last executing test programs: 15m3.065669203s ago: executing program 0 (id=955): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x20008, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0) syz_emit_ethernet(0xa6, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200000086dd6000000000702c00fe800000"], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc044560f, &(0x7f0000000380)=@mmap={0x0, 0x1, 0x4, 0x2, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "37bb54f0"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) 14m58.348239179s ago: executing program 0 (id=969): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000140)=0x15) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000000300)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r3, 0xc04064aa, &(0x7f00000003c0)={&(0x7f0000001280), 0x0, r4, 0x0, '\x00', 0x1ffffffffffffd64, 0x3f}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r3, 0xc01864b0, &(0x7f0000000680)={r4, r4, 0xd, 0x0, 0x3}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r5, 0x5) syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(r5, &(0x7f0000000400)="47e699d91fe0fe5945e1cbd2b1cbcb09e42a9d4e75d9f49e77086cb3a1c2180d9d32e5530a7744623ac8486f38e8fa5ae66b7f46b9e37c7d1cb3b42f6ac6c1d109f743d42ac5856049d882b22ef194bd88f9e6e2329d3588e3b776a1bd9c4555788adb5243de4ff36e2851f4b05f3893b02424", 0x73, 0x11, 0x0, 0x0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r6, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r8, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1004) 14m56.174371466s ago: executing program 3 (id=973): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0x1}], 0x1}, 0x80d1) 14m56.108213658s ago: executing program 2 (id=974): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r0, 0x4001af84, &(0x7f0000000000)) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) syz_open_procfs(0x0, 0x0) quotactl_fd$Q_SETINFO(0xffffffffffffffff, 0xffffffff80000600, 0x0, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, 0x0, 0x0) bind$inet6(r1, 0x0, 0x0) 14m55.964300353s ago: executing program 2 (id=976): r0 = socket$packet(0x11, 0x2, 0x300) close(r0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)="1b0000001a007f029e741683c28f7b331d00000000390000000000", 0x1b}], 0x1}, 0x24000080) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x5, 0x0, &(0x7f0000bbdffc)) socket$packet(0x11, 0x2, 0x300) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r5 = epoll_create1(0x0) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, 0xffffffffffffffff, 0x7, r3, &(0x7f0000000040)={r5, r0, 0x739}) sendto$inet6(r4, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000080)=0x6) r7 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETSF(r7, 0x80045440, &(0x7f0000000140)={0xe47, 0x7, 0x2080060f, 0xffffbffe, 0x12, "1c52b4c2e70c0088c84f1f00"}) r8 = socket$tipc(0x1e, 0x5, 0x0) listen(r8, 0x400) listen(r8, 0xf) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000000}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14m53.497174959s ago: executing program 1 (id=977): r0 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r0, &(0x7f0000001000)='nfsd.fh/channel\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, 0x0, 0x20902, 0x0) socket$kcm(0x2, 0x3, 0x2) write$sequencer(r3, &(0x7f0000000100)=ANY=[@ANYBLOB="810100000001000081", @ANYRES32=r3], 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0xa2e42, 0x0) 14m53.421144902s ago: executing program 3 (id=978): modify_ldt$write2(0x11, &(0x7f0000000100)={0x1d30, 0x0, 0x2000, 0x1}, 0x10) syz_socket_connect_nvme_tcp() openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) writev(r0, &(0x7f00000030c0)=[{&(0x7f0000000dc0)="835170544ea9e0aed3b7d1616b996a0ed904d30492796feef8cadd3fec5155ad89eb37381c", 0x25}, {&(0x7f0000000e00)="5701c518df8fd1a67f0f0cfc203d1fdf12cc59894259dcd9589f84da09dd13168ab9d2acc5e983d3359752d6a4eb6aa4fed9a0af88a0f5554133fcd482d509b50cdb6866062b4ab99dd598", 0x4b}, {&(0x7f0000000ec0)="05011a6b1102e8c6dbc8341797959424121ba20eafab1d76af8ed49d19fdff6ca6979963d9a77894cf9eda667d771c1e0bbe49e32610e78ff675ef5e901eb2739c342248f5c0c36813269405dc44559ea496bee54b33e0b56f4ab9b187e9a718595034cc4b95d569e7ddd0e818148fbf4c88510b7d49ef8551537738214e136a8b8e8c7715f335f49d03005259e0b0a2faa9e2e8cd3673462a6b8047508538ec713d75365d9b721ddea4394eeb3ac98a8ee786ead859e19565d405972f6c4203251a0a5c12c167ab5c358cbb", 0xcc}, {&(0x7f0000000fc0)="d49994e4bad08b75d15a3827fa19928fb608366f63717caceb1cb7007af252e20cdd0c4c123c3bdda549a734337efea5d3bdb5d5ba420305df4d402c9663ea9ae570c042c080cc49bd83f4fe943c278468d13add5a35a9d33717839e0443ddaaebe887cc518fe25fc7e5498b0da4b12caeb5612aa53b6633a1f7cc93d67e6452b741aaa78dbd8c2e2a93d63e76f5aaede89ad1e41cd013c0e6d71fb9c8615d3934e590e2db97ba08950c5e8d5c8c33ce936724fa26be87f90ddf36681534588851246b5e01b8715576666a01b313590533f46afe3192aee546fefcccece1bb9412f0444208b0cd896ae8bbe3259f40e75375c620a2995dee39962aede4270013c21332172b9932a07977b6becf15237029731e6fee97e4a2008a2de4ece49c65c54e5a0d144edb21aac5bc67881ae7a8233fd9e1cfe845f1e981b20d3a5fc8b743a8557e01a08acb4f838562461f1ff197e899c5d9e90158a2342dd61a278d899a77f8d01cf01b36ed70f2e090f2f3f72ffddb34acb0b28d50fc87fe49fc3e72487451a12bb12f5c7a1fe8076d61c63058b95c15b990a55309f3c8eed50c89cf00033ddf93c7ee897075abbdd3c661c9dfcc7ff3bb83104fd733e6c50bd3a851da51b1072136a516f083cf94f834e6cb248546b353c27cd9699dfa70def768f7aacab250496472635591b8ae53d588d4ed6325108e9d86367147b9a3fc392f0034dcc6d29dec88e3408c0e630e333b6a9e519fa92c1ece263e7d770818afc5c56ad356073d250a2acd6c0a7435721d88d703c4916bb0c0f9004efe0a52c3e471360bc6c3ba28c9da57be86493ca6a1cbdd5db3b190c3073528841040a9ddf1f38b2ccc5396655fd2b3da5c27efacb74491d1e75b42999c0753a5706dd2e3d5ffd53c4aee70e88d57d6f731bb7c48a1112ffe4a0ce42eb60ea9ba4b7e6b57fcaba118fb1d9685d962d6fdf25c2afd90f2a13ae098153c9a25a1f313b000b1714cb26798d0839de2d83421bff469bc0056073b7c57438869470ebc17a5135c879e0dcf2cd470e0f0a66d3fdb716689e450927bafcf205d25583a744a800fb10ebdba7d4600a849a61b42d0d5152f2f08c26758d7ec9024e696c276f4249766bb8c8f0aafa1629d74458da97f2a1b72b4f9b9d5d18799eb0a5128c938f656f1062f781b46cc4238392ae2bb3223aa93ab37e7fd2c695d1716037181ac6a713db964de0f74de4bc36381acde43df55cc4d1a67aa9bbaeb7a075f5de0be490b8b127c92ecdefba91ebb46cc100cf987ba8bf93faf1d19d6b6da77d888056b1a4500e5ba847c4bac6efa06922e1d929d8a4993933aded40697de7b9703d40c83b7862b69990bfd883173889594d3a3a3f4a9a04a8d9b4581352a33d5bb1f08f0a72e48ca59dca80873e4e366f6c48506d98de05769e4e6641633fa9a352db17df058e453cf5b42960fe696cde6311e47707bee8a39710283b9987d4f2995e0e8d781e2141860f822353bd61a910bed587e32e011d6bd0363de77dde387195d21846a5ec46c251bec0b4e60e2e0778cccdec6f4939e2cd46ac86fab729b5f2e5dd993df13adcfc955e5fa56907fe5ba9daca858b57eb9a1fd1aeaa2fe23e75c8f1b92b7eebeb1d9dff6a4d5cb6855f4bb2813e980577d4aab6a17bb95ca1b5fbc6b2cc2040672d741a09131365fd24212bc11de436d360d0eb4a4228ba26ec66f8e7ed4bf608e7539656a9255f42bc3b83afb18fc50f44d962439c72d0601a68778f37edd947c0c2e0e8d012b06779c5092b95d461565c1d7bf828d9eb27430dd03852ef952867b6c3e780af88c9158ae0ee3f91f3467707f31348889e09632d0b8bd2d56220af49f6591cc9f0e1dff9de92e891d9170a3818c7d499332371f4ae01c3faf3eaa2ee35485e41cbff880e606d5fcda733b4679116489d42d61873edb9c8072d99fd41e10e3b27b47b08f5e659cfb38ea9a60ee3c7bbccd84a37c2159383762641f1c3f7160774b7d4e03cf43144b8dbf454bc4ea47cd9f045face5c2588c05c624bf82e594fa77c7eec5f368a213c0316fd0ee58a302b3e2c94380cc20f0edb84c81d072355101ce82c492bda9e67e5b1b79ef41c5c873143d364ecbb78e04db4c9e6b516b05d739ff89601271332dfaae52c30886658a307292e1507774e2c3601230d1c614bbbb4412bb26961969d8268d124bb9100dcc99151035394c932a31f0a2f2b9ca1c5d843926795907bbf1688b2aca996788be160da6cc31f9e2fa3978176570e33f58b73ef8d7c073a994240f44174f1f1a4a7076703feb28cc35b5d25560a8326f064ba9f8baca26b9e3db228db68e32db1028", 0x67b}], 0x4) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000001440)='./file0\x00', 0x80040, 0x54) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x100) flock(r3, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x60500, 0x0) flock(r4, 0x2) 14m53.415739233s ago: executing program 2 (id=979): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, 0x0, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xb, 0x20000000, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r10, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 14m53.234303919s ago: executing program 0 (id=980): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000280)='/proc/sys/net/ipv4/tcp_wmem\x00', 0x1, 0x0) mkdir(&(0x7f0000000000)='my_tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='my_tracefs\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0) write(r1, 0x0, 0x30) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)={0x1c, 0x3b, 0x1, 0x70bd27, 0x25dfdbfd, {0xa}, [@typed={0x8, 0x1, 0x0, 0x0, @u32=0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x48c1}, 0x20040010) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000100)='./file0\x00') r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuset.effective_cpus\x00', 0x275a, 0x0) pwritev2(r3, &(0x7f0000000980)=[{&(0x7f0000000500)="be", 0x20013}], 0x1, 0x5, 0xa, 0x14) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000c40)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x28c, 0x16, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_FLOWTABLE_HOOK={0xb0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0xa4, 0x3, 0x0, 0x1, [{0x14, 0x1, 'ip6gre0\x00'}, {0x14, 0x1, 'dummy0\x00'}, {0x14, 0x1, 'veth0_macvtap\x00'}, {0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'team_slave_0\x00'}, {0x14}, {0x14, 0x1, 'veth1_to_bridge\x00'}, {0x14, 0x1, 'tunl0\x00'}]}]}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x8}]}, @NFTA_FLOWTABLE_HOOK={0x184, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x54, 0x3, 0x0, 0x1, [{0x14, 0x1, 'bond_slave_1\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'ipvlan1\x00'}, {0x14, 0x1, 'wlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x54, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vlan0\x00'}, {0x14, 0x1, 'macvlan1\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'team0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bridge\x00'}, {0x14, 0x1, 'veth1_virt_wifi\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x54, 0x3, 0x0, 0x1, [{0x14, 0x1, 'team_slave_0\x00'}, {0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'syz_tun\x00'}, {0x14, 0x1, 'virt_wifi0\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3c}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'batadv0\x00'}, {0x14, 0x1, 'macsec0\x00'}, {0x14, 0x1, 'vxcan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x9}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x5}]}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x2}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x2}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x9}, @NFTA_EXTHDR_OP={0x8, 0x6, 0x1, 0x0, 0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x33c}}, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x56, &(0x7f00000003c0)=[{&(0x7f0000000380)={0x10, 0x814, 0x1, 0x20, 0x25dfdbff}, 0x10}], 0x1, 0x0, 0x0, 0x4000}, 0x20000070) ioctl$USBDEVFS_ALLOC_STREAMS(0xffffffffffffffff, 0x8008551c, &(0x7f0000000340)={0x94d0, 0x2, [{0x1, 0x1}, {0xd, 0x1}]}) 14m53.164245251s ago: executing program 2 (id=981): r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100", 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00'}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r4, 0x890c, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001800dd8d0000c6b00000df2502100000fc00fe070015000006001500060000000c0016800500040002000000"], 0x30}}, 0x40044) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}}) 14m53.155697882s ago: executing program 1 (id=982): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x19, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000020000000000000000000000b7080000000000007b8af8ff00000000b7080000040000007b8af0ff", @ANYRES32, @ANYBLOB="0000000000000000b70500000000000085000000a500000018", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) lsetxattr$security_capability(&(0x7f0000000000)='./file1/file2\x00', &(0x7f0000000140), 0x0, 0x0, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x2) sendmsg$IPSET_CMD_SAVE(r2, 0x0, 0x48040) 14m52.91869082s ago: executing program 1 (id=983): r0 = syz_open_pts(0xffffffffffffffff, 0x400000) futex(0x0, 0x85, 0x2000000, 0x0, 0x0, 0xa0090199) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r4) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, r5, 0xba87317d461c07c9, 0x70bd26, 0x4004}, 0x14}, 0x1, 0x0, 0x0, 0x40000c9}, 0x1000) 14m52.515513115s ago: executing program 1 (id=984): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000100)) r1 = syz_open_pts(r0, 0x2) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000300)=0x1) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl(r2, 0x8914, &(0x7f0000000400)="736c300000000000000000000000000001") ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000803)=0xc2) 14m52.423875717s ago: executing program 3 (id=985): socket$kcm(0x21, 0x7, 0x2) r0 = socket$packet(0x11, 0x2, 0x300) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)="1b0000001a007f029e741683c28f7b331d00000000390000000000", 0x1b}], 0x1}, 0x24000080) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x5, 0x0, &(0x7f0000bbdffc)) socket$packet(0x11, 0x2, 0x300) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r5 = epoll_create1(0x0) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, 0xffffffffffffffff, 0x7, r3, &(0x7f0000000040)={r5, r0, 0x739}) sendto$inet6(r4, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000080)=0x6) r7 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETSF(r7, 0x80045440, &(0x7f0000000140)={0xe47, 0x7, 0x2080060f, 0xffffbffe, 0x12, "1c52b4c2e70c0088c84f1f00"}) r8 = socket$tipc(0x1e, 0x5, 0x0) listen(r8, 0x400) listen(r8, 0xf) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000000}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14m50.388181809s ago: executing program 0 (id=986): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x1c}}, 0x0) getsockname$packet(r1, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="3c0000001000850600000000ff6122314a00", @ANYRES32=r2, @ANYBLOB="f5ff0f00252155b21c0012000c000100626f6e64000000000c0002000800010001"], 