last executing test programs: 22m23.835088653s ago: executing program 32 (id=2439): socket$nl_route(0x10, 0x3, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40e00, 0x5a, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r0, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)=[0x1], 0x0, 0x0, 0x20000000000000b2, 0x1}}, 0x40) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0xc402, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c0000001d00070f000000000000000007000000", @ANYRES32=r3, @ANYBLOB="80005200"], 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2/binder1\x00') 14m45.530938874s ago: executing program 3 (id=3312): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000040)=ANY=[], 0x0, 0x0}) syz_usb_control_io$lan78xx(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3}, 0x50) r5 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000040), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x3, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, [@snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {0x7, 0x0, 0xb, 0x4}, {0x85, 0x0, 0x0, 0x95}}]}, 0x0, 0x9, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, @sched_cls=0x2e, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r6}, 0x10) creat(0x0, 0x58) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_RELOAD_REGDB(r7, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)={0x14, r8, 0x421, 0x70bd2a, 0x25dfdbfb}, 0x14}, 0x1, 0x0, 0x0, 0xc35d4f6d52288271}, 0x200048c4) syz_usb_control_io$sierra_net(r0, 0x0, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 14m45.058256237s ago: executing program 0 (id=3314): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000004180)={"2370491d", 0x0, 0x3, 0xa, 0x8, 0x5, "000064640000001503fe00", "defda28a", '\x00', 't0\x00', ['\x00', "f548000000004000000900", "00000600", "000081909d8f00"]}) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000000)=0x2004, 0xfffffffffffffd3b) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000140)={'ni_at_a2150\x00', [0xb013, 0x7, 0x0, 0xdd5, 0x88d7, 0x8f, 0x2, 0x8012, 0x1006, 0xffffffff, 0x203, 0x7, 0x10000009, 0x3, 0x5, 0xfffffffd, 0x8, 0x6, 0x9, 0x8e, 0x3, 0x3, 0x7, 0xa, 0x4, 0x1, 0xb0c4, 0xc, 0x4, 0x400002, 0x22]}) ioctl$TIOCCBRK(r3, 0x5428) connect$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000194c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000019440)=""/99, 0x63}, &(0x7f0000019500)=0x40) dup(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='jfs\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x40200) 14m42.789656763s ago: executing program 1 (id=3317): unshare(0x6a040000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x11, 0x7, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000f7ffffff000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000001000850000008600000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0xffffffffffffffff, &(0x7f0000001100)='fdinfo/4\x00') openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x500, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) socket$nl_generic(0x10, 0x3, 0x10) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000140)='ns/uts\x00') pipe(&(0x7f0000000080)) socket$inet_smc(0x2b, 0x1, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f00000001c0)) pipe(&(0x7f0000000280)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r2], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7fffffff], 0x0, 0x1}) 14m42.673075337s ago: executing program 4 (id=3318): ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x8000000000000001}) write$binfmt_script(r2, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1c) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000140)='asymmetric\x00', &(0x7f0000000440)=@secondary) socket$nl_route(0x10, 0x3, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r8 = syz_io_uring_setup(0x44c8, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x1, 0x400244}, &(0x7f0000000340)=0x0, &(0x7f00000006c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x104, &(0x7f0000000000)=0x4, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_ASYNC_CANCEL={0xe, 0xc}) io_uring_enter(r8, 0x4c6e, 0xc67a, 0x8, 0x0, 0x0) io_uring_enter(r8, 0x627, 0x4c1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) 14m42.575163701s ago: executing program 5 (id=3319): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) syz_open_dev$rtc(&(0x7f0000000140), 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x20842, 0x4) fcntl$setstatus(r1, 0x4, 0x42000) read$FUSE(r1, &(0x7f0000006100)={0x2020}, 0x2020) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04131505c8"], 0x18) r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r3 = syz_io_uring_setup(0x112, &(0x7f00000002c0)={0x0, 0xf59b, 0x10000, 0x10003, 0x65, 0x0, r2}, &(0x7f0000000140)=0x0, &(0x7f0000000280)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0x200, 0x0, 0x4) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000480), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r2}, 0x2c, {'wfdno', 0x3d, r3}}) r5 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x103041, 0x0) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000cc0)="e1", 0x10113}], 0x1) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={0x0}) 14m42.394140795s ago: executing program 5 (id=3320): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x3) ioctl$FS_IOC_SETFSLABEL(r0, 0x41009432, &(0x7f0000000040)="2b64a156142a788642503dd123243db037e8b396f0feac21d87878e63df50aadae7f6c557a4920c7ea68c2ffbf9aa32caa8cb94e87c235ba0bc25e8086524cba7540df00b2d2f47cc04af0c77874ac8d5cbc4026dd47b6ded581304d27cf171eb40fe03a323dfdcbd9ef05be89b065b5a7ad44abf9f4583a94f564c5d0bcbe8d50ed38ce708d41dcae2fad0fbac65472b37023a40186ef4081ea5ea4fcf184deff3dd9532b9477067fd9108ca8aa0f67ad08309eb7446d1a108e83c14c5e7c468e2c3d0088bb9eb2fd2cc27459fc10706e9fcb4d16834dd2a330a90109707dd94dbcc307c6ebd93e7b0f3bd64bd52bc4e53fb871266b73d6b0a3ddeab1b821e3") ftruncate(r0, 0x0) tee(r0, r0, 0x1, 0x8) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000140)={0x0, 0x83, 0x3}) ftruncate(r0, 0x646) ioctl$FS_IOC_SETVERSION(r0, 0x40087602, &(0x7f0000000540)=0x6) r1 = accept4$tipc(0xffffffffffffffff, &(0x7f0000000580), &(0x7f00000005c0)=0x10, 0x80800) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000600)={0x42, 0x1}, 0x10) r2 = signalfd(r1, &(0x7f0000000640)={[0x2]}, 0x8) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r2, 0xc4c85513, &(0x7f0000000680)={{0x9, 0x3, 0x1, 0x0, 'syz1\x00'}, 0x0, [0x9, 0x1, 0x4, 0x101, 0x100, 0x2000000, 0x83cc, 0xff, 0x3, 0x3, 0x2, 0x4, 0x401, 0x101, 0x5, 0x101, 0x7, 0x9, 0x1, 0x2, 0x0, 0x6b, 0x8, 0x7, 0x5, 0x7, 0x2, 0x6, 0x2, 0x9, 0x24a8, 0x8000000000000000, 0x80000000, 0x1, 0x0, 0x8, 0x2, 0x80, 0x3, 0x4000000000000, 0x7, 0x2, 0x200, 0x3, 0x79, 0x24d, 0x5, 0x7, 0xffff, 0x8, 0x3, 0x0, 0xffffffffffffff81, 0x4cf, 0xf3b2, 0x1a3e, 0x9, 0x2, 0x6, 0x9, 0x200, 0x1000, 0x2, 0x6, 0x1ea, 0x4, 0x40, 0x1, 0x5, 0x8, 0x7dd, 0x3, 0x8000, 0x0, 0x7f, 0x3fc, 0x0, 0xd61, 0x6, 0x4, 0x9, 0x240, 0x3, 0x4, 0x1, 0x80000001, 0xb660, 0x92, 0x7, 0x2, 0x7, 0x5, 0x6, 0x56, 0x2, 0x6, 0x3, 0x7ff, 0x1ff, 0x5, 0x9, 0x5, 0xf3, 0xfffffffffffff801, 0x10000, 0x3, 0xfff, 0x6, 0x8, 0x4, 0x9, 0xf, 0x4, 0xfffffffffffffffe, 0x6b2, 0x6, 0x100000000, 0x7, 0x2, 0x4, 0x8, 0x8, 0x6, 0x1, 0x89b, 0x135d, 0xb1ea, 0x6]}) getsockopt$PNPIPE_IFINDEX(r2, 0x113, 0x2, &(0x7f0000000b80)=0x0, &(0x7f0000000bc0)=0x4) rseq(&(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={0x0, 0x0, 0x9, 0x3, 0x80}, 0x4}, 0x20, 0x0, 0x0) getpeername$unix(r2, &(0x7f0000000c80)=@abs, &(0x7f0000000d00)=0x6e) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000d40)={{0xe0, 0xaf}, {0x7, 0x9}, 0x8, 0x2, 0x9c}) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$fou(&(0x7f0000000e00), r2) sendmsg$FOU_CMD_ADD(r4, &(0x7f0000000ec0)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000e80)={&(0x7f0000000e40)={0x24, r5, 0x1, 0x70bd2c, 0x25dfdbfd, {}, [@FOU_ATTR_AF={0x5, 0x2, 0x1}, @FOU_ATTR_TYPE={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x805}, 0x40004000) r6 = io_uring_setup(0x2618, &(0x7f0000000f00)={0x0, 0xc98, 0x440, 0x3, 0x93, 0x0, r2}) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000f80)={0xaa, 0x408}) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f0000000fc0)={"3fc3754f33d2cdd0b1dbb2bbfe38f74d08375c3a6b2ac371b7a2c8efacfa28ea425a8289656d61ebdfe729614827cd8b6a28c990d4c7290593946fcfdddfcf94baf6a31b11071f54d333ec3c1b841a4c85e4d531a1f6f3380980c7a596a78f2ed65f632cb62f84882528c6ae8113ee1dd13e19ad0a34e23b2b1486fafefa04c1618a91ffbf220591fa5f7c8be0febd9e343f90d2956024c306187e8689a9cacfd9720a14cd3ff3c411257a3e0eb7967f891d848398915b77407a99348af33581858bd325ac4b56bb45b362730bd2bbae6c8b01484caddeba3b5e71e69a0680646def2d2bb439740cc9fda1be9c6d391bcb0374b8e8de3108a1b7be02e746e8973027e0a8d7d7af18975a0869c79e33f73567fecdfcb7d22a3cdc5abe25477ecc5202c2e1d3616cae3af36a5bfa716741e0f8f97821b7bdaeaad5fb750084c6a9ae59a9187e4e38099326885e190077944444ad8310d2f5b78a75d44a399cf1e7f2b662b60ee7483b7604e042032a917fa8e9897afd11c8b34e67aac34ac5942c468244727124d905381f2d0c90d0401f997639b5a97670a2d31d39dafaa18a627309a25c852f88f80d719887cf3e923e7b4b89448211c1de0981521c8b3bc64094b0010f572e2d8a9fd6ee2f4d20f14bb9a10e667596f3b3680623ed8defbb73cc14af54beac0466973d238029644f93a9367a9d6424706735bf4741a3308d8efe695d4346ed2ace06c1492f46268db2696d993277b53d62d2545471213265661ce41e033c528f408a4cfd3f95df04eb1c425997f773b8a4ad107641c369c746f549b0fc07dc28773673c8296d27fbc50bebc8cf4f4fbf808e85423e8044a9b657ba93e155dda2a6933d31d38330e9f91e4ff1cee1d158ffde3ef48c3c2b15d4d92b73efe75efca89b77c8f3ea1751ff550f12183a9b296d9aa7ee0aec6064fb163d924bbcc8ca44d5bf59555f15ee0f47493a435379679279d4172f2f5f6c689edf774073069ae607cf30d42f7a59977eae5d0b433a6a589f26d0ed2952e253d64ba1cd887b27ed13e49203eb4b8eefb35ce744b5e2700b7f16c3ac2af3342806b44a48dc58e9828daffe56f939b016ac82edf5d5a2646b489ff6d3237ca7123d3d92457dcd70821634c86044dce0d2f21e2c6bb11a0ccb9efb329846164371db496d0ed16c7f82a14fce12affd84924a690298db38e5c92ef575b07055bf2bedeb939fa6ff6857db97ee09dcb33bde1d568890992808de83edfb571a01fd3bfce130c52f4e8092f3499aeffea46df6cdd3a495a6a50da67e97edc977b1c1ff58ff28916673a4bd932306080a63f4a83fc3c1a21db17f54baa90a93f150fce0c6aa00492b9cb4de965a171a5ac1de1552275975523cbae84db1927b99c4a69f19c221cf2f1d40a278cd3361bd6a727bca0f004a44f91dfa0a4cbf8da475ae02"}) ioctl$DRM_IOCTL_AGP_ENABLE(r2, 0x40086432, &(0x7f00000013c0)=0xb) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000001500)={@cgroup=r2, 0x1e, 0x0, 0x10, &(0x7f0000001400)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000001440)=[0x0, 0x0, 0x0], &(0x7f0000001480)=[0x0, 0x0], &(0x7f00000014c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r9 = bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000001540)={r2, r3, 0x25, 0x2, @val=@netkit={@void, @value=r2, @void, @void, r8}}, 0x1c) ioctl$SIOCAX25DELFWD(r2, 0x89eb, &(0x7f0000001580)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}}) fcntl$getownex(r2, 0x10, &(0x7f00000018c0)={0x0, 0x0}) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000001900)=0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000001940)=0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000001980)=0x0) sendmmsg$unix(r2, &(0x7f0000002c40)=[{{&(0x7f00000015c0)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000001880)=[{&(0x7f0000001640)="5af17377cdeb21ce77e026f33342d661864db31a4c63d3a51680c0571291ec7d8dc3da4a1b2fb778e11a839b931d8be754466f96b840c61741d34ee4556016a57d93eac3fcaf2cdb5b6b598ada4a67d81fc1216689b95c5abc120e3df2ba64a11ea39385f64b339a0de6dccf55529447cdf25725d08fecd06dd3f4843ec234b4fb04ea56f9f325b8d67f8e5bcc2a1225f997d6689eac55192b83045e94bd1b3c0da1deef0409cee628cd88c100bacc6ea54f30beafa2f39ec32a1cc36164413e", 0xc0}, {&(0x7f0000001700)="533806ea9c83eae972508b824b48387e0f45662bcd9ad8c566786f74904ced1c140d76efa70bdff0f3078d5d1973a77a90c863eb634a95b76b937d717c3a5cdd5834cc4116abe457984b398ff730afb09e64b87ec17577487ececa31df3e39889238a2ec633e3f889edb008c43978ec11646fc607da8309b168fdcb87ae5f8b465638be45cbde7e1f563ed4de01c2e54ea1cfbd7bd41ce10161efd506fe383b6caa54c7aff786d9262f89cc4f7936ea0734ca04b7cc5a99bba66af69afa18fd16d78f8e96122a98eddd2f055af4ebfab8a6fbc14f5e8f3c031d39a5d74e264095232aeac9f5d24a1fe68e17ca9e18350e0e85ac3", 0xf4}, {&(0x7f0000001800)="a9063e185860596282e0323f9cbff8616110c74230cad04926391ae5982fc08617edb3885bc6405d01dfc3910a33a90a5a9ef0b191cbe04c3ec9faafe9dabfc06194fcc809b916095168391d4abd968b696cae7c0ee3c077e86155db7a8a9cb1eb4323c35e", 0x65}], 0x3, &(0x7f0000002100)=[@cred={{0x1c, 0x1, 0x2, {r10, 0xffffffffffffffff}}}, @cred={{0x1c, 0x1, 0x2, {r11, r12, 0xffffffffffffffff}}}, @cred={{0x1c, 0x1, 0x2, {r13}}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, r6, r2, r1, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c, 0x1, 0x2, {0x0, 0xee01}}}, @rights={{0x20, 0x1, 0x1, [r4, r9, r7, r6]}}], 0x128}}, {{0x0, 0x0, &(0x7f0000002300)=[{&(0x7f0000002240)="f7a467ed9eeefde8d1170dba9ce9c33f4bcf8184c2a88b58ffa53103bfebca8f45807913daaecb3e5c83b4a4420507a124fbed7e6e217eab73b296c8e10afdf0f1f1719483fa768657a26975bdec659f537202442a02ca4092672728ad4fa793dbcd7d4199df971a52b17fa056e79613052e894681d61b24a6701d8865718b9e717fc967c826b81939804e0fe3aad6bcf0", 0x91}], 0x1, &(0x7f0000002680)=[@rights={{0x28, 0x1, 0x1, [r2, r2, r2, r1, r7, r1]}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [r7]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [r7, r6, r4]}}, @rights={{0x1c, 0x1, 0x1, [r4, r4, r2]}}, @rights={{0x28, 0x1, 0x1, [r9, r0, r7, r2, r9, r9]}}], 0xe8, 0x1}}, {{&(0x7f0000002780)=@file={0x0, './file0\x00'}, 0x6e, &(0x7f00000029c0)=[{&(0x7f0000002800)="2e39337ef8689951782c770384a50572f630f9f7c4785500ad679c7bd8a8432bf046c6493923a30b55b219d496bf34e3e8986139333b61e40a640a56215c8f1c111283607b6268033bead0e5a6ce34814282ab0580d055c60719a53e9cea32eefc8df2bad2109a6e0234904c60dbab1521941598085869b2e5ef3f97b8d8e9e80a50a1d0e6d944ea8ff15e502ad788744e2aa7a671b09bbaabc98825093c250ef0f5b597060be2f14a96bb2b4846cc933ab899942054cf2173057096970de2d384c07a671b9eaa90c8800e569387abc318725d53", 0xd4}, {&(0x7f0000002900)="dbdebf512af3ec2beb242d45e31852d3e023da2e1da062d469b01f7ea541c4e404f2bc171efe997c16a968baa3416a4fe295d590945fda1db6f777d58529925687ef6310f57d1d116157100d962eb19ab8706ab0a919a257636ae19fb7a6e943a5097c63df", 0x65}, {&(0x7f0000002980)="dd40438a8905fcafd548a212a9ecb9f67ec8b55fb9a4bea57c1e2c16818ca731ac1ad0ff119e", 0x26}], 0x3, &(0x7f0000002c00)=[@cred={{0x1c}}], 0x20, 0xc800}}], 0x3, 0x0) 14m42.251337446s ago: executing program 5 (id=3321): socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e23}, 0x6e) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x27, &(0x7f0000000340)=0x9, 0x4) socket$tipc(0x1e, 0x5, 0x0) syz_open_dev$hiddev(&(0x7f0000000100), 0x8000000000000001, 0x40) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x20801, 0x0) write$rfkill(r1, &(0x7f0000000100)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000680)={0x40, 0xe, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14m42.077325347s ago: executing program 3 (id=3322): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2a0, 0xffffffff, 0x170, 0x0, 0x170, 0xffffffff, 0xffffffff, 0x208, 0x208, 0x208, 0xffffffff, 0x4, 0x0, {[{{@ip={@local, @rand_addr=0x64010100, 0xff, 0x0, 'team_slave_0\x00', 'veth1_to_bond\x00', {}, {}, 0x0, 0x0, 0x20}, 0x0, 0xb0, 0xd8, 0x0, {0x100000000000000}, [@common=@set={{0x40}, {{0x1, [0x6, 0x5, 0x5, 0x2, 0x0, 0x2], 0x9, 0x5}}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@ip={@multicast1, @loopback, 0xff000000, 0x0, 'batadv_slave_0\x00', 'wg1\x00', {}, {}, 0x6c}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xd8}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x300) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @broadcast}}}, 0x0, 0x0, 0xc, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) r7 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r7, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_CHANNELS(r7, 0xc0045006, &(0x7f0000000040)=0xc) ioctl$SNDCTL_DSP_SETFMT(r7, 0xc0045005, &(0x7f0000000640)=0x10) close(r7) 14m41.627176328s ago: executing program 0 (id=3323): syz_emit_ethernet(0xbe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r0, 0x0, 0x20008850) sendmsg$nl_route_sched(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newtfilter={0x34, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r2, {0xf000, 0xffff}, {}, {0x7, 0x10}}, [@filter_kind_options=@f_flower={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0xc0}, 0x20000800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$sndctrl(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000001180)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa0000000000000150300000a004e002d35010000000000950041000000000069163a0000000000bf67000000000000350605000fff07206706000005000000160302000ee60060bf500000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ff3d4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe01c5473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc2300000008ac86d8a297dff0445a15f21dce4de9f29eff65aadc841848c9b562a31e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076ebae3f55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932c9a6aa57f1ad2e99e0e67ab93716d20000009fbb0f53acbb40b4f8e2739670b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc401000000cc43010000207b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000f4000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c6939628950000000000000001c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be19637302f3b41eae50509fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b30410856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fb9fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff010404faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202ee1192b81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9b5a8ded5de8206c812439ab129ae818837ee1562078fc524a3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce95798adc2dca871073f6bd61dc18402cde8b0100010000000000abc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db059acaba9eaea93f811d434e00000000000000000000d154ba10a8e51489a614e69722bac30000000000000000000000000000c5dfd188ff555285b9743d3aac000583f42d168613151d681a2f71373f20d92c9048407c91fabecfe8b3f2d545ffffffff00000000a1cfc4336324c86f3dcb43e9a58208077e90f6ec1c7ac756f61dcc372cdd30b82507489f0bbfbd3c3f21752e81319c0161e154ceb16e00bc7f5a6962dff317f4d014786e432817064874d69a39cb0da31bcc5f81894d8a80756447322207b4007dff12eb95066cc6bc256f0a12282224d718b06ca80b57aa183dd0c3eee45891441f2b89b4c67aa9882281393954972046974f18df232cd7fca610e33f51c2d062020f403d85ff36c26e2f6bd1d82f4d3ceb3472d9a77e0057a3bfe697d9ab7585f4a1b381343d2cf857689232f4fc5135790662dc1419a374be9d7b3e5be2886d23add90d862f1a682ff11c798e338af3e5bb0f9d3952b15bf3e0c618c89d20ca1e18a031397693bf3cfbd8417e5b55e641c898c280356f2da222d5d68919d98158578dcf18efa404e508bcbbb8cfcf70086821ebdf34c9a1dff45af873df904c2bdbef81f246d26f4b40df949e12bdac18533d4e11c608cc31d60cb591c40a7b386fa1c753336d7220a35118d4919b45eff32aab684ee54c0a263c806aabac2f66cb052f847c62c6691de14e97aa7e9dc8ecf0cd50540246d2b746e41e5b4e2c095039dfe0f71db6265f7580d098be40ef36faee5d1695830d4242a23e541e6ce9fa1998d8961ef4fe3c8e8fbb566f148c8befc229614a4b7f80d237b8abc6fc0407de31d6e5532f360d379f20f054692b47207922fe6c14eba96c9a7ae906abc1ae1ae8c4fae92883cfa1978a04bb000000000000000000000000000000884efcecca45ea4ab2ec097668456a6ff12854997f5aed737d5205ace5c0b64f87ef10784d0479cb44ca077e0c4ce6ff880e2ce3de63853a9740e9233683bfc8636bee293aeeb680b399a296e6f44c07b5fc5d9d359af007f23004a7acb6df23664ea209620b4fe0f4df81c33bd8ca2335cb4b50881937379b45a301175c3e8eb32970564ec8e25c46ee3bae079faedaad94276cfa251be8256c4c37fc84a25c3a2feb39e94a5266a10716d4a3cef499fa176018054e9149a1c9d20a809ce3"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xffffffffffffffd2}, 0x48) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x4}, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r5, &(0x7f0000000600)=[{&(0x7f0000000440)="580000001400192340834b80040d8c560a06ffffff7f000000000000000058000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01", 0x53}, {&(0x7f00000000c0)="448aa467934960", 0x7}, {&(0x7f0000000500)="6ff94c110bf3d1ed924a8ebd7436e91477bde1e95469f1bc2fa5eb8be20d487e2afc15dfe053f8333568b2d19ef9ca3e9b29ec427aaf36562c71627a919f5fd7d1035b37cb14a61497eebae7704d3b115cbf0975ad3b8d659504db629d6da901e1ca999786a9548f5566faeaa5ad0707c2c981630b194d5aeeb14b8a497254a9", 0x80}, {0x0}], 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5) r6 = dup(0xffffffffffffffff) write$UHID_INPUT(r6, 0x0, 0x0) epoll_create1(0x80000) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000040)=@filter={'filter\x00', 0xe, 0x4, 0x260, 0xffffffff, 0x0, 0x0, 0x140, 0xffffffff, 0xffffffff, 0x2f0, 0x2f0, 0x2f0, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x3, 0x9, 0x4}}}, {{@ip={@local, @loopback, 0xff000000, 0xffffffff, 'veth0_vlan\x00', 'veth1_virt_wifi\x00', {}, {}, 0x1, 0x4, 0x10}, 0x0, 0x70, 0x98}, @common=@inet=@SYNPROXY={0x28, 'SYNPROXY\x00', 0x0, {0x8, 0x1, 0xfffc}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x17}, @rand_addr=0x64010101, 0xff, 0xff, 'veth0_to_bond\x00', 'veth0_to_team\x00', {0xff}, {}, 0x11, 0x0, 0x4}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2c0) 14m41.398961547s ago: executing program 4 (id=3324): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r2, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r2, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) io_uring_enter(0xffffffffffffffff, 0x47ba, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x41) getdents64(r3, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup, 0x11, 0x700, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 14m40.582089995s ago: executing program 3 (id=3325): r0 = open(&(0x7f0000000000)='./file0\x00', 0x1a0941, 0x190) fcntl$setlease(r0, 0x400, 0x1) socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, 0x0, 0xe707) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) close(0x4) syz_open_procfs$namespace(0x0, &(0x7f0000000200)='ns/pid_for_children\x00') ioctl$SIOCPNGETOBJECT(0xffffffffffffffff, 0x89e0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) 14m40.276673182s ago: executing program 5 (id=3326): r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$AUTOFS_DEV_IOCTL_READY(r0, 0xc0189376, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f00000002c0)=@ethtool_sfeatures={0x3b, 0x2, [{0xfe, 0x80000000}, {0xfffffff9}]}}) syz_usb_connect(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004106cd40cd062a011bd50000000109022400010000800009040bfd02337761000905070200048140060905870308"], 0x0) r2 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000100), 0x800, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x2000003, 0x4008032, r2, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffa) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f00000003c0)={0x26, 'rng\x00', 0x0, 0x0, 'ansi_cprng\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000000c0)="b9da06ce171c2e7cc2a25d589ccd75d0275367048f46e1d1833f0b225d71e6ae", 0x20) accept4(r5, 0x0, 0x0, 0x80000) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{r6, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f0000000380)='%pI4 \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r7, 0xffffffffffffffff}, 0x4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000001040)={0x1f, 0x18, &(0x7f0000000080)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000010000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70500000800000085000000a500000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000000)={r9}, 0xc) 14m40.058558628s ago: executing program 1 (id=3327): syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000040)=@gcm_256={{}, "1df37f1e9402f61c", "9537a1c3df9130c8ec859ab3cb868b231ec8f47d41651c3da60731f13012bd8f", "7a9f4b71", "459c594676665db5"}, 0x38) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x7fff, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x3) r3 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x208180) ioctl$HDIO_GETGEO(r3, 0x301, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) 14m39.820419071s ago: executing program 0 (id=3328): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x118d7, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x9, 0x6, 0x0, 0x76a, 0x9, 0x7fffffff, 0x4, 0x3}, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="0100000004001000ffff00000100000001000000", @ANYRES32=0x1, @ANYBLOB="00000000f9ffffffffffff07040000000000000043a071", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000440)="822fa072a4f3cfd83c18e99be963ff23980b860ccc250aac1b8f85422f02896f51af150616fdd1e539ac2e4a899d6d7c41bf743fe3747e808991abc1e1909410a3f602a9fc3fb464e5febf3b15f3fbacc9f62226c8009dddd4f309dbea1685fb6821cb343d36b17d70ef3b1feec64165d8e018d782679874f6017d3930fcf704f098a38d86d38e6458502d2bf002895c71fa721fc05ed043a2f2549c4e74f3ef9fa6a593071f155978b8678509173d1d0ee0ca9357825be1d19c4a1dff38e1bc4298e89a1575ad83", 0x2, r3}, 0x38) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) r4 = userfaultfd(0x1) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f00000000c0), 0x121602, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000003c0)=0x11) ioctl$TCGETS(r5, 0x8910, &(0x7f00000002c0)) ioctl$UFFDIO_API(r4, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48090}, 0xc001) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000100)={{0x1, 0x1, 0x18, r0}, './file1\x00'}) setsockopt$IP_VS_SO_SET_FLUSH(r6, 0x0, 0x485, 0x0, 0x0) r7 = socket$kcm(0xa, 0x2, 0x0) socket(0x2, 0x80000, 0x0) r8 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADD(r8, 0x0, 0x482, &(0x7f0000000040)={0x84, @rand_addr=0x640100ff, 0x4e20, 0x3, 'lblc\x00', 0x1, 0xa7e, 0x70}, 0x2c) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e20, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) 14m39.688136233s ago: executing program 1 (id=3329): openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2003, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) semget$private(0x0, 0x2, 0x8) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0x18, 0x0, 0x0) setsockopt$sock_int(r1, 0x1, 0x1d, &(0x7f0000000040)=0xfffffc00, 0x4) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbee7, 0x8031, 0xffffffffffffffff, 0x4af8a000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000003f5b646cdc6f447d55"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x4, 0x8, &(0x7f00000002c0)='\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0xa00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r6}, 0x4) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000300)={r6, 0x0}, 0x20) r7 = syz_open_dev$vcsa(&(0x7f0000000080), 0x1, 0x40402) stat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000800)) sendmsg$nl_xfrm(r7, &(0x7f0000000980)={0x0, 0x0, &(0x7f0000000940)={0x0}, 0x1, 0x0, 0x0, 0x40040d0}, 0x4000040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) close_range(r7, r0, 0x0) 14m37.61926927s ago: executing program 1 (id=3330): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'lo\x00'}) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) fsopen(&(0x7f0000000040)='ocfs2_dlmfs\x00', 0x0) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=ANY=[@ANYBLOB="340000001400010000000000fbdbdf250a00a100", @ANYRES64=r0, @ANYBLOB="14000100ff05000000000000dfce00000000000108000800026e"], 0x34}}, 0x0) r6 = syz_usb_connect(0x3, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000351930404516080036cf000000010902120001000000000904"], 0x0) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, &(0x7f00000004c0)={0x24, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r7 = syz_open_dev$sndpcmp(&(0x7f0000000180), 0x0, 0xa2c65) write$snddsp(r7, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r7, 0xc2604110, &(0x7f0000000540)={0x9, [[0x10004, 0x7fffffff, 0x6, 0x1, 0x77, 0x2, 0xb9a, 0x10000], [0x2, 0x1000, 0x0, 0x200, 0x1ff, 0x8, 0x1], [0x7f, 0xd40, 0x7, 0x7, 0x0, 0x8000000, 0xff, 0x7]], '\x00', [{0x4859, 0xb, 0x0, 0x1, 0x1, 0x1}, {0x9, 0x100878a, 0x0, 0x0, 0x1, 0x1}, {0xb4, 0x4, 0x1, 0x1}, {0xc0000000, 0x9, 0x1, 0x1, 0x0, 0x1}, {0x7, 0x5, 0x0, 0x1, 0x1, 0x1}, {0x0, 0x64e, 0x0, 0x1, 0x1}, {0x1855328e, 0x8, 0x1, 0x0, 0x1, 0x1}, {0x6, 0x106b7c9c, 0x0, 0x0, 0x1}, {0x4006, 0xfffffff8, 0x1, 0x1, 0x1}, {0xb, 0x2, 0x1, 0x0, 0x1}, {0x8001, 0x0, 0x1, 0x0, 0x1}, {0x10, 0xe, 0x0, 0x1, 0x1}], '\x00', 0x7}) r8 = socket$igmp(0x2, 0x3, 0x2) syz_emit_ethernet(0x4a, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaa"], 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$MRT_TABLE(r8, 0x0, 0xd1, &(0x7f0000000000)=0xfd, 0x4) syz_usb_control_io$uac1(r6, 0x0, 0x0) socket(0x10, 0x803, 0x0) 14m37.455165468s ago: executing program 4 (id=3331): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800000000fc007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000085"], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @void}, 0x10) r0 = openat$selinux_context(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000005c0)=0x10000) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xffffffff) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000340)=r2) r3 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f0000000040)={0x1, 0x3}, 0x4) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) write$UHID_INPUT(r5, &(0x7f00000030c0)={0xfc, {"a2e3ad09ed1a09f91b37090987f70e06d038e7ff7fc6e5539b0d3d0e8b089b3f363b6c090890e0879b0a0ac6e70a9b3361959b509a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b31070d07640936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$packet_int(r3, 0x107, 0x15, 0x0, &(0x7f0000001600)) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) syz_emit_ethernet(0x46, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086ddf0fca33f00103c00fe80000000000000000000000000000000000000000000000000aa0000fd00660000003b00040005000180"], 0x0) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000600)=""/72, 0x0}) r6 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f00000000c0), 0x1, 0x0) write$tcp_congestion(r6, &(0x7f0000000100)='reno\x00', 