridge_slave_0) entered forwarding state [ 461.025240][ T59] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.032654][ T59] bridge0: port 2(bridge_slave_1) entered forwarding state [ 461.123635][ T9165] hsr_slave_0: entered promiscuous mode [ 461.140482][ T9165] hsr_slave_1: entered promiscuous mode [ 461.154040][ T9165] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 461.166575][ T9165] Cannot create hsr debugfs directory [ 461.249628][ T1035] bridge0: port 1(bridge_slave_0) entered blocking state [ 461.256897][ T1035] bridge0: port 1(bridge_slave_0) entered forwarding state [ 461.472925][ T1035] bridge0: port 2(bridge_slave_1) entered blocking state [ 461.480209][ T1035] bridge0: port 2(bridge_slave_1) entered forwarding state [ 461.793612][ T9128] 8021q: adding VLAN 0 to HW filter on device bond0 [ 462.113094][ T9128] 8021q: adding VLAN 0 to HW filter on device team0 [ 462.195925][ T9114] Bluetooth: hci4: command tx timeout [ 462.451343][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.458674][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 462.471484][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 462.478713][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 462.589972][ T9123] 8021q: adding VLAN 0 to HW filter on device bond0 [ 462.763894][ T9117] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 462.779837][ T9123] 8021q: adding VLAN 0 to HW filter on device team0 [ 462.792097][ T9125] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 462.849324][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 462.856632][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 463.011688][ T1162] bridge0: port 2(bridge_slave_1) entered blocking state [ 463.018966][ T1162] bridge0: port 2(bridge_slave_1) entered forwarding state [ 463.028445][ T9165] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 463.128368][ T9165] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 463.244871][ T9165] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 463.331840][ T9117] veth0_vlan: entered promiscuous mode [ 463.393267][ T9165] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 463.486084][ T9128] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 463.573127][ T9117] veth1_vlan: entered promiscuous mode [ 463.606430][ T9125] veth0_vlan: entered promiscuous mode [ 463.754165][ T9125] veth1_vlan: entered promiscuous mode [ 463.882868][ T9117] veth0_macvtap: entered promiscuous mode [ 463.928965][ T9123] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 464.052887][ T9117] veth1_macvtap: entered promiscuous mode [ 464.254586][ T9128] veth0_vlan: entered promiscuous mode [ 464.266371][ T9114] Bluetooth: hci4: command tx timeout [ 464.275804][ T9125] veth0_macvtap: entered promiscuous mode [ 464.302727][ T9117] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 464.361862][ T9128] veth1_vlan: entered promiscuous mode [ 464.470845][ T9165] 8021q: adding VLAN 0 to HW filter on device bond0 [ 464.622854][ T9125] veth1_macvtap: entered promiscuous mode [ 464.650289][ T9117] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 464.746937][ T9165] 8021q: adding VLAN 0 to HW filter on device team0 [ 464.780173][ T9117] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.814360][ T9117] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.842178][ T9117] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.854806][ T9117] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 464.892364][ T9123] veth0_vlan: entered promiscuous mode [ 464.938899][ T9128] veth0_macvtap: entered promiscuous mode [ 464.981840][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 464.989076][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 465.040306][ T9125] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 465.147636][ T9128] veth1_macvtap: entered promiscuous mode [ 465.212683][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 465.219953][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 465.256699][ T9123] veth1_vlan: entered promiscuous mode [ 465.290484][ T9125] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 465.408350][ T9125] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.436646][ T9125] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.456630][ T9125] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.491919][ T9125] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.527153][ T9128] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 465.580895][ T9128] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 465.712877][ T1035] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 465.780698][ T9128] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.804502][ T1035] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 465.820087][ T9128] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.839914][ T9128] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 465.862903][ T9128] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.030919][ T9123] veth0_macvtap: entered promiscuous mode [ 466.123590][ T9123] veth1_macvtap: entered promiscuous mode [ 466.232908][ T9165] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 466.329232][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.343795][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.414106][ T9123] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 466.568801][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 466.610640][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 466.645558][ T9123] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 466.820575][ T9123] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.845994][ T9123] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.884375][ T9123] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.893157][ T9123] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 466.951726][ T9165] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 467.013671][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.069125][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.513628][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.585443][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 467.779671][ T1035] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 467.813477][ T9165] veth0_vlan: entered promiscuous mode [ 467.863989][ T1035] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 468.011898][ T9165] veth1_vlan: entered promiscuous mode [ 472.628547][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 472.725362][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 472.876755][ T9165] veth0_macvtap: entered promiscuous mode [ 472.992861][ T9165] veth1_macvtap: entered promiscuous mode [ 473.174494][ T3009] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 473.182774][ T3009] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 473.413325][ T9165] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 473.509682][ T9165] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 473.610070][ T9165] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.678513][ T9165] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.719646][ T9165] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 473.768160][ T9165] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 474.970994][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.034390][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.104870][ T5944] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 475.211520][ T9219] syz.8.891 (9219): drop_caches: 2 [ 475.257877][ T1162] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 475.306941][ T5944] usb 10-1: Using ep0 maxpacket: 16 [ 475.324220][ T1162] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 475.334255][ T5944] usb 10-1: config 6 has an invalid interface number: 227 but max is 0 [ 475.378511][ T5944] usb 10-1: config 6 has no interface number 0 [ 475.556012][ T5944] usb 10-1: New USB device found, idVendor=04e8, idProduct=6889, bcdDevice= 7.79 [ 475.636978][ T5944] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.704525][ T5944] usb 10-1: Product: syz [ 475.708863][ T5944] usb 10-1: Manufacturer: syz [ 475.713576][ T5944] usb 10-1: SerialNumber: syz [ 475.840387][ T5944] kalmia 10-1:6.227: probe with driver kalmia failed with error -22 [ 480.974852][ T5836] usb 10-1: USB disconnect, device number 2 [ 501.754416][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.762747][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 506.096859][ T9250] netlink: 4 bytes leftover after parsing attributes in process `syz.9.897'. [ 506.210251][ T9250] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 506.325875][ T9250] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 506.354347][ T30] audit: type=1326 audit(1750718704.976:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=9244 comm="syz.9.897" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f83da38e929 code=0x7fc00000 [ 521.475336][ T9250] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 524.596859][ T9250] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 528.113417][ T9115] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 528.194655][ T9115] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 528.214515][ T9115] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 