0x3c}}, 0x40000) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="3c00000010000305005b68fdce0afc5924000000", @ANYRES32=0x0, @ANYBLOB="0000000006100000140012800b00010062726964676500000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x440b0) socket$nl_route(0x10, 0x3, 0x0) r3 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x2d}, 0x1, 0x0, 0x0, 0x8801}, 0x8000) modify_ldt$write2(0x11, 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r6, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r6, &(0x7f0000005700)=[{{0x0, 0x0, &(0x7f0000003380)=[{&(0x7f0000001f80)=""/132, 0x84}], 0x1}, 0x4}], 0x1, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x1, "56805c734ee222c29de4125f81f6e030a5441a99f362cd24e0a1ac2291500733", "467f517bd818d5a4a8d26ae61b4cbf13", {"31ffc21d2e9bfb1eb3c03976ed837b6f", "876605ac29dcb96a8901e0711afb3db3"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000840)={0x6, 0x64, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x5, 0x0, 0x0, 0x60ff78ce1cb3c070, 0x0, '\x00', 0x0, 0x25, r4}, 0x94) ioctl$EVIOCSMASK(0xffffffffffffffff, 0x40104593, &(0x7f00000001c0)={0x1, 0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) socket(0x28, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r3, 0x84, 0xc, &(0x7f0000000140), &(0x7f00000001c0)=0x4) 14m50.331898461s ago: executing program 1 (id=987): fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10000, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x2000006, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = socket$rds(0x15, 0x5, 0x0) bind$rds(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) sendmsg$inet(r0, &(0x7f0000000480)={&(0x7f0000000000)={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)="91cfdfefdb", 0x1a000}], 0x1}, 0x0) sendmsg$rds(r0, &(0x7f0000000140)={&(0x7f00000000c0)={0x2, 0x4e21, @private=0xa010102}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x800}, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000280)={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000080)=[{&(0x7f0000001940)='{', 0x1}], 0x1}, 0x80d1) 14m50.331066891s ago: executing program 3 (id=988): socket$kcm(0x21, 0x7, 0x2) r0 = socket$packet(0x11, 0x2, 0x300) close(r0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000001c0)="1b0000001a007f029e741683c28f7b331d00000000390000000000", 0x1b}], 0x1}, 0x24000080) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r2 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) timer_create(0x5, 0x0, &(0x7f0000bbdffc)) socket$packet(0x11, 0x2, 0x300) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @empty}, 0x1c) r5 = epoll_create1(0x0) kcmp$KCMP_EPOLL_TFD(0xffffffffffffffff, 0xffffffffffffffff, 0x7, r3, &(0x7f0000000040)={r5, r0, 0x739}) sendto$inet6(r4, &(0x7f0000000180)="1a", 0x1, 0x0, &(0x7f0000000200)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r4, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$SNDCTL_FM_4OP_ENABLE(r2, 0x4004510f, &(0x7f0000000080)=0x6) r7 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCSETSF(r7, 0x80045440, &(0x7f0000000140)={0xe47, 0x7, 0x2080060f, 0xffffbffe, 0x12, "1c52b4c2e70c0088c84f1f00"}) r8 = socket$tipc(0x1e, 0x5, 0x0) listen(r8, 0x400) listen(r8, 0xf) sendmsg$NFULNL_MSG_CONFIG(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x1c, 0x1, 0x4, 0x201, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFULA_CFG_CMD={0x5, 0x1, 0x3}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000000}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) 14m49.009986498s ago: executing program 3 (id=989): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, 0x0, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000340)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r7, {0x4, 0x5}, {}, {0x7, 0x5}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x4, 0xb, 0x20000000, 0x9, 0x3}}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20048091}, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r9 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r9, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r10, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 14m48.6555565s ago: executing program 2 (id=990): r0 = syz_open_procfs(0x0, &(0x7f0000000b00)='net/rpc\x00') openat(r0, &(0x7f0000001000)='nfsd.fh/channel\x00', 0x2, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x20902, 0x0) socket$kcm(0x2, 0x3, 0x2) write$sequencer(r3, 0x0, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0xa2e42, 0x0) 14m48.580632193s ago: executing program 0 (id=991): request_key(0x0, 0x0, &(0x7f0000000340)='\x8e\x00\x9e\xbb\x1e\x1av\xe8M\x00d\xaaI\x00\x00\x00\x00\x00\x00\t<\xe5u\xedA\xa7\aT\xdd\xd1{\xff\xcb\xdb\xb11\xc2s\xcb\xbf\x04\x00\x00\x00<\xfe\xf9\f\xe6E\b\x00\xd7\x85q\xc4\xab\xbd&\x92\x89(\xf3\"\xceJ\x19\x185\xa6- \xe6uK\xe1D\x8f\x9f\x92\xca\x93#\xf5E\xc2\x91Yl\x17\a\x02\t\x17\x7f\xc4\xde\x04\x9b\x89#\xf6&[\xd81\xb3\xdc\x00\x04\x15\x03\x17R\xd24\xeb\xb5\xc2\xff\x1bnF\x8e\xe4\'\x18\xba9.\xd4\xd9\xc6\x98\x8f\xc6D!p\xbeV\xb7x\r@\x1b5\x8br\x11\xdex\x19\x89\xdc\x1el\xcd\x13\xb6\xc2\xdb\x1fr2\x7f?\xfe\x0f\x04\x11\xc3\x8f:uXQ\x0f\v\xfc\xff\x7fL\xfb\xa8]\xd4\xd7\x13?\xe3<#\x1f\x9a\x03C\x8f\xe7\rV1\x99\xaf@Re\x18J\xb6\xee\xeeAnR\n\x8a\xe4\x1a:&\xc7\x15B\x8aG\xa4\a`\xee\xaf\x80T\xddo\xc4D^z\xbf\x1c\x87F?!k\'\xc3\xf9\xa3\xd9\x85\xb1N%\x17\f\xd0#\x05^\xf7\x11\x13\xadKb\x8ck\x10\xd3 >\t\xe0\x16\x80\x82\xb3\xcc\xc7\x05*\x9b\x0eQ\x92\xd7\xbaO\x06\xb2\xdc\xe7/\x1f\x90]IB94(evFMJ\x85\xc4S\xa8\x8b\xbe\xd3\x90\xe9\t\x00\x13\x1e\x9a\x94\x00\x00\x00\x00\x00U\xfbLA\xa6K\xd5\x0eD\xf2Y\xc3,\t4hD\xc4o\xc3\x87$\x9d6\xc8\x93\xa3\x8e:\xfe#\xa0`\xb1k\xacz\xe0\xb3\x95\x17\xdf\xc7\xc2\xedKc\xa3\xbd\xc2\x9f\x86C(/\xe3\xb2\xc6$s^\xd1vU\x9cB)ao\xf1\'', 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x11, 0x19, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000020000000000000000000000b7080000000000007b8af8ff00000000b7080000040000007b8af0ff", @ANYRES32, @ANYBLOB="0000000000000000b70500000000000085000000a500000018", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) lsetxattr$security_capability(&(0x7f0000000000)='./file1/file2\x00', &(0x7f0000000140), 0x0, 0x0, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000300)={'syztnl2\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x2) sendmsg$IPSET_CMD_SAVE(r2, 0x0, 0x48040) 14m48.339860381s ago: executing program 3 (id=992): r0 = syz_open_pts(0xffffffffffffffff, 0x400000) futex(0x0, 0x85, 0x2000000, 0x0, 0x0, 0xa0090199) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r4) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, r5, 0xba87317d461c07c9, 0x70bd26, 0x4004}, 0x14}, 0x1, 0x0, 0x0, 0x40000c9}, 0x1000) 14m48.338823351s ago: executing program 0 (id=993): modify_ldt$write2(0x11, &(0x7f0000000100)={0x1d30, 0x0, 0x2000, 0x1}, 0x10) syz_socket_connect_nvme_tcp() openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) writev(r0, &(0x7f00000030c0)=[{&(0x7f0000000dc0)="835170544ea9e0aed3b7d1616b996a0ed904d30492796feef8cadd3fec5155ad89eb37381c", 0x25}, {&(0x7f0000000e00)="5701c518df8fd1a67f0f0cfc203d1fdf12cc59894259dcd9589f84da09dd13168ab9d2acc5e983d3359752d6a4eb6aa4fed9a0af88a0f5554133fcd482d509b50cdb6866062b4ab99dd598", 0x4b}, {&(0x7f0000000ec0)="05011a6b1102e8c6dbc8341797959424121ba20eafab1d76af8ed49d19fdff6ca6979963d9a77894cf9eda667d771c1e0bbe49e32610e78ff675ef5e901eb2739c342248f5c0c36813269405dc44559ea496bee54b33e0b56f4ab9b187e9a718595034cc4b95d569e7ddd0e818148fbf4c88510b7d49ef8551537738214e136a8b8e8c7715f335f49d03005259e0b0a2faa9e2e8cd3673462a6b8047508538ec713d75365d9b721ddea4394eeb3ac98a8ee786ead859e19565d405972f6c4203251a0a5c12c167ab5c358cbb", 0xcc}, {&(0x7f0000000fc0)="d49994e4bad08b75d15a3827fa19928fb608366f63717caceb1cb7007af252e20cdd0c4c123c3bdda549a734337efea5d3bdb5d5ba420305df4d402c9663ea9ae570c042c080cc49bd83f4fe943c278468d13add5a35a9d33717839e0443ddaaebe887cc518fe25fc7e5498b0da4b12caeb5612aa53b6633a1f7cc93d67e6452b741aaa78dbd8c2e2a93d63e76f5aaede89ad1e41cd013c0e6d71fb9c8615d3934e590e2db97ba08950c5e8d5c8c33ce936724fa26be87f90ddf36681534588851246b5e01b8715576666a01b313590533f46afe3192aee546fefcccece1bb9412f0444208b0cd896ae8bbe3259f40e75375c620a2995dee39962aede4270013c21332172b9932a07977b6becf15237029731e6fee97e4a2008a2de4ece49c65c54e5a0d144edb21aac5bc67881ae7a8233fd9e1cfe845f1e981b20d3a5fc8b743a8557e01a08acb4f838562461f1ff197e899c5d9e90158a2342dd61a278d899a77f8d01cf01b36ed70f2e090f2f3f72ffddb34acb0b28d50fc87fe49fc3e72487451a12bb12f5c7a1fe8076d61c63058b95c15b990a55309f3c8eed50c89cf00033ddf93c7ee897075abbdd3c661c9dfcc7ff3bb83104fd733e6c50bd3a851da51b1072136a516f083cf94f834e6cb248546b353c27cd9699dfa70def768f7aacab250496472635591b8ae53d588d4ed6325108e9d86367147b9a3fc392f0034dcc6d29dec88e3408c0e630e333b6a9e519fa92c1ece263e7d770818afc5c56ad356073d250a2acd6c0a7435721d88d703c4916bb0c0f9004efe0a52c3e471360bc6c3ba28c9da57be86493ca6a1cbdd5db3b190c3073528841040a9ddf1f38b2ccc5396655fd2b3da5c27efacb74491d1e75b42999c0753a5706dd2e3d5ffd53c4aee70e88d57d6f731bb7c48a1112ffe4a0ce42eb60ea9ba4b7e6b57fcaba118fb1d9685d962d6fdf25c2afd90f2a13ae098153c9a25a1f313b000b1714cb26798d0839de2d83421bff469bc0056073b7c57438869470ebc17a5135c879e0dcf2cd470e0f0a66d3fdb716689e450927bafcf205d25583a744a800fb10ebdba7d4600a849a61b42d0d5152f2f08c26758d7ec9024e696c276f4249766bb8c8f0aafa1629d74458da97f2a1b72b4f9b9d5d18799eb0a5128c938f656f1062f781b46cc4238392ae2bb3223aa93ab37e7fd2c695d1716037181ac6a713db964de0f74de4bc36381acde43df55cc4d1a67aa9bbaeb7a075f5de0be490b8b127c92ecdefba91ebb46cc100cf987ba8bf93faf1d19d6b6da77d888056b1a4500e5ba847c4bac6efa06922e1d929d8a4993933aded40697de7b9703d40c83b7862b69990bfd883173889594d3a3a3f4a9a04a8d9b4581352a33d5bb1f08f0a72e48ca59dca80873e4e366f6c48506d98de05769e4e6641633fa9a352db17df058e453cf5b42960fe696cde6311e47707bee8a39710283b9987d4f2995e0e8d781e2141860f822353bd61a910bed587e32e011d6bd0363de77dde387195d21846a5ec46c251bec0b4e60e2e0778cccdec6f4939e2cd46ac86fab729b5f2e5dd993df13adcfc955e5fa56907fe5ba9daca858b57eb9a1fd1aeaa2fe23e75c8f1b92b7eebeb1d9dff6a4d5cb6855f4bb2813e980577d4aab6a17bb95ca1b5fbc6b2cc2040672d741a09131365fd24212bc11de436d360d0eb4a4228ba26ec66f8e7ed4bf608e7539656a9255f42bc3b83afb18fc50f44d962439c72d0601a68778f37edd947c0c2e0e8d012b06779c5092b95d461565c1d7bf828d9eb27430dd03852ef952867b6c3e780af88c9158ae0ee3f91f3467707f31348889e09632d0b8bd2d56220af49f6591cc9f0e1dff9de92e891d9170a3818c7d499332371f4ae01c3faf3eaa2ee35485e41cbff880e606d5fcda733b4679116489d42d61873edb9c8072d99fd41e10e3b27b47b08f5e659cfb38ea9a60ee3c7bbccd84a37c2159383762641f1c3f7160774b7d4e03cf43144b8dbf454bc4ea47cd9f045face5c2588c05c624bf82e594fa77c7eec5f368a213c0316fd0ee58a302b3e2c94380cc20f0edb84c81d072355101ce82c492bda9e67e5b1b79ef41c5c873143d364ecbb78e04db4c9e6b516b05d739ff89601271332dfaae52c30886658a307292e1507774e2c3601230d1c614bbbb4412bb26961969d8268d124bb9100dcc99151035394c932a31f0a2f2b9ca1c5d843926795907bbf1688b2aca996788be160da6cc31f9e2fa3978176570e33f58b73ef8d7c073a994240f44174f1f1a4a7076703feb28cc35b5d25560a8326f064ba9f8baca26b9e3db228db68e32db1028", 0x67b}], 0x4) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000001440)='./file0\x00', 0x80040, 0x54) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x100) flock(r3, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x60500, 0x0) flock(r4, 0x2) 14m48.299634843s ago: executing program 2 (id=994): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r3, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000000000000000000000000000000000001400020077673100000000000000000000000000f4000880"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1/bmControls\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000380)={@multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x10, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="300000004100010029bd7000040000000100000004004880100001800c00108005000380f300000008000200", @ANYRES32=r6, @ANYBLOB="7a8626162d0aee4ba3de2eba145da6a101007b98416ff0674e458c6b1ed6fb70ba64d1954c8699d568b9"], 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000013c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2e00000099f8941fe980963dca9813da7ec92536434d9d841148d6d96d8263a846696bb39d4ab904562c48f432182855febbfc04ea724b6651b1b0a61b49c6372b49a3badf530e0e33c5a2", @ANYRES16=r3, @ANYBLOB="04002abd7000fbdbdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x11) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000480)={0x0, 0x5, 0x10}, 0xc) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x1}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000000c0)='v', 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r7 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0xa0402) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000040)={0x23, 0x1, 0x14, 0xec, 0x0, 0x7, 0x0}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x4, 0x94, 0xfffffffd, 0x5}, 0x9c) r8 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f0000000f80)="900000001c001f4d154a817193278bff0a80a57802000000e503740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e00a2c5fed0759cb068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0b21a1c69d33e02cdba86c9d2896c013bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000900)}}], 0x1, 0x0) 14m48.217818986s ago: executing program 1 (id=995): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./mydev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mydev/ttyS0\x00', 0x2, 0xe) ioctl$TCSBRKP(r0, 0x5425, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x20080000) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00'}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000280)={0x0, 0x0}) prlimit64(r3, 0xd, &(0x7f0000000340)={0x9}, &(0x7f0000000380)) time(0x0) syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x1, 0x3b2}, &(0x7f0000000100), &(0x7f0000000440), &(0x7f0000000180)) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, 0x0, 0x28000) 14m32.467454901s ago: executing program 32 (id=993): modify_ldt$write2(0x11, &(0x7f0000000100)={0x1d30, 0x0, 0x2000, 0x1}, 0x10) syz_socket_connect_nvme_tcp() openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r0 = syz_open_dev$ttys(0xc, 0x2, 0x1) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x6, 0x7}}]}}]}, 0x48}}, 0x4c840) sendmsg$nl_route_sched(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)=@newtfilter={0x38, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xfff3}, {0x0, 