0x5) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x17, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sysctl=0x12, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup\x00', 0x40, 0x39) bpf$BPF_PROG_ATTACH(0x8, &(0x7f00000002c0)={@cgroup=r8, r7, 0x12, 0x0, 0x0, @void, @value=0x0}, 0x20) write$tcp_congestion(r6, &(0x7f0000000300)='reno\x00', 0x5) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@map=r5, 0xffffffffffffffff, 0x12, 0x0, 0x0, @void, @value=0x0}, 0x20) write$tcp_congestion(r6, &(0x7f0000000380)='reno\x00', 0x5) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f0000000000)=0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0000000000000000010001"], 0x50) 14m37.19698772s ago: executing program 3 (id=3332): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) rt_tgsigqueueinfo(r0, r0, 0x22, &(0x7f0000000240)={0x40, 0x1d}) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) r4 = syz_open_procfs(0xffffffffffffffff, 0x0) r5 = socket(0x10, 0x80003, 0x0) write(r5, &(0x7f0000000000)="240000001a005f0214f9f4e6ff0804000a000000fe0000000000aa0008000f00fd000000", 0x24) r6 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r6, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x19a1dc757009216e) close_range(r5, 0xffffffffffffffff, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000340)={0x14, 0x26, 0x1, 0xf0bd29, 0x25dfdbfc, {0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20044002) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockname$netrom(r4, &(0x7f00000002c0)={{}, [@remote, @remote, @remote, @default, @rose, @default, @rose, @rose]}, &(0x7f0000000380)=0x48) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r9, 0x4601, &(0x7f0000000040)={0x191, 0x258, 0x1e0, 0x3f, 0x32, 0x1, 0x0, 0x0, {}, {}, {0x0, 0x0, 0x1f}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x3}) bind$bt_hci(r8, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) syz_open_dev$dri(&(0x7f0000000100), 0xff, 0x400400) write(r8, &(0x7f0000000000)="2e000300010003", 0x7) 14m36.782817926s ago: executing program 5 (id=3333): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000004180)={"2370491d", 0x0, 0x3, 0xa, 0x8, 0x5, "000064640000001503fe00", "defda28a", '\x00', 't0\x00', ['\x00', "f548000000004000000900", "00000600", "000081909d8f00"]}) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000000)=0x2004, 0xfffffffffffffd3b) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(0xffffffffffffffff, 0x10e, 0x1, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000140)={'ni_at_a2150\x00', [0xb013, 0x7, 0x0, 0xdd5, 0x88d7, 0x8f, 0x2, 0x8012, 0x1006, 0xffffffff, 0x203, 0x7, 0x10000009, 0x3, 0x5, 0xfffffffd, 0x8, 0x6, 0x9, 0x8e, 0x3, 0x3, 0x7, 0xa, 0x4, 0x1, 0xb0c4, 0xc, 0x4, 0x400002, 0x22]}) ioctl$TIOCCBRK(r3, 0x5428) connect$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, &(0x7f00000194c0)={&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000019440)=""/99, 0x63}, &(0x7f0000019500)=0x40) dup(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='jfs\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x40200) 14m36.571075964s ago: executing program 0 (id=3334): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x42, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2a0, 0xffffffff, 0x170, 0x0, 0x170, 0xffffffff, 0xffffffff, 0x208, 0x208, 0x208, 0xffffffff, 0x4, 0x0, {[{{@ip={@local, @rand_addr=0x64010100, 0xff, 0x0, 'team_slave_0\x00', 'veth1_to_bond\x00', {}, {}, 0x0, 0x0, 0x20}, 0x0, 0xb0, 0xd8, 0x0, {0x100000000000000}, [@common=@set={{0x40}, {{0x1, [0x6, 0x5, 0x5, 0x2, 0x0, 0x2], 0x9, 0x5}}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x5}}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}, {{@ip={@multicast1, @loopback, 0xff000000, 0x0, 'batadv_slave_0\x00', 'wg1\x00', {}, {}, 0x6c}, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xd8}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x300) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000200)='./file0\x00', 0x28e08a7aa33ba155) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0xc0045005, &(0x7f0000000640)=0x10) close(r4) 14m36.570176318s ago: executing program 4 (id=3335): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x110, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x4e23, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000, 0xffffffffffffffff}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x34}, [@coaddr={0x14, 0xe, @in6=@remote}, @mark={0xc, 0x15, {0x35075b, 0x3b}}]}, 0x110}}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x104, 0x1a, 0x7, 0x70bd2a, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast1, 0xffff, 0x0, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x5a, 0xb400, 0x2, 0xfeffff7f00000001, 0x0, 0x60000}, {0x9, 0x200000, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x104}}, 0x0) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x37}, @IPSET_ATTR_MAXELEM={0x8, 0x13, 0x1, 0x0, 0xed}]}, @IPSET_ATTR_TYPENAME={0x10, 0x3, 'hash:ip,mac\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x0) 14m36.01749622s ago: executing program 4 (id=3336): socket$netlink(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000200)=@abs={0x1, 0x0, 0x4e23}, 0x6e) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x27, &(0x7f0000000340)=0x9, 0x4) socket$tipc(0x1e, 0x5, 0x0) syz_open_dev$hiddev(&(0x7f0000000100), 0x8000000000000001, 0x40) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000180), 0x20801, 0x0) write$rfkill(r1, &(0x7f0000000100)={0x0, 0x2, 0x3, 0x1, 0x1}, 0x8) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000b80)={0x44, &(0x7f0000000680)={0x40, 0xe, 0x1, "01"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 14m34.926920187s ago: executing program 4 (id=3337): socket$inet6(0xa, 0x3, 0x2) r0 = syz_open_dev$video(0x0, 0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x25, &(0x7f0000000340)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f0000002080)=0x58, 0x21c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) futex(0x0, 0x5, 0xfffc, 0x0, 0x0, 0x2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x200, 0xfffffffd, @empty, 0x1}, 0x1c) syz_emit_ethernet(0xf16, &(0x7f0000000700)=ANY=[@ANYRES64=r4, @ANYRESHEX=r0, @ANYRES32=r5, @ANYRES16=r3, @ANYRES64=r4, @ANYRES64, @ANYRESHEX=r4, @ANYRES8=r2, @ANYRESHEX=r1, @ANYRES16=r5], 0x0) r6 = dup(r5) r7 = open(&(0x7f00000000c0)='./file0\x00', 0x1298c2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000016c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000001ac1e000100000000000000000000000000000000000000000a00300000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000300000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001000000000000004400050000000000000000000000ffffe0000002000000003c00000002000000000000000000000000000015a1d14f0000000000043500000403000000000000feffffff00000200"], 0xfc}}, 0x0) ftruncate(r7, 0x200004) sendfile(r6, r7, 0x0, 0x80001d00c0d1) 14m34.907422749s ago: executing program 3 (id=3338): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x6, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) close(0xffffffffffffffff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x82) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, &(0x7f0000000140)=@urb_type_control={0x2, {}, 0x20020009, 0x0, &(0x7f0000000240)={0x20, 0x0, 0xfffc, 0x360, 0x7}, 0x8, 0x7, 0x60000000, 0x0, 0x0, 0x101, 0x0}) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000880)=0x3) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r3 = io_uring_setup(0x15dc, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) r4 = dup2(0xffffffffffffffff, r3) recvmsg$can_j1939(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}], 0x1, &(0x7f0000000340)=""/47, 0x2f}, 0x2060) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006000100d10300000c000440000000000000000114000000110001"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100ff"], 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 14m34.582930642s ago: executing program 1 (id=3339): syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_tcp_TLS_RX(0xffffffffffffffff, 0x6, 0x2, &(0x7f0000000040)=@gcm_256={{}, "1df37f1e9402f61c", "9537a1c3df9130c8ec859ab3cb868b231ec8f47d41651c3da60731f13012bd8f", "7a9f4b71", "459c594676665db5"}, 0x38) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000004, 0x1000000000, 0x5, 0x41, 0x2000000, 0x7fff, 0x2004cb, 0x0, 0xa1d, 0x68ff, 0x5, 0x0, 0x3, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x3) r3 = syz_open_dev$ndb(&(0x7f0000000080), 0x0, 0x208180) ioctl$HDIO_GETGEO(r3, 0x301, &(0x7f00000000c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r4 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r4, 0x40186f40, &(0x7f0000000440)=0x1f) 14m34.507308879s ago: executing program 0 (id=3340): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x6, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) close(0xffffffffffffffff) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x8000000000001, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_open_dev$usbfs(0x0, 0x204, 0x82) ioctl$USBDEVFS_SUBMITURB(r2, 0x8038550a, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000880)=0x3) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = io_uring_setup(0x15dc, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x0, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x50) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = dup2(0xffffffffffffffff, r3) recvmsg$can_j1939(r4, 0x0, 0x2060) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[@ANYBLOB="1400000010000100f7000000000000000500000a44000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000340000000144c0000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a3100"], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETSETELEM(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="480000000d0a010800000000000000000a0000010900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100ff"], 0x48}, 0x1, 0x0, 0x0, 0x4000805}, 0x8000) 14m34.235869096s ago: executing program 5 (id=3341): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) io_uring_enter(0xffffffffffffffff, 0x47ba, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x41) getdents64(r2, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup, 0x11, 0x700, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 14m34.17199744s ago: executing program 3 (id=3342): r0 = open(&(0x7f0000000000)='./file0\x00', 0x1a0941, 0x190) fcntl$setlease(r0, 0x400, 0x1) socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, 0x0, 0xe707) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) close(0x4) sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x400c001) ioctl$SIOCPNGETOBJECT(0xffffffffffffffff, 0x89e0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) 14m33.834422176s ago: executing program 1 (id=3343): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000140)={{0xd}, 0x1, 0x0, 0x5, {0x0, 0x2}, 0xfe, 0x6}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)=@generic={&(0x7f0000000200)='./file0\x00'}, 0x18) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000700)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000380)='\x00', &(0x7f0000000e00), 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x1c9081, 0x0) setpriority(0x0, 0x1, 0xa7a8) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xb, 0x9}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x8, 0xfff9}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) statx(0xffffffffffffffff, &(0x7f0000008b40)='\x00', 0x3000, 0x200, 0x0) r8 = dup(r0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x24, 0x0, 0x0) 14m33.461238481s ago: executing program 0 (id=3344): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0xfffffcdc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) r3 = getuid() ioctl$SIOCAX25GETUID(r2, 0x89e0, &(0x7f00000006c0)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r3}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090000000000000000000000850000002a000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='sys_exit\x00', r5}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x58240, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNGETVNETLE(r6, 0x800454dd, &(0x7f0000000480)) ioperm(0x0, 0x2, 0x7e) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000300), &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa2, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000480), &(0x7f0000000500), 0x8, 0x8f, 0x8, 0x8, &(0x7f0000000540)}}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x19, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x6}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffff}, 0x10, r7}, 0x94) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='&'], 0x10) r10 = getpid() sched_setscheduler(r10, 0x2, 0x0) ptrace$getregs(0xc, r10, 0x4, &(0x7f0000000240)=""/65) syz_usb_connect(0x0, 0x34, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000094ba78084e080110aeed010203010902220001000000000904"], 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r9, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r4}, 0x20) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) 13m57.938274942s ago: executing program 33 (id=3344): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0xfffffcdc) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x8) r3 = getuid() ioctl$SIOCAX25GETUID(r2, 0x89e0, &(0x7f00000006c0)={0x3, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, r3}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r4, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x5, &(0x7f0000000100)=ANY=[@ANYBLOB="18000000090000000000000000000000850000002a000000850000000e00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000040)='sys_exit\x00', r5}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000300), 0x58240, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) ioctl$TUNGETVNETLE(r6, 0x800454dd, &(0x7f0000000480)) ioperm(0x0, 0x2, 0x7e) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000680)={0xffffffffffffffff, 0xe0, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000002c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, &(0x7f0000000300), &(0x7f0000000400)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa2, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000480), &(0x7f0000000500), 0x8, 0x8f, 0x8, 0x8, &(0x7f0000000540)}}, 0x10) r8 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x19, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x8, &(0x7f0000000080)={0x6}, 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffff}, 0x10, r7}, 0x94) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r9, @ANYRES32=r8, @ANYBLOB='&'], 0x10) r10 = getpid() sched_setscheduler(r10, 0x2, 0x0) ptrace$getregs(0xc, r10, 0x4, &(0x7f0000000240)=""/65) syz_usb_connect(0x0, 0x34, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000094ba78084e080110aeed010203010902220001000000000904"], 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r9, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r4}, 0x20) recvmmsg(r4, &(0x7f0000000b80)=[{{0x0, 0xffffffffffffff6c, 0x0, 0x0, 0x0, 0x52}, 0xa}], 0x360, 0x120, 0x0) 13m57.794396946s ago: executing program 34 (id=3343): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_SUBS(r1, 0xc058534f, &(0x7f0000000140)={{0xd}, 0x1, 0x0, 0x5, {0x0, 0x2}, 0xfe, 0x6}) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000300)=@generic={&(0x7f0000000200)='./file0\x00'}, 0x18) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000700)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, &(0x7f0000000380)='\x00', &(0x7f0000000e00), 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x1c9081, 0x0) setpriority(0x0, 0x1, 0xa7a8) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) setsockopt$inet_udp_encap(r2, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @rand_addr=0x64010101, @dev={0xac, 0x14, 0x14, 0x21}}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xb, 0x9}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x8, 0xfff9}}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r7, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) statx(0xffffffffffffffff, &(0x7f0000008b40)='\x00', 0x3000, 0x200, 0x0) r8 = dup(r0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x24, 0x0, 0x0) 13m57.715508857s ago: executing program 35 (id=3341): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e23}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r1 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r1, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r1, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x2007, @fd, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) io_uring_enter(0xffffffffffffffff, 0x47ba, 0x0, 0x0, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x41) getdents64(r2, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup, 0x11, 0x700, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) 13m57.642818492s ago: executing program 36 (id=3342): r0 = open(&(0x7f0000000000)='./file0\x00', 0x1a0941, 0x190) fcntl$setlease(r0, 0x400, 0x1) socket$packet(0x11, 0x3, 0x300) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$rds(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$unix(r1, 0x0, 0xe707) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) close(0x4) sendmsg$DEVLINK_CMD_PORT_SET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x5}, 0x400c001) ioctl$SIOCPNGETOBJECT(0xffffffffffffffff, 0x89e0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0) 13m57.531589261s ago: executing program 37 (id=3337): socket$inet6(0xa, 0x3, 0x2) r0 = syz_open_dev$video(0x0, 0x8, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x25, &(0x7f0000000340)=0x1400200bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r3 = openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r3, r2, &(0x7f0000002080)=0x58, 0x21c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) futex(0x0, 0x5, 0xfffc, 0x0, 0x0, 0x2) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r5, &(0x7f0000000200)={0xa, 0x200, 0xfffffffd, @empty, 0x1}, 0x1c) syz_emit_ethernet(0xf16, &(0x7f0000000700)=ANY=[@ANYRES64=r4, @ANYRESHEX=r0, @ANYRES32=r5, @ANYRES16=r3, @ANYRES64=r4, @ANYRES64, @ANYRESHEX=r4, @ANYRES8=r2, @ANYRESHEX=r1, @ANYRES16=r5], 0x0) r6 = dup(r5) r7 = open(&(0x7f00000000c0)='./file0\x00', 0x1298c2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000016c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000001ac1e000100000000000000000000000000000000000000000a00300000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000300000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f40000200000000000008010000000000000001000000000000004400050000000000000000000000ffffe0000002000000003c00000002000000000000000000000000000015a1d14f0000000000043500000403000000000000feffffff00000200"], 0xfc}}, 0x0) ftruncate(r7, 0x200004) sendfile(r6, r7, 0x0, 0x80001d00c0d1) 15.419005687s ago: executing program 2 (id=5683): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="1801000001010102000000000000000002000008a80001801400018008000100ac14141a08000200640101022c00018014000300fe80000000000000000000000000002714000400fc0100000000000000000000000000011400018008000100e000000208000200e00000010c000400000001003a00000006000340000200002c00018014000300fc01000000000000000000000000000114000400fe880000000000000000000000000001060003400000000006000340000100003c000d8014000500fe8000000000000000000000000000bb14000400fc00000000000000000000000000000008000200ac1414bb08000200800000001800048014000380080002400000f9040500009fb301000000000008000c4000"], 0x118}, 0x1, 0x0, 0x0, 0x4000881}, 0x8000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000240)={0x0, 0xebcc, 0x1, 0x2, 0x24e}, &(0x7f00000000c0)=0x0, &(0x7f0000000380)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x40, 0x0, 0x80, 0x3, 0x0, 0x9276, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x47bc, 0x3bf6, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000240)={'batadv_slave_1\x00', &(0x7f0000000140)=@ethtool_eeprom={0xc, 0x1, 0x9}}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={0x1}, 0x4) 14.569648021s ago: executing program 9 (id=5686): syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) recvmmsg(r2, &(0x7f00000011c0), 0x0, 0x20000, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r1, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000001dc0)=""/69, 0x45}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) read$msr(r0, &(0x7f0000004c00)=""/102392, 0x18ff8) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') 11.221868716s ago: executing program 6 (id=5692): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x1, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18002300000000000800000000080000b7080000005cd60b95460000007b8af8ff000000009408000000001700638af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb7020000080000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000008000000850000006900000095"], &(0x7f0000005d80)='syzkaller\x00', 0xc, 0x0, 0x0, 0x41100}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) io_submit(0x0, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x2002000000, 0x4, 0x0, 0x1, 0x0, r3, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x2}]) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) readv(r4, 0x0, 0x0) r5 = socket(0x400000000010, 0x3, 0x0) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30b529, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x0, 0x4}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0xfffffffffffffffd, 0xa, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r8 = openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000280), 0x12800, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x13, 0x13, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000ff07000000000020020000001415b15e", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018330000030000000000000000000000950000000000000085000000d1000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, &(0x7f0000000240), 0x40f00, 0x0, '\x00', r7, @fallback, r8, 0x8, &(0x7f0000000300)={0xa, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x1, 0x10, 0x8, 0xb68}, 0x10, 0x0, r2, 0x9, &(0x7f00000003c0)=[r1, r2], &(0x7f0000000500)=[{0x5, 0x4}, {0x4, 0x3, 0x9, 0x1}, {0x4, 0x5, 0xd, 0x4}, {0x4, 0x2, 0x4, 0x7}, {0x0, 0x5, 0xe, 0x1}, {0x2, 0x1, 0x3, 0x1}, {0x0, 0x1, 0x1, 0x4}, {0x5, 0x5, 0x3, 0xa}, {0x4, 0x1, 0x9, 0x8}], 0x10, 0x1}, 0x94) r9 = socket$nl_generic(0x10, 0x3, 0x10) pipe(&(0x7f0000000080)) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010025bd70018000002505000000080003"], 0x24}, 0x1, 0x0, 0x0, 0x20000065}, 0xc000) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000200)=r2, 0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000680)={0x0, 0xffffffffffffffff, 0x0, 0x9}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x1b, 0x0, 0x0, &(0x7f0000000280)='GPL\x00', 0x6, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r11 = getpid() sched_setscheduler(r11, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) 10.557917016s ago: executing program 8 (id=5693): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r5, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[], 0x18}}, 0x880) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000001c0)={@dev={0xfe, 0x80, '\x00', 0x2a}, 0x91ee, 0x1, 0x1, 0x0, 0x2, 0x80}, &(0x7f00000002c0)=0x20) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(0xffffffffffffffff, 0x84, 0x66, &(0x7f0000000080)={0x0, 0xddf}, &(0x7f00000000c0)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) io_uring_setup(0x4aec, &(0x7f0000000140)={0x0, 0x81fa, 0x82, 0x1, 0x20}) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000440)=ANY=[@ANYBLOB="6c000000020601000000000600000000000000000e0003006269746d61703a697000000005000400000000000900020073797a3000000000240007800c00028008000140ac1414280c0001800800244080ffffff050014100200000005000500020000000500010006000000991208b0149f3ffb5c3830d231ffd3ab9571b5504ff2a2ef1167c0b3a1771d1614d0d62059db6f003397a7a13490d043bafb6050e29ce6a00f441b06149bf6512a832cf85ca0c857850a946d505dbf9e26514265245c85a84b629563eda16b04dde5147278e19bd7ad12dc5baab40a2d832e6fe19ab6f74cf5e51e7b"], 0x6c}}, 0x40000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) 10.452284875s ago: executing program 7 (id=5694): socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x1e4011, 0x0) r1 = socket$kcm(0x10, 0x2, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, 0x0, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000002c0)="2e00000010008188040f80ec59acbc0413010048100000005e140602000000000e000a000f00000002", 0x29}, {&(0x7f0000000100)="c40ad38ae96bf7e8ef19243a4a63c9ede45421a4cc1ea4504d47866824674eaddcad792a2f1f58188c59fff4b1fb0b49630d4e7f229064316790a791", 0x3c}], 0x2}, 0x4) r2 = fanotify_init(0x20, 0x40000) setreuid(0xffffffffffffffff, 0xee00) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x8, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) r3 = socket$packet(0x11, 0x2, 0x300) r4 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000004c0)={r5, 0x3, 0x6, @random="5e1cf8b4c253"}, 0x10) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r6, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000040)={0x2, [0x3, 0x1]}, 0x8) getsockopt$inet_sctp6_SCTP_HMAC_IDENT(r6, 0x84, 0x16, &(0x7f0000000040)={0x2, [0xc, 0x6]}, &(0x7f00000000c0)=0x8) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f00000000c0)={r5, 0x3, 0x6, @random="cea0300a1672"}, 0x10) dup2(0xffffffffffffffff, r3) fanotify_mark(r2, 0x1, 0x3, 0xffffffffffffffff, &(0x7f0000000000)='./file0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0xa, 0x4, 0x4, 0xc, 0x0, 0xffffffffffffffff, 0x6}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000007b00000018110000", @ANYRES64, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000010b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r7}, 0x10) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) 10.003762935s ago: executing program 7 (id=5695): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) socket$kcm(0x23, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) write$tun(r3, &(0x7f0000000380)=ANY=[], 0x78) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB, @ANYRES32=r2], 0x24}}, 0x0) 9.734676299s ago: executing program 6 (id=5696): r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) fsopen(&(0x7f0000000240)='ramfs\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r5 = signalfd(0xffffffffffffffff, &(0x7f00007aeff8)={[0xfffffffffffffffe]}, 0x8) read(r5, &(0x7f0000000740)=""/384, 0x200008c0) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r6) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) r7 = syz_open_dev$midi(&(0x7f00000001c0), 0xac, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r7, 0xc0205710, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r2, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x800) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x402) setsockopt$X25_QBITINCL(r0, 0x106, 0x1, &(0x7f0000001fc0), 0x4) 9.140772771s ago: executing program 8 (id=5697): r0 = socket$kcm(0xa, 0x2, 0x0) r1 = socket(0x2, 0x80805, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x84, @multicast2, 0x4e24, 0x3, 'sh\x00', 0x29, 0x80005, 0x6f}, 0x2c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) socket$packet(0x11, 0x2, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) sendmsg$IPCTNL_MSG_CT_GET_STATS(0xffffffffffffffff, 0x0, 0x40040) add_key(0x0, 0x0, &(0x7f0000000000)="100c0608262300", 0x7, 0xfffffffffffffffc) sendmsg$ETHTOOL_MSG_PAUSE_SET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x34, r3, 0x1, 0x0, 0x0, {0x23}, [@ETHTOOL_A_PAUSE_HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'nr0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}]}, 0x34}}, 0x0) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@private=0xa010101, 0x4e20, 0x10000, 0xf8}}, 0x44) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000080)=@hopopts={0x62, 0x2, '\x00', [@hao={0xc9, 0x10, @empty}]}, 0x20) sendmsg$sock(r0, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x3e8, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r7, 0xffffffffffffffff, &(0x7f0000fda000/0x18000)=nil, &(0x7f0000000000)=[@text32={0x20, &(0x7f00000003c0)="b805000000b9fa000000660f78c4020a1bf7b805000000c4c21dbf3d5a5600000fae41d901000000b87f8b7f260f21c30f30b8010000000f01d966ba4100ed0f320f3566b857dee300e300d0", 0x4c}], 0x1, 0x0, 0x0, 0x0) 9.011648904s ago: executing program 7 (id=5698): r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket(0x200000000000011, 0x2, 0xd) bind$packet(r1, &(0x7f0000000080)={0x11, 0x800, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) setsockopt$packet_fanout(r1, 0x107, 0x12, &(0x7f0000000140)={0x0, 0x8000}, 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000180)={@remote, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x8}}}}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000440)=@raw={'raw\x00', 0x8, 0x3, 0x4c8, 0x170, 0xffffffff, 0xffffffff, 0x170, 0xffffffff, 0x3f8, 0xffffffff, 0xffffffff, 0x3f8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0x148, 0x170, 0x0, {}, [@common=@unspec=@helper={{0x48}}, @common=@inet=@hashlimit1={{0x58}, {'bond_slave_1\x00', {0x41, 0x1ff, 0x6, 0xb0e2, 0x10001, 0x84e, 0xfffffffb, 0x18, 0x8}, {0x1}}}]}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'erspan0\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'vcan0\x00', {0x3, 0x0, 0x41, 0x0, 0x2, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x528) getsockopt$packet_int(r0, 0x107, 0xf, &(0x7f00000001c0), &(0x7f0000000240)=0x4) r2 = creat(&(0x7f00000002c0)='./file0\x00', 0x101) r3 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x81) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs$pagemap(0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) bpf$MAP_CREATE(0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x32, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff0f0000}, 0x0) r6 = io_uring_setup(0x1148, &(0x7f0000000300)={0x0, 0xc95e, 0x1, 0x2, 0x30f}) io_uring_register$IORING_REGISTER_BUFFERS(r6, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) writev(r2, &(0x7f0000000100)=[{&(0x7f0000000300)="d88b9593204eeb", 