528.378839][ T9115] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 528.672433][ T9115] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 530.994381][ T9115] Bluetooth: hci0: command tx timeout [ 533.082266][ T9115] Bluetooth: hci0: command tx timeout [ 534.325307][ T5831] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 534.638071][ T5831] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 534.655809][ T5831] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 534.672328][ T5831] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 534.680736][ T5831] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 534.875084][ T9114] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 534.885206][ T9114] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 534.893622][ T9114] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 534.906675][ T9114] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 534.915312][ T9114] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 535.089917][ T5835] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 535.114094][ T5835] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 535.123817][ T5835] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 535.132819][ T5835] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 535.144924][ T5835] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 535.155027][ T9114] Bluetooth: hci0: command tx timeout [ 537.387575][ T9114] Bluetooth: hci9: Opcode 0x0c03 failed: -110 [ 548.012499][ T9279] Bluetooth: hci0: command tx timeout [ 548.057018][ T9269] Bluetooth: hci9: Opcode 0x0c03 failed: -4 [ 552.249723][ T5152] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 552.260191][ T5152] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 552.305926][ T5152] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 552.316970][ T5152] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 552.327228][ T5152] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 552.630983][ T9279] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 552.656545][ T9279] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 552.667113][ T9279] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 552.676351][ T9279] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 552.688701][ T9279] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 559.552300][ T9279] Bluetooth: hci10: command tx timeout [ 561.544667][ T9279] Bluetooth: hci8: command tx timeout [ 561.550830][ T9279] Bluetooth: hci3: command tx timeout [ 561.774364][ T5152] Bluetooth: hci10: command tx timeout [ 561.780399][ T5152] Bluetooth: hci7: command tx timeout [ 561.786179][ T5831] Bluetooth: hci9: command tx timeout [ 562.505396][ T9056] bridge0: port 3(syz_tun) entered disabled state [ 563.121481][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 563.134634][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.478402][ T9056] syz_tun (unregistering): left allmulticast mode [ 563.642459][ T5831] Bluetooth: hci8: command tx timeout [ 563.650333][ T9056] syz_tun (unregistering): left promiscuous mode [ 563.675297][ T9056] bridge0: port 3(syz_tun) entered disabled state [ 563.866600][ T5831] Bluetooth: hci7: command tx timeout [ 563.872090][ T5831] Bluetooth: hci3: command tx timeout [ 563.878085][ T5835] Bluetooth: hci9: command tx timeout [ 563.883529][ T5835] Bluetooth: hci10: command tx timeout [ 565.147305][ T5831] Bluetooth: hci6: command 0x0406 tx timeout [ 565.161918][ T5835] Bluetooth: hci1: command 0x0406 tx timeout [ 565.715286][ T9279] Bluetooth: hci8: command tx timeout [ 565.897550][ T9239] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 565.945484][ T9279] Bluetooth: hci3: command tx timeout [ 565.950982][ T9279] Bluetooth: hci10: command tx timeout [ 565.956945][ T5152] Bluetooth: hci9: command tx timeout [ 565.962485][ T5831] Bluetooth: hci7: command tx timeout [ 567.784662][ T9279] Bluetooth: hci8: command tx timeout [ 568.024553][ T9279] Bluetooth: hci9: command tx timeout [ 568.030054][ T9279] Bluetooth: hci7: command tx timeout [ 568.035582][ T5152] Bluetooth: hci3: command tx timeout [ 573.734993][ T5152] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 573.744005][ T5152] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 573.753296][ T5152] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 573.761714][ T5152] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 573.782366][ T5152] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 575.865238][ T5152] Bluetooth: hci2: command tx timeout [ 576.090435][ T9277] chnl_net:caif_netlink_parms(): no params data found [ 576.320340][ T9284] chnl_net:caif_netlink_parms(): no params data found [ 576.578634][ T9275] chnl_net:caif_netlink_parms(): no params data found [ 576.615052][ T9287] chnl_net:caif_netlink_parms(): no params data found [ 577.784237][ T9277] bridge0: port 1(bridge_slave_0) entered blocking state [ 577.822145][ T9277] bridge0: port 1(bridge_slave_0) entered disabled state [ 577.854564][ T9277] bridge_slave_0: entered allmulticast mode [ 577.894733][ T9277] bridge_slave_0: entered promiscuous mode [ 577.936398][ T9277] bridge0: port 2(bridge_slave_1) entered blocking state [ 577.943739][ T9277] bridge0: port 2(bridge_slave_1) entered disabled state [ 577.953380][ T5152] Bluetooth: hci2: command tx timeout [ 577.994573][ T9277] bridge_slave_1: entered allmulticast mode [ 578.013674][ T9277] bridge_slave_1: entered promiscuous mode [ 578.802790][ T9306] chnl_net:caif_netlink_parms(): no params data found [ 578.838320][ T9277] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 578.882245][ T9277] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 579.019043][ T9287] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.034442][ T9287] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.042067][ T9287] bridge_slave_0: entered allmulticast mode [ 579.070815][ T9287] bridge_slave_0: entered promiscuous mode [ 579.093888][ T9284] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.124456][ T9284] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.135681][ T9284] bridge_slave_0: entered allmulticast mode [ 579.164352][ T9284] bridge_slave_0: entered promiscuous mode [ 579.186503][ T9284] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.193717][ T9284] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.235815][ T9284] bridge_slave_1: entered allmulticast mode [ 579.255220][ T9284] bridge_slave_1: entered promiscuous mode [ 579.402135][ T9275] bridge0: port 1(bridge_slave_0) entered blocking state [ 579.435546][ T9275] bridge0: port 1(bridge_slave_0) entered disabled state [ 579.442917][ T9275] bridge_slave_0: entered allmulticast mode [ 579.478476][ T9275] bridge_slave_0: entered promiscuous mode [ 579.497685][ T9275] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.524850][ T9275] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.532199][ T9275] bridge_slave_1: entered allmulticast mode [ 579.564206][ T9275] bridge_slave_1: entered promiscuous mode [ 579.571530][ T9287] bridge0: port 2(bridge_slave_1) entered blocking state [ 579.599092][ T9287] bridge0: port 2(bridge_slave_1) entered disabled state [ 579.625033][ T9287] bridge_slave_1: entered allmulticast mode [ 579.634710][ T9287] bridge_slave_1: entered promiscuous mode [ 580.037564][ T5152] Bluetooth: hci2: command tx timeout [ 580.447997][ T9284] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 580.606050][ T9277] team0: Port device team_slave_0 added [ 580.626545][ T9275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 580.672555][ T9275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 580.706325][ T9287] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 580.768949][ T9287] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 580.798792][ T9284] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 580.981492][ T9277] team0: Port device team_slave_1 added [ 581.590008][ T9284] team0: Port device team_slave_0 added [ 582.117540][ T5152] Bluetooth: hci2: command tx timeout [ 582.223692][ T9287] team0: Port device team_slave_0 added [ 582.237428][ T9284] team0: Port device team_slave_1 added [ 582.360195][ T9306] bridge0: port 1(bridge_slave_0) entered blocking state [ 582.381784][ T9306] bridge0: port 1(bridge_slave_0) entered disabled state [ 582.414888][ T9306] bridge_slave_0: entered allmulticast mode [ 582.435368][ T9306] bridge_slave_0: entered promiscuous mode [ 582.446790][ T9277] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 582.453781][ T9277] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 582.528472][ T9277] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 582.642187][ T9275] team0: Port device team_slave_0 added [ 582.669130][ T9287] team0: Port device team_slave_1 added [ 582.835128][ T9306] bridge0: port 2(bridge_slave_1) entered blocking state [ 582.842350][ T9306] bridge0: port 2(bridge_slave_1) entered disabled state [ 582.874905][ T9306] bridge_slave_1: entered allmulticast mode [ 582.893232][ T9306] bridge_slave_1: entered promiscuous mode [ 583.028965][ T9277] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 583.054480][ T9277] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 583.134398][ T9277] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 583.161674][ T9275] team0: Port device team_slave_1 added [ 583.924065][ T9284] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 583.945520][ T9284] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.005438][ T9284] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 584.052082][ T9284] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 584.074295][ T9284] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.144374][ T9284] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.179435][ T9306] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 584.213642][ T9306] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 584.386603][ T9275] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 584.393696][ T9275] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.460130][ T9275] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 584.499541][ T9287] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 584.522550][ T9287] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.578024][ T9287] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 584.622578][ T9287] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 584.651735][ T9287] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 584.704388][ T9287] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 584.963469][ T9275] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 584.984575][ T9275] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 585.036423][ T9275] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 585.326771][ T9277] hsr_slave_0: entered promiscuous mode [ 585.365491][ T9277] hsr_slave_1: entered promiscuous mode [ 585.396200][ T9277] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 585.429130][ T9277] Cannot create hsr debugfs directory [ 585.907963][ T9306] team0: Port device team_slave_0 added [ 585.936085][ T9306] team0: Port device team_slave_1 added [ 586.356937][ T9287] hsr_slave_0: entered promiscuous mode [ 586.422660][ T9287] hsr_slave_1: entered promiscuous mode [ 586.466461][ T9287] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 586.534311][ T9287] Cannot create hsr debugfs directory [ 586.558820][ T9284] hsr_slave_0: entered promiscuous mode [ 586.616955][ T9284] hsr_slave_1: entered promiscuous mode [ 586.623570][ T9284] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 586.683551][ T9284] Cannot create hsr debugfs directory [ 586.919233][ T9279] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 586.934864][ T9279] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 586.943840][ T9279] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 586.961232][ T9279] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 586.974548][ T9279] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 587.657371][ T9306] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 587.684665][ T9306] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 587.794334][ T9306] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 587.847634][ T9306] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 587.885205][ T9306] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 587.991462][ T9306] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 588.590907][ T5152] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 588.652525][ T5152] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 588.661708][ T5152] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 588.674893][ T5152] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 588.683282][ T5152] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 589.065035][ T5152] Bluetooth: hci4: command tx timeout [ 590.762171][ T5152] Bluetooth: hci5: command tx timeout [ 591.155188][ T5152] Bluetooth: hci4: command tx timeout [ 591.582906][ T9306] hsr_slave_0: entered promiscuous mode [ 591.613050][ T9306] hsr_slave_1: entered promiscuous mode [ 591.637891][ T9306] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 591.654341][ T9306] Cannot create hsr debugfs directory [ 592.834338][ T5152] Bluetooth: hci5: command tx timeout [ 593.107109][ T9284] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 593.225186][ T5152] Bluetooth: hci4: command tx timeout [ 593.961342][ T9343] chnl_net:caif_netlink_parms(): no params data found [ 594.396183][ T9347] chnl_net:caif_netlink_parms(): no params data found [ 594.913188][ T5152] Bluetooth: hci5: command tx timeout [ 594.928465][ T9343] bridge0: port 1(bridge_slave_0) entered blocking state [ 594.946176][ T9343] bridge0: port 1(bridge_slave_0) entered disabled state [ 594.965274][ T9343] bridge_slave_0: entered allmulticast mode [ 594.986701][ T9343] bridge_slave_0: entered promiscuous mode [ 595.015964][ T9343] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.023164][ T9343] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.051666][ T9343] bridge_slave_1: entered allmulticast mode [ 595.066694][ T9343] bridge_slave_1: entered promiscuous mode [ 595.305410][ T5152] Bluetooth: hci4: command tx timeout [ 595.553804][ T9343] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 595.590702][ T9343] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 595.671548][ T9347] bridge0: port 1(bridge_slave_0) entered blocking state [ 595.696012][ T9347] bridge0: port 1(bridge_slave_0) entered disabled state [ 595.703392][ T9347] bridge_slave_0: entered allmulticast mode [ 595.736721][ T9347] bridge_slave_0: entered promiscuous mode [ 595.768601][ T9347] bridge0: port 2(bridge_slave_1) entered blocking state [ 595.784425][ T9347] bridge0: port 2(bridge_slave_1) entered disabled state [ 595.816408][ T9347] bridge_slave_1: entered allmulticast mode [ 595.832722][ T9347] bridge_slave_1: entered promiscuous mode [ 596.330896][ T9347] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 596.366091][ T9347] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 596.412899][ T9343] team0: Port device team_slave_0 added [ 596.540248][ T9343] team0: Port device team_slave_1 added [ 597.002529][ T5152] Bluetooth: hci5: command tx timeout [ 597.048586][ T9347] team0: Port device team_slave_0 added [ 597.068341][ T9347] team0: Port device team_slave_1 added [ 597.085584][ T9343] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 597.092584][ T9343] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 597.153656][ T9343] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 597.410847][ T9343] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 597.424323][ T9343] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 597.478677][ T9343] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 597.515259][ T9347] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 597.522284][ T9347] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 597.593401][ T9347] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 597.883002][ T9347] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 597.906256][ T9347] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 597.982780][ T9347] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 598.081329][ T9343] hsr_slave_0: entered promiscuous mode [ 598.095861][ T9343] hsr_slave_1: entered promiscuous mode [ 598.114493][ T9343] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 598.134314][ T9343] Cannot create hsr debugfs directory [ 598.633352][ T9347] hsr_slave_0: entered promiscuous mode [ 598.686352][ T9347] hsr_slave_1: entered promiscuous mode [ 598.692976][ T9347] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 598.720600][ T9347] Cannot create hsr debugfs directory [ 613.312720][ T9279] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 613.323715][ T9279] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 613.341717][ T9279] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 613.354373][ T9279] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 613.365206][ T9279] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 613.420990][ T5152] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 613.443840][ T5152] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 613.455854][ T5152] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 613.466954][ T5152] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 613.478776][ T5152] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 614.763702][ T9367] chnl_net:caif_netlink_parms(): no params data found [ 614.865207][ T9365] chnl_net:caif_netlink_parms(): no params data found [ 615.395389][ T5152] Bluetooth: hci6: command tx timeout [ 615.562183][ T5152] Bluetooth: hci7: command tx timeout [ 617.475186][ T5152] Bluetooth: hci6: command tx timeout [ 617.625072][ T5152] Bluetooth: hci7: command tx timeout [ 619.555288][ T5152] Bluetooth: hci6: command tx timeout [ 619.715173][ T5152] Bluetooth: hci7: command tx timeout [ 621.635397][ T5152] Bluetooth: hci6: command tx timeout [ 621.795234][ T5152] Bluetooth: hci7: command tx timeout [ 624.438357][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.445236][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 627.675032][ T9279] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 627.688605][ T9279] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 627.697547][ T9279] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 627.717904][ T9279] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 627.730574][ T9279] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 629.795416][ T9279] Bluetooth: hci8: command tx timeout [ 631.865106][ T9279] Bluetooth: hci8: command tx timeout [ 633.945574][ T9279] Bluetooth: hci8: command tx timeout [ 636.025096][ T9279] Bluetooth: hci8: command tx timeout [ 647.368724][ T5152] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 647.378233][ T5152] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 647.387469][ T5152] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 647.411936][ T5152] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 647.436691][ T5152] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 648.381274][ T5152] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 648.393212][ T5152] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 648.402161][ T5152] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 648.410914][ T5152] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 648.420201][ T5152] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 649.555341][ T5152] Bluetooth: hci11: command tx timeout [ 650.515219][ T9279] Bluetooth: hci12: command tx timeout [ 651.625220][ T9279] Bluetooth: hci11: command tx timeout [ 652.105702][ T9279] Bluetooth: hci0: command 0x0406 tx timeout [ 652.595361][ T5831] Bluetooth: hci12: command tx timeout [ 653.704986][ T9279] Bluetooth: hci11: command tx timeout [ 654.678520][ T9279] Bluetooth: hci12: command tx timeout [ 655.785746][ T9279] Bluetooth: hci11: command tx timeout [ 656.745416][ T9279] Bluetooth: hci12: command tx timeout [ 674.434790][ T5831] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 674.454819][ T5831] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 674.463797][ T5831] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 674.475723][ T5831] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 674.483908][ T5831] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 674.610320][ T5835] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 674.620747][ T5835] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 674.645302][ T5835] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 674.656406][ T5835] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 674.674547][ T5835] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 685.874049][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.880939][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 706.604219][ C1] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 706.611235][ C1] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P9324/1:b..l [ 706.619642][ C1] rcu: (detected by 1, t=10503 jiffies, g=45269, q=777075 ncpus=2) [ 706.627659][ C1] task:kworker/0:16 state:R running task stack:27208 pid:9324 tgid:9324 ppid:2 task_flags:0x4208060 flags:0x00004000 [ 706.642476][ C1] Call Trace: [ 706.645808][ C1] [ 706.648792][ C1] __schedule+0x16f5/0x4d00 [ 706.653365][ C1] ? preempt_schedule_irq+0xb5/0x150 [ 706.658698][ C1] ? __pfx___schedule+0x10/0x10 [ 706.663621][ C1] ? __lock_acquire+0xab9/0xd20 [ 706.668514][ C1] ? preempt_schedule_irq+0xaa/0x150 [ 706.673844][ C1] preempt_schedule_irq+0xb5/0x150 [ 706.678992][ C1] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 706.684775][ C1] ? rcu_irq_exit_check_preempt+0xdf/0x210 [ 706.690721][ C1] irqentry_exit+0x6f/0x90 [ 706.695187][ C1] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 706.701370][ C1] RIP: 0010:lock_acquire+0x175/0x360 [ 706.706696][ C1] Code: 00 00 00 00 9c 8f 44 24 30 f7 44 24 30 00 02 00 00 0f 85 cd 00 00 00 f7 44 24 08 00 02 00 00 74 01 fb 65 48 8b 05 3b cd fe 10 <48> 3b 44 24 58 0f 85 f2 00 00 00 48 83 c4 60 5b 41 5c 41 5d 41 5e [ 706.726516][ C1] RSP: 0018:ffffc90003e4f1b8 EFLAGS: 00000206 [ 706.732622][ C1] RAX: 6492ff6d51901400 RBX: 0000000000000000 RCX: 6492ff6d51901400 [ 706.740805][ C1] RDX: 0000000000000000 RSI: ffffffff8db6ec79 RDI: ffffffff8be28bc0 [ 706.749163][ C1] RBP: ffffffff81728af5 R08: 0000000000000000 R09: ffffffff81728af5 [ 706.757169][ C1] R10: ffffc90003e4f378 R11: ffffffff81ace6a0 R12: 0000000000000002 [ 706.765179][ C1] R13: ffffffff8e13ee60 R14: 0000000000000000 R15: 0000000000000246 [ 706.773183][ C1] ? unwind_next_frame+0xa5/0x2390 [ 706.778334][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 706.784520][ C1] ? unwind_next_frame+0xa5/0x2390 [ 706.789782][ C1] ? unwind_next_frame+0xa5/0x2390 [ 706.794941][ C1] ? __free_frozen_pages+0xc71/0xe70 [ 706.800267][ C1] ? unwind_next_frame+0xa5/0x2390 [ 706.805425][ C1] unwind_next_frame+0xc2/0x2390 [ 706.810660][ C1] ? unwind_next_frame+0xa5/0x2390 [ 706.815812][ C1] ? unwind_next_frame+0xa5/0x2390 [ 706.820979][ C1] ? __reset_page_owner+0x71/0x1f0 [ 706.826219][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 706.832405][ C1] arch_stack_walk+0x11c/0x150 [ 706.837208][ C1] ? __free_frozen_pages+0xc71/0xe70 [ 706.842534][ C1] stack_trace_save+0x9c/0xe0 [ 706.847247][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 706.852678][ C1] save_stack+0xf5/0x1f0 [ 706.856984][ C1] ? __pfx_save_stack+0x10/0x10 [ 706.861867][ C1] ? __free_frozen_pages+0xc71/0xe70 [ 706.867224][ C1] __reset_page_owner+0x71/0x1f0 [ 706.872301][ C1] __free_frozen_pages+0xc71/0xe70 [ 706.877543][ C1] __put_partials+0x161/0x1c0 [ 706.882260][ C1] put_cpu_partial+0x17c/0x250 [ 706.887063][ C1] ? put_cpu_partial+0x6d/0x250 [ 706.892038][ C1] __slab_free+0x2f7/0x400 [ 706.896492][ C1] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 706.902860][ C1] ? __phys_addr+0xd3/0x180 [ 706.907413][ C1] qlist_free_all+0x97/0x140 [ 706.912044][ C1] kasan_quarantine_reduce+0x148/0x160 [ 706.917544][ C1] __kasan_kmalloc+0x22/0xb0 [ 706.922168][ C1] __kmalloc_node_track_caller_noprof+0x271/0x4e0 [ 706.928616][ C1] ? __kthread_create_on_node+0x1c6/0x3e0 [ 706.934377][ C1] kvasprintf+0xdc/0x190 [ 706.938752][ C1] ? __pfx_kvasprintf+0x10/0x10 [ 706.943645][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 706.948446][ C1] ? __kthread_create_on_node+0xef/0x3e0 [ 706.954459][ C1] __kthread_create_on_node+0x1c6/0x3e0 [ 706.960036][ C1] ? __pfx___kthread_create_on_node+0x10/0x10 [ 706.966129][ C1] ? string+0x279/0x2b0 [ 706.970335][ C1] ? __pfx_worker_thread+0x10/0x10 [ 706.975486][ C1] ? __pfx_worker_thread+0x10/0x10 [ 706.980640][ C1] kthread_create_on_node+0xdd/0x130 [ 706.985971][ C1] ? __pfx_kthread_create_on_node+0x10/0x10 [ 706.991906][ C1] ? __kmalloc_cache_node_noprof+0x234/0x3d0 [ 706.997922][ C1] ? format_worker_id+0x110/0x260 [ 707.002982][ C1] create_worker+0x299/0x720 [ 707.007607][ C1] ? rcu_is_watching+0x15/0xb0 [ 707.012503][ C1] ? __pfx_create_worker+0x10/0x10 [ 707.017668][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 707.023080][ C1] worker_thread+0x33e/0xda0 [ 707.027738][ C1] kthread+0x70e/0x8a0 [ 707.031854][ C1] ? __pfx_worker_thread+0x10/0x10 [ 707.037437][ C1] ? __pfx_kthread+0x10/0x10 [ 707.042059][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 707.047297][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 707.052612][ C1] ? __pfx_kthread+0x10/0x10 [ 707.057269][ C1] ret_from_fork+0x3fc/0x770 [ 707.061918][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 707.067074][ C1] ? __switch_to_asm+0x39/0x70 [ 707.071873][ C1] ? __switch_to_asm+0x33/0x70 [ 707.076669][ C1] ? __pfx_kthread+0x10/0x10 [ 707.081296][ C1] ret_from_fork_asm+0x1a/0x30 [ 707.086114][ C1] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 715.945515][ T31] INFO: task syz.1.874:9056 blocked for more than 143 seconds. [ 715.953149][ T31] Not tainted 6.16.0-rc3-syzkaller #0 [ 715.995582][ T31] Blocked by coredump. [ 716.000248][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 716.064556][ T31] task:syz.1.874 state:D stack:24856 pid:9056 tgid:9054 ppid:5846 task_flags:0x40054c flags:0x00004002 [ 716.103154][ T31] Call Trace: [ 716.126892][ T31] [ 716.129900][ T31] __schedule+0x16f5/0x4d00 [ 716.154370][ T31] ? schedule+0x165/0x360 [ 716.158841][ T31] ? __pfx___schedule+0x10/0x10 [ 716.163752][ T31] ? schedule+0x91/0x360 [ 716.194714][ T31] schedule+0x165/0x360 [ 716.198963][ T31] schedule_preempt_disabled+0x13/0x30 [ 716.245123][ T31] __mutex_lock+0x724/0xe80 [ 716.249732][ T31] ? __mutex_lock+0x51b/0xe80 [ 716.284551][ T31] ? rcu_barrier+0x4c/0x570 [ 716.289154][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 716.333645][ T31] ? __mutex_unlock_slowpath+0x68a/0x700 [ 716.345940][ T31] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 716.352018][ T31] rcu_barrier+0x4c/0x570 [ 716.384945][ T31] netdev_run_todo+0x327/0xea0 [ 716.389795][ T31] ? __pfx_netif_state_change+0x10/0x10 [ 716.414949][ T31] ? __pfx_netdev_run_todo+0x10/0x10 [ 716.446811][ T31] ? kasan_quarantine_put+0xdd/0x220 [ 716.452208][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 716.485155][ T31] ? netdev_state_change+0x1ca/0x220 [ 716.490537][ T31] ? __pfx_tun_chr_close+0x10/0x10 [ 716.513697][ T31] tun_chr_close+0x13c/0x1c0 [ 716.546110][ T31] __fput+0x44c/0xa70 [ 716.550201][ T31] task_work_run+0x1d1/0x260 [ 716.569284][ T31] ? __pfx_task_work_run+0x10/0x10 [ 716.598801][ T31] ? kmem_cache_free+0x18f/0x400 [ 716.603839][ T31] do_exit+0x6b5/0x22e0 [ 716.608774][ T31] ? do_raw_spin_lock+0x121/0x290 [ 716.613856][ T31] ? __pfx_do_exit+0x10/0x10 [ 716.629244][ T31] do_group_exit+0x21c/0x2d0 [ 716.633917][ T31] ? lockdep_hardirqs_on+0x9c/0x150