0xfff3}, {0x2, 0xa}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x20005000}, 0x0) writev(r0, &(0x7f00000030c0)=[{&(0x7f0000000dc0)="835170544ea9e0aed3b7d1616b996a0ed904d30492796feef8cadd3fec5155ad89eb37381c", 0x25}, {&(0x7f0000000e00)="5701c518df8fd1a67f0f0cfc203d1fdf12cc59894259dcd9589f84da09dd13168ab9d2acc5e983d3359752d6a4eb6aa4fed9a0af88a0f5554133fcd482d509b50cdb6866062b4ab99dd598", 0x4b}, {&(0x7f0000000ec0)="05011a6b1102e8c6dbc8341797959424121ba20eafab1d76af8ed49d19fdff6ca6979963d9a77894cf9eda667d771c1e0bbe49e32610e78ff675ef5e901eb2739c342248f5c0c36813269405dc44559ea496bee54b33e0b56f4ab9b187e9a718595034cc4b95d569e7ddd0e818148fbf4c88510b7d49ef8551537738214e136a8b8e8c7715f335f49d03005259e0b0a2faa9e2e8cd3673462a6b8047508538ec713d75365d9b721ddea4394eeb3ac98a8ee786ead859e19565d405972f6c4203251a0a5c12c167ab5c358cbb", 0xcc}, {&(0x7f0000000fc0)="d49994e4bad08b75d15a3827fa19928fb608366f63717caceb1cb7007af252e20cdd0c4c123c3bdda549a734337efea5d3bdb5d5ba420305df4d402c9663ea9ae570c042c080cc49bd83f4fe943c278468d13add5a35a9d33717839e0443ddaaebe887cc518fe25fc7e5498b0da4b12caeb5612aa53b6633a1f7cc93d67e6452b741aaa78dbd8c2e2a93d63e76f5aaede89ad1e41cd013c0e6d71fb9c8615d3934e590e2db97ba08950c5e8d5c8c33ce936724fa26be87f90ddf36681534588851246b5e01b8715576666a01b313590533f46afe3192aee546fefcccece1bb9412f0444208b0cd896ae8bbe3259f40e75375c620a2995dee39962aede4270013c21332172b9932a07977b6becf15237029731e6fee97e4a2008a2de4ece49c65c54e5a0d144edb21aac5bc67881ae7a8233fd9e1cfe845f1e981b20d3a5fc8b743a8557e01a08acb4f838562461f1ff197e899c5d9e90158a2342dd61a278d899a77f8d01cf01b36ed70f2e090f2f3f72ffddb34acb0b28d50fc87fe49fc3e72487451a12bb12f5c7a1fe8076d61c63058b95c15b990a55309f3c8eed50c89cf00033ddf93c7ee897075abbdd3c661c9dfcc7ff3bb83104fd733e6c50bd3a851da51b1072136a516f083cf94f834e6cb248546b353c27cd9699dfa70def768f7aacab250496472635591b8ae53d588d4ed6325108e9d86367147b9a3fc392f0034dcc6d29dec88e3408c0e630e333b6a9e519fa92c1ece263e7d770818afc5c56ad356073d250a2acd6c0a7435721d88d703c4916bb0c0f9004efe0a52c3e471360bc6c3ba28c9da57be86493ca6a1cbdd5db3b190c3073528841040a9ddf1f38b2ccc5396655fd2b3da5c27efacb74491d1e75b42999c0753a5706dd2e3d5ffd53c4aee70e88d57d6f731bb7c48a1112ffe4a0ce42eb60ea9ba4b7e6b57fcaba118fb1d9685d962d6fdf25c2afd90f2a13ae098153c9a25a1f313b000b1714cb26798d0839de2d83421bff469bc0056073b7c57438869470ebc17a5135c879e0dcf2cd470e0f0a66d3fdb716689e450927bafcf205d25583a744a800fb10ebdba7d4600a849a61b42d0d5152f2f08c26758d7ec9024e696c276f4249766bb8c8f0aafa1629d74458da97f2a1b72b4f9b9d5d18799eb0a5128c938f656f1062f781b46cc4238392ae2bb3223aa93ab37e7fd2c695d1716037181ac6a713db964de0f74de4bc36381acde43df55cc4d1a67aa9bbaeb7a075f5de0be490b8b127c92ecdefba91ebb46cc100cf987ba8bf93faf1d19d6b6da77d888056b1a4500e5ba847c4bac6efa06922e1d929d8a4993933aded40697de7b9703d40c83b7862b69990bfd883173889594d3a3a3f4a9a04a8d9b4581352a33d5bb1f08f0a72e48ca59dca80873e4e366f6c48506d98de05769e4e6641633fa9a352db17df058e453cf5b42960fe696cde6311e47707bee8a39710283b9987d4f2995e0e8d781e2141860f822353bd61a910bed587e32e011d6bd0363de77dde387195d21846a5ec46c251bec0b4e60e2e0778cccdec6f4939e2cd46ac86fab729b5f2e5dd993df13adcfc955e5fa56907fe5ba9daca858b57eb9a1fd1aeaa2fe23e75c8f1b92b7eebeb1d9dff6a4d5cb6855f4bb2813e980577d4aab6a17bb95ca1b5fbc6b2cc2040672d741a09131365fd24212bc11de436d360d0eb4a4228ba26ec66f8e7ed4bf608e7539656a9255f42bc3b83afb18fc50f44d962439c72d0601a68778f37edd947c0c2e0e8d012b06779c5092b95d461565c1d7bf828d9eb27430dd03852ef952867b6c3e780af88c9158ae0ee3f91f3467707f31348889e09632d0b8bd2d56220af49f6591cc9f0e1dff9de92e891d9170a3818c7d499332371f4ae01c3faf3eaa2ee35485e41cbff880e606d5fcda733b4679116489d42d61873edb9c8072d99fd41e10e3b27b47b08f5e659cfb38ea9a60ee3c7bbccd84a37c2159383762641f1c3f7160774b7d4e03cf43144b8dbf454bc4ea47cd9f045face5c2588c05c624bf82e594fa77c7eec5f368a213c0316fd0ee58a302b3e2c94380cc20f0edb84c81d072355101ce82c492bda9e67e5b1b79ef41c5c873143d364ecbb78e04db4c9e6b516b05d739ff89601271332dfaae52c30886658a307292e1507774e2c3601230d1c614bbbb4412bb26961969d8268d124bb9100dcc99151035394c932a31f0a2f2b9ca1c5d843926795907bbf1688b2aca996788be160da6cc31f9e2fa3978176570e33f58b73ef8d7c073a994240f44174f1f1a4a7076703feb28cc35b5d25560a8326f064ba9f8baca26b9e3db228db68e32db1028", 0x67b}], 0x4) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000000)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') openat(0xffffffffffffff9c, &(0x7f0000001440)='./file0\x00', 0x80040, 0x54) r3 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x100) flock(r3, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x60500, 0x0) flock(r4, 0x2) 14m32.431842462s ago: executing program 33 (id=995): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./mydev\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./mydev\x00', &(0x7f0000000300)='devtmpfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./mydev/ttyS0\x00', 0x2, 0xe) ioctl$TCSBRKP(r0, 0x5425, 0x0) sendmsg$IEEE802154_LLSEC_DEL_DEVKEY(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x20080000) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r2 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000005f00)={'wlan0\x00'}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f0000000280)={0x0, 0x0}) prlimit64(r3, 0xd, &(0x7f0000000340)={0x9}, &(0x7f0000000380)) time(0x0) syz_io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xfffffffe, 0x2, 0x1, 0x3b2}, &(0x7f0000000100), &(0x7f0000000440), &(0x7f0000000180)) sendmsg$NL80211_CMD_TRIGGER_SCAN(r1, 0x0, 0x28000) 14m32.246542809s ago: executing program 34 (id=994): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000007c0)=ANY=[@ANYBLOB="40010000", @ANYRES16=r3, @ANYBLOB="01000000000004000000010000002400030000000000000000000000000000000000000000000000000000000000000000001400020077673100000000000000000000000000f4000880"], 0x140}, 0x1, 0x0, 0x0, 0x8000}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./config\x00', 0x1c0) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000002c0)='./config/usb_gadget/g1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./config/usb_gadget/g1/functions/uvc.usb0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1\x00', 0x1c0) openat(0xffffffffffffff9c, &(0x7f00000003c0)='./config/usb_gadget/g1/functions/uvc.usb0/control/extensions/xu1/bmControls\x00', 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r1, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) setsockopt$inet_mreqsrc(r1, 0x0, 0x26, &(0x7f0000000380)={@multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @remote}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x10, 0x0, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x11, '\x00', r4, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="300000004100010029bd7000040000000100000004004880100001800c00108005000380f300000008000200", @ANYRES32=r6, @ANYBLOB="7a8626162d0aee4ba3de2eba145da6a101007b98416ff0674e458c6b1ed6fb70ba64d1954c8699d568b9"], 0x30}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094) sendmsg$WG_CMD_SET_DEVICE(r1, &(0x7f0000001400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f00000013c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="2e00000099f8941fe980963dca9813da7ec92536434d9d841148d6d96d8263a846696bb39d4ab904562c48f432182855febbfc04ea724b6651b1b0a61b49c6372b49a3badf530e0e33c5a2", @ANYRES16=r3, @ANYBLOB="04002abd7000fbdbdf2501000000"], 0x14}, 0x1, 0x0, 0x0, 0x4000}, 0x11) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000480)={0x0, 0x5, 0x10}, 0xc) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x1}, 0x1c, &(0x7f0000000180)=[{&(0x7f00000000c0)='v', 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) r7 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0xa0402) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000040)={0x23, 0x1, 0x14, 0xec, 0x0, 0x7, 0x0}) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf06, 0x4, 0x94, 0xfffffffd, 0x5}, 0x9c) r8 = socket$inet6(0x10, 0x3, 0x0) sendto$inet6(r8, &(0x7f0000000f80)="900000001c001f4d154a817193278bff0a80a57802000000e503740014000100ac1414bb0542d6401051a2d708f37ac8da1a297e00a2c5fed0759cb068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000760700c0b21a1c69d33e02cdba86c9d2896c013bca2d0000000b0015009e49a6560641263da4de1df32c1739d7fbee9aa241731ae9e0b390", 0x90, 0x0, 0x0, 0x0) sendmmsg$inet6(r0, &(0x7f0000000340)=[{{0x0, 0x0, &(0x7f0000000900)}}], 0x1, 0x0) 14m32.167013201s ago: executing program 35 (id=992): r0 = syz_open_pts(0xffffffffffffffff, 0x400000) futex(0x0, 0x85, 0x2000000, 0x0, 0x0, 0xa0090199) ioctl$TIOCMBIC(r0, 0x5417, &(0x7f0000000000)=0x8) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r4) sendmsg$IEEE802154_LLSEC_LIST_DEVKEY(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x14, r5, 0xba87317d461c07c9, 0x70bd26, 0x4004}, 0x14}, 0x1, 0x0, 0x0, 0x40000c9}, 0x1000) 7m30.833731248s ago: executing program 6 (id=1866): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x4, 0xffff2153, 0x2, 0xa, 0xd, 0x1c4, 0x7, 0x2, 0x6}}}}]}, 0x58}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x6, 0xc, 0x0, &(0x7f00000002c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r6, 0x0, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x149540, 0x0) close(r7) socket$nl_route(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000000)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x3}}) r8 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r8, &(0x7f00000001c0)={&(0x7f0000000840)=@xdp={0x2c, 0x7, r9, 0x31}, 0x80, &(0x7f00000000c0)=[{&(0x7f00000002c0)='\x00', 0x5dc}], 0x1}, 0x4) 7m29.924322829s ago: executing program 6 (id=1870): r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0xffffffff, 0x2, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100", 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00'}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r4, 0x890c, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001800dd8d0000c6b00000df2502100000fc00fe070015000006001500060000000c0016800500040002000000"], 0x30}}, 0x40044) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) ptrace$ARCH_GET_FS(0x1e, r1, &(0x7f0000000180), 0x1003) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r7}) 7m16.374391577s ago: executing program 6 (id=1887): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = timerfd_create(0x0, 0x800) syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) getsockopt$inet_mptcp_buf(r2, 0x11c, 0x1, &(0x7f0000000100)=""/32, &(0x7f0000000140)=0x20) r3 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r3, 0x3b88, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000280)={0x1f, 0xfffffffffffffffe, 0xe, 0x400, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, 0x0, 0x0) read$dsp(0xffffffffffffffff, &(0x7f0000000280)=""/79, 0x4f) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$inet(0x2, 0x3, 0x5) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f00000004c0)={0x0, @private, @loopback}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_LINENO={0x8, 0x9, 0x1, 0x0, 0x1}, @IPSET_ATTR_ADT={0x14, 0x8, 0x0, 0x1, [{0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_ETHER={0xa, 0x11, @local}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) timerfd_settime(r2, 0x3, &(0x7f0000000200), 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 7m15.349540123s ago: executing program 6 (id=1888): r0 = socket(0xa, 0x3, 0x3a) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x490000, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f00000002c0)={0x2, 0x28, 0xfa12, {0x0, {0xa, 0x4e23, 0xfffffffd, @loopback, 0x4}}}, 0x30) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000a80)={0x13, 0x10, 0xfa00, {&(0x7f0000000880)}}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x175a978679bbbe1d, 0x80a0a1240160183d) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c80)=ANY=[@ANYRES32=r3, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="0000000000c7003a00000000000000"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r4}, 0x4) open$dir(0x0, 0x40000, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b80)={0x94, 0x9, 0x6, 0x401, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x6c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x9, 0x1a, 'syz1\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR2={0x5, 0x15, 0xe}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}}}, {0x18, 0x7, 0x0, 0x1, @IPSET_ATTR_IFACE={0x14, 0x17, 'pim6reg1\x00'}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x10004017}, 0x81) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x10000, @loopback, 0x1}, 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3a, &(0x7f0000000280)=0x3ff, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000000406030000000000000000000000000005000100070000008b434b420557e3bc2663192cab715837"], 0x1c}}, 0x40000) r6 = openat$vicodec0(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0185647, &(0x7f0000000100)={0x9b0000, 0x5, 0x3, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x98f90d, 0xffffffff, '\x00', @value64=0x2}}) mount(0x0, &(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000000)='tmpfs\x00', 0x2000008, &(0x7f0000000300)='usrquota') 7m12.167187006s ago: executing program 6 (id=1894): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) r2 = syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r2, 0xc018643a, &(0x7f0000000140)={0x1}) r3 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000200)={0x2, 0x0, &(0x7f0000000300)=[0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r3, 0xc04064aa, &(0x7f00000003c0)={&(0x7f0000001280), 0x0, r4, 0x0, '\x00', 0x1ffffffffffffd64, 0x3f}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r3, 0xc01864b0, &(0x7f0000000680)={r4, r4, 0xd, 0x0, 0x3}) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x4e22, 0x0, @loopback}, 0x58) listen(r5, 0x5) syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendto$inet6(r5, &(0x7f0000000400)="47e699d91fe0fe5945e1cbd2b1cbcb09e42a9d4e75d9f49e77086cb3a1c2180d9d32e5530a7744623ac8486f38e8fa5ae66b7f46b9e37c7d1cb3b42f6ac6c1d109f743d42ac5856049d882b22ef194bd88f9e6e2329d3588e3b776a1bd9c4555788adb5243de4ff36e2851f4b05f3893b02424", 0x73, 0x11, 0x0, 0x0) r8 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) bind$tipc(r6, 0x0, 