0x7}], 0x1) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r7, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000004c0)=[0x6], 0x0, 0x0, 0x1}}, 0x40) syz_emit_ethernet(0x5e, &(0x7f0000000d00)={@local, @remote, @void, {@ipv6={0x86dd, @tipc_packet={0x6, 0x6, "df3151", 0x28, 0x6, 0x1, @empty, @private1={0xfc, 0x1, '\x00', 0x1}, {[], @payload_named={{{{{0x28, 0x0, 0x0, 0x1, 0x1, 0xa, 0x3, 0x2, 0x4c, 0x0, 0x2, 0x8, 0x2, 0x2, 0x4fd, 0x0, 0x4, 0x4e22, 0x4e20}, 0x4}, 0x1, 0x1}}}}}}}}, 0x0) 8.253202387s ago: executing program 2 (id=5699): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000064c0)={0x2, 0x0, [{0x41000, 0x1a, &(0x7f0000001500)=""/26}, {0x70000, 0x50, &(0x7f0000006440)=""/80}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000800, 0x0, &(0x7f00000001c0)={0x10004, 0xfffffffffffffffb, 0xc825, 0xffffffffffffffff, 0x2, 0xa, 0x28a7, 0x9, 0x9}) ioctl$HIDIOCGUSAGES(r1, 0xd01c4813, &(0x7f0000006540)={{0x2, 0x2, 0x0, 0x9, 0x5, 0x4}, 0x336, [0x34, 0x9, 0xfffffff7, 0x8, 0x5ff90, 0x1, 0x0, 0x9, 0x0, 0x5, 0x6, 0x81, 0x9, 0x4, 0x2, 0x2, 0x6, 0xd, 0x7, 0x1, 0x7, 0x40, 0x10, 0x299, 0x2, 0x8b, 0x8, 0x25, 0x7, 0x80, 0x9, 0x4, 0x3e, 0xffff, 0x3fa, 0x9, 0x99d, 0x7, 0x3, 0x5, 0xee0, 0xd8, 0xfffffffb, 0x1, 0x58, 0x8001, 0x80000000, 0x5, 0x5b6c, 0x6, 0x0, 0x9, 0x8, 0xc6c, 0x7fff, 0xff, 0x8000, 0x2, 0x1, 0x800, 0x3, 0x4, 0x7, 0x8, 0x1000, 0x5, 0xfffffffc, 0x1, 0x3ff, 0x5, 0xfff, 0x5, 0x7fffffff, 0xd, 0x4f67, 0x5b7f, 0xfffffffc, 0x6, 0x1, 0x6, 0x10000, 0x5, 0xfcb, 0x1800, 0xfff, 0xe0000000, 0x1, 0x2c1e, 0x1, 0x502, 0x2f147a22, 0x9, 0x831, 0x5, 0x0, 0x8000, 0xfffff43b, 0x8, 0x8001, 0x1, 0x10001, 0x1d800, 0x7, 0x0, 0x2, 0x3ff, 0xd3a, 0x0, 0x8, 0x10001, 0x3, 0x8, 0x86f8, 0x8, 0x4e19, 0x4, 0x17d2, 0x3, 0xd, 0x0, 0xc7fc, 0x4, 0xcbb, 0x7, 0xb, 0xb0, 0x0, 0x0, 0x10000, 0x5, 0x3, 0x1ff, 0xcc25, 0x4, 0x2, 0x7, 0x5, 0xfffffffb, 0x53bb, 0x4, 0x9, 0x4, 0xfffffe01, 0x9, 0x6, 0xa, 0x7, 0x1, 0xf, 0x80000001, 0x80000001, 0xfffffffe, 0x1ff, 0x0, 0x1, 0xd6, 0x8d34, 0x5d, 0x0, 0xd, 0x0, 0xffff, 0x5, 0xe2bf, 0x0, 0x2, 0x4, 0x9, 0xff, 0x6, 0x0, 0x8, 0x6, 0x4, 0x2, 0x1, 0x7, 0x8, 0x4f1, 0x0, 0x1, 0x8, 0x8, 0x0, 0x8001, 0x7, 0x4, 0x4, 0x8001, 0x7, 0x4, 0xff, 0x5, 0x5, 0xffffffc0, 0x2, 0x7f, 0x700, 0x48, 0x5, 0x1, 0x3, 0x44f, 0x2, 0xff3, 0x9, 0x0, 0x2, 0x3, 0x2, 0x7fffffff, 0x531, 0x2ed, 0x86c, 0x1d, 0x269, 0x6, 0x531e, 0x8, 0x2, 0x9, 0xb0000000, 0x5, 0x1, 0x4, 0xf, 0x9, 0x8, 0x7b22baff, 0x7, 0x2, 0x40, 0x1, 0xffffff17, 0x9, 0x80, 0x965, 0x2, 0x200, 0x3, 0x5, 0xafd1, 0x4, 0x3, 0x1, 0x1, 0x2, 0xfff, 0x4, 0x401, 0x57a, 0x9, 0x4, 0x7b3, 0x10001, 0x80000000, 0x6, 0x7, 0x8, 0x41b, 0x77, 0x101, 0x3, 0x2, 0x215, 0x39, 0x8, 0x9, 0x4, 0x1, 0xfffffffd, 0x5, 0x3, 0x3, 0x8, 0x2, 0x8, 0x0, 0x1000, 0x7d4a, 0xa, 0x8, 0x6, 0x1c0000, 0x3, 0xfff, 0x9d, 0x5, 0xb, 0x5, 0x2, 0x1, 0x1, 0x2, 0x4, 0xbda, 0x4, 0x100, 0x8, 0x1, 0xfffffff9, 0x7, 0x5, 0xffffffff, 0x6, 0x5, 0xada6, 0x6, 0x80000000, 0x5, 0x100, 0x5, 0xfac8, 0x8, 0x200, 0x7, 0x3, 0x81, 0x5, 0xe, 0x9, 0x200000, 0x7ff, 0x401, 0x0, 0x1, 0x1, 0xff, 0x4, 0x0, 0xd, 0xe, 0xf9, 0x526, 0x7ac5, 0x400, 0x1, 0x0, 0x10001, 0x8, 0x401, 0xc4a0, 0x6, 0x3, 0x3, 0x9, 0xf, 0x35, 0x0, 0x7fffffff, 0x4d, 0xfff, 0x4, 0x9, 0xb0be, 0xffff, 0x4, 0x268, 0x10000, 0x5, 0x962, 0x3, 0xe, 0x4, 0x8, 0x3, 0x8, 0x2, 0x1, 0xffffff30, 0x10000, 0x9, 0x10001, 0x9, 0x7, 0xf, 0xc, 0xffff, 0xf, 0xb2e, 0x7, 0x7fff, 0xa66a, 0xa, 0x6, 0x8001, 0xa, 0xb, 0x80000000, 0xd985, 0x10001, 0x8, 0x5, 0xfffffff9, 0x1, 0xf3d, 0xa54d, 0x1, 0x5, 0x0, 0x8001, 0x9, 0x4, 0xa23, 0x7ff, 0xec, 0x1ff, 0xc, 0x80000000, 0xb, 0x3, 0x9, 0x1, 0x36, 0x1, 0x8001, 0x7, 0x4e3, 0x200, 0x2, 0x6, 0x8000, 0x56f, 0x0, 0x8, 0x7f, 0x7, 0x7f, 0x7, 0x974, 0x0, 0x8, 0x4000400, 0x2, 0x5, 0x6, 0x3, 0x80, 0x6, 0x6, 0x4, 0x1, 0x8, 0x2, 0x7f, 0x100, 0xe, 0xb, 0x2, 0x1, 0x8, 0x66, 0x6, 0x6, 0x80000001, 0x8, 0x9, 0xe, 0x2, 0x10, 0x4, 0x7, 0x0, 0x4, 0x8, 0xf, 0xffff, 0x9, 0x8001, 0x1, 0x101, 0x2, 0x8, 0x6, 0x6, 0x9, 0x40, 0x0, 0x1, 0xfffffffe, 0xfffffffc, 0x1, 0x3f48, 0x7fff, 0x4, 0x400, 0xa85f, 0x41b86c96, 0x7f3b, 0x8001, 0x4, 0x7, 0x3, 0x8000, 0x3, 0x8001, 0x2, 0x100, 0x2, 0x8, 0x5, 0x3ff, 0x1, 0x1, 0x1, 0x94b, 0x80000000, 0x6, 0x100, 0x7, 0xb, 0x8, 0x7, 0x4, 0x6, 0x7fffffff, 0x3, 0xb3f, 0xe9b, 0x3, 0x6, 0x81, 0x5, 0xfb35, 0xfffffff7, 0xb, 0x800, 0x0, 0x6, 0x0, 0x8, 0x6, 0x9, 0x5251, 0x1, 0xe4c, 0x1, 0x42, 0x5, 0x1, 0x7, 0xfff, 0x3, 0x8, 0x1, 0x7, 0x4, 0x1, 0x0, 0xffff, 0x9, 0xe, 0x0, 0x2, 0x2, 0x0, 0x43, 0xc, 0x800, 0x6, 0x1, 0x6, 0xf, 0x12dd, 0x1, 0x7, 0x7f, 0x3, 0x9, 0x9, 0xfffffff8, 0x3, 0x7, 0x24bf, 0x4, 0x5, 0xde11, 0x7f, 0x2, 0x80000001, 0x81, 0x5, 0x200, 0xe, 0xf, 0x6, 0xffffffff, 0x6, 0x3, 0x8b54, 0xfffffff7, 0x7, 0x1, 0x8, 0x97a9, 0x4, 0x10000, 0x119, 0xedaa, 0x7fff, 0x6000, 0x1, 0xe, 0x0, 0x8, 0x2, 0x7fff, 0x70e, 0x5, 0x7, 0x10, 0x7, 0x81, 0x1, 0x1, 0x6, 0x1, 0x9, 0x5b1, 0x1, 0xffffffc0, 0x8, 0x6, 0x9, 0x5, 0x6, 0x7, 0x0, 0x3, 0x2, 0x9, 0x8001, 0x2, 0xff, 0x1, 0x3, 0xaa, 0x39a3e6e9, 0xfffffff7, 0x6, 0x8000, 0x8, 0x37, 0x400, 0x8001, 0x7, 0x3, 0x0, 0x7, 0x1fc00000, 0x4ab3, 0x1ad, 0x8, 0x0, 0x4, 0xb, 0x8, 0x8, 0x8, 0x4, 0x180, 0x10b0, 0x3, 0x6, 0x9, 0x1000, 0x40, 0xfffffffe, 0x7f, 0x6, 0xd, 0x0, 0x2, 0x1, 0x1, 0x4, 0xfff, 0x3, 0x3, 0x1, 0x2400, 0xfc, 0x37, 0x0, 0x3, 0xffffffff, 0x200, 0x74, 0x8, 0x1, 0x5, 0x8, 0x2, 0x80, 0x67, 0xfffffff8, 0x8, 0x0, 0xd13, 0x3, 0x5, 0x2, 0x8, 0xd6, 0x3, 0x10, 0x2, 0x9, 0x8, 0x7, 0x5, 0x8, 0x2d, 0x81, 0xfffffffd, 0x0, 0x9, 0x145b, 0x69e, 0xa, 0x3, 0x7ff, 0x80, 0xcfdf, 0x88, 0x9, 0xb5, 0x5, 0x101, 0x6, 0x1e00, 0x7, 0x1, 0x6, 0x8000, 0x7, 0x8, 0x0, 0x9, 0xfffffffe, 0x5, 0x5, 0xfffffff8, 0x101, 0x2, 0xfffffffc, 0x158, 0x140, 0x5, 0x8, 0xfffffffc, 0x4, 0x2, 0x5, 0x5, 0x7, 0x1, 0x80000000, 0x0, 0x2c95, 0x9, 0x2, 0x18000, 0x9, 0x200, 0xfff, 0x7f, 0x3, 0x4f, 0x6, 0x5ba51650, 0x9, 0x40, 0x64, 0x8, 0xfffffffa, 0x7f, 0x0, 0x1, 0xc0, 0x3, 0x5, 0x62e6c5a3, 0x2, 0xe2, 0x0, 0x7, 0x4, 0x9, 0x101, 0x0, 0x7fffffff, 0x9, 0x996, 0x5, 0x20000000, 0x80, 0x8, 0x65d6, 0x736, 0x8000, 0x8e, 0x7f, 0x6e95, 0x2, 0x8001, 0xf, 0x7, 0xc76, 0x1, 0xfffffff3, 0x7, 0x8, 0x5, 0x0, 0x2, 0x1661, 0x9ba, 0x2, 0xfffffff9, 0x8, 0x7, 0x6, 0x3ff, 0x9, 0x2, 0x0, 0x1, 0x5, 0x2, 0x0, 0x0, 0xff, 0x576, 0xffffffff, 0x6, 0x3c7d, 0x2, 0x0, 0x8, 0x3a309d23, 0xd0, 0x1, 0x8, 0xfffffbff, 0xffff, 0xc, 0x8001, 0x2, 0xe968, 0x2, 0x7, 0xeab, 0x9, 0xc, 0xff, 0x6, 0x0, 0x9, 0x5, 0xf2, 0x0, 0x3ff, 0x23f9, 0x6030, 0x101, 0xbe5, 0x2005e128, 0x80000000, 0x7ff, 0xc669, 0x80000000, 0xd, 0x400, 0xb9, 0x3, 0xc39, 0x105, 0x8, 0xd, 0x6, 0xfffffff8, 0x10001, 0x3622ae81, 0x0, 0x3, 0xc, 0x6, 0x40, 0xa5e, 0x8, 0x6, 0x4, 0xd6d, 0xa, 0x6, 0x0, 0x5, 0x3, 0x5, 0x2, 0x3, 0xfffffff7, 0xffffffff, 0x4, 0x4, 0x3, 0x7fff, 0x4, 0x6, 0x3, 0x5, 0x2, 0xfffffff2, 0x4, 0xfffff000, 0x7, 0x0, 0x163, 0xff, 0xff, 0x10000, 0x1, 0x7, 0xff, 0x80, 0x6, 0x2, 0x101, 0x6, 0x0, 0x0, 0x380000, 0x3, 0x0, 0x9, 0x7fffffff, 0x5, 0x5, 0x7, 0x0, 0x3, 0x602, 0x7, 0x8, 0x16, 0x6, 0x8, 0x0, 0xa, 0xb29, 0x3ff, 0xb7, 0x5, 0x80000000, 0x7, 0x2, 0x4, 0xa29, 0x7fffffff, 0x7, 0xac, 0x2, 0x0, 0xb0, 0x8, 0xcfd, 0x8000, 0x8, 0xe9b, 0x6, 0x868, 0xf, 0xd556, 0x0, 0x8, 0xfffffffd, 0x3ee0, 0x5, 0x6, 0xd6d0000, 0xe, 0x80000001, 0xfffff800, 0x5, 0x8, 0x7, 0xffffffff, 0x7, 0x2, 0x8, 0x4, 0x4, 0x9, 0xfff, 0x81, 0x0, 0x8, 0xc000000, 0x6, 0x1, 0x2, 0x3, 0x1, 0xd12, 0x7, 0x2, 0x0, 0x10, 0x1258, 0x401, 0x10, 0x1, 0x8, 0x7, 0x7, 0x8, 0x1, 0x0, 0x0, 0x5, 0x3, 0x7, 0x7fffffff]}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) write(0xffffffffffffffff, &(0x7f00000002c0), 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000001c0), 0x2482, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r3}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_FLUSH(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r6, @ANYBLOB="0100000000000000000011"], 0xc4}}, 0x40004) sendmsg$IPVS_CMD_SET_SERVICE(r5, &(0x7f0000001800)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x8040080}, 0xc, &(0x7f00000017c0)={&(0x7f0000001840)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="010028bdbeb27000fddbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4000000) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000040)='xfs\x00', 0x800000, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) recvmmsg(r0, &(0x7f0000006240)=[{{&(0x7f0000000040)=@l2tp, 0x80, &(0x7f0000001380)=[{&(0x7f0000000100)=""/158, 0x9e}, {&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/213, 0xd5}, {&(0x7f00000012c0)=""/165, 0xa5}], 0x4, &(0x7f00000013c0)=""/58, 0x3a}}, {{&(0x7f0000001400)=@ieee802154, 0x80, &(0x7f0000001580)=[{&(0x7f0000001480)=""/118, 0x76}, {&(0x7f00000063c0)=""/65, 0x41}], 0x2, &(0x7f00000015c0)=""/247, 0xf7}, 0x401}, {{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000016c0)=""/134, 0x86}, {0x0}], 0x2, &(0x7f00000027c0)=""/213, 0xd5}, 0xfb}, {{&(0x7f00000028c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000002980)=[{0x0}], 0x1, &(0x7f0000002a00)=""/10, 0xa}, 0x10}, {{&(0x7f0000002a40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000005d40)=[{&(0x7f0000002d40)=""/4096, 0x1000}, {&(0x7f0000002ac0)=""/233, 0xe9}, {&(0x7f0000003d40)=""/4096, 0x1000}, {&(0x7f0000004d40)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/141, 0x8d}, {&(0x7f0000002c80)=""/60, 0x3c}], 0x6, &(0x7f0000005dc0)=""/104, 0x68}, 0x2}, {{&(0x7f0000005e40)=@can, 0x80, &(0x7f00000061c0)=[{&(0x7f0000005ec0)=""/243, 0xf3}, {&(0x7f0000005fc0)=""/215, 0xd7}, {&(0x7f00000060c0)=""/224, 0xe0}, {&(0x7f0000002cc0)=""/1, 0x1}], 0x4, &(0x7f0000006200)=""/4, 0x4}, 0x9}], 0x6, 0x40012000, 0x0) 8.130546361s ago: executing program 8 (id=5700): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB, @ANYRES32=r3], 0x1c}}, 0x24044080) 7.146975026s ago: executing program 8 (id=5701): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, 0x0, 0x800) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f00000064c0)={0x2, 0x0, [{0x41000, 0x1a, &(0x7f0000001500)=""/26}, {0x70000, 0x50, &(0x7f0000006440)=""/80}]}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000800, 0x0, &(0x7f00000001c0)={0x10004, 0xfffffffffffffffb, 0xc825, 0xffffffffffffffff, 0x2, 0xa, 0x28a7, 0x9, 0x9}) ioctl$HIDIOCGUSAGES(r1, 0xd01c4813, &(0x7f0000006540)={{0x2, 0x2, 0x0, 0x9, 0x5, 0x4}, 0x336, [0x34, 0x9, 0xfffffff7, 0x8, 0x5ff90, 0x1, 0x0, 0x9, 0x0, 0x5, 0x6, 0x81, 0x9, 0x4, 0x2, 0x2, 0x6, 0xd, 0x7, 0x1, 0x7, 0x40, 0x10, 0x299, 0x2, 0x8b, 0x8, 0x25, 0x7, 0x80, 0x9, 0x4, 0x3e, 0xffff, 0x3fa, 0x9, 0x99d, 0x7, 0x3, 0x5, 0xee0, 0xd8, 0xfffffffb, 0x1, 0x58, 0x8001, 0x80000000, 0x5, 0x5b6c, 0x6, 0x0, 0x9, 0x8, 0xc6c, 0x7fff, 0xff, 0x8000, 0x2, 0x1, 0x800, 0x3, 0x4, 0x7, 0x8, 0x1000, 0x5, 0xfffffffc, 0x1, 0x3ff, 0x5, 0xfff, 0x5, 0x7fffffff, 0xd, 0x4f67, 0x5b7f, 0xfffffffc, 0x6, 0x1, 0x6, 0x10000, 0x5, 0xfcb, 0x1800, 0xfff, 0xe0000000, 0x1, 0x2c1e, 0x1, 0x502, 0x2f147a22, 0x9, 0x831, 0x5, 0x0, 0x8000, 0xfffff43b, 0x8, 0x8001, 0x1, 0x10001, 0x1d800, 0x7, 0x0, 0x2, 0x3ff, 0xd3a, 0x0, 0x8, 0x10001, 0x3, 0x8, 0x86f8, 0x8, 0x4e19, 0x4, 0x17d2, 0x3, 0xd, 0x0, 0xc7fc, 0x4, 0xcbb, 0x7, 0xb, 0xb0, 0x0, 0x0, 0x10000, 0x5, 0x3, 0x1ff, 0xcc25, 0x4, 0x2, 0x7, 0x5, 0xfffffffb, 0x53bb, 0x4, 0x9, 0x4, 0xfffffe01, 0x9, 0x6, 0xa, 0x7, 0x1, 0xf, 0x80000001, 0x80000001, 0xfffffffe, 0x1ff, 0x0, 0x1, 0xd6, 0x8d34, 0x5d, 0x0, 0xd, 0x0, 0xffff, 0x5, 0xe2bf, 0x0, 0x2, 0x4, 0x9, 0xff, 0x6, 0x0, 0x8, 0x6, 0x4, 0x2, 0x1, 0x7, 0x8, 0x4f1, 0x0, 0x1, 0x8, 0x8, 0x0, 0x8001, 0x7, 0x4, 0x4, 0x8001, 0x7, 0x4, 0xff, 0x5, 0x5, 0xffffffc0, 0x2, 0x7f, 0x700, 0x48, 0x5, 0x1, 0x3, 0x44f, 0x2, 0xff3, 0x9, 0x0, 0x2, 0x3, 0x2, 0x7fffffff, 0x531, 0x2ed, 0x86c, 0x1d, 0x269, 0x6, 0x531e, 0x8, 0x2, 0x9, 0xb0000000, 0x5, 0x1, 0x4, 0xf, 0x9, 0x8, 0x7b22baff, 0x7, 0x2, 0x40, 0x1, 0xffffff17, 0x9, 0x80, 0x965, 0x2, 0x200, 0x3, 0x5, 0xafd1, 0x4, 0x3, 0x1, 0x1, 0x2, 0xfff, 0x4, 0x401, 0x57a, 0x9, 0x4, 0x7b3, 0x10001, 0x80000000, 0x6, 0x7, 0x8, 0x41b, 0x77, 0x101, 0x3, 0x2, 0x215, 0x39, 0x8, 0x9, 0x4, 0x1, 0xfffffffd, 0x5, 0x3, 0x3, 0x8, 0x2, 0x8, 0x0, 0x1000, 0x7d4a, 0xa, 0x8, 0x6, 0x1c0000, 0x3, 0xfff, 0x9d, 0x5, 0xb, 0x5, 0x2, 0x1, 0x1, 0x2, 0x4, 0xbda, 0x4, 0x100, 0x8, 0x1, 0xfffffff9, 0x7, 0x5, 0xffffffff, 0x6, 0x5, 0xada6, 0x6, 0x80000000, 0x5, 0x100, 0x5, 0xfac8, 0x8, 0x200, 0x7, 0x3, 0x81, 0x5, 0xe, 0x9, 0x200000, 0x7ff, 0x401, 0x0, 0x1, 0x1, 0xff, 0x4, 0x0, 0xd, 0xe, 0xf9, 0x526, 0x7ac5, 0x400, 0x1, 0x0, 0x10001, 0x8, 0x401, 0xc4a0, 0x6, 0x3, 0x3, 0x9, 0xf, 0x35, 0x0, 0x7fffffff, 0x4d, 0xfff, 0x4, 0x9, 0xb0be, 0xffff, 0x4, 0x268, 0x10000, 0x5, 0x962, 0x3, 0xe, 0x4, 0x8, 0x3, 0x8, 0x2, 0x1, 0xffffff30, 0x10000, 0x9, 0x10001, 0x9, 0x7, 0xf, 0xc, 0xffff, 0xf, 0xb2e, 0x7, 0x7fff, 0xa66a, 0xa, 0x6, 0x8001, 0xa, 0xb, 0x80000000, 0xd985, 0x10001, 0x8, 0x5, 0xfffffff9, 0x1, 0xf3d, 0xa54d, 0x1, 0x5, 0x0, 0x8001, 0x9, 0x4, 0xa23, 0x7ff, 0xec, 0x1ff, 0xc, 0x80000000, 0xb, 0x3, 0x9, 0x1, 0x36, 0x1, 0x8001, 0x7, 0x4e3, 0x200, 0x2, 0x6, 0x8000, 0x56f, 0x0, 0x8, 0x7f, 0x7, 0x7f, 0x7, 0x974, 0x0, 0x8, 0x4000400, 0x2, 0x5, 0x6, 0x3, 0x80, 0x6, 0x6, 0x4, 0x1, 0x8, 0x2, 0x7f, 0x100, 0xe, 0xb, 0x2, 0x1, 0x8, 0x66, 0x6, 0x6, 0x80000001, 0x8, 0x9, 0xe, 0x2, 0x10, 0x4, 0x7, 0x0, 0x4, 0x8, 0xf, 0xffff, 0x9, 0x8001, 0x1, 0x101, 0x2, 0x8, 0x6, 0x6, 0x9, 0x40, 0x0, 0x1, 0xfffffffe, 0xfffffffc, 0x1, 0x3f48, 0x7fff, 0x4, 0x400, 0xa85f, 0x41b86c96, 0x7f3b, 0x8001, 0x4, 0x7, 0x3, 0x8000, 0x3, 0x8001, 0x2, 0x100, 0x2, 0x8, 0x5, 0x3ff, 0x1, 0x1, 0x1, 0x94b, 0x80000000, 0x6, 0x100, 0x7, 0xb, 0x8, 0x7, 0x4, 0x6, 0x7fffffff, 0x3, 0xb3f, 0xe9b, 0x3, 0x6, 0x81, 0x5, 0xfb35, 0xfffffff7, 0xb, 0x800, 0x0, 0x6, 0x0, 0x8, 0x6, 0x9, 0x5251, 0x1, 0xe4c, 0x1, 0x42, 0x5, 0x1, 0x7, 0xfff, 0x3, 0x8, 0x1, 0x7, 0x4, 0x1, 0x0, 0xffff, 0x9, 0xe, 0x0, 0x2, 0x2, 0x0, 0x43, 0xc, 0x800, 0x6, 0x1, 0x6, 0xf, 0x12dd, 0x1, 0x7, 0x7f, 0x3, 0x9, 0x9, 0xfffffff8, 0x3, 0x7, 0x24bf, 0x4, 0x5, 0xde11, 0x7f, 0x2, 0x80000001, 0x81, 0x5, 0x200, 0xe, 0xf, 0x6, 0xffffffff, 0x6, 0x3, 0x8b54, 0xfffffff7, 0x7, 0x1, 0x8, 0x97a9, 0x4, 0x10000, 0x119, 0xedaa, 0x7fff, 0x6000, 0x1, 0xe, 0x0, 0x8, 0x2, 0x7fff, 0x70e, 0x5, 0x7, 0x10, 0x7, 0x81, 0x1, 0x1, 0x6, 0x1, 0x9, 0x5b1, 0x1, 0xffffffc0, 0x8, 0x6, 0x9, 0x5, 0x6, 0x7, 0x0, 0x3, 0x2, 0x9, 0x8001, 0x2, 0xff, 0x1, 0x3, 0xaa, 0x39a3e6e9, 0xfffffff7, 0x6, 0x8000, 0x8, 0x37, 0x400, 0x8001, 0x7, 0x3, 0x0, 0x7, 0x1fc00000, 0x4ab3, 0x1ad, 0x8, 0x0, 0x4, 0xb, 0x8, 0x8, 0x8, 0x4, 0x180, 0x10b0, 0x3, 0x6, 0x9, 0x1000, 0x40, 0xfffffffe, 0x7f, 0x6, 0xd, 0x0, 0x2, 0x1, 0x1, 0x4, 0xfff, 0x3, 0x3, 0x1, 0x2400, 0xfc, 0x37, 0x0, 0x3, 0xffffffff, 0x200, 0x74, 0x8, 0x1, 0x5, 0x8, 0x2, 0x80, 0x67, 0xfffffff8, 0x8, 0x0, 0xd13, 0x3, 0x5, 0x2, 0x8, 0xd6, 0x3, 0x10, 0x2, 0x9, 0x8, 0x7, 0x5, 0x8, 0x2d, 0x81, 0xfffffffd, 0x0, 0x9, 0x145b, 0x69e, 0xa, 0x3, 0x7ff, 0x80, 0xcfdf, 0x88, 0x9, 0xb5, 0x5, 0x101, 0x6, 0x1e00, 0x7, 0x1, 0x6, 0x8000, 0x7, 0x8, 0x0, 0x9, 0xfffffffe, 0x5, 0x5, 0xfffffff8, 0x101, 0x2, 0xfffffffc, 0x158, 0x140, 0x5, 0x8, 0xfffffffc, 0x4, 0x2, 0x5, 0x5, 0x7, 0x1, 0x80000000, 0x0, 0x2c95, 0x9, 0x2, 0x18000, 0x9, 0x200, 0xfff, 0x7f, 0x3, 0x4f, 0x6, 0x5ba51650, 0x9, 0x40, 0x64, 0x8, 0xfffffffa, 0x7f, 0x0, 0x1, 0xc0, 0x3, 0x5, 0x62e6c5a3, 0x2, 0xe2, 0x0, 0x7, 0x4, 0x9, 0x101, 0x0, 0x7fffffff, 0x9, 0x996, 0x5, 0x20000000, 0x80, 0x8, 0x65d6, 0x736, 0x8000, 0x8e, 0x7f, 0x6e95, 0x2, 0x8001, 0xf, 0x7, 0xc76, 0x1, 0xfffffff3, 0x7, 0x8, 0x5, 0x0, 0x2, 0x1661, 0x9ba, 0x2, 0xfffffff9, 0x8, 0x7, 0x6, 0x3ff, 0x9, 0x2, 0x0, 0x1, 0x5, 0x2, 0x0, 0x0, 0xff, 0x576, 0xffffffff, 0x6, 0x3c7d, 0x2, 0x0, 0x8, 0x3a309d23, 0xd0, 0x1, 0x8, 0xfffffbff, 0xffff, 0xc, 0x8001, 0x2, 0xe968, 0x2, 0x7, 0xeab, 0x9, 0xc, 0xff, 0x6, 0x0, 0x9, 0x5, 0xf2, 0x0, 0x3ff, 0x23f9, 0x6030, 0x101, 0xbe5, 0x2005e128, 0x80000000, 0x7ff, 0xc669, 0x80000000, 0xd, 0x400, 0xb9, 0x3, 0xc39, 0x105, 0x8, 0xd, 0x6, 0xfffffff8, 0x10001, 0x3622ae81, 0x0, 0x3, 0xc, 0x6, 0x40, 0xa5e, 0x8, 0x6, 0x4, 0xd6d, 0xa, 0x6, 0x0, 0x5, 0x3, 0x5, 0x2, 0x3, 0xfffffff7, 0xffffffff, 0x4, 0x4, 0x3, 0x7fff, 0x4, 0x6, 0x3, 0x5, 0x2, 0xfffffff2, 0x4, 0xfffff000, 0x7, 0x0, 0x163, 0xff, 0xff, 0x10000, 0x1, 0x7, 0xff, 0x80, 0x6, 0x2, 0x101, 0x6, 0x0, 0x0, 0x380000, 0x3, 0x0, 0x9, 0x7fffffff, 0x5, 0x5, 0x7, 0x0, 0x3, 0x602, 0x7, 0x8, 0x16, 0x6, 0x8, 0x0, 0xa, 0xb29, 0x3ff, 0xb7, 0x5, 0x80000000, 0x7, 0x2, 0x4, 0xa29, 0x7fffffff, 0x7, 0xac, 0x2, 0x0, 0xb0, 0x8, 0xcfd, 0x8000, 0x8, 0xe9b, 0x6, 0x868, 0xf, 0xd556, 0x0, 0x8, 0xfffffffd, 0x3ee0, 0x5, 0x6, 0xd6d0000, 0xe, 0x80000001, 0xfffff800, 0x5, 0x8, 0x7, 0xffffffff, 0x7, 0x2, 0x8, 0x4, 0x4, 0x9, 0xfff, 0x81, 0x0, 0x8, 0xc000000, 0x6, 0x1, 0x2, 0x3, 0x1, 0xd12, 0x7, 0x2, 0x0, 0x10, 0x1258, 0x401, 0x10, 0x1, 0x8, 0x7, 0x7, 0x8, 0x1, 0x0, 0x0, 0x5, 0x3, 0x7, 0x7fffffff]}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) r2 = socket(0x8000000010, 0x2, 0x0) write(r2, &(0x7f00000002c0), 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000001c0), 0x2482, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r4}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r5 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r5, &(0x7f0000002700)=""/102392, 0x18ff8) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000380), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_FLUSH(r7, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000040)=ANY=[@ANYBLOB="c4000000", @ANYRES16=r6, @ANYBLOB="0100000000000000000011"], 0xc4}}, 0x40004) sendmsg$IPVS_CMD_SET_SERVICE(0xffffffffffffffff, &(0x7f0000001800)={&(0x7f0000001540)={0x10, 0x0, 0x0, 0x8040080}, 0xc, &(0x7f00000017c0)={&(0x7f0000001840)=ANY=[@ANYBLOB="14000000", @ANYRES16=r6, @ANYBLOB="010028bdbeb27000fddbdf2502000000"], 0x14}, 0x1, 0x0, 0x0, 0x8800}, 0x4000000) mount(&(0x7f00000000c0)=@nbd={'/dev/nbd', 0x0}, &(0x7f00000001c0)='./cgroup\x00', &(0x7f0000000040)='xfs\x00', 0x800000, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$igmp(0x2, 0x3, 0x2) recvmmsg(r0, &(0x7f0000006240)=[{{&(0x7f0000000040)=@l2tp, 0x80, &(0x7f0000001380)=[{&(0x7f0000000100)=""/158, 0x9e}, {&(0x7f00000001c0)=""/4096, 0x1000}, {&(0x7f00000011c0)=""/213, 0xd5}, {&(0x7f00000012c0)=""/165, 0xa5}], 0x4, &(0x7f00000013c0)=""/58, 0x3a}}, {{&(0x7f0000001400)=@ieee802154, 0x80, &(0x7f0000001580)=[{&(0x7f0000001480)=""/118, 0x76}, {&(0x7f00000063c0)=""/65, 0x41}], 0x2, &(0x7f00000015c0)=""/247, 0xf7}, 0x401}, {{0x0, 0x0, &(0x7f0000002780)=[{&(0x7f00000016c0)=""/134, 0x86}, {0x0}], 0x2, &(0x7f00000027c0)=""/213, 0xd5}, 0xfb}, {{&(0x7f00000028c0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast1}}}, 0x80, &(0x7f0000002980)=[{0x0}], 0x1, &(0x7f0000002a00)=""/10, 0xa}, 0x10}, {{&(0x7f0000002a40)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000005d40)=[{&(0x7f0000002d40)=""/4096, 0x1000}, {&(0x7f0000002ac0)=""/233, 0xe9}, {&(0x7f0000003d40)=""/4096, 0x1000}, {&(0x7f0000004d40)=""/4096, 0x1000}, {&(0x7f0000002bc0)=""/141, 0x8d}, {&(0x7f0000002c80)=""/60, 0x3c}], 0x6, &(0x7f0000005dc0)=""/104, 0x68}, 0x2}, {{&(0x7f0000005e40)=@can, 0x80, &(0x7f00000061c0)=[{&(0x7f0000005ec0)=""/243, 0xf3}, {&(0x7f0000005fc0)=""/215, 0xd7}, {&(0x7f00000060c0)=""/224, 0xe0}, {&(0x7f0000002cc0)=""/1, 0x1}], 0x4, &(0x7f0000006200)=""/4, 0x4}, 0x9}], 0x6, 0x40012000, 0x0) 7.013717774s ago: executing program 2 (id=5702): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec85000000750000000400000007000000"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, &(0x7f00000010c0)={@in6={{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}, 0x0, 0x0, 0x1b, 0x0, "61a1ed8439cde8054f2ada6fcd5fe76b933e8bb0ac60081e33dffa150835f7519d5f73b4e1d80eb4881a5b98cb9fb96d225d602392f816d0bdcc09b5063087117502d8c24f1fe97f61fd27a06d6a38a7"}, 0xd8) fcntl$getownex(r3, 0x10, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x20000841, &(0x7f0000b63fe4)={0xa, 0x2, 0xfffffffd, @empty}, 0x1c) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)={0x24, 0x1, 0x4, 0x101, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_NLBUFSIZ={0x8, 0x3, 0x1, 0x0, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, &(0x7f0000000000)) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000003c0)={0x0, @in6={{0xa, 0x4e20, 0x0, @empty, 0x9}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0x7}, 0x9c) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r5, 0x84, 0x13, &(0x7f0000000100)=0x7, 0x4) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x80000, @loopback}, 0x1c) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) 6.735574325s ago: executing program 9 (id=5703): io_submit(0x0, 0x0, 0x0) openat$selinux_user(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000340)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) add_key(0x0, &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) syz_genetlink_get_family_id$l2tp(&(0x7f0000000600), r2) r3 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000300)='source', &(0x7f0000000180)='%\xde({^\xfa@:', 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r2, 0x84, 0xa, &(0x7f0000000a40)={0x9, 0x5, 0x9, 0x5, 0xffff, 0x4, 0x8, 0x7fffffff}, &(0x7f0000000a80)=0x20) getsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@initdev, @in6=@mcast1}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_COPY(0xffffffffffffffff, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ac2000/0x2000)=nil, 0x4000}) r4 = syz_open_dev$loop(&(0x7f0000000040), 0x1000000009, 0x198960) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/fscaps', 0x40000, 0xf) ioctl$LOOP_CONFIGURE(r4, 0x4c0a, &(0x7f0000000080)={r5, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0xd, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) syz_open_dev$loop(&(0x7f0000000080), 0x401, 0x0) 5.971851469s ago: executing program 2 (id=5704): syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000004280)="0d1c409c14b8ddbbe2423ac75d732f3d0e9cd37b375b9673cb39c6b35cbb85c4ba83de9d23bbcdd53a9f0d7c92b66f6d872096b32f4bdac32a6136c86365cfd42c3b0a25fac76123b6d700d3ba70cc138bc435d3b1fcee2545c3a421119087bddbbfd0418488219343819cf0a6780d54166d2769a719b207136357ff3f505fc1d6144239ba630b15e7f8aeef7be5cb8c9e738faec0d1ab79d34b994e098323b94d32926bc3b0fd88c13cc781a0fc3da7c4d83fbaf3288fabe01685a3422570fa4cba7e840bd0a01e995c91c5aba51ca15461dc1916bde9e70c66f3aae48475e95aea1f8e6c6f10104d64f767b7f9b7909f5caa5fd61ec7bc7392bfb7fe4f1d1d0528601a87f9248693f31a0f2ea07a0f33e670bad3ba0c648266195c6d9a76cd973a9da6016d1f5e0d49122f64da8933cfcf6a970d1176ee189e3320ff21a807e6ea473e146069e72894fcd378e17d4fa761999c128492a0321c3153edf7b28d0cddd78758f5192a924fbe2e8c594cf35aeffc635b14903d134fc5f7857218f99266c64be16e5f4ad76a8b5f6d39ca2451afcdcb0cf42322a5166becc90621f99f28e42bb2cb610039c45e54cc4bb8e8210e612a3f1ac93366fc1e77410af8b4b3eb03085354c9f8d12cc62da82eff96a006dab656c10e1bf210124b0ed6841158ec70981a399ba7c406f3014bf77553be6197d79dc1d31ac4c598bdbd007578d50f00ce85810e0759e91505549c70005a5f923aba20d8e05d0b764680b9ea259c8fa71f1ee36b71da662b825019c07aade7db363662103887079dea43ca30c32e4f0d9ff043720541633157a3ff1dc055ac1db5b25765b7ef2e338c104db28b6be7fdae54f04075e26ce38ec71d35c029df580ee3ef68e46359031aea121d0776398d1f1e28e9cbdc20cb58adf5dfa01a2819f697bb3189ac0d32eec43c0ef75f5bd4c7926d18daf9a6e9265c961aadbed4fb9627a1f0a6c3dde66fe5530993a7f150e5b361ad0db403a864ef4f5e0f21db55aa22055bdc5b282b057d07efd6abe23f941a62d6f613a1ff8d31da632284e89a3069c6b26ef35e55fc846fb1c28651cc5a879a4994568c4639b9fba8395014c9f4f6152cee1ddf8d582bc496bcbad8e39e0a5a3e713deed021eb9d5b3f8679a8bddc08ca77d7cd101006c5021b65cc7648a646735d9d7f6e54e4fb5bcf1fd9aee4beb700e597011a2fa6c01d22e9b6c7a5afd7def8ab0a3e612d8a5ce571dba2d0696155c3dbfcc851293eebccfac6855a7b024d762e768867f57446ecd6e1d09a31959a6374c50445884dfcc68a62662e5701a25a1da8e0abd0428bb558f9f7e74c250d4af62afad71e0f23268a955c548b41cc83f6810c72c832476383a355abfa449fc05c7afa2ed70849f175e826361882503246e688983f472c418578ae4c893d847c0c7f8ec99352d3024a69134dfccbc6ec3351b321483c57d2d1e77c0c7551cdaf4c14038844b1b05c25541d1d48bf0dfd1ae40c35872a5b37c2958e3a60187531814f3adff870aeb42cf611c3f777b08f7dcacf5c087b19c17dfca413097a603823363c2c55597330de20a73465ccbe5acfad066fcb17c177827cf081c588b73c042150bf1a18aff97518fbc1b4d5d22f29077e186ae9b998b4d6fdbcbc8c3bd57dcc61cc322537743ce480c1dea39adcc6a51da745a60e5272a7181986bcb992895035f0f882cdf79c56a84cd88c9bf0b7dab9c1f453cf4c05e2a33f43f4252fdcf99cf785e639bd9d11c374d4e3107ce128d2a823b6a8631a8fdebdf14a0bfc3f79d44cd54d3e8b9c5a3f41b9a1187e23f5a5eb5fadff92d746ff3befec7189ca19c1987551d0fec321cc306d235f82b3f479f3d7a3c1d2377afe3f22a49c682646e9893d7700061a0229a99d360f89d281dc6bb95b92329cc7d3c753cbb93e9f1249572bae520fb7c46970f527fd93c445a8159d4992badc395c05313462d37c4f651afbdb04f9f42ad4433c5c765735731ed6d8c97e4ca9fd3a1885de6c051e652a1ea40230e9d854ec2145c78ef5574deac83e78df8932dde1d5c46862c9f808394dc7f064b5649cc7b2627a55683ed33f2712ad2d4f77ec7f2be200e01fca138b3d1f42916a54a66561916bcbd3109f6eacf5096e478442e56e5af61f7c32c681bd35bf94a429a52024a48f6002978594418b66c6eb0fa91dccc4fa83d4892734218f0e4670670bd78b8acbbcb554a219cdc6740de4bbfcad2250fc219436ba5da5299039d6e24eaedf29d169b8867fc84eb2e721b31b08604a6fbd8d5edd9bb0152346509619f4a0f41090228b10868f56cd7d7c025cccc8f2b4a7d85ab91862c65d5d578fd5c046928c5c8f999611dea07a1451357b4365b33bac0a2a842b84e2cd4f790dca74cc962000f72d821b093e271e63680c0e9019769f3abed377f51f2e0a373958dfe351a1db29da4b74f9ba1250a8a0b985ed86cd7a2a4ede57ce00dbe77f5c797e6b98e4000000d3a01047f9ac7d66e820073193b6a3400ff41f2f8a98a44a0d2a608db3000571efdade9a44f278272e7ada101d275c589fed2ee0191801b7a2ea62dec117c9cfd96ccb73de7fa2eb4d60a7ce1170047a5266668da1aa8489c6e4ce564607a485afc6991ba262cd6f155c23fbb47610f555e0be090854ffa0d610ae4baa1dbd1f36249beb0510b8d96132b6396a6261214f3153bfc4f0dcfeb55046bcca5868aa913316a2e802f9bfb51caacfd0045d96b3983b883db123da07fc20d06c973e3dc74c53006c77361cfa9d3b2062da3f9740cc7335ec792d1b2c767e86417433fe047c8d9368c0c51373b5e5158503afa52ab08ef49616499ccb8dc829e343d25fc1fc2ea6c95933295ab397f07703d1d8defebeb44a2a9556bbd5414cf921abfa8df9bc5ea76922d728ef0024f516c9fd7a2927a68ba9a7dcc4f52c3d8b72909b2bde14408e476778a3221644dfa13794e365a9ebb670eaf691b3c2393adc441519c1125b960ff109ccab52294c6584d74b3084cfda3707f7153681c88a1578a77be9224a70ce400f4af3dd72452df147476abf2668c1801fe538be40042717b6c468fe1a33d1d597fb637396b8ebed9f64eee42e645bd8dc0e63fbd3a139bce3157ce7ed6f5f643ee26847908efaf61cd977627647bc0e4f119b924bb185664f1dcf2240b2697c89e8f569332d19ceec176642ebf0bf509bd3b9477272159d45b708510908e74cc5e0304104d5ed6e578b46dffcf64367fe9d274ab8f16f3154f3e83ce6d3ae92a2644ceeb8ec33e07f728319eb69dfa37bb70b40a1001ff0157173e33af633496062b17cfab8b5c06ef2fadfef280da4e1f70fbbac10981a0b35f3ada39733d7d31798e455f0dd1c530939f09df43b5aff342c39052a51d773b22acbc8c1525f3572ef469eefe66d1895a9ca3c637286e3f9acd29e890ffccbb313dd9da50aacce808d06d0b109a16a1c2bf69fc4b85b9b7cc9b9ba9e5d709c65fd0a879032caee38315eb049b12f11c4d485ef426fff3a4f91b4f1ad4c192c4074636787ff966f82c8d4fcad13a7b581718ee7318f6731da2eb1338c95c35f1f2e082bedea7f05b87d891876cfab51ddf2908ebb2bc153c20001ae9c142b35a3de474b732c5f629bd948ac9230067120671d296001cabe19e3d2302c1f32e4fcff1681ab2ef216309c21c6a5afc51ac500687a5140d015ee2bda5f3d8a15826a21a0a9495b36fe958fff32afe270f809f3a8f8cd2d8992a859e5de779bd8aa4dc6979807171282ef34502f1bf34f529cdad15671692f232a9f2dd2107f8198f7a9ea5883cbeb2a060ff1b13fc1a4df315dff940e8f013e8142c640acf51ebb2b2f878dafb6c12747cef3061f2235bccceacce4bf9829df24b9f9e9c5c259aafbe61ff6be827e492e2c03fa1e9f936196ff9acb28081f7ca74109d823c5c96b1e808bc2b8072763954ec5691f7935284e045c6d86c5c68d69b4502a5132b3c1cdc5e000ed1f6aa4bc0a9090a8923004ac05558e08827c71fd2e24f931f880244143a8d092dc8bb2b48317ff49fa0b494b3fea0741fbcac6cf780f93db42f47d23170a70619d06b0462f2fb04dabe2a0c94a1d97ecb159d426df47f0a1e13764e045d97ba75fd0eede9711d112581b4a2e66b10077aa92c98e30d6504f0c08c0c68015c88abbc991d5a799e588d1ee7492d650390c02599206debb024a59ccd9d3df0197c8e56219d76698b61ec94927f41ccc7bc80ab6f65380d31d58f796e7e697b28e371ecd9ccf6b58e9cf32daee54c5228268446677f600ca8d091b6a4774749d40d6d4d6a009ae12bae1c530e6961420507a13a2a32c4f0863c790159a26588bed9f50b4ffbfc8649adc8144779653b4226fed5ab93570fb3edcc1be70780f6ddc8d9ef1ff39d22bd20cd8ae0195d02ada60fa0d65e065b7a3950d5a2b77546ad8f1c1018344589085638793d26fb4a5c59c23f1c9b148ddcbc478e1867e109590c44c14f5ad6e8cda21a75358cbfe6f397c711eead2b1c73df1453d184a44e85c2f6ac0c266b0f67b001426cec02efb66085bd1b8bcaf06d6709d545895337fe36e9d26417238f36be5ba51d5cd7cd7cec452780b72bc441052f67496ed8bb4d393db8da52aa3b0ef10a74a33c2b7ee24f76642f83bfc3e686951cbd1983f1ea54d536f6c86e8b20a4eaefb9ca57308abcfd81357e3d0eebeb0ff805c151ea1d0063c3bea7120562886fc4ce284f33d4a85c830d8b9b9b1295c352c3f5db54973a5ed3788e5396a1add7022546f13db95e4ad1a994142aa4f98d644cd822192e3e1875da3b4a6cfd61cca36a82fd4c1f09db84f6b379483e2b81749609750b493e406c8add341d8855ef47d8e8cd49e9d1340be1223d268bed3a2cc949b74cf01160723d26de9b11138fd8e8957354c2a58fa30903b7544d2bdf49249e5ca9f5d030f0c17e7ec605482523d1da3b3ca6c94c8724c20b929954c1c1f321ba7f77e2e954056a2838e57696e40a2fc9f8c2b7e25a41cd500f4fffb196810b3d77f79dfc1f7179fd4e2c63957c65da8325185cdfa37a82d42ebfc631a87ce7ba60ad09132f1eabe7b870c88fa277578e19a6adabd328e6b453dae201ce4327a378174695264ff4411a3815c362480058038b1b70b652e89b0c7743548b897c80c53b16aba4d244753fd8c14c8bcdbe2a2710df7842a8af2bd0a966632655c01bbc2604151b80e349b2f5f63fc8fdfb34c7223803fc0fd1dcf7fb5471c65f59ef9b02c3c0440f7e44fa4759782a46165c64e2ffc246d0438248c461e932806ddc20d3eeb597d74e9cbfba85951c601fd8b903c80f5d8bd5fc5b824cd63d9bc2d38438eb8a8bd1fbbad944b3ca074eb318ae074ef4d7f12076ac1809ca6868be7e5fcbb953ee70bcccb7cf51422e8293faf3e88d4b179b4c7a6ab53638eb05c902715c023f33ba9e121aed0b7b5f0544b5275cf22093e64a7038cda03fc9014002cb52d4568625d321b344e566b50a7e9695c79daab4aa0fc82790cd32708bdc0242686052677eb163cba152231e45d0ad1b8238a7d1230f43612ae8b9525d1f98372774a326e9baa48e69093b215ea503e054729722a71c7e6c58b958f3cec95fdbf1811b7c8a53787e95d266a70d408798e94d9579e813a8e9e3d4bdb4f2682f7aa30b659c722aa07faa911543c57db9fb3abf73ac5b4096cadb4bfa2b25e51b11e754348a2abff384a16194af26590ccd657cf76bae1f1246b67ee0834105f008cf77b1320ecfcb87bfa7d2b2fdec1330f54b6c6cf2280119e39e9a66ccef3df0c4297e1c861a027fa2ea5a1ab530f5b94a98895405c620bb6faecd7e80bfb42d1a4646360e0e8355af548439f8db48d583352ea84385e271b3067bf7b047e69e23c3bd2c3ea74df48b3649985b0ef12a9f3803ccfa52e01381d30a9005f0415a149557b67d0ac7c439ba8b20a9eb293ee4d357cc1d9e1e7f707ad77e58f22d2b26f9a8e726e826b6722c2b910416dcdaf772476e55256fefb1fa5de0139e15c2bf84e267be5d5381bb30607b731c8f305a1b4e1e4bae0b59e61dc77b13d129dfff4fdaf48f95038cc11b14e8266aac4d59fb40346c07a7fee92327e40905e40f8135b0f6e9e31969902e9926a99d7ae30891be917581189ff998ea5310da0cf72faae333ab8ee7cb9f78bb0a8695a841b8d37709e2826594cc8927f5dd98c53ea4c5246b5fc09f756f29b61c21996dc2a8eae1a15b4c87fb6f69ccfcf8672b048ee723af55104da1c2f5250e8bbb3bdf2b7edb4878a902032ab4115f516d804d2cde7bce6b0c6dcd1f0d321fe4bb279e4c45294df0fd33956469839c70bcb68c033b597daf3f515354e72fd1ecff87e4b8d1ae52e6ef0fc773a49ca76d0659454b59e9c62fc8e10131e50893c0c0a997fb5766157701ce8e6a6482bd8b0b53a6b4fd4227d8e02c6453114f161017b18e52867282010df15c361a0ed3b17636adce6567ca97d4864dc15fca353490aecd5d26af991a92dcfd3e4dd38b8ed9181dee7e2e20cc2600c3211eecafd0dac537a693573e843259c30789a3d0ef91b78f95ed5da1c9e61716f651284e4eea663aab9c30d28a620745e44fbcf71221a23d332d411d17220c5a43321cbae90ba8104ffb4415d7563a21406d6be1fdc9abfff8998b51628b28b4ed84ded6804726cae5b62281949bb7cd7bec7bb2dfa8d831d4928b274c7452d2e9f8a37c67c98239b121d3acf381a10469d0dee019d38dbba865fdecfa34e39b0dcd4cf7a66e30f87d4f26d4190fdc62d44c850e94121ace3d531de3204ed5f838f5953c98b44a387a0cc95fc5e76facdf3a9f98183d32d887fb7d997a37b4737861bb12ea8e412e1015d3cceff7b448381f3fedd35a535e524f9e6df67e14882d9ec956a81e1972392c8c79cec77fe6d0f88a00710aaab4878187d6c387cf1ade1c61ca3b9bef117ad621c9a971d4f04a2e45314422f9f7606c932ab593db97747d7666948d04aacee1ceb6ae2fb205f32d953d94e5f2c7cb332eefa4bf11c999fb67e287960b64c36fa37de3c81fe53e057abc6f5575cb900a117242340126f721f8ad4c3d744440f2d9e1abf71fb24ca6f5abd392ce1110d4d138cd312373f99eef5a9b55a2a92a73be76860c380e5f2f1c9e5526ab5dc6f91d81d086dcfb70165c69b9bba0670366910ed053d43a61bc8215e95f304d73d38a689f174ac4940f1c7c87a011fbaa364e54887a0f38281509282943c38c77f9dbf385d0f8f62d30b300ae7ce24eb5b855057fc4fc8efcb05c4451fbc4de6f8b545559fb2bd2f8200eaa2822990d4afa0398e4c4d40534ece023306239bd86e2a0b9ae2fbfa640046379c1e2f0471e0005bdbd929119e54808f53fbc9ae318fd128aecaee2e314efcd76085a1da95b1261a321fe8229434dcc57844f15914221116d53faef06466643b996d5802167c0dcabe44979e576b4290aceee7aa771820fe113b85162e45961dea78ba31e0c54faa89ef75263d15580dd144745ab42b5d510f1beb115832df59ce57be19113f97aa21d984448e7fbc92c1291fd84f98e9ddd832336be330528e9df7b88f17f47708dfa401ba49562ef3650155bca61a81348896c151d05651caf865a3c40dbaecde5036233dd42a23f5712c93b2fa1c3ab754445bd258491fcf508ac344eeb38db1a4cb9980b1d97b826d76b0b10f8b8937dd0a9385c66ffffdab1819049c35aaf90b15267f7c58ff236c425414286bc7dfc3bd22abea8aeaeb113592ed41fa566d1426c85c3db9ef04e70b31ea52ae2f9352ae1195035b517f7e36350906773fabaef38fb29348b9797ec90cce08e0afb923fcfe0fe62ed2abd97d39949993048ae10c5be54808986f6c4aa437e413b449f57b0b0fc6f393808631fac191af623b8e90193ef2b0dda64f26b4771ab256bccd61ebf4b7ad099156986d64e77d37039d4a2e5836528a10c8c9d9ca9c640804dbf2db4154384cd8a8c02ce863e102ea944c17a643c120361d631b7f349f920ae6bd06db3e3af1bf902c3204e8632d27bd928701ee206a7d64448f9a81265a17a31878e3c1a2a044fc6f956b557471d1bf7dfe160716028191e851e18439f4e3561aa589528889090a3b673f70aebc1edb12861277f04f300acd8278e5f640ac0dc7e4f8df3ea39186119b0599f3e7bedfa0ee65e4d25d8586a2d10e773182d98ea9eef3b3d9805697adce7daf083b8a934c0d9c6467be25a6a22b6b246abcb355d03b8c3345dff9f40e253ae80a2de668dd9da044a2b90bc5788b0fe3a2c6387b3c817ea456eb7713a728caf4287d15006500435ff93eb6803e42e57c087c483e23605d9dcd6f758883fbb990eb0f91f351191956ac451e1c1d1ae113c03311057f5e70d8231bef8edb7c2cbecc4ab3e46b02945afbcdb2e8b005819dd141055af1fd6a3240af08751cd3a78ff92e39bba4d3c23aef960646512b3b86d6a8fa6880cfce6d58e1fbe734ac5f9b7018451a7a5879b3767dfb359eee615bab65116237e5de5b96bf9fbacd11702c73a8e478a64895d15ac0110737c3ab91222bc4c87326b5d5e3cf089da0a76d43222a8eeeb5286a4cb2fced98ebc2f6e876e8ff48b6f8f8264e52cf5b38906d657bd8d0d91e2d7846224ac60526f878e8189d80957a73a0fb95223842fb819286234d742c0aee14c75ed069411f7631aaa3e2a011fe75e67131a51733b9d2dc7981935d559a08a965363cdbc02dbadfcc4435040cff61df0cea2dcc5017deab9076fcc1a11ebe5020b6c96a16425397df15881815cf60b942648c234a5614ecffd4d5de50884934bdbd5177d24ee76f0c97fd0a2b97e527fa86c73ec672398f1d88c03d467f2712908d8fff5e02b4e1fe2d7bff02205597b3a5360e2767a3d7c488d222a3ea39d3fec61423e349689297868a4bfcf08a09380000bc819ca2181f03f4ea42c7892dccd76560f1ef812ba7380681a8943e7bf2d6bb0729002a33a4a595c411cec870e8757e5d9cddb17563a627e598bd170cb6eab4d0d8a02c926bd0d67d2084df5873591ba8da1309f9c309fcdb1e1afea2ed48b467170f9d2539e62e75ed1e9ad94e2f574bba5e25f7473534e82e99263cef442f31e9e568a3eafa2b9de2a99fa681c6f6f245db26c24d56ae77fe239c63a70c2edd113f0d48bf5c2a887e1512bfb2801a0c628d3b91f57b1d1401b0e5e6012d32dafacd08775b1b28f15c44b03cd340a4e45be0534c4f5099c5bda5ef0035ab7d1ddbdb2e73ad49e15f6a04b5b09280581ebe2ce940a8058e2d14a0556c14adce8a40b6f0f78cc6bf46f0d0b2c4f9ce79e60eadd828eec8fd5c6b1196f685add24c959d4f1c9cbf7d21fb010df2f26fd1f1a5186186de0ab6f7fbf7ac2406a815382aad4edde90c8aa08ce053e86777fcbb089b4cbeb596949ff04739b53c4262b84881814c1cee97eb9147854b54ea354d53d906869c21e5772be517c127a0feb3844acb8b721f060e065b096d5f390b3557e25d50bb887ac018564a9b3ca3fe38eec76dace59bcadb81ed3764c177766ffc8770b7eca1fd3c87f3fc84f157974dc6356ab41388d973ae0a5a4a1d3d08f207b4add5bb902034f0be23bd27010cf5fb3a8ce4c34b123be47bf50fb6ff1593602e720d893561f72fcabdf7141ea4a274d319e9157ee4deb55dd412296525a1d82726fc8e8ad1ebddd6f7ac4ac10d3f59473cf5b0ae0644db9224268415ad314e4a7f4e4a17be80425198c097287ef95948ef260eb02d59e235caabeb1bcbf8829240e5637358879016ea8b5b06337d58aab36bc1a981d7667974068ca1a353a8caad2885236f407fcfc277210ff15f4d7d0caa2b31e5f745f455ff36a5fd9a9036c02f319a049ecb1d67c057130ae3d68374c82191059b44f8aebdf4574cd84cf7c031b6e177e8f5808f25ac76df8d7f9aada99e1a16ea5b22cc4bb349a352aceb2cb1ea47710704d446498f4d6ff2d8705797cfe62e03de9064a5831df451d021fcd93a71c3105f81df9d1ce5dc27d26d77326ab4bedf0c428a70772f2b0630b0640f643292e68e9b44d53f5c401f6ee09f8217b77b2d308e13cbedefa56920ad948b464a74c3e9ca9259d10132880d7dbd2c972c772985f7022a41ef473c254289982b9cde41f937a1de59b9a50caf728accac23ba485842dae35ad4ed412a31d2a134bf05ede9fc70fab45fee38f1f7e749e803446b418cc1b5e7f2019777ae03eab5e129e1eef2195ca84cde2848df14a93bbc3a917f1e06ce3753cf127f2241295fb630f6e27eadeaff570f955ace44dd204dcc082f7bcbe310e2c33267852049cb839142d072e3f3ebb1fc289c78769fd0f05578630e42a5829b82c6d535c012204aa74659282ba0498156e2183ecee174054d45fd97e5a0159255d8af432563d367f045d209c67cc70f7cf13b9a6578983ea640f0e8e66113484f48d41cb65b1338eb6cec534b3acdf9e5a1a3ac9157d75986583edfda4958e79593b6808b4762f823a6f442ee1749e592bc103f2b9e16107b939ece49cb447e5a7d34d66f18567d0e981f4fef25a467144689662783503a03e1800d22f40f61903d8270453161a68386bdd94d59dd66eb5ae067d4129be23a0b17b89d0478734460bb88c5771d9444caa769aa62d56bd128bc328e03d2e18d966f5784398ca2aab86007f7ca00908d4bd7f2f3ecf3024110b073304c7bb17bd73725721a99e94c8d5e5da7a839d58f2196cace99b98d7f584a49fee2a426e6ec3f08e520f7965aa2dad97084c2ebed43c58dbc9116f420d4735decc47dea514b689f5479c56b6128dd684c4fbf0945aa15363276af833b27b82cb48541413bc9fc51f9ce57c14bb6c39f86cbc99b69e5d91e7cf72f340f67012eb2f5fb21d830e97eb3664674ecc36c754f90d1a8f6092fe3a48827849ec95ed35887cfd2ab3f26331bdc154ad034f31ef26ecec5feedac1367f4f642e99ebb409ddd5dd8d0087ebf048e4924a2119c69ff00af79233443b897f7bd1d80f4d34555719bd8dd9c0d824d0437c2adfc598fd4c2c2d8cf7693e05238987bdb9bb04751dfcd44fbced899a7dadef499b9bfb45ee52e039369c950821a667712946c7207e36473660f3f9c9906ed889ffe7a8c735e98d41cc96aecf3e577072cb4711eb690d28ff41dbe9070cd73da26875994a7b8480f2d21bd4b92402bc293fea154071c401581a9b858dcb4113149105d793fd4d0e98894f228f24250ada364f49180fbd116e0677cbfbe928a840dbfab2791865cec67ab39affa7b76c266285ed2ede7ce77e9e6f21545b8d177cc73e5142e6bbfbb3e9793716de8d6faeb74e18475cac7541e3ccd875cc0dc8bd5a01e468700d5817fc44b6dd64d74dbe0b351c80815102a0dc2038c83dc75189bb4ca425eabeeaa70fcebfda8f16c4b083762811325fdc6b94f84b6d4629929b85d0cf678b28651cab8a825f28440ca4e7a2193c6f9c769b0aa226754fa8eabd7cd1d31ea2478a83e0d79eaff6f72bfb05c31098f4640256b8c21ef25808821c08cbc68e8b6205fdbcb10b17d63cfb5ead7fb8ae100", 0x2000, 0x0) (async, rerun: 32) r0 = fsopen(&(0x7f0000000180)='proc\x00', 0x1) (rerun: 32) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) (async) r1 = fsmount(r0, 0x0, 0x1) fchdir(r1) (async) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000000)={0xffffffffffffffff}, 0x106, 0xa}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r2, &(0x7f0000000280)={0x15, 0x110, 0xfa00, {r3, 0x0, 0x0, 0x30, 0x0, @in6={0x1b, 0x0, 0x7, @empty, 0x3aa7}, @ib={0x1b, 0xffff, 0x0, {}, 0x0, 0xfffffffffffffffc, 0x6}}}, 0x118) (async) write$RDMA_USER_CM_CMD_QUERY(r2, &(0x7f0000000080)={0x13, 0x10, 0xfa00, {0x0, r3}}, 0x18) write$RDMA_USER_CM_CMD_LISTEN(r1, &(0x7f0000000000)={0x7, 0x8, 0xfa00, {r3, 0x8}}, 0x10) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r4, &(0x7f0000000240)={0x24, &(0x7f0000000480)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r4, 0x0, &(0x7f0000001200)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000040)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r4, 0x0, 0x0) (async) syz_usb_control_io(r4, 0x0, &(0x7f0000000640)={0x84, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20, 0x0, 0x4, {0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r4, 0x0, &(0x7f0000000540)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="4010040000179ed05ca0c40b3728db382392065aaf756d38464d91c61c07269e3567a049e4492ab2cf21f80d51a9207680066983aca13c943411e150ae15db3b0561a049e3161b3ee303134923b81063c69fb3e68227bd2305"], 0x0, 0x0, 0x0, 0x0}) 5.612649889s ago: executing program 8 (id=5705): socket(0x26, 0x80000, 0x9) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000), 0x8) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000003c0)='kfree\x00', 0xffffffffffffffff, 0x0, 0x4}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x17, 0xc, 0x0, 0x0, 0x4000002, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x5, 0x0, 0x0, 0x0, 0x71, 0x10, 0x9b}, [@ldst={0x6}]}, &(0x7f0000003ff6)='GPL\x00', 0x5}, 0x94) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000040)=ANY=[@ANYBLOB="e00000027f0000010000000003"], 0x1c) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f00000008c0)={0x1, {{0x2, 0x0, @multicast2}}}, 0x88) writev(r4, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_TSINFO_GET(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16, @ANYBLOB="01002dbd7000fedbdf2531000000180001801400020064756d6d7930"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c804) 5.518534391s ago: executing program 2 (id=5706): syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = socket(0x1e, 0x4, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) recvmmsg(r2, &(0x7f00000011c0), 0x0, 0x20000, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r1, &(0x7f0000004180)=[{{0x0, 0x0, &(0x7f00000021c0)=[{&(0x7f0000001dc0)=""/69, 0x45}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) read$msr(r0, &(0x7f0000004c00)=""/102392, 0x18ff8) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') 5.465279743s ago: executing program 9 (id=5707): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040895}, 0x4) openat$kvm(0xffffffffffffff9c, 0x0, 0x20040, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) mmap(&(0x7f0000f74000/0x3000)=nil, 0x3000, 0x0, 0x28011, 0xffffffffffffffff, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) r2 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000240)=r2) ioctl$VHOST_SET_VRING_KICK(r1, 0x4008af20, &(0x7f0000000040)={0x1, r2}) ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000002c0)=""/100, &(0x7f0000000480)=""/84, 0xeeef0000}) socket$nl_route(0x10, 0x3, 0x0) r3 = dup(0xffffffffffffffff) r4 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000f00)=[{&(0x7f0000000200)="5c00000014006b05c84e21000ab16d6e230675f811000000440002005817d30461bc24eeb556a7ef595105ea1698fa51f60a64c9f408000000e786a6d0bdbdc3d44bd70011b6c0504bb9189d9193e9bd00"/92, 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x240040c4) r5 = socket$phonet_pipe(0x23, 0x5, 0x2) connect$phonet_pipe(r5, &(0x7f0000000040)={0x23, 0x0, 0x58}, 0x10) readv(r5, &(0x7f0000000100)=[{&(0x7f00000005c0)=""/183, 0xb7}], 0x1) ioctl$VHOST_SET_MEM_TABLE(r1, 0x4008af03, &(0x7f0000000e40)) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000080)={0x0, 0x1, 0x0, &(0x7f0000000680)=""/264, 0x0, 0xdddd0000}) ioctl$VHOST_VSOCK_SET_RUNNING(r1, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_SET_LOG_BASE(r1, 0x4008af04, &(0x7f0000000340)=&(0x7f0000000180)) syz_open_dev$MSR(&(0x7f0000000140), 0xfffffffffffffffe, 0x0) r6 = userfaultfd(0x80801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r7 = userfaultfd(0x80001) ioctl$UFFDIO_API(r7, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x100}) 4.705670419s ago: executing program 6 (id=5708): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) socket$kcm(0x23, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) write$tun(r3, &(0x7f0000000380)=ANY=[], 0x78) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$BATADV_CMD_GET_NEIGHBORS(r0, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB, @ANYRES32=r2], 0x24}}, 0x0) 4.575425154s ago: executing program 8 (id=5709): socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r0 = syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r0, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="1801000001010102000000000000000002000008a80001801400018008000100ac14141a08000200640101022c00018014000300fe80000000000000000000000000002714000400fc0100000000000000000000000000011400018008000100e000000208000200e00000010c000400000001003a00000006000340000200002c00018014000300fc01000000000000000000000000000114000400fe880000000000000000000000000001060003400000000006000340000100003c000d8014000500fe8000000000000000000000000000bb14000400fc00000000000000000000000000000008000200ac1414bb08000200800000001800048014000380080002400000f9040500009fb301000000000008000c4000"], 0x118}, 0x1, 0x0, 0x0, 0x4000881}, 0x8000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000240)={0x0, 0xebcc, 0x1, 0x2, 0x24e}, &(0x7f00000000c0)=0x0, &(0x7f0000000380)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x40, 0x0, 0x80, 0x3, 0x0, 0x9276, 0x0, 0x0, {0x1}}) io_uring_enter(r2, 0x47bc, 0x3bf6, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000240)={'batadv_slave_1\x00', &(0x7f0000000140)=@ethtool_eeprom={0xc, 0x1, 0x9}}) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={0x1}, 0x4) 3.979243301s ago: executing program 7 (id=5710): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @broadcast}, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000200)='/proc/bus/input/devices\x00', 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$SOUND_PCM_READ_RATE(r3, 0x80045002, &(0x7f00000012c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) dup3(0xffffffffffffffff, r6, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') socket$inet6(0xa, 0x3, 0x7) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd2b, 0x4, {{@in6=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x200000, 0x20000000, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x820000000000002}, 0x0, 0x0, 0x1}}, 0xb8}, 0x1, 0x0, 0x0, 0x8001}, 0x0) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}}, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x201, 0x0, 0x0) 3.949056752s ago: executing program 9 (id=5711): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000540), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f00000000c0)={'batadv0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r4 = getpid() sched_setscheduler(r4, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$BATADV_CMD_GET_DAT_CACHE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="050300000000000000", @ANYRES32=r3], 0x1c}}, 0x24044080) 3.631022038s ago: executing program 6 (id=5712): bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x0, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="180000000000000000000000000000009540000000"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) pipe(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x2a, 0xa9}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, 0x0, 0x0) mount(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080)='ecryptfs\x00', 0x10005, 0x0) ioctl$FUSE_DEV_IOC_CLONE(r2, 0x8004e500, &(0x7f0000000240)=r3) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f00000002c0)="23000000010006", 0x7) 2.762613551s ago: executing program 7 (id=5713): io_setup(0x25dc, &(0x7f0000000040)=0x0) io_submit(r0, 0x0, 0x0) openat$selinux_user(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$kcm(0x10, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000080), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket(0x10, 0x3, 0x0) sendto$inet6(r2, &(0x7f0000000340)="9000000018001f2fb9409b52ffff65580200be04020c060560020b0243000f00ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20b6ec0cff3959547f500f58ba86c902000f1d012e02000280160012000a000000000000000000000000080000000eceb6b362bb944cf2e70100aba4183b003e5fa424ac4d31c4f7a1", 0x90, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) add_key(0x0, &(0x7f0000000100)={'syz', 0x3}, 0x0, 0x0, 0xfffffffffffffffe) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) syz_genetlink_get_family_id$l2tp(&(0x7f0000000600), r3) r4 = fsopen(&(0x7f0000000040)='afs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000300)='source', &(0x7f0000000180)='%\xde({^\xfa@:', 0x0) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r3, 0x84, 0xa, &(0x7f0000000a40)={0x9, 0x5, 0x9, 0x5, 0xffff, 0x4, 0x8, 0x7fffffff}, &(0x7f0000000a80)=0x20) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000500)={{{@in6=@initdev, @in6=@mcast1}}, {{@in=@multicast2}, 0x0, @in6=@empty}}, &(0x7f0000000cc0)=0xe8) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, 0x0) ioctl$UFFDIO_COPY(r5, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ac2000/0x2000)=nil, 0x4000}) r6 = syz_open_dev$loop(&(0x7f0000000040), 0x1000000009, 0x198960) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/fscaps', 0x40000, 0xf) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000000080)={r7, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0xd, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0xfffffffffffffce8, 0xa]}}) syz_open_dev$loop(&(0x7f0000000080), 0x401, 0x0) 2.000203704s ago: executing program 6 (id=5714): socket$inet_tcp(0x2, 0x1, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r1 = syz_open_dev$vcsa(&(0x7f0000000000), 0x9, 0x0) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000180)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[], 0x118}, 0x1, 0x0, 0x0, 0x4000881}, 0x8000) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x1, 0x2}, 0x28) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x18, 0x4, &(0x7f0000000080)=@framed={{}, [@jmp={0x5, 0x0, 0xe, 0x0, 0x0, 0x3}]}, &(0x7f0000000140)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x8}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_io_uring_setup(0x237, &(0x7f0000000240)={0x0, 0xebcc, 0x1, 0x2, 0x24e}, &(0x7f00000000c0)=0x0, &(0x7f0000000380)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r6, 0x16, &(0x7f00000001c0)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, 0x0) io_uring_enter(r6, 0x47bc, 0x3bf6, 0x7, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r9, &(0x7f0000019680)=""/102392, 0x18ff8) r10 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r10, 0x8946, &(0x7f0000000240)={'batadv_slave_1\x00', &(0x7f0000000140)=@ethtool_eeprom={0xc, 0x1, 0x9}}) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000000c0)={0x1}, 0x4) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r5, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000440)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x3, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], &(0x7f00000004c0)=[0x0, 0x0, 0x0], 0x0, 0xa5, 0x0, 0x0, 0x10, &(0x7f0000000540), &(0x7f0000000580), 0x8, 0x54, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) 1.103721815s ago: executing program 7 (id=5715): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0xfffe, 0x4, @mcast2={0xff, 0x3}}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000080)=ANY=[@ANYBLOB="ffffffffffd2a9dc6da626c0e21677ffaaaaaaaaaa2b86dd6700000100513afffe880000000000000000000000000201ff02000000000000000000000000000189009078000000002001000000000000000000000001fe800000000000000000000000000038220560aeb59d3fb13258c6f29dd7eed9c5aaa04a18f74d2a89000000000000"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = mq_open(&(0x7f0000000000)='e_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000040000000, 0x4, 0x4, 0x9}) mq_timedsend(r3, 0x0, 0x0, 0x5, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f00000000c0)={0x18}) mq_timedreceive(r3, &(0x7f0000000140)=""/154, 0x9a, 0x0, &(0x7f0000000040)={0x77359400}) r5 = creat(&(0x7f00000001c0)='./file0\x00', 0x16c) r6 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r6, 0x5423, &(0x7f0000000080)=0x1) ioctl$TCSETA(r6, 0x8925, &(0x7f0000000100)={0x1, 0x0, 0x805, 0x0, 0x13, "31f40000f7ece2f4"}) r7 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ZERO(r7, 0x0, 0x48f, &(0x7f0000000740)={0x11, @multicast2, 0x4e24, 0x4, 'wrr\x00', 0x39, 0x7ff, 0x22}, 0x2c) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000240), 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) r8 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(r8, &(0x7f0000000200)=ANY=[@ANYRESDEC=r6, @ANYRES64=r5], 0x119) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x8031, r8, 0x1000) syz_open_dev$hidraw(&(0x7f00000004c0), 0x0, 0x14a042) read(r3, 0x0, 0x0) 1.045081541s ago: executing program 9 (id=5716): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000, 0x0) preadv2(r4, &(0x7f0000000080)=[{&(0x7f0000001200)=""/4096, 0x1fee00}], 0x2, 0x0, 0x0, 0x0) 125.212938ms ago: executing program 2 (id=5717): write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x2}, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000900)={&(0x7f00000000c0)='mmap_lock_acquire_returned\x00', r2, 0x0, 0x1}, 0x18) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000180), 0x400, &(0x7f0000000080)=ANY=[@ANYBLOB="6d706f6c3d708941c8eb50"]) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f0000000700)={&(0x7f0000000140)=@in={0x2, 0x4e21, @local}, 0x10, 0x0}, 0x1) read$msr(0xffffffffffffffff, &(0x7f0000000400)=""/246, 0xf6) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(0xffffffffffffffff, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x80000001, 0x30}, 0xc) r3 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) gettid() r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x180, 0x0) ioctl$TIOCGSOFTCAR(r4, 0x5414, &(0x7f0000000000)) ioctl$COMEDI_DEVCONFIG(r3, 0x40946400, 0x0) msgsnd(0x0, 0x0, 0xff, 0x0) msgrcv(0x0, 0x0, 0x0, 0xffffffffffffffff, 0x2000) r5 = dup(0xffffffffffffffff) write$cgroup_subtree(r5, 0x0, 0x32600) futex(0x0, 0x85, 0x0, 0x0, 0x0, 0xa0090199) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000f195"], &(0x7f0000000140)='GPL\x00'}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000016c0)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x8, 0x0, &(0x7f00000006c0)="d19db5e8a2a441df", 0x0, 0x2, 0x0, 0x4}, 0x50) openat$fuse(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) 17.604722ms ago: executing program 9 (id=5718): socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) r1 = syz_open_dev$cec(&(0x7f00000003c0), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r1, 0xc05c6104, &(0x7f0000004180)={"2370491d", 0x0, 0x3, 0xa, 0x8, 0x5, "000064640000001503fe00", "defda28a", '\x00', 't0\x00', ['\x00', "f548000000004000000900", "00000600", "000081909d8f00"]}) ioctl$CEC_TRANSMIT(r1, 0xc0386105, &(0x7f0000000480)={0x7, 0xc, 0x7, 0x0, 0x3, 0x202, "3bf9575d0000000010344a00", 0x2, 0x2, 0x0, 0x6, 0x0, 0x4, 0xff}) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x6, &(0x7f0000000000)=0x2004, 0xfffffffffffffd3b) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0x2100, 0x0, &(0x7f0000000100), 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f0000000140)={'ni_at_a2150\x00', [0xb013, 0x7, 0x0, 0xdd5, 0x88d7, 0x8f, 0x2, 0x8012, 0x1006, 0xffffffff, 0x203, 0x7, 0x10000009, 0x3, 0x5, 0xfffffffd, 0x8, 0x6, 0x9, 0x8e, 0x3, 0x3, 0x7, 0xa, 0x4, 0x1, 0xb0c4, 0xc, 0x4, 0x400002, 0x22]}) ioctl$TIOCCBRK(r3, 0x5428) connect$inet(0xffffffffffffffff, 0x0, 0x0) getsockopt$inet6_tcp_TCP_ZEROCOPY_RECEIVE(r2, 0x6, 0x23, 0x0, &(0x7f0000019500)) dup(0xffffffffffffffff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='.\x00', &(0x7f0000000000)='jfs\x00', 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d0241710d8050a81b892000000010902900902000000000904"], 0x0) syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x40200) 0s ago: executing program 6 (id=5719): r0 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) ioctl$mixer_OSS_ALSAEMULVER(0xffffffffffffffff, 0x80044df9, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) connect$vsock_stream(0xffffffffffffffff, &(0x7f0000000200)={0x28, 0x0, 0x2711, @my=0x1}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r2 = socket(0x1e, 0x4, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/crypto\x00', 0x0, 0x0) recvmmsg(r3, &(0x7f00000011c0)=[{{0x0, 0x0, &(0x7f0000000140)=[{0x0}], 0x1}, 0x404}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000240)=""/108, 0x6c}, {&(0x7f0000000100)=""/3, 0x3}, {&(0x7f000001dc00)=""/4096, 0x1000}, {&(0x7f0000000300)=""/198, 0xc6}, {&(0x7f0000000440)}], 0x5, &(0x7f0000000500)=""/175, 0xaf}, 0xa}, {{&(0x7f00000005c0)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f00000009c0)=[{&(0x7f0000000640)=""/235, 0xeb}, {&(0x7f0000000440)=""/29, 0x1d}, {&(0x7f000001ec00)=""/4096, 0x1000}, {&(0x7f0000000780)=""/127, 0x7f}, {&(0x7f0000000800)=""/174, 0xae}, {&(0x7f00000008c0)=""/144, 0x90}, {&(0x7f0000000980)=""/2, 0x2}], 0x7, &(0x7f0000000a40)=""/45, 0x2d}, 0x60}, {{&(0x7f0000000a80)=@nfc, 0x80, 0x0, 0x0, &(0x7f0000001100)=""/144, 0x90}, 0x1}], 0x4, 0x20000, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7fffffff, 0x400, 0x1, 0xd, 0x1, 0x6, 0x6}, 0x1c) recvmmsg$unix(r2, &(0x7f0000004180)=[{{&(0x7f0000001d40), 0x6e, &(0x7f00000021c0)=[{&(0x7f0000001dc0)=""/69, 0x45}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) read$msr(r1, &(0x7f0000004c00)=""/102392, 0x18ff8) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r4 = add_key$keyring(&(0x7f0000000080), &(0x7f00000000c0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) add_key$keyring(&(0x7f0000000040), &(0x7f0000000140)={'syz', 0x3}, 0x0, 0x0, r4) keyctl$clear(0x7, r4) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r5, &(0x7f0000000040)=[{&(0x7f0000001440)=""/4106, 0x100a}], 0x1, 0x300, 0x0) syz_io_uring_setup(0x239, &(0x7f0000001080)={0x0, 0x0, 0x10100, 0x0, 0x0, 0x0, r0}, &(0x7f0000000000), &(0x7f00000001c0)) kernel console output (not intermixed with test programs): 68] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 1879.060548][T23778] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1879.210918][T23768] usb 7-1: device descriptor read/64, error -71 [ 1879.289975][T27277] FAULT_INJECTION: forcing a failure. [ 1879.289975][T27277] name failslab, interval 1, probability 0, space 0, times 0 [ 1879.312334][T27277] CPU: 1 UID: 0 PID: 27277 Comm: syz.8.5143 Not tainted syzkaller #0 PREEMPT(full) [ 1879.312361][T27277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1879.312371][T27277] Call Trace: [ 1879.312377][T27277] [ 1879.312384][T27277] dump_stack_lvl+0x16c/0x1f0 [ 1879.312415][T27277] should_fail_ex+0x512/0x640 [ 1879.312440][T27277] ? kmem_cache_alloc_noprof+0x62/0x760 [ 1879.312465][T27277] should_failslab+0xc2/0x120 [ 1879.312492][T27277] kmem_cache_alloc_noprof+0x75/0x760 [ 1879.312512][T27277] ? security_file_alloc+0x34/0x2b0 [ 1879.312537][T27277] ? security_file_alloc+0x34/0x2b0 [ 1879.312557][T27277] security_file_alloc+0x34/0x2b0 [ 1879.312577][T27277] init_file+0x93/0x4c0 [ 1879.312597][T27277] alloc_empty_file+0x73/0x1e0 [ 1879.312617][T27277] path_openat+0xde/0x3140 [ 1879.312633][T27277] ? do_syscall_64+0xcd/0xf80 [ 1879.312655][T27277] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1879.312679][T27277] ? __pfx_path_openat+0x10/0x10 [ 1879.312705][T27277] do_filp_open+0x20b/0x470 [ 1879.312721][T27277] ? __pfx_do_filp_open+0x10/0x10 [ 1879.312754][T27277] ? alloc_fd+0x471/0x7d0 [ 1879.312775][T27277] do_sys_openat2+0x11f/0x280 [ 1879.312795][T27277] ? __pfx_do_sys_openat2+0x10/0x10 [ 1879.312817][T27277] ? __fget_files+0x20e/0x3c0 [ 1879.312837][T27277] __x64_sys_openat+0x174/0x210 [ 1879.312858][T27277] ? __pfx___x64_sys_openat+0x10/0x10 [ 1879.312877][T27277] ? ksys_write+0x1ac/0x250 [ 1879.312909][T27277] do_syscall_64+0xcd/0xf80 [ 1879.312933][T27277] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1879.312950][T27277] RIP: 0033:0x7fc79c58f749 [ 1879.312974][T27277] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1879.312992][T27277] RSP: 002b:00007fc79d374038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1879.313009][T27277] RAX: ffffffffffffffda RBX: 00007fc79c7e5fa0 RCX: 00007fc79c58f749 [ 1879.313021][T27277] RDX: 0000000000000002 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 1879.313032][T27277] RBP: 00007fc79d374090 R08: 0000000000000000 R09: 0000000000000000 [ 1879.313042][T27277] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1879.313052][T27277] R13: 00007fc79c7e6038 R14: 00007fc79c7e5fa0 R15: 00007ffcc7ac3808 [ 1879.313075][T27277] [ 1879.314744][ T5883] usb 10-1: new high-speed USB device number 48 using dummy_hcd [ 1879.409523][T27280] bridge0: entered promiscuous mode [ 1879.413992][T23768] usb usb7-port1: attempt power cycle [ 1879.417647][T27279] bridge0: left promiscuous mode [ 1879.840858][T23768] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 1879.888403][T27291] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1879.904813][T23768] usb 7-1: device descriptor read/8, error -71 [ 1879.935518][ T5883] usb 10-1: too many configurations: 94, using maximum allowed: 8 [ 1880.209780][T27291] netlink: 176 bytes leftover after parsing attributes in process `syz.8.5147'. [ 1880.271558][T23768] usb 7-1: new high-speed USB device number 55 using dummy_hcd [ 1880.281069][ T5883] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 1880.290024][ T5883] usb 10-1: can't read configurations, error -61 [ 1880.298287][T23768] usb 7-1: device descriptor read/8, error -71 [ 1880.332770][T27288] XFS (nbd8): SB validate failed with error -5. [ 1880.411290][T23768] usb usb7-port1: unable to enumerate USB device [ 1880.451120][ T5883] usb 10-1: new high-speed USB device number 49 using dummy_hcd [ 1880.621418][ T5883] usb 10-1: too many configurations: 94, using maximum allowed: 8 [ 1880.632371][ T5883] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 1880.672199][ T5883] usb 10-1: can't read configurations, error -61 [ 1880.708435][ T5883] usb usb10-port1: attempt power cycle [ 1881.061010][ T5883] usb 10-1: new high-speed USB device number 50 using dummy_hcd [ 1881.541756][ T5883] usb 10-1: too many configurations: 94, using maximum allowed: 8 [ 1881.580954][ T5883] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 1881.698276][ T5883] usb 10-1: can't read configurations, error -61 [ 1882.334742][ T5883] usb 10-1: new high-speed USB device number 51 using dummy_hcd [ 1882.451372][ T5883] usb 10-1: device descriptor read/8, error -71 [ 1882.645778][T27323] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5154'. [ 1882.987452][ T5883] usb usb10-port1: unable to enumerate USB device [ 1883.813293][T27335] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1883.907852][T27336] XFS (nbd6): SB validate failed with error -5. [ 1884.240804][T23768] usb 7-1: new full-speed USB device number 56 using dummy_hcd [ 1884.476937][T23768] usb 7-1: config 16 has an invalid interface number: 19 but max is 0 [ 1884.641024][T23768] usb 7-1: config 16 has no interface number 0 [ 1884.664477][T23768] usb 7-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1884.698668][T23768] usb 7-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 1884.875349][T23768] usb 7-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 1884.885388][T23768] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1884.900826][T23768] usb 7-1: Product: syz [ 1884.905066][T23768] usb 7-1: Manufacturer: syz [ 1884.909865][T23768] usb 7-1: SerialNumber: syz [ 1884.952097][T27336] raw-gadget.2 gadget.6: fail, usb_ep_enable returned -22 [ 1885.018136][T27353] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1885.198253][T23768] usb 7-1: USB disconnect, device number 56 [ 1885.221634][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1885.275285][T27354] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5160'. [ 1886.022921][T27354] XFS (nbd2): SB validate failed with error -5. [ 1886.362768][T27368] Mount JFS Failure: -22 [ 1886.367155][T27368] jfs_mount failed w/return code = -22 [ 1887.616247][T27378] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=27378 comm=syz.9.5165 [ 1887.640781][ T5875] usb 7-1: new high-speed USB device number 57 using dummy_hcd [ 1888.550867][ T5875] usb 7-1: Using ep0 maxpacket: 32 [ 1888.651472][ T5875] usb 7-1: config 0 has an invalid descriptor of length 70, skipping remainder of the config [ 1889.619614][ T5875] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1889.633043][ T5875] usb 7-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 1889.645374][ T5875] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1889.947578][ T5875] usb 7-1: Product: syz [ 1889.957012][ T5875] usb 7-1: Manufacturer: syz [ 1889.975445][ T5875] usb 7-1: SerialNumber: syz [ 1889.984679][ T5875] usb 7-1: config 0 descriptor?? [ 1890.030836][ T5875] usb 7-1: can't set config #0, error -71 [ 1890.111002][ T5875] usb 7-1: USB disconnect, device number 57 [ 1890.641043][T19251] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 1890.771859][ T5941] usb 3-1: new high-speed USB device number 106 using dummy_hcd [ 1890.890906][T19251] usb 9-1: Using ep0 maxpacket: 16 [ 1890.902319][T19251] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1890.913902][T19251] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 1890.930803][T19251] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1890.931122][ T5941] usb 3-1: Using ep0 maxpacket: 16 [ 1890.940806][ T5875] usb 10-1: new full-speed USB device number 52 using dummy_hcd [ 1890.952978][T19251] usb 9-1: config 0 descriptor?? [ 1890.982387][ T5941] usb 3-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1891.001098][ T5941] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1891.009121][ T5941] usb 3-1: Product: syz [ 1891.018276][ T5941] usb 3-1: Manufacturer: syz [ 1891.031071][ T5941] usb 3-1: SerialNumber: syz [ 1891.037726][ T5941] usb 3-1: config 0 descriptor?? [ 1891.044876][ T5941] visor 3-1:0.0: Sony Clie 3.5 converter detected [ 1891.061264][T23778] usb 7-1: new high-speed USB device number 58 using dummy_hcd [ 1891.133323][ T5875] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1891.143682][ T5875] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1891.152804][ T5875] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1891.163952][ T5875] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1891.174519][ T5875] usb 10-1: config 0 descriptor?? [ 1891.184080][ T5875] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1891.191822][ T5875] dvb-usb: bulk message failed: -22 (3/0) [ 1891.202357][ T5875] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1891.216133][T23778] usb 7-1: Using ep0 maxpacket: 16 [ 1891.222367][ T5875] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1891.229643][ T5875] usb 10-1: media controller created [ 1891.237509][T23778] usb 7-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1891.247093][ T5875] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1891.248958][ T5941] usb 3-1: clie_3_5_startup: get config number failed: -71 [ 1891.255615][T23778] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1891.267628][ T5941] visor 3-1:0.0: probe with driver visor failed with error -71 [ 1891.274140][T23778] usb 7-1: Product: syz [ 1891.290168][T23778] usb 7-1: Manufacturer: syz [ 1891.295410][ T5875] dvb-usb: bulk message failed: -22 (6/0) [ 1891.297898][ T5941] usb 3-1: USB disconnect, device number 106 [ 1891.305765][ T5875] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1891.319629][T23778] usb 7-1: SerialNumber: syz [ 1891.330009][ T5875] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.9/usb10/10-1/input/input87 [ 1891.346677][T23778] usb 7-1: config 0 descriptor?? [ 1891.354905][ T5875] dvb-usb: schedule remote query interval to 150 msecs. [ 1891.363016][ T5875] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1891.373682][T23778] visor 7-1:0.0: Sony Clie 3.5 converter detected [ 1891.386440][T19251] mcp2221 0003:04D8:00DD.0014: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.8-1/input0 [ 1891.404336][ T5875] usb 10-1: USB disconnect, device number 52 [ 1891.427445][ T5875] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1891.567858][T23778] usb 7-1: clie_3_5_startup: get config number failed: -71 [ 1891.581076][T23778] visor 7-1:0.0: probe with driver visor failed with error -71 [ 1891.616961][T23778] usb 7-1: USB disconnect, device number 58 [ 1891.816449][ T5883] usb 9-1: USB disconnect, device number 62 [ 1893.705668][T27427] kAFS: unable to lookup cell '({^@' [ 1895.385144][T27440] Device name cannot be null; rc = [-22] [ 1896.473716][T27446] netlink: 'syz.7.5185': attribute type 3 has an invalid length. [ 1896.645297][T27454] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=27454 comm=syz.6.5187 [ 1896.691413][ T5875] usb 9-1: new full-speed USB device number 63 using dummy_hcd [ 1897.530364][ T5875] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1897.673023][ T5875] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1897.727742][ T5875] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1898.190790][ T5875] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1898.204299][ T5875] usb 9-1: Product: syz [ 1898.208788][ T5875] usb 9-1: Manufacturer: syz [ 1898.213774][ T5875] usb 9-1: SerialNumber: syz [ 1898.230401][ T5875] usb 9-1: config 0 descriptor?? [ 1898.238616][ T5875] usb 9-1: can't set config #0, error -71 [ 1898.257544][ T5875] usb 9-1: USB disconnect, device number 63 [ 1900.760162][T27493] FAULT_INJECTION: forcing a failure. [ 1900.760162][T27493] name failslab, interval 1, probability 0, space 0, times 0 [ 1900.796683][T27493] CPU: 1 UID: 0 PID: 27493 Comm: syz.7.5199 Not tainted syzkaller #0 PREEMPT(full) [ 1900.796710][T27493] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1900.796721][T27493] Call Trace: [ 1900.796727][T27493] [ 1900.796734][T27493] dump_stack_lvl+0x16c/0x1f0 [ 1900.796766][T27493] should_fail_ex+0x512/0x640 [ 1900.796792][T27493] ? kmem_cache_alloc_node_noprof+0x65/0x7f0 [ 1900.796818][T27493] should_failslab+0xc2/0x120 [ 1900.796853][T27493] kmem_cache_alloc_node_noprof+0x78/0x7f0 [ 1900.796874][T27493] ? __alloc_skb+0x156/0x410 [ 1900.796899][T27493] ? __alloc_skb+0x35d/0x410 [ 1900.796929][T27493] ? __alloc_skb+0x156/0x410 [ 1900.796953][T27493] __alloc_skb+0x156/0x410 [ 1900.796977][T27493] ? __alloc_skb+0x35d/0x410 [ 1900.797002][T27493] ? __pfx___alloc_skb+0x10/0x10 [ 1900.797022][T27493] ? __pfx_tc_modify_qdisc+0x10/0x10 [ 1900.797056][T27493] netlink_ack+0x15d/0xb80 [ 1900.797083][T27493] netlink_rcv_skb+0x332/0x420 [ 1900.797103][T27493] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1900.797124][T27493] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1900.797153][T27493] ? netlink_deliver_tap+0x1ae/0xd30 [ 1900.797180][T27493] netlink_unicast+0x5aa/0x870 [ 1900.797204][T27493] ? __pfx_netlink_unicast+0x10/0x10 [ 1900.797234][T27493] netlink_sendmsg+0x8c8/0xdd0 [ 1900.797260][T27493] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1900.797291][T27493] ____sys_sendmsg+0xa5d/0xc30 [ 1900.797315][T27493] ? copy_msghdr_from_user+0x10a/0x160 [ 1900.797331][T27493] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1900.797355][T27493] ? __pfx__kstrtoull+0x10/0x10 [ 1900.797379][T27493] ___sys_sendmsg+0x134/0x1d0 [ 1900.797396][T27493] ? __pfx____sys_sendmsg+0x10/0x10 [ 1900.797422][T27493] ? find_held_lock+0x2b/0x80 [ 1900.797455][T27493] __sys_sendmmsg+0x200/0x420 [ 1900.797474][T27493] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1900.797500][T27493] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1900.797536][T27493] ? fput+0x70/0xf0 [ 1900.797555][T27493] ? ksys_write+0x1ac/0x250 [ 1900.797581][T27493] ? __pfx_ksys_write+0x10/0x10 [ 1900.797609][T27493] __x64_sys_sendmmsg+0x9c/0x100 [ 1900.797626][T27493] ? lockdep_hardirqs_on+0x7c/0x110 [ 1900.797651][T27493] do_syscall_64+0xcd/0xf80 [ 1900.797678][T27493] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1900.797697][T27493] RIP: 0033:0x7f51e538f749 [ 1900.797712][T27493] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1900.797730][T27493] RSP: 002b:00007f51e6309038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1900.797749][T27493] RAX: ffffffffffffffda RBX: 00007f51e55e5fa0 RCX: 00007f51e538f749 [ 1900.797761][T27493] RDX: 040000000000009f RSI: 00002000000002c0 RDI: 0000000000000004 [ 1900.797772][T27493] RBP: 00007f51e6309090 R08: 0000000000000000 R09: 0000000000000000 [ 1900.797783][T27493] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1900.797794][T27493] R13: 00007f51e55e6038 R14: 00007f51e55e5fa0 R15: 00007ffd04424168 [ 1900.797815][T27493] [ 1901.308257][T27504] netlink: 'syz.2.5186': attribute type 15 has an invalid length. [ 1901.316348][T27504] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5186'. [ 1901.416693][T27504] kAFS: unable to lookup cell '({^@' [ 1901.753064][T27501] netlink: 176 bytes leftover after parsing attributes in process `syz.8.5201'. [ 1901.803461][T27501] XFS (nbd8): SB validate failed with error -5. [ 1901.917071][T27522] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=27522 comm=syz.2.5202 [ 1902.018412][T27523] FAULT_INJECTION: forcing a failure. [ 1902.018412][T27523] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1902.085026][T27523] CPU: 0 UID: 0 PID: 27523 Comm: syz.6.5205 Not tainted syzkaller #0 PREEMPT(full) [ 1902.085052][T27523] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1902.085063][T27523] Call Trace: [ 1902.085070][T27523] [ 1902.085078][T27523] dump_stack_lvl+0x16c/0x1f0 [ 1902.085110][T27523] should_fail_ex+0x512/0x640 [ 1902.085141][T27523] _copy_from_user+0x2e/0xd0 [ 1902.085168][T27523] kstrtouint_from_user+0xd6/0x1d0 [ 1902.085188][T27523] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1902.085212][T27523] ? lock_acquire+0x179/0x330 [ 1902.085244][T27523] proc_fail_nth_write+0x83/0x220 [ 1902.085270][T27523] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1902.085300][T27523] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1902.085322][T27523] vfs_write+0x2a0/0x11d0 [ 1902.085353][T27523] ? __pfx___mutex_lock+0x10/0x10 [ 1902.085386][T27523] ? __pfx_vfs_write+0x10/0x10 [ 1902.085421][T27523] ? __fget_files+0x20e/0x3c0 [ 1902.085447][T27523] ksys_write+0x12a/0x250 [ 1902.085474][T27523] ? __pfx_ksys_write+0x10/0x10 [ 1902.085499][T27523] ? rcu_is_watching+0x12/0xc0 [ 1902.085527][T27523] do_syscall_64+0xcd/0xf80 [ 1902.085556][T27523] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1902.085576][T27523] RIP: 0033:0x7f0ea7d8e1ff [ 1902.085591][T27523] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1902.085610][T27523] RSP: 002b:00007f0ea8cc7030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1902.085628][T27523] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0ea7d8e1ff [ 1902.085641][T27523] RDX: 0000000000000001 RSI: 00007f0ea8cc70a0 RDI: 0000000000000005 [ 1902.085652][T27523] RBP: 00007f0ea8cc7090 R08: 0000000000000000 R09: 0000000000000000 [ 1902.085664][T27523] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1902.085676][T27523] R13: 00007f0ea7fe6128 R14: 00007f0ea7fe6090 R15: 00007ffd38e02058 [ 1902.085703][T27523] [ 1902.280342][ C0] vkms_vblank_simulate: vblank timer overrun [ 1902.640417][T27529] input: syz0 as /devices/virtual/input/input88 [ 1902.689137][T27527] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1902.833175][T27534] FAULT_INJECTION: forcing a failure. [ 1902.833175][T27534] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1902.846340][T27534] CPU: 0 UID: 0 PID: 27534 Comm: syz.2.5210 Not tainted syzkaller #0 PREEMPT(full) [ 1902.846367][T27534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1902.846378][T27534] Call Trace: [ 1902.846385][T27534] [ 1902.846393][T27534] dump_stack_lvl+0x16c/0x1f0 [ 1902.846426][T27534] should_fail_ex+0x512/0x640 [ 1902.846456][T27534] _copy_to_user+0x32/0xd0 [ 1902.846482][T27534] simple_read_from_buffer+0xcb/0x170 [ 1902.846508][T27534] proc_fail_nth_read+0x197/0x240 [ 1902.846527][T27534] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1902.846546][T27534] ? rw_verify_area+0xcf/0x6c0 [ 1902.846564][T27534] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1902.846582][T27534] vfs_read+0x1e4/0xcf0 [ 1902.846603][T27534] ? __pfx___mutex_lock+0x10/0x10 [ 1902.846626][T27534] ? __pfx_vfs_read+0x10/0x10 [ 1902.846656][T27534] ? __fget_files+0x20e/0x3c0 [ 1902.846677][T27534] ksys_read+0x12a/0x250 [ 1902.846696][T27534] ? __pfx_ksys_read+0x10/0x10 [ 1902.846715][T27534] ? rcu_is_watching+0x12/0xc0 [ 1902.846738][T27534] do_syscall_64+0xcd/0xf80 [ 1902.846760][T27534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1902.846775][T27534] RIP: 0033:0x7fccb138e15c [ 1902.846788][T27534] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1902.846803][T27534] RSP: 002b:00007fccb2278030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1902.846818][T27534] RAX: ffffffffffffffda RBX: 00007fccb15e6180 RCX: 00007fccb138e15c [ 1902.846828][T27534] RDX: 000000000000000f RSI: 00007fccb22780a0 RDI: 0000000000000007 [ 1902.846836][T27534] RBP: 00007fccb2278090 R08: 0000000000000000 R09: 0000000000000000 [ 1902.846845][T27534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1902.846853][T27534] R13: 00007fccb15e6218 R14: 00007fccb15e6180 R15: 00007ffd66f36d38 [ 1902.846873][T27534] [ 1903.033734][ C0] vkms_vblank_simulate: vblank timer overrun [ 1903.441048][T27527] netlink: 176 bytes leftover after parsing attributes in process `syz.8.5208'. [ 1903.578761][T27527] XFS (nbd8): SB validate failed with error -5. [ 1903.665226][T27547] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=27547 comm=syz.9.5207 [ 1903.687607][T27547] netlink: 'syz.9.5207': attribute type 1 has an invalid length. [ 1904.492821][T27547] workqueue: Failed to create a rescuer kthread for wq "bond3": -EINTR [ 1905.325354][T19251] usb 7-1: new high-speed USB device number 59 using dummy_hcd [ 1905.590986][T19251] usb 7-1: Using ep0 maxpacket: 8 [ 1905.605965][T27558] netlink: 'syz.8.5213': attribute type 10 has an invalid length. [ 1905.919548][T19251] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1905.929810][T19251] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 1905.950842][T19251] usb 7-1: can't read configurations, error -71 [ 1906.007956][T27562] netlink: 'syz.9.5215': attribute type 10 has an invalid length. [ 1906.308799][T27568] kAFS: unable to lookup cell '({^@' [ 1906.637127][T27561] kAFS: unable to lookup cell '({^@' [ 1907.411189][T27575] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5217'. [ 1907.420223][T27575] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5217'. [ 1907.729085][T27583] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=27583 comm=syz.9.5220 [ 1908.603665][T27592] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5221'. [ 1908.641630][T27586] Mount JFS Failure: -22 [ 1908.645929][T27586] jfs_mount failed w/return code = -22 [ 1908.933093][T19251] usb 9-1: new full-speed USB device number 64 using dummy_hcd [ 1909.512599][T19251] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1909.522986][T19251] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1909.533121][T19251] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1909.552629][T19251] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1909.563789][T19251] usb 9-1: config 0 descriptor?? [ 1909.573128][T19251] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1909.580166][T19251] dvb-usb: bulk message failed: -22 (3/0) [ 1909.595656][T19251] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1909.607644][T19251] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1909.616672][T19251] usb 9-1: media controller created [ 1909.630199][T19251] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1909.643354][T27604] Bluetooth: MGMT ver 1.23 [ 1909.651320][ T30] audit: type=1400 audit(1764869399.489:1202): avc: denied { read } for pid=27602 comm="syz.9.5226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1909.912643][T23780] hid-generic 0000:0000:0000.0015: unknown main item tag 0x0 [ 1909.959274][ T30] audit: type=1400 audit(1764869399.599:1203): avc: denied { mount } for pid=27602 comm="syz.9.5226" name="/" dev="devtmpfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=filesystem permissive=1 [ 1910.105236][T23780] hid-generic 0000:0000:0000.0015: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1910.170605][T19251] dvb-usb: bulk message failed: -22 (6/0) [ 1910.228161][T19251] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1910.498522][T19251] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input90 [ 1910.531229][T27609] netlink: 'syz.2.5227': attribute type 10 has an invalid length. [ 1910.703811][T19251] dvb-usb: schedule remote query interval to 150 msecs. [ 1910.870452][T19251] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1911.068238][ T7414] dvb-usb: bulk message failed: -22 (1/0) [ 1911.114309][ T7414] dvb-usb: error while querying for an remote control event. [ 1911.173907][T19251] usb 9-1: USB disconnect, device number 64 [ 1911.501083][T27615] netlink: 'syz.8.5229': attribute type 15 has an invalid length. [ 1911.509233][T27615] netlink: 24 bytes leftover after parsing attributes in process `syz.8.5229'. [ 1911.564445][T27615] kAFS: unable to lookup cell '({^@' [ 1911.852983][T27042] udevd[27042]: setting mode of /dev/hidraw0 to 020600 failed: No such file or directory [ 1911.892948][T19251] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1911.990419][T27042] udevd[27042]: setting owner of /dev/hidraw0 to uid=0, gid=0 failed: No such file or directory [ 1912.531686][T27626] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5232'. [ 1912.540837][T27626] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5232'. [ 1913.203774][T27636] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5235'. [ 1914.102888][T27644] netlink: 24 bytes leftover after parsing attributes in process `syz.7.5237'. [ 1914.131164][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 1914.137495][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1914.937401][T27652] netlink: 'syz.8.5240': attribute type 10 has an invalid length. [ 1915.721112][T19251] usb 3-1: new high-speed USB device number 107 using dummy_hcd [ 1915.746746][T27662] netlink: 'syz.6.5242': attribute type 15 has an invalid length. [ 1915.754797][T27662] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5242'. [ 1915.812515][T27662] kAFS: unable to lookup cell '({^@' [ 1915.892451][T19251] usb 3-1: Using ep0 maxpacket: 16 [ 1915.929091][T19251] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1915.962736][T19251] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1916.267455][T19251] usb 3-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice=e5.00 [ 1916.353752][T19251] usb 3-1: New USB device strings: Mfr=255, Product=0, SerialNumber=0 [ 1916.479378][T19251] usb 3-1: Manufacturer: syz [ 1916.548754][T27669] Device name cannot be null; rc = [-22] [ 1916.962541][T19251] usb 3-1: config 0 descriptor?? [ 1917.723765][T19251] mcp2221 0003:04D8:00DD.0016: unknown main item tag 0x0 [ 1917.754655][T19251] mcp2221 0003:04D8:00DD.0016: unknown main item tag 0x0 [ 1918.420352][T27655] netlink: 'syz.2.5239': attribute type 10 has an invalid length. [ 1918.756145][T19251] mcp2221 0003:04D8:00DD.0016: unknown main item tag 0x0 [ 1918.825994][T19251] mcp2221 0003:04D8:00DD.0016: unknown main item tag 0x0 [ 1918.836584][T19251] mcp2221 0003:04D8:00DD.0016: unknown main item tag 0x0 [ 1918.877803][T19251] mcp2221 0003:04D8:00DD.0016: USB HID v0.05 Device [syz] on usb-dummy_hcd.2-1/input0 [ 1918.996046][T19251] usb 3-1: USB disconnect, device number 107 [ 1920.119541][T27701] Bluetooth: hci1: Frame reassembly failed (-84) [ 1920.212567][T14806] Bluetooth: hci1: Frame reassembly failed (-84) [ 1920.306335][T27702] netlink: 'syz.2.5254': attribute type 15 has an invalid length. [ 1920.314479][T27702] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5254'. [ 1920.380741][T27702] kAFS: unable to lookup cell '({^@' [ 1920.791505][T27707] Device name cannot be null; rc = [-22] [ 1921.135580][T27708] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5252'. [ 1922.190834][T15273] Bluetooth: hci1: Opcode 0x1003 failed: -110 [ 1923.472531][T27746] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 1923.930832][T23780] usb 3-1: new high-speed USB device number 108 using dummy_hcd [ 1923.957985][T27750] netlink: 'syz.7.5264': attribute type 10 has an invalid length. [ 1924.140914][T23780] usb 3-1: device descriptor read/64, error -71 [ 1924.711581][T23780] usb 3-1: new high-speed USB device number 109 using dummy_hcd [ 1924.923047][T23780] usb 3-1: device descriptor read/64, error -71 [ 1925.051217][T23780] usb usb3-port1: attempt power cycle [ 1925.871005][T23780] usb 3-1: new high-speed USB device number 110 using dummy_hcd [ 1925.911671][T23780] usb 3-1: device descriptor read/8, error -71 [ 1925.964646][T27763] FAULT_INJECTION: forcing a failure. [ 1925.964646][T27763] name failslab, interval 1, probability 0, space 0, times 0 [ 1925.992564][T27763] CPU: 0 UID: 0 PID: 27763 Comm: syz.6.5269 Not tainted syzkaller #0 PREEMPT(full) [ 1925.992582][T27763] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1925.992588][T27763] Call Trace: [ 1925.992593][T27763] [ 1925.992597][T27763] dump_stack_lvl+0x16c/0x1f0 [ 1925.992619][T27763] should_fail_ex+0x512/0x640 [ 1925.992636][T27763] ? __kmalloc_noprof+0xca/0x8f0 [ 1925.992649][T27763] should_failslab+0xc2/0x120 [ 1925.992666][T27763] __kmalloc_noprof+0xdd/0x8f0 [ 1925.992677][T27763] ? kobject_put+0xab/0x590 [ 1925.992694][T27763] ? nfc_llcp_build_tlv+0xfd/0x230 [ 1925.992712][T27763] ? nfc_llcp_build_tlv+0xfd/0x230 [ 1925.992725][T27763] nfc_llcp_build_tlv+0xfd/0x230 [ 1925.992741][T27763] nfc_llcp_build_gb.isra.0+0xed/0x3d0 [ 1925.992755][T27763] ? __pfx_nfc_llcp_build_gb.isra.0+0x10/0x10 [ 1925.992770][T27763] ? __print_lock_name+0x43/0xe0 [ 1925.992782][T27763] ? nfc_llcp_find_local+0x137/0x180 [ 1925.992796][T27763] ? do_raw_spin_unlock+0x172/0x230 [ 1925.992816][T27763] nfc_llcp_general_bytes+0x30/0xf0 [ 1925.992830][T27763] nfc_dep_link_up+0x258/0x520 [ 1925.992850][T27763] ? __pfx_nfc_dep_link_up+0x10/0x10 [ 1925.992865][T27763] ? nfc_get_device+0x8d/0xd0 [ 1925.992880][T27763] ? __pfx_nfc_get_device+0x10/0x10 [ 1925.992899][T27763] nfc_genl_dep_link_up+0x1b0/0x250 [ 1925.992917][T27763] genl_family_rcv_msg_doit+0x209/0x2f0 [ 1925.992936][T27763] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1925.992957][T27763] ? bpf_lsm_capable+0x9/0x10 [ 1925.992971][T27763] ? security_capable+0x7e/0x260 [ 1925.992992][T27763] genl_rcv_msg+0x55c/0x800 [ 1925.993009][T27763] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1925.993025][T27763] ? __pfx_nfc_genl_dep_link_up+0x10/0x10 [ 1925.993045][T27763] ? __lock_acquire+0x433/0x22f0 [ 1925.993061][T27763] netlink_rcv_skb+0x158/0x420 [ 1925.993074][T27763] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1925.993091][T27763] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1925.993110][T27763] ? netlink_deliver_tap+0x1ae/0xd30 [ 1925.993125][T27763] genl_rcv+0x28/0x40 [ 1925.993139][T27763] netlink_unicast+0x5aa/0x870 [ 1925.993155][T27763] ? __pfx_netlink_unicast+0x10/0x10 [ 1925.993175][T27763] netlink_sendmsg+0x8c8/0xdd0 [ 1925.993191][T27763] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1925.993210][T27763] ____sys_sendmsg+0xa5d/0xc30 [ 1925.993225][T27763] ? copy_msghdr_from_user+0x10a/0x160 [ 1925.993235][T27763] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1925.993247][T27763] ? __lock_acquire+0x433/0x22f0 [ 1925.993268][T27763] ___sys_sendmsg+0x134/0x1d0 [ 1925.993280][T27763] ? __pfx____sys_sendmsg+0x10/0x10 [ 1925.993290][T27763] ? __lock_acquire+0x433/0x22f0 [ 1925.993320][T27763] __sys_sendmsg+0x16d/0x220 [ 1925.993331][T27763] ? __pfx___sys_sendmsg+0x10/0x10 [ 1925.993350][T27763] do_syscall_64+0xcd/0xf80 [ 1925.993368][T27763] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1925.993379][T27763] RIP: 0033:0x7f0ea7d8f749 [ 1925.993389][T27763] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1925.993400][T27763] RSP: 002b:00007f0ea8ce8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1925.993412][T27763] RAX: ffffffffffffffda RBX: 00007f0ea7fe5fa0 RCX: 00007f0ea7d8f749 [ 1925.993423][T27763] RDX: 0000000000000050 RSI: 0000200000000a80 RDI: 0000000000000004 [ 1925.993429][T27763] RBP: 00007f0ea8ce8090 R08: 0000000000000000 R09: 0000000000000000 [ 1925.993436][T27763] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1925.993442][T27763] R13: 00007f0ea7fe6038 R14: 00007f0ea7fe5fa0 R15: 00007ffd38e02058 [ 1925.993456][T27763] [ 1926.250962][T23780] usb 3-1: new high-speed USB device number 111 using dummy_hcd [ 1926.910860][T27772] Device name cannot be null; rc = [-22] [ 1927.000817][T23780] usb 3-1: device not accepting address 111, error -71 [ 1927.060070][T23780] usb usb3-port1: unable to enumerate USB device [ 1927.473432][T27777] netlink: 176 bytes leftover after parsing attributes in process `syz.7.5270'. [ 1928.448749][T27792] netlink: 'syz.2.5272': attribute type 10 has an invalid length. [ 1928.491544][T27777] XFS (nbd7): SB validate failed with error -5. [ 1929.445852][T27803] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1929.916985][T27809] XFS (nbd6): SB validate failed with error -5. [ 1930.025310][T27825] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1930.065409][T23768] usb 7-1: new full-speed USB device number 61 using dummy_hcd [ 1930.495323][T23768] usb 7-1: config 16 has an invalid interface number: 19 but max is 0 [ 1930.513758][T23768] usb 7-1: config 16 has no interface number 0 [ 1930.553422][T23768] usb 7-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1930.587960][T27836] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=27836 comm=syz.7.5282 [ 1930.687044][T23768] usb 7-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 1930.795113][T23768] usb 7-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 1930.860671][T27826] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd9": -EINTR [ 1930.867894][T23768] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1931.018355][T23768] usb 7-1: Product: syz [ 1931.082184][T23768] usb 7-1: Manufacturer: syz [ 1931.104311][T23768] usb 7-1: SerialNumber: syz [ 1931.292991][T27812] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1931.735692][T23768] usb 7-1: USB disconnect, device number 61 [ 1931.859993][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1933.205476][T27858] FAULT_INJECTION: forcing a failure. [ 1933.205476][T27858] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1933.222096][T27858] CPU: 0 UID: 0 PID: 27858 Comm: syz.9.5289 Not tainted syzkaller #0 PREEMPT(full) [ 1933.222124][T27858] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1933.222136][T27858] Call Trace: [ 1933.222142][T27858] [ 1933.222150][T27858] dump_stack_lvl+0x16c/0x1f0 [ 1933.222182][T27858] should_fail_ex+0x512/0x640 [ 1933.222213][T27858] strncpy_from_user+0x3b/0x2e0 [ 1933.222240][T27858] getname_flags.part.0+0x8f/0x550 [ 1933.222266][T27858] getname_flags+0x93/0xf0 [ 1933.222294][T27858] user_path_at+0x24/0x60 [ 1933.222321][T27858] __x64_sys_mount+0x1fb/0x310 [ 1933.222342][T27858] ? __pfx___x64_sys_mount+0x10/0x10 [ 1933.222372][T27858] do_syscall_64+0xcd/0xf80 [ 1933.222399][T27858] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1933.222418][T27858] RIP: 0033:0x7efcb0d8f749 [ 1933.222434][T27858] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1933.222451][T27858] RSP: 002b:00007efcb1cc4038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 1933.222469][T27858] RAX: ffffffffffffffda RBX: 00007efcb0fe5fa0 RCX: 00007efcb0d8f749 [ 1933.222481][T27858] RDX: 0000200000000100 RSI: 0000200000000040 RDI: 0000000000000000 [ 1933.222493][T27858] RBP: 00007efcb1cc4090 R08: 0000200000000080 R09: 0000000000000000 [ 1933.222504][T27858] R10: 0000000000008402 R11: 0000000000000246 R12: 0000000000000001 [ 1933.222515][T27858] R13: 00007efcb0fe6038 R14: 00007efcb0fe5fa0 R15: 00007ffe5aad06b8 [ 1933.222541][T27858] [ 1933.423634][T27859] netlink: 87 bytes leftover after parsing attributes in process `syz.6.5288'. [ 1933.641574][T27861] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5290'. [ 1933.650560][T27861] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5290'. [ 1933.687010][ T30] audit: type=1400 audit(1764869423.519:1204): avc: denied { connect } for pid=27862 comm="syz.6.5291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1934.083199][T27872] Mount JFS Failure: -22 [ 1934.087701][T27872] jfs_mount failed w/return code = -22 [ 1934.230861][T23768] usb 10-1: new full-speed USB device number 53 using dummy_hcd [ 1934.885286][T23768] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1934.940922][T23780] usb 9-1: new full-speed USB device number 65 using dummy_hcd [ 1934.943631][T23768] usb 10-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1935.011008][T23768] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1935.023383][T23768] usb 10-1: Product: syz [ 1935.027885][T23768] usb 10-1: Manufacturer: syz [ 1935.066000][T23768] usb 10-1: SerialNumber: syz [ 1935.146403][T23768] usb 10-1: config 0 descriptor?? [ 1935.159501][T23768] streamzap 10-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 1935.224476][T23780] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1935.235328][T23780] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1935.244671][T23780] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1935.259822][T23780] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1935.394506][T23768] usb 10-1: USB disconnect, device number 53 [ 1935.405997][T23780] usb 9-1: config 0 descriptor?? [ 1935.432342][T23780] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1935.457761][T23780] dvb-usb: bulk message failed: -22 (3/0) [ 1935.604062][T27884] netlink: 176 bytes leftover after parsing attributes in process `syz.7.5295'. [ 1935.766591][T23780] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1935.792272][T23780] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1935.803534][T23780] usb 9-1: media controller created [ 1935.905248][T23780] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1935.932217][T23780] dvb-usb: bulk message failed: -22 (6/0) [ 1935.940875][T23780] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1935.947943][T27884] XFS (nbd7): SB validate failed with error -5. [ 1935.973140][T23780] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input91 [ 1936.507846][T23780] dvb-usb: schedule remote query interval to 150 msecs. [ 1936.515069][T23780] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1936.533389][T23780] usb 9-1: USB disconnect, device number 65 [ 1936.627525][T23780] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1937.356322][T27900] netlink: 'syz.7.5298': attribute type 10 has an invalid length. [ 1937.631534][T27907] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1937.842159][T27913] netlink: 'syz.8.5302': attribute type 10 has an invalid length. [ 1938.039419][T27914] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5300'. [ 1938.167678][ T30] audit: type=1400 audit(1764869427.999:1205): avc: denied { setopt } for pid=27912 comm="syz.9.5303" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1938.273705][T27914] XFS (nbd2): SB validate failed with error -5. [ 1939.539266][T27938] netlink: 'syz.9.5307': attribute type 10 has an invalid length. [ 1939.592663][T27938] bridge0: entered promiscuous mode [ 1939.953170][T27936] bridge0: left promiscuous mode [ 1941.445131][T27946] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5310'. [ 1941.561531][ T5941] usb 10-1: new high-speed USB device number 54 using dummy_hcd [ 1941.690801][ T5941] usb 10-1: device descriptor read/64, error -71 [ 1941.755684][T27951] netlink: 76 bytes leftover after parsing attributes in process `syz.2.5312'. [ 1942.731133][T27953] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5313'. [ 1942.931419][ T5941] usb 10-1: new high-speed USB device number 55 using dummy_hcd [ 1943.003317][T27963] Mount JFS Failure: -22 [ 1943.007659][T27963] jfs_mount failed w/return code = -22 [ 1943.300876][ T5941] usb 10-1: device descriptor read/64, error -71 [ 1943.412095][T17847] usb 9-1: new full-speed USB device number 66 using dummy_hcd [ 1943.420208][ T5941] usb usb10-port1: attempt power cycle [ 1943.694895][T17847] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1943.713929][T17847] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1944.117443][ T5941] usb 10-1: new high-speed USB device number 56 using dummy_hcd [ 1944.126483][T17847] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1944.137021][T17847] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1944.152882][T17847] usb 9-1: config 0 descriptor?? [ 1944.163867][ T5941] usb 10-1: device descriptor read/8, error -71 [ 1944.178891][T17847] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1944.201772][T17847] dvb-usb: bulk message failed: -22 (3/0) [ 1944.216048][T17847] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1944.254983][T17847] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1944.271914][T17847] usb 9-1: media controller created [ 1944.278997][T17847] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1944.301686][T17847] dvb-usb: bulk message failed: -22 (6/0) [ 1944.309934][T17847] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1944.331126][T17847] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input92 [ 1944.368858][T17847] dvb-usb: schedule remote query interval to 150 msecs. [ 1944.399281][T17847] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1944.492864][T17847] usb 9-1: USB disconnect, device number 66 [ 1944.815348][T27977] Device name cannot be null; rc = [-22] [ 1945.499989][T17847] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1948.745524][T28007] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5326'. [ 1949.220810][T17847] usb 3-1: new high-speed USB device number 112 using dummy_hcd [ 1949.507652][T17847] usb 3-1: device descriptor read/64, error -71 [ 1949.664234][T28013] netlink: 'syz.9.5328': attribute type 10 has an invalid length. [ 1949.797278][T28012] bridge0: entered promiscuous mode [ 1949.820967][T17847] usb 3-1: new high-speed USB device number 113 using dummy_hcd [ 1949.847726][T28011] bridge0: left promiscuous mode [ 1950.382700][T17847] usb 3-1: device descriptor read/64, error -71 [ 1950.761639][T17847] usb usb3-port1: attempt power cycle [ 1951.100897][T17847] usb 3-1: new high-speed USB device number 114 using dummy_hcd [ 1951.145852][T17847] usb 3-1: device descriptor read/8, error -71 [ 1951.267307][T28035] netlink: 'syz.6.5332': attribute type 15 has an invalid length. [ 1951.275289][T28035] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5332'. [ 1952.295515][T17847] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1952.597510][T28037] kAFS: unable to lookup cell '({^@' [ 1952.638186][T17847] usb 3-1: device descriptor read/8, error -71 [ 1952.795548][T17847] usb usb3-port1: unable to enumerate USB device [ 1952.934725][T28042] Mount JFS Failure: -22 [ 1952.939113][T28042] jfs_mount failed w/return code = -22 [ 1953.250969][T17847] usb 3-1: new full-speed USB device number 116 using dummy_hcd [ 1953.541160][ T5875] usb 10-1: new full-speed USB device number 58 using dummy_hcd [ 1953.912723][T17847] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1953.928401][T17847] usb 3-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1953.937892][T17847] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1953.946907][T17847] usb 3-1: Product: syz [ 1953.952174][T17847] usb 3-1: Manufacturer: syz [ 1954.320826][T17847] usb 3-1: SerialNumber: syz [ 1954.327775][T17847] usb 3-1: config 0 descriptor?? [ 1954.336500][T17847] streamzap 3-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 1954.478939][T28061] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5339'. [ 1954.492186][ T5875] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1954.502793][ T5875] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1954.550183][T28062] Mount JFS Failure: -22 [ 1954.555432][T28062] jfs_mount failed w/return code = -22 [ 1954.767621][ T5875] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1954.789678][ T5875] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1954.815389][ T5875] usb 10-1: config 0 descriptor?? [ 1954.845992][ T5875] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1954.853444][ T5875] dvb-usb: bulk message failed: -22 (3/0) [ 1954.876627][T17847] usb 3-1: USB disconnect, device number 116 [ 1954.891572][ T5875] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1954.918059][ T5875] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1954.927450][ T5875] usb 10-1: media controller created [ 1954.940012][ T5875] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1954.965933][ T5875] dvb-usb: bulk message failed: -22 (6/0) [ 1954.976511][ T5875] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1954.988516][ T5875] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.9/usb10/10-1/input/input93 [ 1954.990856][T10646] usb 7-1: new full-speed USB device number 62 using dummy_hcd [ 1955.017666][ T5875] dvb-usb: schedule remote query interval to 150 msecs. [ 1955.028460][ T5875] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1955.054180][ T5875] usb 10-1: USB disconnect, device number 58 [ 1955.096711][ T5875] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1955.163965][T10646] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1955.174571][T10646] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1955.183623][T10646] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1955.192971][T10646] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1955.210004][T10646] usb 7-1: config 0 descriptor?? [ 1955.220771][T10646] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1955.227700][T10646] dvb-usb: bulk message failed: -22 (3/0) [ 1955.238412][T10646] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1955.254083][T10646] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1955.262076][T10646] usb 7-1: media controller created [ 1955.268745][T10646] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1955.298337][T10646] dvb-usb: bulk message failed: -22 (6/0) [ 1955.305286][T10646] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1955.321006][T10646] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input94 [ 1955.346607][T10646] dvb-usb: schedule remote query interval to 150 msecs. [ 1955.366786][T10646] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1955.580861][T10646] dvb-usb: bulk message failed: -22 (1/0) [ 1955.592674][T10646] dvb-usb: error while querying for an remote control event. [ 1956.091255][T10646] usb 7-1: USB disconnect, device number 62 [ 1956.129975][T10646] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1958.210775][T28091] netlink: 'syz.6.5347': attribute type 10 has an invalid length. [ 1958.610183][T28102] Mount JFS Failure: -22 [ 1958.614632][T28102] jfs_mount failed w/return code = -22 [ 1958.803952][T28104] netlink: 48 bytes leftover after parsing attributes in process `syz.2.5353'. [ 1958.876107][T28108] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5353'. [ 1958.931795][T28106] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1959.001986][T10646] usb 10-1: new full-speed USB device number 59 using dummy_hcd [ 1959.088463][T28110] XFS (nbd8): SB validate failed with error -5. [ 1959.259968][T10646] usb 10-1: no configurations [ 1959.268152][T10646] usb 10-1: can't read configurations, error -22 [ 1959.410956][T10646] usb 10-1: new full-speed USB device number 60 using dummy_hcd [ 1959.451219][ T5875] usb 9-1: new full-speed USB device number 67 using dummy_hcd [ 1959.619154][ T5875] usb 9-1: config 16 has an invalid interface number: 19 but max is 0 [ 1959.903338][ T5875] usb 9-1: config 16 has no interface number 0 [ 1959.905758][T10646] usb 10-1: no configurations [ 1959.909668][ T5875] usb 9-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1959.914430][T10646] usb 10-1: can't read configurations, error -22 [ 1959.942259][T10646] usb usb10-port1: attempt power cycle [ 1960.431036][ T5875] usb 9-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 1960.462497][ T5875] usb 9-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 1960.482907][ T5875] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1960.500396][ T5875] usb 9-1: Product: syz [ 1960.507337][ T5875] usb 9-1: Manufacturer: syz [ 1960.512596][ T5875] usb 9-1: SerialNumber: syz [ 1960.564533][T28114] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1961.056417][T10646] usb 10-1: new full-speed USB device number 61 using dummy_hcd [ 1961.087479][T10646] usb 10-1: no configurations [ 1961.092350][T10646] usb 10-1: can't read configurations, error -22 [ 1961.261774][T10646] usb 10-1: new full-speed USB device number 62 using dummy_hcd [ 1961.572880][T10646] usb 10-1: device descriptor read/all, error -71 [ 1961.591266][T10646] usb usb10-port1: unable to enumerate USB device [ 1961.610938][ T5875] usb 9-1: USB disconnect, device number 67 [ 1961.660275][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1961.753753][T28136] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5359'. [ 1962.141370][T28147] netlink: 'syz.7.5362': attribute type 10 has an invalid length. [ 1962.369318][T10646] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1962.476733][T28144] bridge0: entered promiscuous mode [ 1962.486490][T28142] bridge0: left promiscuous mode [ 1962.644468][T10646] usb 3-1: Using ep0 maxpacket: 16 [ 1962.660924][T10646] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1962.670476][T10646] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1962.691533][T10646] usb 3-1: Product: syz [ 1962.707977][T10646] usb 3-1: Manufacturer: syz [ 1962.714242][T28158] netlink: 48 bytes leftover after parsing attributes in process `syz.9.5364'. [ 1962.735815][T10646] usb 3-1: SerialNumber: syz [ 1962.756372][T10646] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1962.785771][T28163] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5364'. [ 1962.800774][T10646] r8152-cfgselector 3-1: config 0 descriptor?? [ 1962.810822][T23768] usb 7-1: new high-speed USB device number 63 using dummy_hcd [ 1962.852992][T10646] hub 3-1:0.0: bad descriptor, ignoring hub [ 1962.880500][T10646] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1962.961147][T17847] usb 9-1: new high-speed USB device number 68 using dummy_hcd [ 1963.002041][T23768] usb 7-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1963.044410][T23768] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1963.061221][T23768] usb 7-1: Product: syz [ 1963.065463][T23768] usb 7-1: Manufacturer: syz [ 1963.070072][T23768] usb 7-1: SerialNumber: syz [ 1963.142253][T17847] usb 9-1: config 1 interface 0 altsetting 127 bulk endpoint 0x81 has invalid maxpacket 64 [ 1963.152743][T17847] usb 9-1: config 1 interface 0 altsetting 127 bulk endpoint 0x2 has invalid maxpacket 32 [ 1963.162816][T17847] usb 9-1: config 1 interface 0 has no altsetting 0 [ 1963.191039][ T5875] r8152-cfgselector 3-1: USB disconnect, device number 117 [ 1963.234152][T17847] usb 9-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 1963.243521][T17847] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1963.252750][T17847] usb 9-1: Product: syz [ 1963.257271][T17847] usb 9-1: Manufacturer: syz [ 1963.262078][T17847] usb 9-1: SerialNumber: syz [ 1963.272367][T28161] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1963.279759][T28161] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1963.434762][T28141] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1963.458051][T28141] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1963.621205][T28169] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1963.895201][T28170] XFS (nbd9): SB validate failed with error -5. [ 1963.985577][T28177] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 1964.117960][T28178] : renamed from lo (while UP) [ 1964.245985][T28181] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5370'. [ 1964.424373][ T30] audit: type=1400 audit(1764869454.259:1206): avc: denied { ioctl } for pid=28160 comm="syz.8.5367" path="socket:[107323]" dev="sockfs" ino=107323 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1964.444965][T23768] rtl8150 7-1:1.0: couldn't reset the device [ 1964.460300][T17847] (unnamed net_device) (uninitialized): Assigned a random MAC address: 5a:15:e9:42:f7:77 [ 1964.500792][ T5875] usb 10-1: new full-speed USB device number 63 using dummy_hcd [ 1964.502372][T23768] rtl8150 7-1:1.0: probe with driver rtl8150 failed with error -5 [ 1964.595493][T17847] rtl8150 9-1:1.0: eth21: rtl8150 is detected [ 1964.611622][T28181] XFS (nbd2): SB validate failed with error -5. [ 1964.634959][T17847] usb 9-1: USB disconnect, device number 68 [ 1964.672247][ T5875] usb 10-1: config 16 has an invalid interface number: 19 but max is 0 [ 1964.681674][ T5875] usb 10-1: config 16 has no interface number 0 [ 1964.730509][ T5875] usb 10-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1964.752634][ T5875] usb 10-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 1964.779399][ T5875] usb 10-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 1964.809333][ T5875] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1964.835765][ T5875] usb 10-1: Product: syz [ 1964.850528][ T5875] usb 10-1: Manufacturer: syz [ 1964.880630][ T5875] usb 10-1: SerialNumber: syz [ 1964.947460][T28169] raw-gadget.3 gadget.9: fail, usb_ep_enable returned -22 [ 1965.194817][ T5875] usb 10-1: USB disconnect, device number 63 [ 1965.221876][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1965.314789][T28194] netlink: 'syz.8.5372': attribute type 15 has an invalid length. [ 1965.322930][T28194] netlink: 24 bytes leftover after parsing attributes in process `syz.8.5372'. [ 1966.070165][T23768] usb 7-1: USB disconnect, device number 63 [ 1966.193230][ T30] audit: type=1400 audit(1764869456.029:1207): avc: denied { read } for pid=28206 comm="syz.7.5376" name="file0" dev="tmpfs" ino=2227 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1966.243872][ T30] audit: type=1400 audit(1764869456.049:1208): avc: denied { open } for pid=28206 comm="syz.7.5376" path="/429/file0" dev="tmpfs" ino=2227 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1966.423692][T28212] netlink: 48 bytes leftover after parsing attributes in process `syz.8.5379'. [ 1966.554974][T28218] kAFS: unable to lookup cell '({^@' [ 1966.722995][T28222] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5379'. [ 1966.784756][T28216] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5380'. [ 1966.953928][T28225] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5381'. [ 1967.050859][T23778] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1967.211872][T23778] usb 3-1: Using ep0 maxpacket: 16 [ 1967.220978][T23778] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1967.230277][T23778] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1967.238561][ T5875] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 1967.246237][T23778] usb 3-1: Product: syz [ 1967.257792][T23778] usb 3-1: Manufacturer: syz [ 1967.268152][T23778] usb 3-1: SerialNumber: syz [ 1967.343918][T23778] r8152-cfgselector 3-1: Unknown version 0x0000 [ 1967.356472][T23778] r8152-cfgselector 3-1: config 0 descriptor?? [ 1967.375897][T23778] hub 3-1:0.0: bad descriptor, ignoring hub [ 1967.384778][T23778] hub 3-1:0.0: probe with driver hub failed with error -5 [ 1967.418146][ T5875] usb 7-1: Using ep0 maxpacket: 16 [ 1967.432400][ T5875] usb 7-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 1967.442890][ T5875] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1967.463256][ T5875] usb 7-1: Product: syz [ 1967.467528][ T5875] usb 7-1: Manufacturer: syz [ 1967.472396][ T5875] usb 7-1: SerialNumber: syz [ 1967.513048][ T5875] r8152-cfgselector 7-1: Unknown version 0x0000 [ 1967.519713][ T5875] r8152-cfgselector 7-1: config 0 descriptor?? [ 1967.529028][ T5875] hub 7-1:0.0: bad descriptor, ignoring hub [ 1967.535713][ T5875] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1967.777236][T17847] r8152-cfgselector 3-1: USB disconnect, device number 118 [ 1968.351851][ T5875] r8152-cfgselector 7-1: USB disconnect, device number 64 [ 1968.887093][T28265] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=28265 comm=syz.2.5387 [ 1970.643450][T28287] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1971.125023][T28287] netlink: 176 bytes leftover after parsing attributes in process `syz.7.5395'. [ 1971.161663][T28287] XFS (nbd7): SB validate failed with error -5. [ 1971.351794][ T30] audit: type=1400 audit(1764869461.189:1209): avc: denied { setopt } for pid=28294 comm="syz.8.5389" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1972.241924][T28310] netlink: 'syz.2.5399': attribute type 4 has an invalid length. [ 1972.249698][T28310] netlink: 152 bytes leftover after parsing attributes in process `syz.2.5399'. [ 1973.061919][T28310] .`: renamed from bond0 [ 1973.182519][T28318] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1973.386072][T28323] netlink: 176 bytes leftover after parsing attributes in process `syz.7.5400'. [ 1973.974942][T28327] Mount JFS Failure: -22 [ 1973.979441][T28327] jfs_mount failed w/return code = -22 [ 1974.287681][T28323] XFS (nbd7): SB validate failed with error -5. [ 1974.442896][T28339] Mount JFS Failure: -22 [ 1974.447235][T28339] jfs_mount failed w/return code = -22 [ 1974.650832][T23777] usb 7-1: new full-speed USB device number 65 using dummy_hcd [ 1974.828889][T23777] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1974.840629][T23777] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1974.870803][ T5875] usb 10-1: new full-speed USB device number 64 using dummy_hcd [ 1974.880544][T23777] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1974.889993][T23777] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1974.930296][T23777] usb 7-1: config 0 descriptor?? [ 1974.963097][T23777] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1974.983216][T23777] dvb-usb: bulk message failed: -22 (3/0) [ 1975.011420][T23777] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1975.036307][T23777] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1975.057962][ T5875] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1975.073329][T23777] usb 7-1: media controller created [ 1975.092443][ T5875] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1975.103094][T23768] hid-generic 0000:0000:0000.0017: unknown main item tag 0x0 [ 1975.210926][T23768] hid-generic 0000:0000:0000.0017: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1975.214710][T23777] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1975.302001][T28345] FAULT_INJECTION: forcing a failure. [ 1975.302001][T28345] name failslab, interval 1, probability 0, space 0, times 0 [ 1975.314838][T28345] CPU: 0 UID: 0 PID: 28345 Comm: syz.8.5404 Not tainted syzkaller #0 PREEMPT(full) [ 1975.314865][T28345] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1975.314876][T28345] Call Trace: [ 1975.314883][T28345] [ 1975.314891][T28345] dump_stack_lvl+0x16c/0x1f0 [ 1975.314924][T28345] should_fail_ex+0x512/0x640 [ 1975.314950][T28345] ? __kmalloc_noprof+0xca/0x8f0 [ 1975.314972][T28345] should_failslab+0xc2/0x120 [ 1975.315001][T28345] __kmalloc_noprof+0xdd/0x8f0 [ 1975.315021][T28345] ? afs_lookup_cell+0x8d2/0x1900 [ 1975.315054][T28345] ? afs_lookup_cell+0x8d2/0x1900 [ 1975.315081][T28345] afs_lookup_cell+0x8d2/0x1900 [ 1975.315115][T28345] ? __pfx_afs_lookup_cell+0x10/0x10 [ 1975.315147][T28345] ? afs_parse_param+0xc5/0x970 [ 1975.315172][T28345] ? __sanitizer_cov_trace_switch+0x16/0x90 [ 1975.315200][T28345] afs_parse_param+0x5c4/0x970 [ 1975.315226][T28345] ? __pfx_afs_parse_param+0x10/0x10 [ 1975.315252][T28345] ? static_key_count+0x5a/0x70 [ 1975.315277][T28345] ? __pfx_afs_parse_param+0x10/0x10 [ 1975.315302][T28345] vfs_parse_fs_param+0x20b/0x3c0 [ 1975.315326][T28345] __do_sys_fsconfig+0x930/0xbe0 [ 1975.315360][T28345] ? __pfx___do_sys_fsconfig+0x10/0x10 [ 1975.315393][T28345] ? __do_sys_fsconfig+0x10/0xbe0 [ 1975.315421][T28345] do_syscall_64+0xcd/0xf80 [ 1975.315450][T28345] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1975.315470][T28345] RIP: 0033:0x7fc79c58f749 [ 1975.315485][T28345] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1975.315504][T28345] RSP: 002b:00007fc79a7f6038 EFLAGS: 00000246 ORIG_RAX: 00000000000001af [ 1975.315521][T28345] RAX: ffffffffffffffda RBX: 00007fc79c7e6180 RCX: 00007fc79c58f749 [ 1975.315533][T28345] RDX: 0000200000000000 RSI: 0000000000000001 RDI: 0000000000000007 [ 1975.315544][T28345] RBP: 00007fc79a7f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1975.315555][T28345] R10: 00002000000000c0 R11: 0000000000000246 R12: 0000000000000001 [ 1975.315566][T28345] R13: 00007fc79c7e6218 R14: 00007fc79c7e6180 R15: 00007ffcc7ac3808 [ 1975.315592][T28345] [ 1975.315694][T28345] kAFS: unable to lookup cell '(' [ 1975.460802][ T5875] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1975.562874][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 1975.569255][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1975.592664][T23777] dvb-usb: bulk message failed: -22 (6/0) [ 1975.622434][T23777] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1975.649290][T23777] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input95 [ 1975.690806][ T5875] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1975.712997][T23777] dvb-usb: schedule remote query interval to 150 msecs. [ 1975.730089][ T5875] usb 10-1: config 0 descriptor?? [ 1975.735816][T28343] kAFS: unable to lookup cell '(,cL' [ 1975.765029][T23777] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1975.808921][ T5875] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1975.828577][T28308] tipc: Started in network mode [ 1975.844211][ T5875] dvb-usb: bulk message failed: -22 (3/0) [ 1975.863130][T28308] tipc: Node identity 4, cluster identity 4711 [ 1975.876946][T23777] usb 7-1: USB disconnect, device number 65 [ 1975.892867][ T5875] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1975.957496][T28308] tipc: Node number set to 4 [ 1976.004521][ T5875] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1976.159280][T23777] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1976.173023][ T5875] usb 10-1: media controller created [ 1976.179243][ T5875] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1976.363603][ T5875] dvb-usb: bulk message failed: -22 (6/0) [ 1976.403377][ T5875] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1976.446100][ T5875] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.9/usb10/10-1/input/input96 [ 1976.517394][T10324] tipc: Left network mode [ 1976.522169][T28355] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1976.538228][ T5875] dvb-usb: schedule remote query interval to 150 msecs. [ 1976.571301][ T5875] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1976.645460][T28355] netlink: 176 bytes leftover after parsing attributes in process `syz.6.5407'. [ 1976.672497][T28355] XFS (nbd6): SB validate failed with error -5. [ 1976.713604][ T5875] usb 10-1: USB disconnect, device number 64 [ 1977.735281][ T5875] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1978.057849][T28374] netlink: 'syz.6.5410': attribute type 10 has an invalid length. [ 1980.841041][T28397] XFS (nbd8): SB validate failed with error -5. [ 1981.421343][T23768] usb 9-1: new full-speed USB device number 69 using dummy_hcd [ 1981.513182][T28413] Mount JFS Failure: -22 [ 1981.517548][T28413] jfs_mount failed w/return code = -22 [ 1981.838473][T23777] usb 7-1: new full-speed USB device number 66 using dummy_hcd [ 1981.853639][T23768] usb 9-1: config 16 has an invalid interface number: 19 but max is 0 [ 1981.861957][T23768] usb 9-1: config 16 has no interface number 0 [ 1981.868482][T23768] usb 9-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1981.880212][T23768] usb 9-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 1981.893348][T23768] usb 9-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 1982.337108][T23762] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1982.344935][T23768] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1982.362396][T23768] usb 9-1: Product: syz [ 1982.370804][T23768] usb 9-1: Manufacturer: syz [ 1982.382130][T23768] usb 9-1: SerialNumber: syz [ 1982.396605][T23768] usb 9-1: can't set config #16, error -71 [ 1982.419185][T23768] usb 9-1: USB disconnect, device number 69 [ 1982.561894][T23762] usb 3-1: config 0 has no interfaces? [ 1982.567688][T23762] usb 3-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 1982.568021][T23777] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1983.057995][T23762] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1983.059144][T23777] usb 7-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1983.086351][T23777] usb 7-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1983.102125][T23762] usb 3-1: config 0 descriptor?? [ 1983.108942][T23777] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1983.140582][T23777] usb 7-1: config 0 descriptor?? [ 