0x0) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r8, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1004) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f0000001540)={0xffffffffffffffff, 0x9, {0x0, 0x0, 0x0, 0xbb, 0x1b99, 0x0, 0x3, 0x4, 0x13, "b7f8ada941fbfa24b230324b3122fe227031c9fb2622e97099e554942542690fb0219cbefea4d3a5c75b831367cbd848f5a1b04aff3568c826ed63af1057abf6", "e5774ce57e1395c66549c09e1a753713979872f8b081a61f3a2ce683ee7b6ead66b72f1365216f05a2ea09d6cd61fc85ebf757186da4d22874517bf0100dd87b", "8cbcf6468f994f1274302174ba4d9ee37a68f48b1ba174b75fe8178e0debfa0a", [0x80000000, 0xb52]}}) 7m6.775061655s ago: executing program 6 (id=1898): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x20008, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc044560f, &(0x7f0000000380)=@mmap={0x0, 0x1, 0x4, 0x2, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "37bb54f0"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) 6m50.327378665s ago: executing program 36 (id=1898): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x80a4d1, 0x2) close(0xffffffffffffffff) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x20008, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() syz_emit_ethernet(0x46, &(0x7f0000000400)=ANY=[@ANYBLOB], 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x2, 0x1, 0x1}) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc044560f, &(0x7f0000000380)=@mmap={0x0, 0x1, 0x4, 0x2, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "37bb54f0"}}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000100)=0x1) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x402, 0x8001, 0xfffa}, 0x3a, [0x8000, 0x401, 0xf, 0x8, 0x89, 0x2, 0x6, 0x7f, 0xfffffffa, 0x4d, 0x6, 0x5f, 0x9, 0x15, 0xffff2d37, 0xff7fff01, 0x6, 0x5, 0x7, 0x5, 0xdb, 0x0, 0x7, 0x6, 0x1, 0x24, 0x10, 0x5, 0x0, 0xffffffff, 0x10, 0x80, 0x207, 0x20003, 0x8, 0x4c76, 0x10000, 0x242, 0x3, 0xe, 0x4, 0x80008071, 0x7fc, 0x17, 0x0, 0x7, 0x5, 0x3e, 0x18e, 0x200006, 0x4, 0x454f, 0x6, 0x80004, 0x8, 0x3ff, 0x80, 0x0, 0x0, 0x0, 0x8, 0x8000, 0x1, 0x40], [0x10000004, 0x9, 0x8000012f, 0x8004, 0x8, 0xffffbff3, 0x129432f6, 0xc8, 0xc9, 0xe, 0x2bf, 0x6c7, 0x1, 0xfffffffc, 0x5, 0x2, 0x0, 0x9, 0x2f, 0xe, 0x1, 0x66abcbd2, 0xea4, 0x8, 0x4, 0x7, 0x7ffb, 0x6, 0x500, 0x401, 0x10001, 0x1, 0xff, 0x15, 0xfffff572, 0x5f31, 0xd, 0x4e0, 0x381, 0x4, 0xb, 0x4, 0x9, 0x8, 0x5, 0xd, 0xfffff256, 0x2, 0x1, 0xfdfffffd, 0x8, 0x2, 0x4, 0x9, 0x3, 0x3, 0x4000009, 0x6, 0x0, 0x3, 0xfffffffc, 0x48c93690, 0xe79, 0x3], [0x7, 0x408, 0x4, 0x5, 0xfffffffd, 0x4, 0x4, 0xb, 0x6, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x80, 0xfffffffd, 0x1ef, 0x5, 0x28, 0x86, 0x3, 0x3039, 0xfffffffa, 0xb, 0x0, 0xffffffff, 0x2, 0x400003, 0x6, 0x4, 0x6d01, 0xb, 0x34, 0x800003, 0x200, 0x83, 0xffffffff, 0x5, 0x2950bfaf, 0x1000, 0xa2, 0x4, 0x1000, 0x5, 0xb1, 0xac8, 0xbf, 0x50, 0x3, 0x7ff, 0x12b, 0x2, 0x1, 0xa, 0xb3e, 0x5, 0x1c, 0x8, 0x2008077f, 0x2006, 0x7, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0xb, 0x5, 0x2000004, 0xffff, 0x6, 0x80000000, 0xb9, 0xce4, 0x10001fc, 0x10002, 0x4184, 0x5, 0x3, 0x0, 0x10000, 0x4, 0x7fff, 0xfffe, 0xa620, 0x1, 0x5, 0x1, 0x6, 0x14c, 0x60a7, 0x6, 0xa, 0xffffffff, 0x80000000, 0x5, 0x5, 0xc8, 0x1, 0xfffff000, 0xffff, 0x0, 0x7e, 0x100, 0x1622, 0x7, 0x200af, 0x20000008, 0x5, 0x226, 0x3, 0x5, 0x0, 0x30b1d693, 0xfffff4f0, 0x4, 0x7, 0x7, 0x6c1b, 0x0, 0x4, 0x5, 0x803, 0xd7, 0x200, 0x30, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) prctl$PR_GET_FPEMU(0x9, &(0x7f0000000040)) socket$nl_netfilter(0x10, 0x3, 0xc) 7.868414686s ago: executing program 8 (id=3234): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 7.73638336s ago: executing program 4 (id=3236): socket$vsock_stream(0x28, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x11e) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/msr/parameters/allow_writes\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='on\x00', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/cpu/0/msr\x00', 0x2, 0x0) pwrite64(r3, &(0x7f0000000200), 0x0, 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/cpu/1/msr\x00', 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0) write(r5, &(0x7f0000000180)='0', 0x1) pwrite64(r4, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00', 0x7, 0x1a0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000003c0)=[@in6={0xa, 0x4e20, 0x2, @mcast2, 0x62d}]}, &(0x7f0000000100)=0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="300000001000010800"/19, @ANYRES32=0x0], 0x30}}, 0x0) socket$kcm(0x2, 0x3, 0x2) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x5e5e, 0xc00, 0x1, 0x11}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) 7.666316451s ago: executing program 8 (id=3237): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2", 0x95}, {0x0}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e6", 0xae}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae", 0x39}], 0x4, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) ioctl$KVM_RUN(r5, 0xae80, 0x0) 7.224308382s ago: executing program 4 (id=3238): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = timerfd_create(0x0, 0x800) syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) getsockopt$inet_mptcp_buf(r2, 0x11c, 0x1, &(0x7f0000000100)=""/32, &(0x7f0000000140)=0x20) r3 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r3, 0x3b88, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000280)={0x1f, 0xfffffffffffffffe, 0xe, 0x400, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, 0x0, 0x0) read$dsp(0xffffffffffffffff, &(0x7f0000000280)=""/79, 0x4f) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$inet(0x2, 0x3, 0x5) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f00000004c0)={0x0, @private, @loopback}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) timerfd_settime(r2, 0x3, &(0x7f0000000200), 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 7.149449974s ago: executing program 7 (id=3239): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x46002, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f00000001c0)='bfs\x00', 0x8000, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000080)='./file0\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f0000000100)='./control\x00') r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x6, 0x4, 0x3, 0x7}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007baaf8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x2000300, 0xe, 0x0, &(0x7f0000000040)="4a57b01363c58aeced8ef9ff3f0a", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r2) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x40, r5, 0x1, 0x0, 0x4, {0x3, 0x74, 0x600}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ip6gre0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x7}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0x40}, 0x1, 0xffffffff00000003}, 0x0) timer_create(0x9, &(0x7f0000000180)={0x0, 0x4, 0x1, @thr={0x0, 0x0}}, &(0x7f00000001c0)=0x0) timer_settime(r6, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0) timer_gettime(0x0, &(0x7f0000000040)) r7 = openat$btrfs_control(0xffffff9c, &(0x7f0000000040), 0x301000, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r7, 0xaea2, 0x795c) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000080)) 7.117492895s ago: executing program 8 (id=3240): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2", 0x95}, {&(0x7f0000000ac0)="3fe4", 0x2}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e6", 0xae}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae", 0x39}], 0x4, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 6.961646888s ago: executing program 5 (id=3241): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./bus\x00', 0x300f401, 0x0, 0x2, 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, 0x0) chdir(&(0x7f00000003c0)='./bus\x00') open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x81800) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f0000000600)={0x18b704efda9c5c41, 0xa0, 0x10}, 0x18) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x1, 0x2, 0x4, 0x3, 0xff, 0x1, 0x4, 0xb6, 0x4, 0x2, 0x2, 0x65, 0xf1}, 0xe) r1 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @empty}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x50103}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) syz_emit_ethernet(0x46, &(0x7f0000000000)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x4, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "00186371ae9b1c03"}}}}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000005980)=@delchain={0xe0, 0x65, 0x400, 0x70bd26, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xfff1, 0xffe0}, {0x5, 0xb}, {0x0, 0xb}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xe, 0x1}}]}}, @filter_kind_options=@f_matchall={{0xd}, {0x94, 0x2, [@TCA_MATCHALL_ACT={0x90, 0x2, [@m_sample={0x30, 0x17, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc}}}, @m_ct={0x2c, 0x1, 0x0, 0x0, {{0x7}, {0x4}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x2}}}}, @m_police={0x30, 0x9, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}]}]}}]}, 0xe0}, 0x1, 0x0, 0x0, 0x20008000}, 0x4000) getsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r0, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x481a3fb, 0x20}, &(0x7f0000000280)=0xc) r4 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x1, &(0x7f0000000480)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 6.958442388s ago: executing program 7 (id=3242): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPERTY(0xffffffffffffffff, 0xc04064aa, &(0x7f00000003c0)={&(0x7f0000001280), 0x0, 0x0, 0x0, '\x00', 0x1ffffffffffffd64, 0x3f}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000680)={0x0, 0x0, 0xd, 0x0, 0x3}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) sendto$inet6(r2, &(0x7f0000000400)="47e699d91fe0fe5945e1cbd2b1cbcb09e42a9d4e75d9f49e77086cb3a1c2180d9d32e5530a7744623ac8486f38e8fa5ae66b7f46b9e37c7d1cb3b42f6ac6c1d109f743d42ac5856049d882b22ef194bd88f9e6e2329d3588e3b776a1bd9c4555788adb5243de4ff36e2851f4b05f3893b02424", 0x73, 0x11, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r3, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1004) 5.071533735s ago: executing program 4 (id=3243): ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x7fff, 0x1, 0x4, 0x9, 0xa0, 0xffb, 0x2, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0x8, 0x9, 0x3, 0x3, 0x1, 0xfffffffc, 0x0, 0x6, 0x9, 0x4, 0x7, 0x5, 0x100000, 0x762, 0x3, 0xd, 0xe, 0x2b12, 0x240d43ee, 0x6, 0x1c00, 0xb, 0x7, 0xbed4, 0x8, 0x8000100, 0x3, 0x8, 0x11000, 0x80000000, 0xbab4, 0x79b, 0x2, 0x1, 0x7f, 0x3, 0x2, 0x7, 0x8000, 0x101, 0xd7, 0x1fa0860a, 0x7, 0xae, 0x7f, 0x8, 0x180000, 0x4007, 0x8b, 0x5, 0x2b3, 0xf7, 0x5, 0xfffffffe, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x8, 0x753, 0x0, 0x1005, 0x80005, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x488b, 0x84, 0x100, 0x10, 0x252, 0x81, 0xb, 0x5, 0x20006, 0x5, 0x2, 0xb, 0x2, 0xdda, 0xd, 0x29e, 0xfffffffd, 0x2, 0x2, 0x5, 0x8, 0x0, 0x7fff, 0x2, 0x3f, 0x8, 0xcb, 0x3, 0x400, 0x66cd, 0x8, 0x8, 0x1, 0x1fc, 0xc5c, 0xffffffff]}}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff274140000001100"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0xa, 0x2) socket$inet_sctp(0x2, 0x5, 0x84) r1 = socket(0x2, 0x80805, 0x0) recvmsg$kcm(r1, &(0x7f0000000100)={&(0x7f0000000200)=@pppol2tp, 0x80, &(0x7f0000002700)=[{&(0x7f0000000280)=""/60, 0x3c}, {&(0x7f00000002c0)=""/115, 0x73}, {&(0x7f0000000440)=""/4096, 0x1000}, {&(0x7f0000001440)=""/138, 0x8a}, {&(0x7f0000002840)=""/248, 0xf8}, {&(0x7f0000001600)=""/235, 0xeb}, {&(0x7f0000001700)=""/4096, 0x1000}], 0x7, &(0x7f0000002740)=""/243, 0xf3}, 0x3dfdbfbdd7a869e0) r2 = socket(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) setsockopt$MRT6_ADD_MIF(r2, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) statx(0xffffffffffffffff, 0x0, 0x1000, 0xf0cb2f4a0c2cfc5d, 0x0) setsockopt$MRT6_FLUSH(r2, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x4) mkdir(&(0x7f0000000240)='./file1\x00', 0x8) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000002780)=ANY=[@ANYBLOB="640000000206010800000000000000000100000a16000300686173683a6e65742c706f72742c6e6574000000050001"], 0x64}, 0x1, 0x0, 0x0, 0x2006c0c4}, 0x0) 5.070951365s ago: executing program 7 (id=3244): sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000058c0)=[{{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000002c0)="a8d81e6d947d922587e5abd7a547dd11ec10b1c149e49cdd3a3acce0e471282c8b594920aca050647626d317dc6c38dc493cb80ae55dbb9e00d8376a96cab883ecd9c634e8f1965a11ae4e9ba062368bf6b8c3424d469dbb24c7919f332e637a015802cb8739f82185ed1bf0c2f1a2a0c59942596f4fd386adeab9b2683beaca798e3ee69e0a6d239098c745305d21b9293483dfdbcd94277f7a08f414e77a78001546e1449a889cbef622f3874183060c884ea7e3abca8d3fed20b5013cdeb7f7dc474909ecfd57a1d4c7fe05129fb45468e681e3bc744e43ef5ffa40e4ac7ee8332cafa8b254079bc94711f6090b3c65d0d79208f463dd3b16242cc1c15249b3e42c624749049179fd397ee1daf5e5b907b6fec63b1aa2be29320af21a37e729c0445b4bfa5d338495804dfab92a2e973104c7bed5a24e0bdfb4846036d623e173269b722c9ccd93b8c9682c3cdf0e1b806b5b00ede878c698663d851dfba23d9abfca0140f167ef1b9cd0e1e49fc0eb6bdc46f4fdf381d55b3d6185361afc9cfebc3f98af4524fec4d5277bf6134a2a473932947f2051b7ca196b8b9931c14b04c34f309efecb1bbdc563497e7e66847057967363411c2f720df3a0ed530abbaa72d4b8d2aeecab950759c47057d7cc26c7d939191908d0426fa7d9abd51fabc26324575bee2848486f3736bbd3714f07ac559a918c06f31c391cba5b6cbd4e7316f68e45e421001b5b002520c769be330de8e7d86bc218d4562f6a86167eb0bf35ed70478200b58d420db3d4f6408ed160c36d6e92a085212394d5507243aff5ba8fc1be49eff3fe050cf4dbf033385b751d3fe87001cf608583d3394e87e73aedffd99312705e726f0b85622fe7b3ef5b08ae9e1e2ca1bcfc804209102a1a358c88e6456169a7a9731acebe1264385509a19d534e45fc352e6cf1347aff24f17c21242ada32ff0565bacec22528790f461195cd5a2293ac5df991acf980be873cded06b84c6094a62cfe5438d19a4fe04e1238c595bd764477094ae3ad1660a0d65e3a63ca9a197879f05fb64fe542ea13ef2ec836ea2513c841fb133d38696e9f1f0222e4afc160fc05d3e6279469c1af9a158d3240e20d15d3d03d8be46067c17d4e42f0d97e0d25b410a3a6be7964119aae495c6ef148882f15f52df74bb810876c2762d69cc331a9de08dd8138787c283249c8406172bc6cd4625a31865bdbc674379e9ff08de675dc91f088f9d38b33bf335d199907d6225bc4958a7f74aa6030cd1a3c1220af6396d37a85c1efc4b5d88936d485c2dd350a4e1f4d75ff07bce3920e1fec69d5ba8d142957f8f4d7c0e0da2a0ca6643ebd8c96562c238d9485287354a3e307d3edd316de5ec9bcd31dbc3ec5a2247ace805ff3f2a18603d9c9169b1571fac8cc267a7f965189f3da1e504f7f373ba03133936bcb003187ed2ddf1b89e2c68b485029d18b744dd2d5d55313f5ebd0909afaeb0481d23b970d3cb50457eb9157a95cd94dba4e50de0b530edec00500688ab06162ae52d4abb9974980dde0e5f4cbf3dc4d0a2e720101b9a02c86a49a2e8ee760a9edb4b2a7d160867459c9f611850e795b0e4d6254da594d30591bd553748ed7447cfc8c58aa9fbbdf3ea5fdb9d30361cfdd82a08bbb71595ac56c4e5b6df47abb0e79e16adbd0aa678876b4e6822af40d81a4f4c7d2f633e3aef4184497194f75929cf6c8f260f217d00123a71c94d07b018511d4188e671b4d6063ab0bf48ee5c871a7824b3763d2c940396627aa61863787f2102daefdfafae8d4e197ef7e1a61d5695c062cbbf36f7f8d975d1d65e5f36bf4a2a149f37144b4b89614632fc1ed73f81bbfdc8d9f849a920d9eff33ccaed1c279a945f25ab1ce301860e44086642aef273c45b6d978d97d8a68da76b157e14cf88ae85f807b0304ae36b7170975738d012003ec94dc4805963462cd883e47766231f6edb8b54bd70bf5554bf53f6ea533d228ac4e19c7290b1795328df2f6609de358e9183e3ffe75d8e9088fb7193ab10327a8cc31523f8ff54c0d583c46e26d931e2a62a7e9e97153668d4e4f17f0d09e472dc2739f81feba73bb4ffe9c60820ca1945f316918f9c9785976058109cc44494b71475f91131ea2c7f96b8a516c4813c0aaa75f03169b31f870c3bd76f9cd01410c0ad742ba9c150397626ada311cf6f6d60015d3cc44e9b3bc0216f99927d9cd581527bc8c83e789fe10a720cb297c0b5331a915508dfee3266e24d59c32cfd117ccbc970c4edb63d6d7fe1ec9359c853610a489aebdfc4631b189793a1669f3d963318e5d0e6098928dc34662d67317d270ace8a0911f775f6a69de83aef6fb35a446a37058cea30633904ca086e0f77c431a3fa3cb88f7d0e0d7922a353ce9c7091424ba79a52612be292a3c7ab3542f60db70ce6755e5eb0cfeeec3ce2982843cae0b7e7fccb19b8bb16ccb39db8786ee58f3068d91b8283c7af51b21c880d2f52f12ec0d2b483708a60cb53dada400ed95bb0f07996dd6734cf53d4ce28b49116c3595318f4f8a25c88559eff0e4fff0231be9d3eb8a96346933dc921f1ec6e733bcf0512554c54123fb02178ee50ab888d2c87112dd426fc8396bf28d5ed4937b1f3d0aef752aae6034f34b30bacbf0919e2eebbce5d5ac314a24e5f18fe4b59e4be6cc13d239adb62c2a8419db389e1bd792c02e32760675ef063f64129c7d02ba879fc4ec16212ce387c9a141acf3e46f0464a955072122b778e64dba6055b094987e323a5fc23dc02d1294bd54ca0dc26b6180beab864b3a5a40675820776661b52124de2432836110baabd247c013b9f0c3cbc1f0fa30e54ef3e619915e07640a9bb01fbb2ead18d8741ad0cf02e3a4fbd505baff5033671fece669d5532d15b04b14e19a1d65ba884b67453322fadd98fbcedd9e9216a913a11dc3689f7211c65d8f2b8932a4fb307e366e403ff03d7678ba9b5a464ae03f5b63002c6a599bf16b490c48ccc134718fb337f633a681aa7f036048d8255a02049c3cc593335c3a33ef4458308672671becd7900a996a80d07fdfe450a75f43f45161f0605a985b8a4a1c432d273108723ab754458263387672fb5a4b06c92647aab90e699ae0adefd8702d054febfd057b83cb14ef6f5294c473fbd94b67d687067e2086485ad0cc0a133c7edcae10dd5849c8dd600702c49874489e11070007a5e1868e639402cf76c2058136e17c2feb526cbb8dab2f839380f082b0d74e155dd1d9e337ae1e90fb1879288a7fd1d33105daa0d3eb7d0630fffe98fc2978a1ddeb81e13e694d65bd5a69400ee1d2ff28a4b1c18288af5815b7680427c01d090f09636f52ec3aa1b0e1940053002decff63edb22558a38ac91f8f95c20e71541b0c4952793bb339be8d86016d7f49f2e98c3ce8af1d2015ce8588c1745314762ab3bec3b799bbb6253511084bb976d2d95c2a894313196e578c8c1b56933395c11f4acf54cf6e17fbada9ba700a04570266a9a007b9dc5ad5be2c6e4f64d1ee9560496950d62b66770e11b20565fbe0624f0c3c5deb1b0efe7019b25dd2dd74ffe4b6db87e796d7b0be95657198d0a15942e", 0x9f6}], 0x1}}], 0x1, 0x40080) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 5.023855167s ago: executing program 8 (id=3245): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0x5, 0x5, 0x9fd, 0x84}, 0x48) syz_kvm_setup_cpu$x86(r1, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x14, 0x0, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x5, 0x20, 0x3, 0x2, 0x106c, 0x100, 0x8000000000000001, 0x80000004000080, 0x80000001, 0x8, 0x8, 0x8, 0x0, 0x45], 0x26000, 0x3c0251}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.146540433s ago: executing program 5 (id=3246): socket$vsock_stream(0x28, 0x1, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x11e) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000040)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/module/msr/parameters/allow_writes\x00', 0x2, 0x0) write(r2, &(0x7f0000000340)='on\x00', 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./dev/cpu/0/msr\x00', 0x2, 0x0) pwrite64(r3, &(0x7f0000000200), 0x0, 0x9) r4 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./dev/cpu/1/msr\x00', 0x2, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./sys/devices/system/cpu/cpu1/online\x00', 0x2, 0x0) write(r5, &(0x7f0000000180)='0', 0x1) pwrite64(r4, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00', 0x7, 0x1a0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000003c0)=[@in6={0xa, 0x4e20, 0x2, @mcast2, 0x62d}]}, &(0x7f0000000100)=0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=ANY=[@ANYBLOB="300000001000010800"/19, @ANYRES32=0x0], 0x30}}, 0x0) socket$kcm(0x2, 0x3, 0x2) syz_io_uring_setup(0x34b8, &(0x7f0000000540)={0x0, 0x5e5e, 0xc00, 0x1, 0x11}, &(0x7f0000000100), &(0x7f0000000140), &(0x7f0000000180)) 3.016079786s ago: executing program 7 (id=3247): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x42}}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000040)='bic', 0xff3d) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @window={0x3, 0x0, 0x401}, @window], 0x5) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0xb, 0x0, 0x0) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 2.624363866s ago: executing program 7 (id=3248): sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000058c0)=[{{0x0, 0x0, &(0x7f0000001300)=[{&(0x7f00000002c0)="a8d81e6d947d922587e5abd7a547dd11ec10b1c149e49cdd3a3acce0e471282c8b594920aca050647626d317dc6c38dc493cb80ae55dbb9e00d8376a96cab883ecd9c634e8f1965a11ae4e9ba062368bf6b8c3424d469dbb24c7919f332e637a015802cb8739f82185ed1bf0c2f1a2a0c59942596f4fd386adeab9b2683beaca798e3ee69e0a6d239098c745305d21b9293483dfdbcd94277f7a08f414e77a78001546e1449a889cbef622f3874183060c884ea7e3abca8d3fed20b5013cdeb7f7dc474909ecfd57a1d4c7fe05129fb45468e681e3bc744e43ef5ffa40e4ac7ee8332cafa8b254079bc94711f6090b3c65d0d79208f463dd3b16242cc1c15249b3e42c624749049179fd397ee1daf5e5b907b6fec63b1aa2be29320af21a37e729c0445b4bfa5d338495804dfab92a2e973104c7bed5a24e0bdfb4846036d623e173269b722c9ccd93b8c9682c3cdf0e1b806b5b00ede878c698663d851dfba23d9abfca0140f167ef1b9cd0e1e49fc0eb6bdc46f4fdf381d55b3d6185361afc9cfebc3f98af4524fec4d5277bf6134a2a473932947f2051b7ca196b8b9931c14b04c34f309efecb1bbdc563497e7e66847057967363411c2f720df3a0ed530abbaa72d4b8d2aeecab950759c47057d7cc26c7d939191908d0426fa7d9abd51fabc26324575bee2848486f3736bbd3714f07ac559a918c06f31c391cba5b6cbd4e7316f68e45e421001b5b002520c769be330de8e7d86bc218d4562f6a86167eb0bf35ed70478200b58d420db3d4f6408ed160c36d6e92a085212394d5507243aff5ba8fc1be49eff3fe050cf4dbf033385b751d3fe87001cf608583d3394e87e73aedffd99312705e726f0b85622fe7b3ef5b08ae9e1e2ca1bcfc804209102a1a358c88e6456169a7a9731acebe1264385509a19d534e45fc352e6cf1347aff24f17c21242ada32ff0565bacec22528790f461195cd5a2293ac5df991acf980be873cded06b84c6094a62cfe5438d19a4fe04e1238c595bd764477094ae3ad1660a0d65e3a63ca9a197879f05fb64fe542ea13ef2ec836ea2513c841fb133d38696e9f1f0222e4afc160fc05d3e6279469c1af9a158d3240e20d15d3d03d8be46067c17d4e42f0d97e0d25b410a3a6be7964119aae495c6ef148882f15f52df74bb810876c2762d69cc331a9de08dd8138787c283249c8406172bc6cd4625a31865bdbc674379e9ff08de675dc91f088f9d38b33bf335d199907d6225bc4958a7f74aa6030cd1a3c1220af6396d37a85c1efc4b5d88936d485c2dd350a4e1f4d75ff07bce3920e1fec69d5ba8d142957f8f4d7c0e0da2a0ca6643ebd8c96562c238d9485287354a3e307d3edd316de5ec9bcd31dbc3ec5a2247ace805ff3f2a18603d9c9169b1571fac8cc267a7f965189f3da1e504f7f373ba03133936bcb003187ed2ddf1b89e2c68b485029d18b744dd2d5d55313f5ebd0909afaeb0481d23b970d3cb50457eb9157a95cd94dba4e50de0b530edec00500688ab06162ae52d4abb9974980dde0e5f4cbf3dc4d0a2e720101b9a02c86a49a2e8ee760a9edb4b2a7d160867459c9f611850e795b0e4d6254da594d30591bd553748ed7447cfc8c58aa9fbbdf3ea5fdb9d30361cfdd82a08bbb71595ac56c4e5b6df47abb0e79e16adbd0aa678876b4e6822af40d81a4f4c7d2f633e3aef4184497194f75929cf6c8f260f217d00123a71c94d07b018511d4188e671b4d6063ab0bf48ee5c871a7824b3763d2c940396627aa61863787f2102daefdfafae8d4e197ef7e1a61d5695c062cbbf36f7f8d975d1d65e5f36bf4a2a149f37144b4b89614632fc1ed73f81bbfdc8d9f849a920d9eff33ccaed1c279a945f25ab1ce301860e44086642aef273c45b6d978d97d8a68da76b157e14cf88ae85f807b0304ae36b7170975738d012003ec94dc4805963462cd883e47766231f6edb8b54bd70bf5554bf53f6ea533d228ac4e19c7290b1795328df2f6609de358e9183e3ffe75d8e9088fb7193ab10327a8cc31523f8ff54c0d583c46e26d931e2a62a7e9e97153668d4e4f17f0d09e472dc2739f81feba73bb4ffe9c60820ca1945f316918f9c9785976058109cc44494b71475f91131ea2c7f96b8a516c4813c0aaa75f03169b31f870c3bd76f9cd01410c0ad742ba9c150397626ada311cf6f6d60015d3cc44e9b3bc0216f99927d9cd581527bc8c83e789fe10a720cb297c0b5331a915508dfee3266e24d59c32cfd117ccbc970c4edb63d6d7fe1ec9359c853610a489aebdfc4631b189793a1669f3d963318e5d0e6098928dc34662d67317d270ace8a0911f775f6a69de83aef6fb35a446a37058cea30633904ca086e0f77c431a3fa3cb88f7d0e0d7922a353ce9c7091424ba79a52612be292a3c7ab3542f60db70ce6755e5eb0cfeeec3ce2982843cae0b7e7fccb19b8bb16ccb39db8786ee58f3068d91b8283c7af51b21c880d2f52f12ec0d2b483708a60cb53dada400ed95bb0f07996dd6734cf53d4ce28b49116c3595318f4f8a25c88559eff0e4fff0231be9d3eb8a96346933dc921f1ec6e733bcf0512554c54123fb02178ee50ab888d2c87112dd426fc8396bf28d5ed4937b1f3d0aef752aae6034f34b30bacbf0919e2eebbce5d5ac314a24e5f18fe4b59e4be6cc13d239adb62c2a8419db389e1bd792c02e32760675ef063f64129c7d02ba879fc4ec16212ce387c9a141acf3e46f0464a955072122b778e64dba6055b094987e323a5fc23dc02d1294bd54ca0dc26b6180beab864b3a5a40675820776661b52124de2432836110baabd247c013b9f0c3cbc1f0fa30e54ef3e619915e07640a9bb01fbb2ead18d8741ad0cf02e3a4fbd505baff5033671fece669d5532d15b04b14e19a1d65ba884b67453322fadd98fbcedd9e9216a913a11dc3689f7211c65d8f2b8932a4fb307e366e403ff03d7678ba9b5a464ae03f5b63002c6a599bf16b490c48ccc134718fb337f633a681aa7f036048d8255a02049c3cc593335c3a33ef4458308672671becd7900a996a80d07fdfe450a75f43f45161f0605a985b8a4a1c432d273108723ab754458263387672fb5a4b06c92647aab90e699ae0adefd8702d054febfd057b83cb14ef6f5294c473fbd94b67d687067e2086485ad0cc0a133c7edcae10dd5849c8dd600702c49874489e11070007a5e1868e639402cf76c2058136e17c2feb526cbb8dab2f839380f082b0d74e155dd1d9e337ae1e90fb1879288a7fd1d33105daa0d3eb7d0630fffe98fc2978a1ddeb81e13e694d65bd5a69400ee1d2ff28a4b1c18288af5815b7680427c01d090f09636f52ec3aa1b0e1940053002decff63edb22558a38ac91f8f95c20e71541b0c4952793bb339be8d86016d7f49f2e98c3ce8af1d2015ce8588c1745314762ab3bec3b799bbb6253511084bb976d2d95c2a894313196e578c8c1b56933395c11f4acf54cf6e17fbada9ba700a04570266a9a007b9dc5ad5be2c6e4f64d1ee9560496950d62b66770e11b20565fbe0624f0c3c5deb1b0efe7019b25dd2dd74ffe4b6db87e796d7b0be95657198d0a15942e57afd7808bc147df32848bfd7c9ea5bb81d40262951cde3532e52dde9d2c2a29be7b5931f9f5fa6aeb452d4b0492b518d3112891c91e4553271fa1cd4148415bb959b2f3d1927be54aa354dd5c918b9f2b9258d145f77c0d6151d003437d9ce1c47044eb1406ca041d76772ed0446d4c71ac7d5a3b87c633ce5405a49e8995e2f3430023772174d2facaa711067c6521bbf0a757aaf4157b82dbca4d14ae47ae3bef12e0266418f8b5bf88b04d9d2f5c67415347e627a90595d4fc822f6cdc742e1410f3e71783485cf14720ea083d809ed0c31fdcbaf3dfea2d0a680beb6256ad2c3e1a6ab465b6ec901595a4d4262bf56d4b965652b419d40f36655183c443a393eb05e19c30af99c2e97e07b5a67bc706b9b57d12c4183331435b5434db570978ca2cafdd5b9bc9e962964e040f328d442865f19a28c257b6263b21882f43eed48255db5162ce343890a247a061aa42f29adeea3db3d3f9b8ba17dc11b757580645510a7e0685386ec6b158209b3a143e522efbc68d5d8cc5749561e1a11859b0644ebd", 0xb7b}], 0x1}}], 0x1, 0x40080) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x10, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 2.560546407s ago: executing program 5 (id=3249): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000440), 0x8, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./bus\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) 2.43598114s ago: executing program 7 (id=3250): r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0xffffffff, 0x2, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100", 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00'}) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r4, 0x890c, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb') socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001800dd8d0000c6b00000df2502100000fc00fe070015000006001500060000000c0016800500040002000000"], 0x30}}, 0x40044) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}}) 2.337497353s ago: executing program 8 (id=3251): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, 0x0) openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fdinfo/3\x00') r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000000c0)={0xffffffffffffffff}) r2 = timerfd_create(0x0, 0x800) syz_open_dev$vim2m(&(0x7f00000001c0), 0x1f7ff6, 0x2) getsockopt$inet_mptcp_buf(r2, 0x11c, 0x1, &(0x7f0000000100)=""/32, &(0x7f0000000140)=0x20) r3 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000080)={0xc}) ioctl$IOMMU_VFIO_IOAS$SET(r3, 0x3b88, 0x0) ioctl$IOMMU_VFIO_IOAS$GET(r3, 0x3b88, 0x0) pselect6(0x0, 0x0, 0x0, &(0x7f0000000280)={0x1f, 0xfffffffffffffffe, 0xe, 0x400, 0x7, 0x4, 0x0, 0xfffffffffffffffc}, 0x0, 0x0) read$dsp(0xffffffffffffffff, &(0x7f0000000280)=""/79, 0x4f) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$inet(0x2, 0x3, 0x5) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f00000004c0)={0x0, @private, @loopback}, 0x0) socket$alg(0x26, 0x5, 0x0) openat$adsp1(0xffffffffffffff9c, 0x0, 0x40000, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000000206050800000000000000000000000005000400000000000900020073797a30000000001400078008001340000000000800064000000000050005000000000005000100060000000d000300686173683a6d6163"], 0x5c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000440)={0x0}, 0x1, 0x0, 0x0, 0x8000}, 0x44000) timerfd_settime(r2, 0x3, &(0x7f0000000200), 0x0) close_range(r1, 0xffffffffffffffff, 0x0) 2.334823883s ago: executing program 4 (id=3252): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2", 0x95}, {&(0x7f0000000ac0)}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e6", 0xae}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae", 0x39}], 0x4, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 2.300684603s ago: executing program 5 (id=3253): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x401, 0xfffffffc, 0x717e387b, 0x40, "1ae34e0626788a22b2fb12dab240794233a5bd", 0x4, 