1983.160495][T23777] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1983.169288][T23777] dvb-usb: bulk message failed: -22 (3/0) [ 1983.190395][T23777] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1983.446707][T28433] Mount JFS Failure: -22 [ 1983.452036][T28433] jfs_mount failed w/return code = -22 [ 1983.531925][T23777] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1983.539824][T23768] usb 3-1: USB disconnect, device number 119 [ 1983.579049][T23777] usb 7-1: media controller created [ 1983.591596][T23777] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1983.615580][T23777] dvb-usb: bulk message failed: -22 (6/0) [ 1983.626508][T23777] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1983.640966][T23777] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.6/usb7/7-1/input/input97 [ 1983.731894][T23777] dvb-usb: schedule remote query interval to 150 msecs. [ 1983.739696][T23777] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1983.767081][T23777] usb 7-1: USB disconnect, device number 66 [ 1983.773340][T23780] usb 10-1: new full-speed USB device number 65 using dummy_hcd [ 1983.899330][ T30] audit: type=1400 audit(1764869473.719:1210): avc: denied { read } for pid=28435 comm="syz.8.5427" lport=1 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1983.920470][T23777] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1984.022768][T23780] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1984.042116][T23780] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1984.051648][T23780] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1984.078510][T23780] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1984.108240][T23780] usb 10-1: config 0 descriptor?? [ 1984.130186][T23780] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1984.137202][T23780] dvb-usb: bulk message failed: -22 (3/0) [ 1984.204825][T23780] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1984.240801][T23780] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1984.248238][T23780] usb 10-1: media controller created [ 1984.270581][T23780] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1984.351464][T23780] dvb-usb: bulk message failed: -22 (6/0) [ 1984.396553][T23780] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1984.471214][T28445] netlink: 'syz.6.5429': attribute type 15 has an invalid length. [ 1984.479262][T28445] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5429'. [ 1984.485155][T23780] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.9/usb10/10-1/input/input98 [ 1984.768920][T23780] dvb-usb: schedule remote query interval to 150 msecs. [ 1984.797461][T23780] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1984.827440][T23780] usb 10-1: USB disconnect, device number 65 [ 1984.943076][T23780] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1984.955398][T28443] netlink: 20 bytes leftover after parsing attributes in process `syz.2.5428'. [ 1984.986763][T28447] vivid-007: ================= START STATUS ================= [ 1985.010934][T28447] vivid-007: Generate PTS: true [ 1985.016329][T28447] vivid-007: Generate SCR: true [ 1985.055747][T28447] tpg source WxH: 320x240 (Y'CbCr) [ 1985.090846][T28447] tpg field: 1 [ 1985.094476][T28447] tpg crop: (0,0)/320x240 [ 1985.098806][T28447] tpg compose: (0,0)/320x240 [ 1985.264701][T28447] tpg colorspace: 8 [ 1985.272293][T28447] tpg transfer function: 0/0 [ 1985.276902][T28447] tpg Y'CbCr encoding: 0/0 [ 1985.321921][T28447] tpg quantization: 0/0 [ 1985.326095][T28447] tpg RGB range: 0/2 [ 1985.330011][T28447] vivid-007: ================== END STATUS ================== [ 1985.414679][T28458] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1985.495543][T28462] netlink: 176 bytes leftover after parsing attributes in process `syz.6.5434'. [ 1985.745446][T28462] XFS (nbd6): SB validate failed with error -5. [ 1987.203609][T28478] XFS (nbd8): SB validate failed with error -5. [ 1987.261476][T23768] usb 9-1: new full-speed USB device number 70 using dummy_hcd [ 1987.740777][T23762] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1988.034381][T23768] usb 9-1: config 16 has an invalid interface number: 19 but max is 0 [ 1988.050916][T23768] usb 9-1: config 16 has no interface number 0 [ 1988.057705][T23768] usb 9-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 1988.069921][T23762] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1988.080421][T23762] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1988.105008][T23768] usb 9-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 1988.120068][T23762] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1988.141206][T23762] usb 3-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 1988.152038][T23768] usb 9-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 1988.164464][T23768] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1988.174644][T23762] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1988.183241][T23768] usb 9-1: Product: syz [ 1988.187460][T23768] usb 9-1: Manufacturer: syz [ 1988.195882][T23762] usb 3-1: config 0 descriptor?? [ 1988.201497][T23768] usb 9-1: SerialNumber: syz [ 1988.227850][T28473] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1988.459956][T23780] usb 3-1: USB disconnect, device number 120 [ 1989.040355][T23768] usb 9-1: USB disconnect, device number 70 [ 1989.082027][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1989.218768][T28509] Mount JFS Failure: -22 [ 1989.223201][T28509] jfs_mount failed w/return code = -22 [ 1989.469110][T28511] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1989.618837][T28512] netlink: 176 bytes leftover after parsing attributes in process `syz.9.5444'. [ 1989.890801][T23768] usb 9-1: new full-speed USB device number 71 using dummy_hcd [ 1990.203654][T28512] XFS (nbd9): SB validate failed with error -5. [ 1990.610629][T23768] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1990.720482][T23768] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1990.730004][T23768] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1990.739235][T23768] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1990.759222][T23768] usb 9-1: config 0 descriptor?? [ 1990.775297][T23768] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1990.783947][T23768] dvb-usb: bulk message failed: -22 (3/0) [ 1990.932752][ T30] audit: type=1400 audit(1764869480.719:1211): avc: denied { listen } for pid=28524 comm="syz.2.5447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1990.964443][T23768] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1990.965065][T23768] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1990.965105][T23768] usb 9-1: media controller created [ 1990.966545][T23768] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1991.482985][T23768] dvb-usb: bulk message failed: -22 (6/0) [ 1991.483083][T23768] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1991.487848][T23768] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input99 [ 1991.490942][T23768] dvb-usb: schedule remote query interval to 150 msecs. [ 1991.490963][T23768] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1991.638255][T23768] usb 9-1: USB disconnect, device number 71 [ 1991.765083][T23768] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1994.411507][T28581] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5459'. [ 1994.573582][T28576] netlink: 28 bytes leftover after parsing attributes in process `syz.8.5457'. [ 1994.880760][T28590] Device name cannot be null; rc = [-22] [ 1997.700151][T28606] ntfs3(nullb0): Primary boot signature is not NTFS. [ 1997.708006][T28606] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 1998.106714][T28611] Mount JFS Failure: -22 [ 1998.111193][T28611] jfs_mount failed w/return code = -22 [ 1998.661292][T23780] usb 3-1: new full-speed USB device number 121 using dummy_hcd [ 1998.736662][T28618] FAULT_INJECTION: forcing a failure. [ 1998.736662][T28618] name failslab, interval 1, probability 0, space 0, times 0 [ 1998.749649][T28618] CPU: 0 UID: 0 PID: 28618 Comm: syz.6.5468 Not tainted syzkaller #0 PREEMPT(full) [ 1998.749675][T28618] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1998.749687][T28618] Call Trace: [ 1998.749695][T28618] [ 1998.749703][T28618] dump_stack_lvl+0x16c/0x1f0 [ 1998.749734][T28618] should_fail_ex+0x512/0x640 [ 1998.749760][T28618] ? kmem_cache_alloc_noprof+0x62/0x760 [ 1998.749787][T28618] should_failslab+0xc2/0x120 [ 1998.749815][T28618] kmem_cache_alloc_noprof+0x75/0x760 [ 1998.749837][T28618] ? __proc_create+0x2c8/0x8d0 [ 1998.749860][T28618] ? __proc_create+0x2c8/0x8d0 [ 1998.749876][T28618] __proc_create+0x2c8/0x8d0 [ 1998.749894][T28618] ? __pfx___proc_create+0x10/0x10 [ 1998.749922][T28618] proc_create_reg+0x7d/0x180 [ 1998.749945][T28618] proc_create_data+0x86/0x110 [ 1998.749964][T28618] ? __pfx_proc_create_data+0x10/0x10 [ 1998.749983][T28618] ? recent_mt_check.isra.0+0x588/0xc30 [ 1998.750014][T28618] recent_mt_check.isra.0+0x7c6/0xc30 [ 1998.750041][T28618] ? __pfx_recent_mt_check.isra.0+0x10/0x10 [ 1998.750069][T28618] ? recent_mt_check_v0+0xbc/0x160 [ 1998.750098][T28618] recent_mt_check_v0+0xf5/0x160 [ 1998.750123][T28618] ? __pfx_recent_mt_check_v0+0x10/0x10 [ 1998.750165][T28618] ? xt_find_match+0x1f1/0x290 [ 1998.750190][T28618] ? irqentry_exit+0x1dd/0x8c0 [ 1998.750220][T28618] ? __mutex_unlock_slowpath+0x161/0x790 [ 1998.750248][T28618] ? __pfx_recent_mt_check_v0+0x10/0x10 [ 1998.750278][T28618] xt_check_match+0x286/0xa50 [ 1998.750303][T28618] ? out_of_line_wait_on_bit_lock+0x30/0x110 [ 1998.750331][T28618] ? __pfx_xt_check_match+0x10/0x10 [ 1998.750369][T28618] ? xt_find_match+0x1f6/0x290 [ 1998.750402][T28618] find_check_entry.constprop.0+0x317/0x9b0 [ 1998.750437][T28618] ? __pfx_find_check_entry.constprop.0+0x10/0x10 [ 1998.750479][T28618] ? kfree+0x2f8/0x6e0 [ 1998.750495][T28618] ? xt_alloc_entry_offsets+0x3f/0x60 [ 1998.750521][T28618] ? translate_table+0xba1/0x1720 [ 1998.750545][T28618] translate_table+0xc98/0x1720 [ 1998.750572][T28618] ? __pfx_translate_table+0x10/0x10 [ 1998.750598][T28618] do_ipt_set_ctl+0x603/0xc40 [ 1998.750614][T28618] ? find_held_lock+0x2b/0x80 [ 1998.750636][T28618] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 1998.750667][T28618] ? __pfx_do_ipt_set_ctl+0x10/0x10 [ 1998.750685][T28618] ? sockopt_release_sock+0x52/0x60 [ 1998.750704][T28618] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1998.750741][T28618] ? nf_sockopt_find.constprop.0+0x222/0x290 [ 1998.750770][T28618] nf_setsockopt+0x8d/0xf0 [ 1998.750798][T28618] ip_setsockopt+0xcb/0xf0 [ 1998.750819][T28618] tcp_setsockopt+0xa7/0x100 [ 1998.750839][T28618] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 1998.750862][T28618] do_sock_setsockopt+0xf3/0x1d0 [ 1998.750887][T28618] __sys_setsockopt+0x1a0/0x230 [ 1998.750921][T28618] __x64_sys_setsockopt+0xbd/0x160 [ 1998.750947][T28618] ? do_syscall_64+0x91/0xf80 [ 1998.750973][T28618] ? lockdep_hardirqs_on+0x7c/0x110 [ 1998.750998][T28618] do_syscall_64+0xcd/0xf80 [ 1998.751025][T28618] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1998.751043][T28618] RIP: 0033:0x7f0ea7d8f749 [ 1998.751058][T28618] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1998.751076][T28618] RSP: 002b:00007f0ea8ca6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1998.751093][T28618] RAX: ffffffffffffffda RBX: 00007f0ea7fe6180 RCX: 00007f0ea7d8f749 [ 1998.751105][T28618] RDX: 0000000000000040 RSI: 0000000000000000 RDI: 0000000000000003 [ 1998.751116][T28618] RBP: 00007f0ea8ca6090 R08: 0000000000000448 R09: 0000000000000000 [ 1998.751127][T28618] R10: 0000200000001f40 R11: 0000000000000246 R12: 0000000000000001 [ 1998.751137][T28618] R13: 00007f0ea7fe6218 R14: 00007f0ea7fe6180 R15: 00007ffd38e02058 [ 1998.751162][T28618] [ 1999.707925][T28627] Device name cannot be null; rc = [-22] [ 1999.734810][T23780] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1999.744987][T23780] usb 3-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1999.754089][T23780] usb 3-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1999.764861][T23780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1999.775224][T23780] usb 3-1: config 0 descriptor?? [ 1999.797825][T23780] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1999.805267][T23780] dvb-usb: bulk message failed: -22 (3/0) [ 1999.822706][T23780] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1999.833727][T23780] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1999.840900][T23780] usb 3-1: media controller created [ 1999.847049][T23780] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1999.862789][T23780] dvb-usb: bulk message failed: -22 (6/0) [ 1999.872448][T23780] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1999.893547][T23780] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input100 [ 1999.917632][T23780] dvb-usb: schedule remote query interval to 150 msecs. [ 1999.924906][T23780] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 2000.089815][T23780] usb 3-1: USB disconnect, device number 121 [ 2000.227554][T23780] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 2000.698380][T28647] netlink: 'syz.6.5476': attribute type 15 has an invalid length. [ 2000.706455][T28647] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5476'. [ 2001.170112][T28655] FAULT_INJECTION: forcing a failure. [ 2001.170112][T28655] name failslab, interval 1, probability 0, space 0, times 0 [ 2001.187821][T28652] ip6tnl1: entered promiscuous mode [ 2001.194810][T28655] CPU: 1 UID: 0 PID: 28655 Comm: syz.8.5479 Not tainted syzkaller #0 PREEMPT(full) [ 2001.194827][T28655] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2001.194835][T28655] Call Trace: [ 2001.194839][T28655] [ 2001.194844][T28655] dump_stack_lvl+0x16c/0x1f0 [ 2001.194866][T28655] should_fail_ex+0x512/0x640 [ 2001.194889][T28655] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 2001.194907][T28655] should_failslab+0xc2/0x120 [ 2001.194926][T28655] kmem_cache_alloc_noprof+0x75/0x760 [ 2001.194940][T28655] ? skb_clone+0x190/0x3f0 [ 2001.194954][T28655] ? skb_clone+0x190/0x3f0 [ 2001.194964][T28655] skb_clone+0x190/0x3f0 [ 2001.194974][T28655] netlink_deliver_tap+0xabd/0xd30 [ 2001.194992][T28655] netlink_unicast+0x64c/0x870 [ 2001.195008][T28655] ? __pfx_netlink_unicast+0x10/0x10 [ 2001.195027][T28655] netlink_sendmsg+0x8c8/0xdd0 [ 2001.195043][T28655] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2001.195062][T28655] ____sys_sendmsg+0xa5d/0xc30 [ 2001.195077][T28655] ? copy_msghdr_from_user+0x10a/0x160 [ 2001.195087][T28655] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2001.195100][T28655] ? __lock_acquire+0x433/0x22f0 [ 2001.195121][T28655] ___sys_sendmsg+0x134/0x1d0 [ 2001.195132][T28655] ? __pfx____sys_sendmsg+0x10/0x10 [ 2001.195142][T28655] ? __lock_acquire+0x433/0x22f0 [ 2001.195172][T28655] __sys_sendmsg+0x16d/0x220 [ 2001.195183][T28655] ? __pfx___sys_sendmsg+0x10/0x10 [ 2001.195202][T28655] do_syscall_64+0xcd/0xf80 [ 2001.195220][T28655] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2001.195232][T28655] RIP: 0033:0x7fc79c58f749 [ 2001.195241][T28655] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2001.195252][T28655] RSP: 002b:00007fc79d374038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2001.195264][T28655] RAX: ffffffffffffffda RBX: 00007fc79c7e5fa0 RCX: 00007fc79c58f749 [ 2001.195271][T28655] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 2001.195277][T28655] RBP: 00007fc79d374090 R08: 0000000000000000 R09: 0000000000000000 [ 2001.195284][T28655] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2001.195290][T28655] R13: 00007fc79c7e6038 R14: 00007fc79c7e5fa0 R15: 00007ffcc7ac3808 [ 2001.195305][T28655] [ 2001.469322][T28655] : entered promiscuous mode [ 2001.484000][T28660] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5481'. [ 2001.544369][T28665] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5481'. [ 2001.557770][T28664] netlink: 'syz.2.5480': attribute type 10 has an invalid length. [ 2001.700886][T28668] Mount JFS Failure: -22 [ 2001.705237][T28668] jfs_mount failed w/return code = -22 [ 2002.060835][T23780] usb 9-1: new full-speed USB device number 72 using dummy_hcd [ 2002.610345][T23780] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2002.620966][T23780] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2002.629916][T23780] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 2002.639345][T23780] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2003.118840][T23780] usb 9-1: config 0 descriptor?? [ 2003.146036][T23780] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 2003.249362][T23780] dvb-usb: bulk message failed: -22 (3/0) [ 2003.275057][T23780] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 2003.292030][T23780] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 2003.303926][T23780] usb 9-1: media controller created [ 2003.322016][T23780] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2003.417474][T23780] dvb-usb: bulk message failed: -22 (6/0) [ 2003.432659][T23780] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 2003.466716][T23780] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input101 [ 2003.526295][T23780] dvb-usb: schedule remote query interval to 150 msecs. [ 2003.546034][T23780] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 2003.594811][T23780] usb 9-1: USB disconnect, device number 72 [ 2003.675301][T23780] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 2003.820346][T28697] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=28697 comm=syz.2.5492 [ 2004.580318][T28711] netlink: 'syz.9.5496': attribute type 10 has an invalid length. [ 2004.710950][T23780] usb 3-1: new high-speed USB device number 122 using dummy_hcd [ 2005.448168][T28722] netlink: 176 bytes leftover after parsing attributes in process `syz.8.5497'. [ 2005.471016][T23780] usb 3-1: Using ep0 maxpacket: 32 [ 2005.530282][T23780] usb 3-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 2005.822141][T28729] netlink: 176 bytes leftover after parsing attributes in process `syz.6.5499'. [ 2006.031175][T28722] XFS (nbd8): SB validate failed with error -5. [ 2006.040935][T23780] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2006.059693][T23780] usb 3-1: config 0 descriptor?? [ 2006.078682][T28729] workqueue: Failed to create a rescuer kthread for wq "xfs-buf/nbd6": -EINTR [ 2006.124287][T23780] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 2006.408450][T28748] /dev/nullb0: Can't open blockdev [ 2006.596008][ T5875] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 2006.818426][T17847] usb 9-1: new full-speed USB device number 73 using dummy_hcd [ 2006.830982][ T5875] usb 7-1: Using ep0 maxpacket: 32 [ 2006.839491][ T5875] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2006.854343][ T5875] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2006.864421][ T5875] usb 7-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2006.873653][ T5875] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2006.903671][ T5875] usb 7-1: config 0 descriptor?? [ 2006.917208][ T5875] hub 7-1:0.0: USB hub found [ 2006.982901][T17847] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2006.993235][T17847] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2007.108701][T17847] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 2007.123101][T17847] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2007.131908][ T5875] hub 7-1:0.0: 1 port detected [ 2007.133824][T17847] usb 9-1: config 0 descriptor?? [ 2007.155389][T17847] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 2007.743648][T17847] dvb-usb: bulk message failed: -22 (3/0) [ 2007.763605][T17847] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 2007.815582][T17847] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 2007.946807][T17847] usb 9-1: media controller created [ 2007.959479][T17847] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2008.240525][T23780] gspca_vc032x: reg_w err -110 [ 2008.247367][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.257938][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.267535][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.273067][ T5875] hub 7-1:0.0: activate --> -90 [ 2008.281012][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.284390][T17847] dvb-usb: bulk message failed: -22 (6/0) [ 2008.298655][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.298684][T17847] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 2008.312517][T23768] usb 10-1: new high-speed USB device number 66 using dummy_hcd [ 2008.322683][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.328686][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.334329][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.334815][T17847] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input102 [ 2008.339763][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.356371][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.378021][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.383653][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.385328][T17847] dvb-usb: schedule remote query interval to 150 msecs. [ 2008.404720][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.410277][T17847] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 2008.419979][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.428550][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.437279][T17847] usb 9-1: USB disconnect, device number 73 [ 2008.441841][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.448688][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.455235][T23780] gspca_vc032x: I2c Bus Busy Wait 00 [ 2008.461168][T23780] gspca_vc032x: Unknown sensor... [ 2008.478028][T23768] usb 10-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 2008.481212][T23780] vc032x 3-1:0.0: probe with driver vc032x failed with error -22 [ 2008.506413][T23768] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2008.517923][T23768] usb 10-1: Product: syz [ 2008.522556][T17847] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 2008.537553][T23768] usb 10-1: Manufacturer: syz [ 2008.547373][T23768] usb 10-1: SerialNumber: syz [ 2008.731750][T23780] usb 3-1: USB disconnect, device number 122 [ 2008.800844][T28739] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2008.821765][T28758] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2008.831590][T28739] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2008.842140][ T5875] usb 7-1-port1: config error [ 2008.842429][T17847] usb 7-1: USB disconnect, device number 67 [ 2008.887784][T28758] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2009.598513][T28772] netlink: 'syz.8.5509': attribute type 15 has an invalid length. [ 2009.606610][T28772] netlink: 24 bytes leftover after parsing attributes in process `syz.8.5509'. [ 2010.119358][T23768] rtl8150 10-1:1.0: couldn't reset the device [ 2010.135266][T23768] rtl8150 10-1:1.0: probe with driver rtl8150 failed with error -5 [ 2010.164773][T28774] XFS (nbd7): SB validate failed with error -5. [ 2010.208692][T28783] netlink: 'syz.2.5512': attribute type 10 has an invalid length. [ 2012.529616][T10646] usb 10-1: USB disconnect, device number 66 [ 2013.004384][T28810] netlink: 176 bytes leftover after parsing attributes in process `syz.9.5518'. [ 2013.229148][T28810] XFS (nbd9): SB validate failed with error -5. [ 2013.936728][T28822] Mount JFS Failure: -22 [ 2013.941378][T28822] jfs_mount failed w/return code = -22 [ 2014.210938][T23777] usb 9-1: new full-speed USB device number 74 using dummy_hcd [ 2014.384197][T23777] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2014.407624][T23777] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2014.425939][T23777] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 2014.436751][T23777] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2014.455741][ T5875] usb 10-1: new high-speed USB device number 67 using dummy_hcd [ 2014.618943][T23777] usb 9-1: config 0 descriptor?? [ 2014.750870][ T5875] usb 10-1: Using ep0 maxpacket: 32 [ 2015.057021][T23777] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 2015.068423][ T5875] usb 10-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 2015.088135][T23777] dvb-usb: bulk message failed: -22 (3/0) [ 2015.097267][ T5875] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2015.121704][T23777] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 2015.143765][ T5875] usb 10-1: config 0 descriptor?? [ 2015.161520][T23777] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 2015.183178][ T5875] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 2015.194495][T23777] usb 9-1: media controller created [ 2015.243063][T23777] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2015.426758][T23777] dvb-usb: bulk message failed: -22 (6/0) [ 2015.462437][T23777] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 2016.151794][ T5875] gspca_vc032x: reg_w err -110 [ 2016.175589][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.213093][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.248321][T23777] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input103 [ 2016.319310][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.381494][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.394121][T23777] dvb-usb: schedule remote query interval to 150 msecs. [ 2016.402955][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.408319][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.418178][T23777] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 2016.430849][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.440865][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.478779][T23777] usb 9-1: USB disconnect, device number 74 [ 2016.485014][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.490397][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.516751][ T30] audit: type=1400 audit(1764869506.349:1212): avc: denied { connect } for pid=28843 comm="syz.6.5526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 2016.655012][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.660342][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.667463][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2016.693971][ T30] audit: type=1400 audit(1764869506.509:1213): avc: denied { bind } for pid=28843 comm="syz.6.5526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 2016.694038][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2017.156582][ T30] audit: type=1400 audit(1764869506.509:1214): avc: denied { listen } for pid=28843 comm="syz.6.5526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 2017.176919][ T30] audit: type=1400 audit(1764869506.509:1215): avc: denied { accept } for pid=28843 comm="syz.6.5526" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 2017.219849][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2017.325747][T23777] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 2017.367623][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2017.382595][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2017.475473][ T5875] gspca_vc032x: I2c Bus Busy Wait 00 [ 2017.475787][ T30] audit: type=1400 audit(1764869507.309:1216): avc: denied { read } for pid=28843 comm="syz.6.5526" path="socket:[111626]" dev="sockfs" ino=111626 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 2017.621325][ T30] audit: type=1400 audit(1764869507.449:1217): avc: denied { ioctl } for pid=28843 comm="syz.6.5526" path="socket:[111640]" dev="sockfs" ino=111640 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 2017.685095][ T5875] gspca_vc032x: Unknown sensor... [ 2017.694414][ T5875] vc032x 10-1:0.0: probe with driver vc032x failed with error -22 [ 2017.725734][T28852] XFS (nbd2): SB validate failed with error -5. [ 2018.220908][ T5941] usb 3-1: new full-speed USB device number 123 using dummy_hcd [ 2018.291518][T10646] usb 10-1: USB disconnect, device number 67 [ 2018.476950][ T5941] usb 3-1: config 16 has an invalid interface number: 19 but max is 0 [ 2018.506281][ T5941] usb 3-1: config 16 has no interface number 0 [ 2019.011765][ T5941] usb 3-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 2019.023012][ T5941] usb 3-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 2019.067710][ T5941] usb 3-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 2019.174656][ T5941] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2019.204257][ T5941] usb 3-1: Product: syz [ 2019.210780][T23777] usb 9-1: new high-speed USB device number 75 using dummy_hcd [ 2019.218764][ T5941] usb 3-1: Manufacturer: syz [ 2019.270369][ T5941] usb 3-1: SerialNumber: syz [ 2019.308787][T28855] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 2019.404696][T23777] usb 9-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 2019.438118][T23777] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2019.473655][T23777] usb 9-1: Product: syz [ 2019.596242][T28879] netlink: 176 bytes leftover after parsing attributes in process `syz.9.5532'. [ 2019.817869][T23777] usb 9-1: Manufacturer: syz [ 2019.841513][T23777] usb 9-1: SerialNumber: syz [ 2019.857676][T28879] XFS (nbd9): SB validate failed with error -5. [ 2019.865699][ T5941] usb 3-1: USB disconnect, device number 123 [ 2019.925548][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2020.088036][T28868] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2020.186727][T28868] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2020.337979][T28893] netlink: 'syz.9.5534': attribute type 15 has an invalid length. [ 2020.346171][T28893] netlink: 24 bytes leftover after parsing attributes in process `syz.9.5534'. [ 2020.551530][T28893] kAFS: unable to lookup cell '({^@' [ 2020.952793][T23777] rtl8150 9-1:1.0: couldn't reset the device [ 2020.961240][T23777] rtl8150 9-1:1.0: probe with driver rtl8150 failed with error -5 [ 2022.124241][T28901] infiniband sy: set active [ 2022.129098][T28901] infiniband sy: added bond_slave_0 [ 2022.186267][T28901] RDS/IB: sy: added [ 2022.191203][T28901] smc: adding ib device sy with port count 1 [ 2022.197457][T28901] smc: ib device sy port 1 has no pnetid [ 2023.826533][T23780] usb 9-1: USB disconnect, device number 75 [ 2023.969608][T28910] netlink: 'syz.9.5537': attribute type 10 has an invalid length. [ 2024.319858][ T30] audit: type=1400 audit(1764869514.149:1218): avc: denied { ioctl } for pid=28911 comm="syz.8.5538" path="socket:[111911]" dev="sockfs" ino=111911 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 2024.403855][T28913] tipc: Enabling of bearer rejected, failed to enable media [ 2024.843132][T28918] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 2025.172216][T28926] Mount JFS Failure: -22 [ 2025.176612][T28926] jfs_mount failed w/return code = -22 [ 2025.500953][T23780] usb 10-1: new full-speed USB device number 68 using dummy_hcd [ 2025.809421][T23780] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2025.820837][T23780] usb 10-1: config 0 has 0 interfaces, different from the descriptor's value: 2 [ 2025.830065][T23780] usb 10-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 2025.844461][T23780] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2025.868258][T23780] usb 10-1: config 0 descriptor?? [ 2025.873810][T28929] XFS (nbd6): SB validate failed with error -5. [ 2025.896798][T28936] netlink: 16 bytes leftover after parsing attributes in process `syz.8.5544'. [ 2025.943091][T28936] binder: 28933:28936 unknown command 0 [ 2025.948755][T28936] binder: 28933:28936 ioctl c0306201 200000000080 returned -22 [ 2025.957282][T28936] binder: 28933:28936 ioctl c0306201 2000000003c0 returned -14 [ 2025.992375][T10646] usb 7-1: new full-speed USB device number 68 using dummy_hcd [ 2026.249665][T10646] usb 7-1: config 16 has an invalid interface number: 19 but max is 0 [ 2026.261979][T10646] usb 7-1: config 16 has no interface number 0 [ 2026.262296][T23780] usb 10-1: USB disconnect, device number 68 [ 2026.285914][T10646] usb 7-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 2026.317864][T10646] usb 7-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 2026.364892][T10646] usb 7-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 2026.381414][T10646] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2026.451600][T10646] usb 7-1: Product: syz [ 2026.456021][T10646] usb 7-1: Manufacturer: syz [ 2026.461224][T10646] usb 7-1: SerialNumber: syz [ 2026.486584][T28931] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2026.769555][T10646] usb 7-1: USB disconnect, device number 68 [ 2026.794993][T27063] udevd[27063]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2026.870002][T28944] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2027.193744][T28948] XFS (nbd8): SB validate failed with error -5. [ 2027.202312][T28946] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2027.468623][T28951] netlink: 176 bytes leftover after parsing attributes in process `syz.9.5547'. [ 2027.784069][T28960] Device name cannot be null; rc = [-22] [ 2028.213402][T28946] XFS (nbd9): SB validate failed with error -5. [ 2028.493164][T28972] Device name cannot be null; rc = [-22] [ 2028.950368][T28977] netlink: 'syz.2.5551': attribute type 15 has an invalid length. [ 2028.962786][T28977] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5551'. [ 2029.732431][T28977] kAFS: unable to lookup cell '({^@' [ 2030.181608][ T5941] usb 9-1: new high-speed USB device number 76 using dummy_hcd [ 2030.600782][ T5941] usb 9-1: Using ep0 maxpacket: 16 [ 2030.612191][ T5941] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2030.625631][ T5941] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2030.692438][ T5941] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice=e5.00 [ 2030.704331][ T5941] usb 9-1: New USB device strings: Mfr=255, Product=0, SerialNumber=0 [ 2030.733777][ T5941] usb 9-1: Manufacturer: syz [ 2030.746575][ T5941] usb 9-1: config 0 descriptor?? [ 2031.233963][ T5941] mcp2221 0003:04D8:00DD.0018: unknown main item tag 0x0 [ 2032.378638][ T5941] mcp2221 0003:04D8:00DD.0018: unknown main item tag 0x0 [ 2032.387480][ T5941] mcp2221 0003:04D8:00DD.0018: unknown main item tag 0x0 [ 2032.395135][ T5941] mcp2221 0003:04D8:00DD.0018: unknown main item tag 0x0 [ 2032.402846][ T5941] mcp2221 0003:04D8:00DD.0018: unknown main item tag 0x0 [ 2032.410293][ T5941] mcp2221 0003:04D8:00DD.0018: USB HID v0.05 Device [syz] on usb-dummy_hcd.8-1/input0 [ 2033.172866][ T5941] usb 9-1: USB disconnect, device number 76 [ 2033.362718][T29003] netlink: 'syz.2.5559': attribute type 10 has an invalid length. [ 2033.526301][T29010] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2033.699349][T29014] Device name cannot be null; rc = [-22] [ 2034.073728][T29012] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5561'. [ 2034.224912][T29010] XFS (nbd2): SB validate failed with error -5. [ 2034.761388][T19251] libceph: connect (1)[c::]:6789 error -101 [ 2034.780942][T19251] libceph: mon0 (1)[c::]:6789 connect error [ 2034.952904][T19251] libceph: connect (1)[c::]:6789 error -101 [ 2035.412118][T29024] ceph: No mds server is up or the cluster is laggy [ 2035.413755][T29033] ceph: No mds server is up or the cluster is laggy [ 2035.426987][T19251] libceph: mon0 (1)[c::]:6789 connect error [ 2035.435432][T23780] libceph: connect (1)[c::]:6789 error -101 [ 2035.447327][T23780] libceph: mon0 (1)[c::]:6789 connect error [ 2035.600192][ T5875] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 2035.721321][T23780] libceph: connect (1)[c::]:6789 error -101 [ 2035.729731][T23780] libceph: mon0 (1)[c::]:6789 connect error [ 2035.885045][ T5875] usb 7-1: Using ep0 maxpacket: 16 [ 2035.899457][ T5875] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2035.912022][ T5875] usb 7-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 2035.921336][ T5875] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2035.929377][ T5875] usb 7-1: Product: syz [ 2035.946051][ T5875] usb 7-1: Manufacturer: syz [ 2035.970802][ T5875] usb 7-1: SerialNumber: syz [ 2035.995179][ T5875] usb 7-1: config 0 descriptor?? [ 2036.078816][T29052] FAULT_INJECTION: forcing a failure. [ 2036.078816][T29052] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2036.092233][T29052] CPU: 1 UID: 0 PID: 29052 Comm: syz.7.5568 Not tainted syzkaller #0 PREEMPT(full) [ 2036.092259][T29052] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2036.092271][T29052] Call Trace: [ 2036.092278][T29052] [ 2036.092286][T29052] dump_stack_lvl+0x16c/0x1f0 [ 2036.092319][T29052] should_fail_ex+0x512/0x640 [ 2036.092369][T29052] _copy_to_user+0x32/0xd0 [ 2036.092397][T29052] simple_read_from_buffer+0xcb/0x170 [ 2036.092429][T29052] proc_fail_nth_read+0x197/0x240 [ 2036.092454][T29052] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2036.092480][T29052] ? rw_verify_area+0xcf/0x6c0 [ 2036.092504][T29052] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2036.092528][T29052] vfs_read+0x1e4/0xcf0 [ 2036.092555][T29052] ? __pfx___mutex_lock+0x10/0x10 [ 2036.092586][T29052] ? __pfx_vfs_read+0x10/0x10 [ 2036.092616][T29052] ? __fget_files+0x20e/0x3c0 [ 2036.092642][T29052] ksys_read+0x12a/0x250 [ 2036.092668][T29052] ? __pfx_ksys_read+0x10/0x10 [ 2036.092702][T29052] do_syscall_64+0xcd/0xf80 [ 2036.092731][T29052] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2036.092750][T29052] RIP: 0033:0x7f51e538e15c [ 2036.092766][T29052] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 2036.092783][T29052] RSP: 002b:00007f51e62e8030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2036.092802][T29052] RAX: ffffffffffffffda RBX: 00007f51e55e6090 RCX: 00007f51e538e15c [ 2036.092814][T29052] RDX: 000000000000000f RSI: 00007f51e62e80a0 RDI: 000000000000000c [ 2036.092826][T29052] RBP: 00007f51e62e8090 R08: 0000000000000000 R09: 0000000000000000 [ 2036.092837][T29052] R10: 0000000000001135 R11: 0000000000000246 R12: 0000000000000001 [ 2036.092847][T29052] R13: 00007f51e55e6128 R14: 00007f51e55e6090 R15: 00007ffd04424168 [ 2036.092874][T29052] [ 2036.350320][ T5941] usb 7-1: USB disconnect, device number 69 [ 2036.649763][T29050] netlink: 48 bytes leftover after parsing attributes in process `syz.8.5569'. [ 2037.031566][ T1297] ieee802154 phy0 wpan0: encryption failed: -22 [ 2037.038393][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 2037.153527][T29061] netlink: 'syz.2.5571': attribute type 10 has an invalid length. [ 2037.310535][T29065] x_tables: duplicate underflow at hook 1 [ 2037.599519][T29071] netlink: 'syz.6.5575': attribute type 10 has an invalid length. [ 2037.982110][T29074] Device name cannot be null; rc = [-22] [ 2038.638912][T29078] netlink: 'syz.7.5577': attribute type 10 has an invalid length. [ 2040.404408][T29097] netlink: 'syz.6.5582': attribute type 15 has an invalid length. [ 2040.412558][T29097] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5582'. [ 2040.556065][T29097] kAFS: unable to lookup cell '({^@' [ 2040.810871][ T5875] usb 3-1: new high-speed USB device number 124 using dummy_hcd [ 2041.467959][ T5875] usb 3-1: Using ep0 maxpacket: 16 [ 2041.518607][ T5875] usb 3-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 2041.542388][ T5875] usb 3-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 2041.560349][ T5875] usb 3-1: Product: syz [ 2042.178942][ T5875] usb 3-1: Manufacturer: syz [ 2042.204333][ T5875] usb 3-1: SerialNumber: syz [ 2042.224415][ T5875] usb 3-1: config 0 descriptor?? [ 2042.295608][T29114] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5586'. [ 2043.048520][ T5875] usb 3-1: USB disconnect, device number 124 [ 2046.203153][ T30] audit: type=1400 audit(1764869536.029:1219): avc: denied { setopt } for pid=29137 comm="syz.6.5593" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 2046.237074][T29164] FAULT_INJECTION: forcing a failure. [ 2046.237074][T29164] name failslab, interval 1, probability 0, space 0, times 0 [ 2046.335434][T29164] CPU: 0 UID: 0 PID: 29164 Comm: syz.9.5597 Not tainted syzkaller #0 PREEMPT(full) [ 2046.335461][T29164] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2046.335472][T29164] Call Trace: [ 2046.335478][T29164] [ 2046.335485][T29164] dump_stack_lvl+0x16c/0x1f0 [ 2046.335516][T29164] should_fail_ex+0x512/0x640 [ 2046.335541][T29164] ? fs_reclaim_acquire+0xae/0x150 [ 2046.335567][T29164] should_failslab+0xc2/0x120 [ 2046.335592][T29164] __kmalloc_noprof+0xdd/0x8f0 [ 2046.335610][T29164] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2046.335635][T29164] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2046.335656][T29164] tomoyo_realpath_from_path+0xc2/0x6e0 [ 2046.335679][T29164] ? tomoyo_profile+0x47/0x60 [ 2046.335703][T29164] tomoyo_path_number_perm+0x245/0x580 [ 2046.335720][T29164] ? tomoyo_path_number_perm+0x237/0x580 [ 2046.335739][T29164] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2046.335758][T29164] ? find_held_lock+0x2b/0x80 [ 2046.335797][T29164] ? find_held_lock+0x2b/0x80 [ 2046.335813][T29164] ? hook_file_ioctl_common+0x144/0x410 [ 2046.335843][T29164] ? __fget_files+0x20e/0x3c0 [ 2046.335863][T29164] security_file_ioctl+0x9b/0x240 [ 2046.335890][T29164] __x64_sys_ioctl+0xb7/0x210 [ 2046.335917][T29164] do_syscall_64+0xcd/0xf80 [ 2046.335948][T29164] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2046.335967][T29164] RIP: 0033:0x7efcb0d8f749 [ 2046.335983][T29164] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2046.336000][T29164] RSP: 002b:00007efcb1cc4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2046.336018][T29164] RAX: ffffffffffffffda RBX: 00007efcb0fe5fa0 RCX: 00007efcb0d8f749 [ 2046.336029][T29164] RDX: 0000200000000000 RSI: 000000008028640c RDI: 0000000000000003 [ 2046.336040][T29164] RBP: 00007efcb1cc4090 R08: 0000000000000000 R09: 0000000000000000 [ 2046.336051][T29164] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2046.336061][T29164] R13: 00007efcb0fe6038 R14: 00007efcb0fe5fa0 R15: 00007ffe5aad06b8 [ 2046.336085][T29164] [ 2046.336094][T29164] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2046.460775][T23780] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 2046.942023][T23780] usb 9-1: Using ep0 maxpacket: 8 [ 2047.116113][T10646] IPVS: starting estimator thread 0... [ 2047.157451][T23780] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 2047.187140][T23780] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2047.213039][T23780] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2047.260805][T29172] IPVS: using max 40 ests per chain, 96000 per kthread [ 2047.268959][T23780] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 10982, setting to 1024 [ 2047.311092][T23780] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 2047.352375][T23780] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2047.423468][T23780] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2047.472658][T23780] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2047.555815][T23780] usb 9-1: can't set config #16, error -71 [ 2047.641726][T29177] netlink: 'syz.8.5600': attribute type 10 has an invalid length. [ 2047.939281][T23780] usb 9-1: USB disconnect, device number 77 [ 2049.119434][ T30] audit: type=1400 audit(1764869538.949:1220): avc: denied { mount } for pid=29198 comm="syz.7.5606" name="/" dev="bpf" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 2050.331239][T29209] netlink: 'syz.2.5608': attribute type 10 has an invalid length. [ 2050.987293][ T30] audit: type=1400 audit(1764869540.809:1221): avc: denied { execute } for pid=29219 comm="syz.2.5612" path="/file1" dev="ramfs" ino=111307 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:ramfs_t tclass=file permissive=1 [ 2051.115696][T29226] netlink: 'syz.6.5611': attribute type 10 has an invalid length. [ 2051.499099][ T30] audit: type=1400 audit(1764869541.329:1222): avc: denied { ioctl } for pid=29219 comm="syz.2.5612" path="socket:[111316]" dev="sockfs" ino=111316 ioctlcmd=0x8915 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 2051.524593][ C0] vkms_vblank_simulate: vblank timer overrun [ 2052.191100][T19251] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 2052.509895][T19251] usb 7-1: Using ep0 maxpacket: 32 [ 2052.536160][T19251] usb 7-1: New USB device found, idVendor=0ac8, idProduct=0321, bcdDevice=6f.be [ 2052.547405][T19251] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2052.581284][T19251] usb 7-1: config 0 descriptor?? [ 2052.588049][T19251] gspca_main: vc032x-2.14.0 probing 0ac8:0321 [ 2052.904331][T29247] netlink: 'syz.8.5618': attribute type 10 has an invalid length. [ 2054.540881][T19251] gspca_vc032x: reg_w err -110 [ 2054.545826][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.560909][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.588387][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.608578][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.649602][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.650314][ T30] audit: type=1400 audit(1764869544.479:1223): avc: denied { write } for pid=29263 comm="syz.7.5622" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 2054.735577][ T30] audit: type=1400 audit(1764869544.519:1224): avc: denied { open } for pid=29263 comm="syz.7.5622" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 2054.737612][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.770009][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.797248][ T30] audit: type=1400 audit(1764869544.519:1225): avc: denied { ioctl } for pid=29263 comm="syz.7.5622" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0x9439 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 2054.851756][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.864635][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.870001][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2054.891509][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.065070][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.082343][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.173865][T29267] netlink: 'syz.7.5623': attribute type 10 has an invalid length. [ 2055.182272][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.193985][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.354627][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.360348][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.376672][T19251] gspca_vc032x: I2c Bus Busy Wait 00 [ 2055.387018][T19251] gspca_vc032x: Unknown sensor... [ 2055.836539][T19251] vc032x 7-1:0.0: probe with driver vc032x failed with error -22 [ 2055.906119][T19251] usb 7-1: USB disconnect, device number 70 [ 2055.922650][T29276] IPVS: set_ctl: invalid protocol: 46 100.1.1.0:20003 [ 2056.467709][T29287] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2056.924300][T29293] netlink: 176 bytes leftover after parsing attributes in process `syz.8.5629'. [ 2057.114330][T29293] XFS (nbd8): SB validate failed with error -5. [ 2057.162728][T29292] netlink: 'syz.6.5630': attribute type 10 has an invalid length. [ 2057.381967][T29305] netlink: 4 bytes leftover after parsing attributes in process `syz.2.5632'. [ 2058.704078][T29319] tmpfs: Unknown parameter ' ڛ5Hru.Uē͸ƖO8)GT`)BDži' [ 2059.406631][T29333] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2060.013423][T29333] netlink: 176 bytes leftover after parsing attributes in process `syz.6.5641'. [ 2060.037237][T29333] XFS (nbd6): SB validate failed with error -5. [ 2060.554710][T29350] netlink: 'syz.8.5643': attribute type 10 has an invalid length. [ 2060.792187][T29359] Mount JFS Failure: -22 [ 2060.796493][T29359] jfs_mount failed w/return code = -22 [ 2061.110368][T29360] Mount JFS Failure: -22 [ 2061.114877][T29360] jfs_mount failed w/return code = -22 [ 2061.420928][ T5875] usb 9-1: new full-speed USB device number 78 using dummy_hcd [ 2061.456408][T29370] netlink: 'syz.2.5650': attribute type 10 has an invalid length. [ 2061.696019][ T5875] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2061.732261][ T5875] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2061.841224][ T5875] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 2061.861460][ T5875] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2061.932199][ T5875] usb 9-1: config 0 descriptor?? [ 2061.964245][ T5875] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 2061.981895][ T5875] dvb-usb: bulk message failed: -22 (3/0) [ 2062.021686][ T5875] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 2062.038575][ T5875] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 2062.060427][ T5875] usb 9-1: media controller created [ 2062.069378][T29377] netlink: 'syz.2.5651': attribute type 10 has an invalid length. [ 2062.114202][ T5875] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2062.252170][ T5875] dvb-usb: bulk message failed: -22 (6/0) [ 2062.268672][ T5875] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 2062.307353][ T5875] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input104 [ 2062.392193][ T5875] dvb-usb: schedule remote query interval to 150 msecs. [ 2062.411563][ T5875] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 2062.470781][ T5875] usb 9-1: USB disconnect, device number 78 [ 2062.546336][ T5875] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 2062.804953][T29380] netlink: 'syz.6.5652': attribute type 10 has an invalid length. [ 2065.542062][T29413] netlink: 'syz.7.5660': attribute type 15 has an invalid length. [ 2065.550154][T29413] netlink: 24 bytes leftover after parsing attributes in process `syz.7.5660'. [ 2065.660719][T29413] kAFS: unable to lookup cell '({^@' [ 2065.852751][T29416] netlink: 'syz.9.5661': attribute type 10 has an invalid length. [ 2069.825685][T29461] XFS (nbd7): SB validate failed with error -5. [ 2070.911217][T29478] netlink: 'syz.6.5673': attribute type 10 has an invalid length. [ 2071.788443][ T5875] usb 3-1: new full-speed USB device number 125 using dummy_hcd [ 2072.120279][ T5875] usb 3-1: config 16 has an invalid interface number: 19 but max is 0 [ 2072.140766][ T5875] usb 3-1: config 16 has no interface number 0 [ 2072.150290][ T5875] usb 3-1: config 16 interface 19 altsetting 0 endpoint 0x5 has an invalid bInterval 0, changing to 10 [ 2072.170845][ T5875] usb 3-1: config 16 interface 19 altsetting 0 endpoint 0x5 has invalid maxpacket 2176, setting to 64 [ 2072.662569][T29492] ceph: No mds server is up or the cluster is laggy [ 2072.677203][T23777] libceph: connect (1)[c::]:6789 error -101 [ 2072.684002][ T5875] usb 3-1: New USB device found, idVendor=0499, idProduct=cdf4, bcdDevice=78.ee [ 2072.693784][T23777] libceph: mon0 (1)[c::]:6789 connect error [ 2072.699755][ T5875] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2072.710013][ T5875] usb 3-1: Product: syz [ 2072.714985][ T5875] usb 3-1: Manufacturer: syz [ 2072.719772][ T5875] usb 3-1: SerialNumber: syz [ 2072.861125][T29479] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 2073.080739][T29505] netlink: 'syz.8.5682': attribute type 10 has an invalid length. [ 2073.703602][ T5875] usb 3-1: USB disconnect, device number 125 [ 2074.426811][T29467] udevd[29467]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:16.19/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2075.356219][T29529] netlink: 'syz.7.5687': attribute type 4 has an invalid length. [ 2076.007202][T29534] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2076.705694][T29542] netlink: 176 bytes leftover after parsing attributes in process `syz.7.5688'. [ 2077.211724][T29542] XFS (nbd7): SB validate failed with error -5. [ 2077.989363][T29552] FAULT_INJECTION: forcing a failure. [ 2077.989363][T29552] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2078.002532][T29552] CPU: 1 UID: 0 PID: 29552 Comm: syz.8.5691 Not tainted syzkaller #0 PREEMPT(full) [ 2078.002558][T29552] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2078.002569][T29552] Call Trace: [ 2078.002578][T29552] [ 2078.002585][T29552] dump_stack_lvl+0x16c/0x1f0 [ 2078.002617][T29552] should_fail_ex+0x512/0x640 [ 2078.002647][T29552] _copy_from_iter+0x2a4/0x16c0 [ 2078.002678][T29552] ? __alloc_skb+0x220/0x410 [ 2078.002703][T29552] ? __alloc_skb+0x35d/0x410 [ 2078.002729][T29552] ? __pfx__copy_from_iter+0x10/0x10 [ 2078.002767][T29552] netlink_sendmsg+0x820/0xdd0 [ 2078.002797][T29552] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2078.002830][T29552] ____sys_sendmsg+0xa5d/0xc30 [ 2078.002861][T29552] ? copy_msghdr_from_user+0x10a/0x160 [ 2078.002879][T29552] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2078.002907][T29552] ? __lock_acquire+0x433/0x22f0 [ 2078.002936][T29552] ___sys_sendmsg+0x134/0x1d0 [ 2078.002956][T29552] ? __pfx____sys_sendmsg+0x10/0x10 [ 2078.002974][T29552] ? find_held_lock+0x2b/0x80 [ 2078.003022][T29552] __sys_sendmsg+0x16d/0x220 [ 2078.003040][T29552] ? __pfx___sys_sendmsg+0x10/0x10 [ 2078.003057][T29552] ? __pfx___schedule+0x10/0x10 [ 2078.003088][T29552] ? rcu_is_watching+0x12/0xc0 [ 2078.003116][T29552] do_syscall_64+0xcd/0xf80 [ 2078.003144][T29552] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2078.003163][T29552] RIP: 0033:0x7fc79c58f749 [ 2078.003179][T29552] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2078.003198][T29552] RSP: 002b:00007fc79d374038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2078.003217][T29552] RAX: ffffffffffffffda RBX: 00007fc79c7e5fa0 RCX: 00007fc79c58f749 [ 2078.003229][T29552] RDX: 0000000000040000 RSI: 0000200000000000 RDI: 0000000000000008 [ 2078.003241][T29552] RBP: 00007fc79d374090 R08: 0000000000000000 R09: 0000000000000000 [ 2078.003252][T29552] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2078.003263][T29552] R13: 00007fc79c7e6038 R14: 00007fc79c7e5fa0 R15: 00007ffcc7ac3808 [ 2078.003289][T29552] [ 2078.476203][T29561] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5692'. [ 2078.925108][T29568] netlink: 'syz.7.5694': attribute type 10 has an invalid length. [ 2081.011526][T29589] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2081.283400][T29596] netlink: 176 bytes leftover after parsing attributes in process `syz.2.5699'. [ 2081.761146][T29596] XFS (nbd2): SB validate failed with error -5. [ 2081.901698][T29605] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2082.049587][T29605] netlink: 176 bytes leftover after parsing attributes in process `syz.8.5701'. [ 2082.816342][T29605] XFS (nbd8): SB validate failed with error -5. [ 2082.890474][T29618] netlink: 'syz.9.5703': attribute type 15 has an invalid length. [ 2082.898486][T29618] netlink: 24 bytes leftover after parsing attributes in process `syz.9.5703'. [ 2083.151793][T29618] kAFS: unable to lookup cell '({^@' [ 2083.765824][T29629] netlink: 'syz.8.5705': attribute type 4 has an invalid length. [ 2084.229930][T29633] netlink: 'syz.9.5707': attribute type 2 has an invalid length. [ 2086.090100][T29657] Device name cannot be null; rc = [-22] [ 2086.766476][T29661] kAFS: unable to lookup cell '({^@' [ 2089.007807][T29681] tmpfs: Bad value for 'mpol' [ 2089.017347][T29681] Oops: general protection fault, probably for non-canonical address 0xed25e9cd2c4e65ea: 0000 [#1] SMP KASAN NOPTI [ 2089.029437][T29681] KASAN: maybe wild-memory-access in range [0x692f6e6962732f50-0x692f6e6962732f57] [ 2089.038712][T29681] CPU: 0 UID: 0 PID: 29681 Comm: syz.2.5717 Not tainted syzkaller #0 PREEMPT(full) [ 2089.048067][T29681] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2089.058110][T29681] RIP: 0010:kernfs_root+0x67/0x2a0 [ 2089.063224][T29681] Code: 89 c6 e8 4c 72 56 ff 58 85 db 0f 85 b7 00 00 00 e8 8e 77 56 ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 24 02 00 00 48 8b 5d 30 e8 46 2a fb 08 31 ff 41 [ 2089.082818][T29681] RSP: 0018:ffffc9000da27998 EFLAGS: 00010202 [ 2089.088872][T29681] RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc9000c429000 [ 2089.096831][T29681] RDX: 0d25edcd2c4e65ea RSI: ffffffff82678d12 RDI: 692f6e6962732f50 [ 2089.104793][T29681] RBP: 692f6e6962732f20 R08: 0000000000000001 R09: 0000000000000000 [ 2089.112748][T29681] R10: 0000000000000001 R11: 00000000f80c4a1a R12: 0000000000000000 [ 2089.120715][T29681] R13: ffffffff8c2073a0 R14: 0000000000000002 R15: ffff88806a9b7920 [ 2089.128672][T29681] FS: 00007fccb22786c0(0000) GS:ffff88812497e000(0000) knlGS:0000000000000000 [ 2089.137589][T29681] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2089.144171][T29681] CR2: 000000110c305a84 CR3: 000000005acc7000 CR4: 00000000003526f0 [ 2089.152138][T29681] Call Trace: [ 2089.155400][T29681] [ 2089.158313][T29681] kernfs_remove_by_name_ns+0x2e/0x100 [ 2089.163793][T29681] driver_remove_file+0x4a/0x60 [ 2089.168648][T29681] bus_remove_driver+0x224/0x2c0 [ 2089.173587][T29681] driver_unregister+0x76/0xb0 [ 2089.178340][T29681] comedi_device_detach_locked+0x12f/0xa50 [ 2089.184153][T29681] do_devconfig_ioctl+0x555/0x710 [ 2089.189176][T29681] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 2089.194723][T29681] ? find_held_lock+0x2b/0x80 [ 2089.199390][T29681] comedi_unlocked_ioctl+0x165d/0x2ee0 [ 2089.204859][T29681] ? futex_wake+0x1ad/0x530 [ 2089.209345][T29681] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 2089.215144][T29681] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2089.221030][T29681] ? do_vfs_ioctl+0x128/0x14f0 [ 2089.225783][T29681] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 2089.230797][T29681] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 2089.237659][T29681] ? hook_file_ioctl_common+0x144/0x410 [ 2089.243205][T29681] ? selinux_file_ioctl+0x180/0x270 [ 2089.248398][T29681] ? selinux_file_ioctl+0xb4/0x270 [ 2089.253502][T29681] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 2089.259482][T29681] __x64_sys_ioctl+0x18e/0x210 [ 2089.264235][T29681] do_syscall_64+0xcd/0xf80 [ 2089.268732][T29681] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2089.274619][T29681] RIP: 0033:0x7fccb138f749 [ 2089.279021][T29681] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2089.298632][T29681] RSP: 002b:00007fccb2278038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2089.307049][T29681] RAX: ffffffffffffffda RBX: 00007fccb15e6180 RCX: 00007fccb138f749 [ 2089.315020][T29681] RDX: 0000000000000000 RSI: 0000000040946400 RDI: 0000000000000005 [ 2089.322976][T29681] RBP: 00007fccb1413f91 R08: 0000000000000000 R09: 0000000000000000 [ 2089.330939][T29681] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2089.338906][T29681] R13: 00007fccb15e6218 R14: 00007fccb15e6180 R15: 00007ffd66f36d38 [ 2089.346905][T29681] [ 2089.349919][T29681] Modules linked in: [ 2089.354164][T29681] ---[ end trace 0000000000000000 ]--- [ 2089.466665][ T30] audit: type=1400 audit(3912353227.285:1226): avc: denied { read } for pid=5173 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 2089.477773][T29681] RIP: 0010:kernfs_root+0x67/0x2a0 [ 2089.495402][ T30] audit: type=1400 audit(3912353227.285:1227): avc: denied { search } for pid=5173 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 2089.614790][T29688] Mount JFS Failure: -22 [ 2089.619161][T29688] jfs_mount failed w/return code = -22 [ 2089.630821][T29681] Code: 89 c6 e8 4c 72 56 ff 58 85 db 0f 85 b7 00 00 00 e8 8e 77 56 ff 48 8d 7d 30 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 24 02 00 00 48 8b 5d 30 e8 46 2a fb 08 31 ff 41 [ 2089.650596][T29681] RSP: 0018:ffffc9000da27998 EFLAGS: 00010202 [ 2089.656816][T29681] RAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffc9000c429000 [ 2089.664849][T29681] RDX: 0d25edcd2c4e65ea RSI: ffffffff82678d12 RDI: 692f6e6962732f50 [ 2089.673467][T29681] RBP: 692f6e6962732f20 R08: 0000000000000001 R09: 0000000000000000 [ 2089.681514][T29681] R10: 0000000000000001 R11: 00000000f80c4a1a R12: 0000000000000000 [ 2089.689628][T29681] R13: ffffffff8c2073a0 R14: 0000000000000002 R15: ffff88806a9b7920 [ 2089.697690][T29681] FS: 00007fccb22786c0(0000) GS:ffff888124a7e000(0000) knlGS:0000000000000000 [ 2089.706817][T29681] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2089.713566][T29681] CR2: 0000200000010000 CR3: 000000005acc7000 CR4: 00000000003526f0 [ 2089.722130][T29681] Kernel panic - not syncing: Fatal exception [ 2089.728485][T29681] Kernel Offset: disabled [ 2089.732785][T29681] Rebooting in 86400 seconds..