0x2}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x60081, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400004, 0x14, "3eccd8000000000000000010000000040100"}) ioctl$TCSETS(r1, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) syz_open_dev$dri(&(0x7f0000000000), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPERTY(0xffffffffffffffff, 0xc04064aa, &(0x7f00000003c0)={&(0x7f0000001280), 0x0, 0x0, 0x0, '\x00', 0x1ffffffffffffd64, 0x3f}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(0xffffffffffffffff, 0xc01864b0, &(0x7f0000000680)={0x0, 0x0, 0xd, 0x0, 0x3}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$loop(&(0x7f00000014c0), 0x4, 0x2) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000000)={0x2001, 0x0, 0x1}, 0x10) sendto$inet6(r2, &(0x7f0000000400)="47e699d91fe0fe5945e1cbd2b1cbcb09e42a9d4e75d9f49e77086cb3a1c2180d9d32e5530a7744623ac8486f38e8fa5ae66b7f46b9e37c7d1cb3b42f6ac6c1d109f743d42ac5856049d882b22ef194bd88f9e6e2329d3588e3b776a1bd9c4555788adb5243de4ff36e2851f4b05f3893b02424", 0x73, 0x11, 0x0, 0x0) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x30, r3, 0x1, 0x0, 0x100000, {{}, {}, {0x14, 0x19, {0x2, 0x1, 0x0, 0x2000000}}}}, 0x30}, 0x1, 0x0, 0x0, 0x4080}, 0x1004) 523.892347ms ago: executing program 5 (id=3254): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000240)={0x73622a85, 0x1}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000002c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000200)={0x30, 0x30, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(r4, &(0x7f0000000000)=[{&(0x7f0000000140)='2', 0x55}], 0x1) 280.047603ms ago: executing program 8 (id=3255): r0 = socket$inet6(0xa, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0xffffffff, 0x2, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x40844}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), 0x0, &(0x7f0000000000)) setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100", 0x14) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r4 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r4, 0x890c, &(0x7f0000000100)='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00lapb0') socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001800dd8d0000c6b00000df2502100000fc00fe070015000006001500060000000c0016800500040002000000"], 0x30}}, 0x40044) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) ptrace$ARCH_GET_FS(0x1e, r1, &(0x7f0000000180), 0x1003) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) ioctl$sock_inet6_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f0000000080)={@loopback={0x0, 0x3fc}, 0x0, r7}) 245.556244ms ago: executing program 5 (id=3256): syz_clone(0xb04140, 0x0, 0x0, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x24044010) r2 = socket$kcm(0xa, 0x3, 0x3a) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xffffffffffff0000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 187.321996ms ago: executing program 4 (id=3257): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x46002, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mount(0x0, &(0x7f0000000100)='.\x00', &(0x7f00000001c0)='bfs\x00', 0x8000, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x1e) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f0000000040), 0x0, 0x0) chdir(&(0x7f0000000080)='./file0\x00') mkdir(&(0x7f0000000140)='./control\x00', 0x111) rmdir(&(0x7f0000000100)='./control\x00') r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000740)=@base={0x6, 0x4, 0x3, 0x7}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000181100", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007baaf8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c3"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xd}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r4, 0x2000300, 0xe, 0x0, &(0x7f0000000040)="4a57b01363c58aeced8ef9ff3f0a", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r2) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x40, r5, 0x1, 0x0, 0x4, {0x3, 0x74, 0x600}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'ip6gre0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x7}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @local}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @broadcast}]}, 0x40}, 0x1, 0xffffffff00000003}, 0x0) timer_create(0x9, &(0x7f0000000180)={0x0, 0x4, 0x1, @thr={0x0, 0x0}}, &(0x7f00000001c0)=0x0) timer_settime(r6, 0x1, &(0x7f0000000080)={{0x77359400}, {0x0, 0x3938700}}, 0x0) timer_gettime(0x0, &(0x7f0000000040)) r7 = openat$btrfs_control(0xffffff9c, &(0x7f0000000040), 0x301000, 0x0) ioctl$KVM_SET_TSC_KHZ_vm(r7, 0xaea2, 0x795c) ioctl$KVM_GET_MSRS_sys(r0, 0xc008ae88, &(0x7f0000000080)) 0s ago: executing program 4 (id=3258): r0 = socket(0xa, 0x3, 0x3a) r1 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x490000, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) write$RDMA_USER_CM_CMD_BIND_IP(0xffffffffffffffff, &(0x7f00000002c0)={0x2, 0x28, 0xfa12, {0x0, {0xa, 0x4e23, 0xfffffffd, @loopback, 0x4}}}, 0x30) write$RDMA_USER_CM_CMD_QUERY(r1, &(0x7f0000000a80)={0x13, 0x10, 0xfa00, {&(0x7f0000000880)}}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000000)={0x4, 0x1, 0x4}, 0xc) setsockopt$MRT6_FLUSH(r0, 0x29, 0xd4, &(0x7f0000000080)=0xa, 0x4) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', 0x0, 0x0, 0x0) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x175a978679bbbe1d, 0x80a0a1240160183d) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000c80)=ANY=[@ANYRES32=r3, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYBLOB="0000000000c7003a00000000000000"], 0x50) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000480)={r4}, 0x4) open$dir(&(0x7f00000000c0)='./file0\x00', 0x40000, 0x4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000b80)={0x94, 0x9, 0x6, 0x401, 0x0, 0x0, {0x5, 0x0, 0x40}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_ADT={0x6c, 0x8, 0x0, 0x1, [{0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_MARK={0x8}}, {0x10, 0x7, 0x0, 0x1, @IPSET_ATTR_COMMENT={0x9, 0x1a, 'syz1\x00'}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_CIDR2={0x5, 0x15, 0xe}}, {0xc, 0x7, 0x0, 0x1, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e24}}, {0x1c, 0x7, 0x0, 0x1, @IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @loopback}}}}, {0x18, 0x7, 0x0, 0x1, @IPSET_ATTR_IFACE={0x14, 0x17, 'pim6reg1\x00'}}]}]}, 0x94}, 0x1, 0x0, 0x0, 0x10004017}, 0x81) connect$inet6(0xffffffffffffffff, &(0x7f00000002c0)={0xa, 0x0, 0x10000, @loopback, 0x1}, 0x1c) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x3a, &(0x7f0000000280)=0x3ff, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000000406030000000000000000000000000005000100070000008b434b420557e3bc2663192cab715837"], 0x1c}}, 0x40000) r6 = openat$vicodec0(0xffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0185647, &(0x7f0000000100)={0x9b0000, 0x5, 0x3, 0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x98f90d, 0xffffffff, '\x00', @value64=0x2}}) mount(0x0, &(0x7f0000000040)='./cgroup.cpu/cgroup.procs\x00', &(0x7f0000000000)='tmpfs\x00', 0x2000008, &(0x7f0000000300)='usrquota') kernel console output (not intermixed with test programs): 072.701422][T15368] RBP: 00007fca5ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 1072.709387][T15368] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1072.717364][T15368] R13: 00007fca5ee26128 R14: 00007fca5ee26090 R15: 00007ffce474f5a8 [ 1072.725337][T15368] [ 1072.728561][ C0] vkms_vblank_simulate: vblank timer overrun [ 1073.038061][T15368] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1074.802790][T15380] kAFS: bad VL server IP address [ 1074.866785][T15388] binder: 15386:15388 ioctl 4018620d 0 returned -22 [ 1075.536582][T15400] netlink: 'syz.8.2073': attribute type 1 has an invalid length. [ 1075.843443][T15407] 9pnet_virtio: no channels available for device syz [ 1075.869070][T15409] binder: BINDER_SET_CONTEXT_MGR already set [ 1075.895078][T15409] binder: 15408:15409 ioctl 4018620d 200000004a80 returned -16 [ 1076.557405][T15423] binder: 15421:15423 ioctl 4018620d 0 returned -22 [ 1076.627672][T15426] Set syz0 is full, maxelem 0 reached [ 1076.644960][T15422] netlink: 'syz.7.2074': attribute type 4 has an invalid length. [ 1078.392529][T15429] kAFS: bad VL server IP address [ 1078.899795][T15445] vxcan1: tx drop: invalid sa for name 0x0000000000000002 [ 1079.136480][T15450] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1079.145012][T15450] CPU: 0 PID: 15450 Comm: syz.4.2085 Not tainted syzkaller #0 [ 1079.152460][T15450] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1079.162507][T15450] Call Trace: [ 1079.165782][T15450] [ 1079.168706][T15450] dump_stack_lvl+0x18c/0x250 [ 1079.173383][T15450] ? show_regs_print_info+0x20/0x20 [ 1079.178576][T15450] ? load_image+0x420/0x420 [ 1079.183086][T15450] sysfs_create_dir_ns+0x26e/0x2a0 [ 1079.188193][T15450] ? __lock_acquire+0x7d80/0x7d80 [ 1079.193226][T15450] ? sysfs_warn_dup+0xa0/0xa0 [ 1079.197897][T15450] ? rcu_is_watching+0x15/0xb0 [ 1079.202659][T15450] ? do_raw_spin_unlock+0x121/0x230 [ 1079.207866][T15450] kobject_add_internal+0x617/0xc90 [ 1079.213066][T15450] kobject_add+0x164/0x240 [ 1079.217484][T15450] ? kobject_init+0x1d0/0x1d0 [ 1079.222165][T15450] ? get_device_parent+0x366/0x390 [ 1079.227288][T15450] device_add+0x3fa/0xc40 [ 1079.231613][T15450] tty_register_device_attr+0x425/0x950 [ 1079.237174][T15450] ? tty_register_device+0x30/0x30 [ 1079.242289][T15450] ? tty_port_init+0x132/0x1a0 [ 1079.247043][T15450] ? gsm_dlci_alloc+0x32a/0x630 [ 1079.251888][T15450] ? __might_fault+0xaa/0x120 [ 1079.256560][T15450] gsm_activate_mux+0x110/0x2a0 [ 1079.261414][T15450] gsmld_ioctl+0x12ca/0x1900 [ 1079.266006][T15450] ? gsmld_write+0x120/0x120 [ 1079.270624][T15450] ? __init_ldsem+0x150/0x150 [ 1079.275296][T15450] ? __fget_files+0x28/0x460 [ 1079.279906][T15450] ? gsmld_write+0x120/0x120 [ 1079.284491][T15450] tty_ioctl+0x9b5/0xdc0 [ 1079.288739][T15450] ? tty_get_icount+0xb0/0xb0 [ 1079.293439][T15450] __se_sys_ioctl+0xfd/0x170 [ 1079.298038][T15450] do_syscall_64+0x55/0xb0 [ 1079.302454][T15450] ? clear_bhb_loop+0x40/0x90 [ 1079.307124][T15450] ? clear_bhb_loop+0x40/0x90 [ 1079.311796][T15450] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1079.317686][T15450] RIP: 0033:0x7f4d6dd9e0d9 [ 1079.322094][T15450] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1079.341701][T15450] RSP: 002b:00007f4d6ec5b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1079.350111][T15450] RAX: ffffffffffffffda RBX: 00007f4d6e026180 RCX: 00007f4d6dd9e0d9 [ 1079.358077][T15450] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1079.366043][T15450] RBP: 00007f4d6de35024 R08: 0000000000000000 R09: 0000000000000000 [ 1079.374007][T15450] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1079.381970][T15450] R13: 00007f4d6e026218 R14: 00007f4d6e026180 R15: 00007ffc7e9f4e98 [ 1079.389944][T15450] [ 1079.564141][T15450] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1079.619592][T15455] 9pnet_virtio: no channels available for device syz [ 1079.969623][T15460] netlink: 'syz.8.2088': attribute type 1 has an invalid length. [ 1080.060609][T15462] binder: 15461:15462 ioctl 4018620d 0 returned -22 [ 1080.962125][T15469] pim6reg: entered allmulticast mode [ 1082.253804][T15468] pim6reg: left allmulticast mode [ 1082.911762][T15480] Set syz0 is full, maxelem 0 reached [ 1083.334109][T15495] 9pnet_virtio: no channels available for device syz [ 1083.563292][T15502] netlink: 'syz.7.2100': attribute type 1 has an invalid length. [ 1083.770663][T15510] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1085.685131][T15510] CPU: 0 PID: 15510 Comm: syz.8.2101 Not tainted syzkaller #0 [ 1085.692610][T15510] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1085.702660][T15510] Call Trace: [ 1085.705932][T15510] [ 1085.708858][T15510] dump_stack_lvl+0x18c/0x250 [ 1085.713536][T15510] ? show_regs_print_info+0x20/0x20 [ 1085.718728][T15510] ? load_image+0x420/0x420 [ 1085.723235][T15510] sysfs_create_dir_ns+0x26e/0x2a0 [ 1085.728339][T15510] ? __lock_acquire+0x7d80/0x7d80 [ 1085.733361][T15510] ? sysfs_warn_dup+0xa0/0xa0 [ 1085.738031][T15510] ? rcu_is_watching+0x15/0xb0 [ 1085.742806][T15510] ? do_raw_spin_unlock+0x121/0x230 [ 1085.748008][T15510] kobject_add_internal+0x617/0xc90 [ 1085.753210][T15510] kobject_add+0x164/0x240 [ 1085.757629][T15510] ? kobject_init+0x1d0/0x1d0 [ 1085.762309][T15510] ? get_device_parent+0x366/0x390 [ 1085.767430][T15510] device_add+0x3fa/0xc40 [ 1085.771796][T15510] tty_register_device_attr+0x425/0x950 [ 1085.777351][T15510] ? tty_register_device+0x30/0x30 [ 1085.782467][T15510] ? tty_port_init+0x132/0x1a0 [ 1085.787222][T15510] ? gsm_dlci_alloc+0x32a/0x630 [ 1085.792068][T15510] ? __might_fault+0xaa/0x120 [ 1085.796753][T15510] gsm_activate_mux+0x110/0x2a0 [ 1085.801606][T15510] gsmld_ioctl+0x12ca/0x1900 [ 1085.806196][T15510] ? gsmld_write+0x120/0x120 [ 1085.810788][T15510] ? __init_ldsem+0x150/0x150 [ 1085.815470][T15510] ? __fget_files+0x28/0x460 [ 1085.820074][T15510] ? gsmld_write+0x120/0x120 [ 1085.824668][T15510] tty_ioctl+0x9b5/0xdc0 [ 1085.828957][T15510] ? tty_get_icount+0xb0/0xb0 [ 1085.833633][T15510] __se_sys_ioctl+0xfd/0x170 [ 1085.838219][T15510] do_syscall_64+0x55/0xb0 [ 1085.842630][T15510] ? clear_bhb_loop+0x40/0x90 [ 1085.847300][T15510] ? clear_bhb_loop+0x40/0x90 [ 1085.851973][T15510] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1085.857859][T15510] RIP: 0033:0x7ff84639e0d9 [ 1085.862271][T15510] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1085.881879][T15510] RSP: 002b:00007ff8472ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1085.890289][T15510] RAX: ffffffffffffffda RBX: 00007ff846626180 RCX: 00007ff84639e0d9 [ 1085.898252][T15510] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1085.906222][T15510] RBP: 00007ff846435024 R08: 0000000000000000 R09: 0000000000000000 [ 1085.914189][T15510] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1085.922152][T15510] R13: 00007ff846626218 R14: 00007ff846626180 R15: 00007fffe44c89e8 [ 1085.930141][T15510] [ 1085.962911][T15502] bond9: entered promiscuous mode [ 1086.022518][T15502] 8021q: adding VLAN 0 to HW filter on device bond9 [ 1086.054022][T15513] bond9: (slave bridge7): making interface the new active one [ 1086.063585][T15513] bridge7: entered promiscuous mode [ 1086.268606][T15513] bond9: (slave bridge7): Enslaving as an active interface with an up link [ 1086.299062][T15514] pim6reg: entered allmulticast mode [ 1086.321659][T15516] pim6reg: left allmulticast mode [ 1086.514449][T15510] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1087.298607][T15539] 9pnet_virtio: no channels available for device syz [ 1087.695118][ T28] audit: type=1800 audit(1786934922.655:79): pid=15548 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2111" name="bmControls" dev="configfs" ino=47372 res=0 errno=0 [ 1087.727300][T15548] netlink: 'syz.7.2111': attribute type 1 has an invalid length. [ 1087.745904][T15545] netlink: 'syz.5.2104': attribute type 4 has an invalid length. [ 1087.794912][T15553] binder: 15552:15553 ioctl c0306201 0 returned -14 [ 1087.993408][T15560] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2111'. [ 1088.868296][T15572] netlink: 'syz.5.2114': attribute type 1 has an invalid length. [ 1090.741789][T15572] bond14: entered promiscuous mode [ 1090.800373][T15572] 8021q: adding VLAN 0 to HW filter on device bond14 [ 1090.906904][T15573] pim6reg: entered allmulticast mode [ 1090.954902][T15574] pim6reg: left allmulticast mode [ 1091.193307][T15588] 9pnet_virtio: no channels available for device syz [ 1091.318437][T15579] bond14: (slave bridge6): making interface the new active one [ 1091.370821][T15579] bridge6: entered promiscuous mode [ 1091.408842][T15579] bond14: (slave bridge6): Enslaving as an active interface with an up link [ 1091.485054][T15586] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2117'. [ 1091.988551][T15605] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1092.114695][T15608] binder: 15604:15608 ioctl c0306201 0 returned -14 [ 1092.251480][T15605] CPU: 0 PID: 15605 Comm: syz.5.2122 Not tainted syzkaller #0 [ 1092.258955][T15605] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1092.269004][T15605] Call Trace: [ 1092.272284][T15605] [ 1092.275205][T15605] dump_stack_lvl+0x18c/0x250 [ 1092.279883][T15605] ? show_regs_print_info+0x20/0x20 [ 1092.285076][T15605] ? load_image+0x420/0x420 [ 1092.289583][T15605] sysfs_create_dir_ns+0x26e/0x2a0 [ 1092.294690][T15605] ? __lock_acquire+0x7d80/0x7d80 [ 1092.299721][T15605] ? sysfs_warn_dup+0xa0/0xa0 [ 1092.304407][T15605] ? rcu_is_watching+0x15/0xb0 [ 1092.309192][T15605] ? do_raw_spin_unlock+0x121/0x230 [ 1092.314390][T15605] kobject_add_internal+0x617/0xc90 [ 1092.319596][T15605] kobject_add+0x164/0x240 [ 1092.324016][T15605] ? kobject_init+0x1d0/0x1d0 [ 1092.328694][T15605] ? get_device_parent+0x366/0x390 [ 1092.333805][T15605] device_add+0x3fa/0xc40 [ 1092.338131][T15605] tty_register_device_attr+0x425/0x950 [ 1092.343691][T15605] ? tty_register_device+0x30/0x30 [ 1092.348805][T15605] ? tty_port_init+0x132/0x1a0 [ 1092.353563][T15605] ? gsm_dlci_alloc+0x32a/0x630 [ 1092.358419][T15605] ? __might_fault+0xaa/0x120 [ 1092.363099][T15605] gsm_activate_mux+0x110/0x2a0 [ 1092.367951][T15605] gsmld_ioctl+0x12ca/0x1900 [ 1092.372545][T15605] ? gsmld_write+0x120/0x120 [ 1092.377137][T15605] ? __init_ldsem+0x150/0x150 [ 1092.381811][T15605] ? __fget_files+0x28/0x460 [ 1092.386403][T15605] ? gsmld_write+0x120/0x120 [ 1092.390985][T15605] tty_ioctl+0x9b5/0xdc0 [ 1092.395222][T15605] ? tty_get_icount+0xb0/0xb0 [ 1092.399898][T15605] __se_sys_ioctl+0xfd/0x170 [ 1092.404501][T15605] do_syscall_64+0x55/0xb0 [ 1092.408912][T15605] ? clear_bhb_loop+0x40/0x90 [ 1092.413585][T15605] ? clear_bhb_loop+0x40/0x90 [ 1092.418257][T15605] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1092.424144][T15605] RIP: 0033:0x7fca5eb9e0d9 [ 1092.428551][T15605] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1092.448159][T15605] RSP: 002b:00007fca5fad4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1092.456582][T15605] RAX: ffffffffffffffda RBX: 00007fca5ee26180 RCX: 00007fca5eb9e0d9 [ 1092.464554][T15605] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1092.472539][T15605] RBP: 00007fca5ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 1092.480506][T15605] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1092.488470][T15605] R13: 00007fca5ee26218 R14: 00007fca5ee26180 R15: 00007ffce474f5a8 [ 1092.496463][T15605] [ 1092.499551][ C0] vkms_vblank_simulate: vblank timer overrun [ 1092.665113][T15605] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1095.020492][T15628] 9pnet_virtio: no channels available for device syz [ 1095.903622][T15638] pim6reg: entered allmulticast mode [ 1097.326320][T15634] netlink: 'syz.7.2130': attribute type 1 has an invalid length. [ 1097.475014][T15634] bond10: entered promiscuous mode [ 1097.493264][T15634] 8021q: adding VLAN 0 to HW filter on device bond10 [ 1097.560910][T15640] bond10: (slave bridge8): making interface the new active one [ 1097.597779][T15640] bridge8: entered promiscuous mode [ 1097.628470][T15640] bond10: (slave bridge8): Enslaving as an active interface with an up link [ 1097.654761][T15632] pim6reg: left allmulticast mode [ 1097.678938][T15644] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2132'. [ 1097.795867][T15656] UBIFS error (pid: 15656): cannot open "(null)", error -22 [ 1099.744236][T15674] 9pnet_virtio: no channels available for device syz [ 1099.940127][ T28] audit: type=1800 audit(1786934934.895:80): pid=15682 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2141" name="bmControls" dev="configfs" ino=47859 res=0 errno=0 [ 1099.976328][T15682] netlink: 'syz.7.2141': attribute type 1 has an invalid length. [ 1100.363149][T15695] pim6reg: entered allmulticast mode [ 1102.105176][T15693] pim6reg: left allmulticast mode [ 1102.186150][T15698] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2141'. [ 1102.291999][T15697] netlink: 'syz.5.2145': attribute type 1 has an invalid length. [ 1102.463055][T15697] bond15: entered promiscuous mode [ 1102.507900][T15697] 8021q: adding VLAN 0 to HW filter on device bond15 [ 1102.609720][T15700] bond15: (slave bridge7): making interface the new active one [ 1102.635167][T15700] bridge7: entered promiscuous mode [ 1102.657340][T15700] bond15: (slave bridge7): Enslaving as an active interface with an up link [ 1102.701333][T15679] netlink: 'syz.4.2140': attribute type 4 has an invalid length. [ 1105.030059][T15735] 9pnet_virtio: no channels available for device syz [ 1105.233066][T15743] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2154'. [ 1107.168372][T15747] pim6reg: entered allmulticast mode [ 1107.233627][T15749] pim6reg: left allmulticast mode [ 1107.290087][ T28] audit: type=1800 audit(1786934942.255:81): pid=15756 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2157" name="bmControls" dev="configfs" ino=48057 res=0 errno=0 [ 1107.339972][T15757] netlink: 'syz.5.2156': attribute type 1 has an invalid length. [ 1107.350089][T15756] netlink: 'syz.7.2157': attribute type 1 has an invalid length. [ 1107.472653][T15757] bond16: entered promiscuous mode [ 1107.517159][T15757] 8021q: adding VLAN 0 to HW filter on device bond16 [ 1107.630096][T15759] bond16: (slave bridge8): making interface the new active one [ 1107.682237][T15759] bridge8: entered promiscuous mode [ 1107.730100][T15759] bond16: (slave bridge8): Enslaving as an active interface with an up link [ 1107.784268][T15769] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2157'. [ 1107.883557][T15777] Set syz0 is full, maxelem 0 reached [ 1109.995018][T15767] netlink: 'syz.8.2159': attribute type 4 has an invalid length. [ 1111.801539][T15820] pim6reg: entered allmulticast mode [ 1113.166888][T15818] pim6reg: left allmulticast mode [ 1113.589282][T15828] netlink: 'syz.4.2170': attribute type 1 has an invalid length. [ 1115.356329][T15828] bond13: entered promiscuous mode [ 1115.461847][T15828] 8021q: adding VLAN 0 to HW filter on device bond13 [ 1115.644134][T15835] bond13: (slave bridge6): making interface the new active one [ 1115.720314][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.748500][T15835] bridge6: entered promiscuous mode [ 1115.754422][T15835] bond13: (slave bridge6): Enslaving as an active interface with an up link [ 1115.968598][T15865] netlink: 'syz.5.2175': attribute type 1 has an invalid length. [ 1116.137614][T15873] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2176'. [ 1116.238512][T15876] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2177'. [ 1116.277465][T15880] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2175'. [ 1116.325003][T15878] netlink: 64 bytes leftover after parsing attributes in process `syz.4.2177'. [ 1117.081293][T15886] pim6reg: entered allmulticast mode [ 1118.313492][T15884] pim6reg: left allmulticast mode [ 1120.456150][T15904] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2183'. [ 1122.505942][T15925] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2187'. [ 1123.654630][T15941] pim6reg: entered allmulticast mode [ 1125.187038][T15940] pim6reg: left allmulticast mode [ 1125.403699][T15948] netlink: 'syz.4.2191': attribute type 1 has an invalid length. [ 1125.458816][T15949] syzkaller0: entered promiscuous mode [ 1125.496831][T15949] syzkaller0: entered allmulticast mode [ 1125.805533][T15948] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2191'. [ 1127.934525][T15978] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2197'. [ 1128.025393][ T51] Bluetooth: hci1: command 0x0406 tx timeout [ 1129.814380][T15977] pim6reg: entered allmulticast mode [ 1129.842998][T15987] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2199'. [ 1129.858482][T15977] 9pnet_virtio: no channels available for device syz [ 1129.867611][T15977] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2198'. [ 1129.958321][T15987] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2199'. [ 1130.019916][T15987] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2199'. [ 1131.650781][T15987] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2199'. [ 1131.706331][T15989] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1131.715561][T15989] CPU: 0 PID: 15989 Comm: syz.5.2200 Not tainted syzkaller #0 [ 1131.723022][T15989] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1131.733073][T15989] Call Trace: [ 1131.736352][T15989] [ 1131.739279][T15989] dump_stack_lvl+0x18c/0x250 [ 1131.743966][T15989] ? show_regs_print_info+0x20/0x20 [ 1131.749164][T15989] ? load_image+0x420/0x420 [ 1131.753702][T15989] sysfs_create_dir_ns+0x26e/0x2a0 [ 1131.758816][T15989] ? __lock_acquire+0x7d80/0x7d80 [ 1131.763843][T15989] ? sysfs_warn_dup+0xa0/0xa0 [ 1131.768517][T15989] ? rcu_is_watching+0x15/0xb0 [ 1131.773291][T15989] ? do_raw_spin_unlock+0x121/0x230 [ 1131.778502][T15989] kobject_add_internal+0x617/0xc90 [ 1131.783721][T15989] kobject_add+0x164/0x240 [ 1131.788142][T15989] ? kobject_init+0x1d0/0x1d0 [ 1131.792821][T15989] ? get_device_parent+0x366/0x390 [ 1131.797960][T15989] device_add+0x3fa/0xc40 [ 1131.802291][T15989] tty_register_device_attr+0x425/0x950 [ 1131.807845][T15989] ? tty_register_device+0x30/0x30 [ 1131.812973][T15989] ? tty_port_init+0x132/0x1a0 [ 1131.817733][T15989] ? gsm_dlci_alloc+0x32a/0x630 [ 1131.822583][T15989] ? __might_fault+0xaa/0x120 [ 1131.827282][T15989] gsm_activate_mux+0x110/0x2a0 [ 1131.832141][T15989] gsmld_ioctl+0x12ca/0x1900 [ 1131.836746][T15989] ? gsmld_write+0x120/0x120 [ 1131.841364][T15989] ? __init_ldsem+0x150/0x150 [ 1131.846050][T15989] ? __fget_files+0x28/0x460 [ 1131.850657][T15989] ? gsmld_write+0x120/0x120 [ 1131.855256][T15989] tty_ioctl+0x9b5/0xdc0 [ 1131.859508][T15989] ? tty_get_icount+0xb0/0xb0 [ 1131.864194][T15989] __se_sys_ioctl+0xfd/0x170 [ 1131.868794][T15989] do_syscall_64+0x55/0xb0 [ 1131.873219][T15989] ? clear_bhb_loop+0x40/0x90 [ 1131.877903][T15989] ? clear_bhb_loop+0x40/0x90 [ 1131.882618][T15989] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1131.888516][T15989] RIP: 0033:0x7fca5eb9e0d9 [ 1131.892929][T15989] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1131.912533][T15989] RSP: 002b:00007fca5fb16028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1131.920945][T15989] RAX: ffffffffffffffda RBX: 00007fca5ee25fa0 RCX: 00007fca5eb9e0d9 [ 1131.928915][T15989] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1131.936937][T15989] RBP: 00007fca5ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 1131.944922][T15989] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1131.952902][T15989] R13: 00007fca5ee26038 R14: 00007fca5ee25fa0 R15: 00007ffce474f5a8 [ 1131.960905][T15989] [ 1131.967312][T15989] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1132.689329][T15997] pim6reg: entered allmulticast mode [ 1134.222683][T15995] pim6reg: left allmulticast mode [ 1134.964556][T16013] syzkaller0: entered promiscuous mode [ 1135.004602][T16013] syzkaller0: entered allmulticast mode [ 1135.464759][T16022] netlink: 'syz.4.2206': attribute type 1 has an invalid length. [ 1136.947073][T16029] binder: BINDER_SET_CONTEXT_MGR already set [ 1136.983299][T16029] binder: 16028:16029 ioctl 4018620d 200000004a80 returned -16 [ 1137.057368][T16029] binder: 16028:16029 ioctl c0306201 0 returned -14 [ 1137.198216][T16025] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2206'. [ 1137.461440][T16042] 9pnet_virtio: no channels available for device syz [ 1137.877712][T16046] pim6reg: left allmulticast mode [ 1141.125720][T16055] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1141.283172][T16055] CPU: 0 PID: 16055 Comm: syz.8.2214 Not tainted syzkaller #0 [ 1141.290747][T16055] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1141.300796][T16055] Call Trace: [ 1141.304070][T16055] [ 1141.306996][T16055] dump_stack_lvl+0x18c/0x250 [ 1141.311678][T16055] ? show_regs_print_info+0x20/0x20 [ 1141.316869][T16055] ? load_image+0x420/0x420 [ 1141.321387][T16055] sysfs_create_dir_ns+0x26e/0x2a0 [ 1141.326493][T16055] ? __lock_acquire+0x7d80/0x7d80 [ 1141.331511][T16055] ? sysfs_warn_dup+0xa0/0xa0 [ 1141.336178][T16055] ? rcu_is_watching+0x15/0xb0 [ 1141.340943][T16055] ? do_raw_spin_unlock+0x121/0x230 [ 1141.346143][T16055] kobject_add_internal+0x617/0xc90 [ 1141.351354][T16055] kobject_add+0x164/0x240 [ 1141.355771][T16055] ? kobject_init+0x1d0/0x1d0 [ 1141.360448][T16055] ? get_device_parent+0x366/0x390 [ 1141.365557][T16055] device_add+0x3fa/0xc40 [ 1141.369885][T16055] tty_register_device_attr+0x425/0x950 [ 1141.375460][T16055] ? tty_register_device+0x30/0x30 [ 1141.380573][T16055] ? tty_port_init+0x132/0x1a0 [ 1141.385331][T16055] ? gsm_dlci_alloc+0x32a/0x630 [ 1141.390182][T16055] ? __might_fault+0xaa/0x120 [ 1141.394854][T16055] gsm_activate_mux+0x110/0x2a0 [ 1141.399708][T16055] gsmld_ioctl+0x12ca/0x1900 [ 1141.404304][T16055] ? gsmld_write+0x120/0x120 [ 1141.408903][T16055] ? __init_ldsem+0x150/0x150 [ 1141.413577][T16055] ? __fget_files+0x28/0x460 [ 1141.418169][T16055] ? gsmld_write+0x120/0x120 [ 1141.422761][T16055] tty_ioctl+0x9b5/0xdc0 [ 1141.427009][T16055] ? tty_get_icount+0xb0/0xb0 [ 1141.431683][T16055] __se_sys_ioctl+0xfd/0x170 [ 1141.436290][T16055] do_syscall_64+0x55/0xb0 [ 1141.440701][T16055] ? clear_bhb_loop+0x40/0x90 [ 1141.445372][T16055] ? clear_bhb_loop+0x40/0x90 [ 1141.450043][T16055] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1141.455930][T16055] RIP: 0033:0x7ff84639e0d9 [ 1141.460340][T16055] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1141.479935][T16055] RSP: 002b:00007ff8472ef028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1141.488344][T16055] RAX: ffffffffffffffda RBX: 00007ff846626180 RCX: 00007ff84639e0d9 [ 1141.496312][T16055] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1141.504273][T16055] RBP: 00007ff846435024 R08: 0000000000000000 R09: 0000000000000000 [ 1141.512238][T16055] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1141.520200][T16055] R13: 00007ff846626218 R14: 00007ff846626180 R15: 00007fffe44c89e8 [ 1141.528175][T16055] [ 1141.531200][ C0] vkms_vblank_simulate: vblank timer overrun [ 1141.873898][T16066] binder: BINDER_SET_CONTEXT_MGR already set [ 1141.890453][T16066] binder: 16065:16066 ioctl 4018620d 200000004a80 returned -16 [ 1141.935951][T16070] kAFS: bad VL server IP address [ 1143.532124][T16072] binder: 16065:16072 ioctl c0306201 0 returned -14 [ 1143.553379][T16071] syzkaller0: entered promiscuous mode [ 1143.590190][T16071] syzkaller0: entered allmulticast mode [ 1143.670037][T16055] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1145.112509][T16090] pim6reg: entered allmulticast mode [ 1146.111150][T16085] pim6reg: left allmulticast mode [ 1146.801091][T16111] binder: BINDER_SET_CONTEXT_MGR already set [ 1146.826780][T16111] binder: 16110:16111 ioctl 4018620d 200000004a80 returned -16 [ 1146.892412][T16111] binder: 16110:16111 ioctl c0306201 0 returned -14 [ 1148.576904][T16114] kAFS: bad VL server IP address [ 1148.722809][T16119] syzkaller0: entered promiscuous mode [ 1148.756095][T16119] syzkaller0: entered allmulticast mode [ 1148.857351][T16120] netlink: 'syz.5.2225': attribute type 4 has an invalid length. [ 1149.910457][T16132] pim6reg: entered allmulticast mode [ 1150.834328][T16130] pim6reg: left allmulticast mode [ 1152.747627][T16142] kAFS: bad VL server IP address [ 1152.885472][T16147] tipc: Started in network mode [ 1152.918774][T16147] tipc: Node identity 2e85003d3eb1, cluster identity 4711 [ 1152.958393][T16147] tipc: Enabled bearer , priority 0 [ 1153.008857][T16153] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1153.031739][T16151] binder_alloc: binder_alloc_mmap_handler: 16150 200000ffd000-200001000000 already mapped failed -16 [ 1153.070662][T16147] tipc: Resetting bearer [ 1153.164599][T16145] tipc: Disabling bearer [ 1154.963833][T16163] pim6reg: entered allmulticast mode [ 1155.726824][T16162] pim6reg: left allmulticast mode [ 1155.750427][T16151] syz.7.2244 (16151): drop_caches: 2 [ 1157.796651][T16173] kAFS: bad VL server IP address [ 1159.281327][T16165] netlink: 'syz.7.2249': attribute type 4 has an invalid length. [ 1160.052480][T16194] pim6reg: entered allmulticast mode [ 1160.059881][T16196] pim6reg: left allmulticast mode [ 1160.094050][T16198] syzkaller0: entered promiscuous mode [ 1160.100015][T16198] syzkaller0: entered allmulticast mode [ 1160.108874][T16200] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2260'. [ 1160.128457][T16200] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2260'. [ 1162.054783][T16208] kAFS: bad VL server IP address [ 1164.080381][T16223] pim6reg: entered allmulticast mode [ 1164.101432][T16224] pim6reg: left allmulticast mode [ 1164.323527][T16232] syzkaller0: entered promiscuous mode [ 1164.343831][T16232] syzkaller0: entered allmulticast mode [ 1164.367941][T16235] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2273'. [ 1164.398181][T16235] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2273'. [ 1166.152042][T16241] kAFS: bad VL server IP address [ 1166.826823][T16265] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2285'. [ 1167.126149][T16274] syzkaller0: entered promiscuous mode [ 1167.158299][T16274] syzkaller0: entered allmulticast mode [ 1167.263412][T16279] binder: BINDER_SET_CONTEXT_MGR already set [ 1167.287673][T16279] binder: 16277:16279 ioctl 4018620d 200000004a80 returned -16 [ 1167.843999][T16295] netlink: 1688 bytes leftover after parsing attributes in process `syz.5.2299'. [ 1168.103094][T16307] syzkaller0: entered promiscuous mode [ 1168.122504][T16307] syzkaller0: entered allmulticast mode [ 1168.138141][T16304] md: could not open device unknown-block(1,0). [ 1168.594357][T16321] netlink: 1688 bytes leftover after parsing attributes in process `syz.4.2312'. [ 1168.857967][T16329] md: could not open device unknown-block(1,0). [ 1168.924328][T16334] syzkaller0: entered promiscuous mode [ 1168.957226][T16334] syzkaller0: entered allmulticast mode [ 1169.367061][T16350] netlink: 'syz.7.2322': attribute type 1 has an invalid length. [ 1169.415179][T16347] netlink: 1688 bytes leftover after parsing attributes in process `syz.8.2324'. [ 1169.427358][T16349] netlink: 1688 bytes leftover after parsing attributes in process `syz.4.2325'. [ 1169.719285][T16360] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2322'. [ 1169.900649][T16362] md: could not open device unknown-block(1,0). [ 1170.411422][T16374] netlink: 'syz.7.2335': attribute type 72 has an invalid length. [ 1172.215373][T16376] pim6reg: entered allmulticast mode [ 1172.309782][T16376] pim6reg: left allmulticast mode [ 1172.513627][T16376] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2336'. [ 1172.642214][T16390] md: could not open device unknown-block(1,0). [ 1172.785145][T16396] netlink: 'syz.7.2343': attribute type 1 has an invalid length. [ 1172.889140][T16394] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2343'. [ 1173.123119][T16403] socket: no more sockets [ 1173.128918][T16407] netlink: 'syz.7.2348': attribute type 72 has an invalid length. [ 1173.159895][T16403] socket: no more sockets [ 1175.313152][T16418] pim6reg: entered allmulticast mode [ 1175.332626][T16421] md: could not open device unknown-block(1,0). [ 1175.377404][T16418] pim6reg: left allmulticast mode [ 1175.655636][T16418] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2353'. [ 1175.749493][T16433] netlink: 'syz.5.2359': attribute type 72 has an invalid length. [ 1176.131497][T16446] syzkaller0: entered promiscuous mode [ 1176.151366][T16446] syzkaller0: entered allmulticast mode [ 1176.449029][T16453] md: could not open device unknown-block(1,0). [ 1176.491684][T16459] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2369'. [ 1177.151773][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.544824][ T5153] kworker/dying (5153) used greatest stack depth: 19592 bytes left [ 1178.688943][T16467] pim6reg: entered allmulticast mode [ 1178.721683][T16467] pim6reg: left allmulticast mode [ 1178.957541][T16483] syzkaller0: entered promiscuous mode [ 1178.965988][T16467] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2372'. [ 1178.991077][T16483] syzkaller0: entered allmulticast mode [ 1179.213880][T16492] md: could not open device unknown-block(1,0). [ 1179.265624][T16496] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2381'. [ 1179.309670][T16496] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2381'. [ 1179.799616][T16515] socket: no more sockets [ 1179.849690][T16515] socket: no more sockets [ 1179.857083][T16521] Set syz0 is full, maxelem 0 reached [ 1179.873964][T16520] syzkaller0: entered promiscuous mode [ 1179.903282][T16520] syzkaller0: entered allmulticast mode [ 1179.975778][ T28] audit: type=1800 audit(1786935014.945:82): pid=16524 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.2390" name="bmControls" dev="configfs" ino=51371 res=0 errno=0 [ 1180.030087][T16524] netlink: 'syz.5.2390': attribute type 1 has an invalid length. [ 1181.998068][T16527] pim6reg: entered allmulticast mode [ 1182.007120][T16527] pim6reg: left allmulticast mode [ 1182.123953][T16532] netlink: 96 bytes leftover after parsing attributes in process `syz.5.2390'. [ 1182.212154][T16536] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2394'. [ 1182.253335][T16527] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2391'. [ 1182.268888][T16536] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2394'. [ 1182.784948][T16548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2399'. [ 1182.820598][T16548] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2399'. [ 1182.898530][T16554] syzkaller0: entered promiscuous mode [ 1182.913926][T16554] syzkaller0: entered allmulticast mode [ 1182.940393][T16548] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2399'. [ 1183.166986][T16559] Set syz0 is full, maxelem 0 reached [ 1183.219184][T16561] netlink: 'syz.7.2403': attribute type 72 has an invalid length. [ 1185.313386][T16571] pim6reg: entered allmulticast mode [ 1185.329378][T16571] pim6reg: left allmulticast mode [ 1185.559346][T16580] syzkaller0: entered promiscuous mode [ 1185.605120][T16580] syzkaller0: entered allmulticast mode [ 1185.613454][T16572] __nla_validate_parse: 3 callbacks suppressed [ 1185.613464][T16572] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2408'. [ 1185.878804][T16588] netlink: 'syz.4.2415': attribute type 72 has an invalid length. [ 1186.192332][ T28] audit: type=1800 audit(1786935021.155:83): pid=16601 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2421" name="bmControls" dev="configfs" ino=51784 res=0 errno=0 [ 1186.226139][T16601] netlink: 'syz.7.2421': attribute type 1 has an invalid length. [ 1186.480613][T16610] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2421'. [ 1186.559061][T16612] binder: 16611:16612 ioctl 4018620d 0 returned -22 [ 1186.591358][T16612] binder_alloc: binder_alloc_mmap_handler: 16611 200000ffd000-200001000000 already mapped failed -16 [ 1186.618118][T16614] syzkaller0: entered promiscuous mode [ 1186.630879][T16614] syzkaller0: entered allmulticast mode [ 1187.106587][T16618] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.2427'. [ 1189.323576][T16634] pim6reg: entered allmulticast mode [ 1189.388806][T16612] syz.5.2425 (16612): drop_caches: 2 [ 1189.418197][T16623] pim6reg: left allmulticast mode [ 1189.527906][T16623] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2430'. [ 1190.015131][T16650] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.2440'. [ 1190.564744][T16666] netlink: 1624 bytes leftover after parsing attributes in process `syz.8.2447'. [ 1192.575986][T16677] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.2451'. [ 1192.671625][T16680] pim6reg: entered allmulticast mode [ 1192.755395][T16671] pim6reg: left allmulticast mode [ 1192.866961][T16671] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2449'. [ 1192.964171][T16687] binder: 16686:16687 ioctl c0306201 0 returned -14 [ 1193.199406][T16694] binder: 16693:16694 ioctl 4018620d 0 returned -22 [ 1193.211535][T16696] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2459'. [ 1193.233612][T16694] binder_alloc: binder_alloc_mmap_handler: 16693 200000ffd000-200001000000 already mapped failed -16 [ 1193.342955][T16698] netlink: 1624 bytes leftover after parsing attributes in process `syz.4.2460'. [ 1194.252323][T16694] syz.7.2458 (16694): drop_caches: 2 [ 1196.184419][T16719] pim6reg: entered allmulticast mode [ 1196.193924][T16722] netlink: 1624 bytes leftover after parsing attributes in process `syz.8.2470'. [ 1196.212646][T16719] pim6reg: left allmulticast mode [ 1196.232048][T16726] binder: 16724:16726 ioctl c0306201 0 returned -14 [ 1196.393768][T16719] 9pnet_virtio: no channels available for device syz [ 1196.406689][T16719] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2469'. [ 1198.200011][T16731] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2475'. [ 1198.231366][T16733] pim6reg: entered allmulticast mode [ 1198.254699][T16734] pim6reg: left allmulticast mode [ 1198.337128][T16737] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2476'. [ 1198.367108][T16737] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2476'. [ 1198.648677][T16748] Set syz0 is full, maxelem 0 reached [ 1198.925572][T16758] binder: 16756:16758 ioctl c0306201 0 returned -14 [ 1198.968580][T16760] netlink: 1752 bytes leftover after parsing attributes in process `syz.7.2485'. [ 1200.936802][T16766] pim6reg: entered allmulticast mode [ 1200.953187][T16766] pim6reg: left allmulticast mode [ 1201.246789][T16766] 9pnet_virtio: no channels available for device syz [ 1201.276276][T16766] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2487'. [ 1201.333521][T16775] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2490'. [ 1201.380662][T16775] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2490'. [ 1201.613266][T16778] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2491'. [ 1201.871757][T16789] netlink: 'syz.4.2488': attribute type 4 has an invalid length. [ 1201.880190][T16786] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2495'. [ 1202.165130][T16798] Set syz0 is full, maxelem 0 reached [ 1202.342934][T16802] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2501'. [ 1203.290551][T16828] __nla_validate_parse: 5 callbacks suppressed [ 1203.290562][T16828] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2514'. [ 1203.635134][T16837] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.2518'. [ 1203.846609][T16848] Set syz0 is full, maxelem 0 reached [ 1203.914641][T16849] netlink: 'syz.5.2515': attribute type 4 has an invalid length. [ 1203.960615][T16851] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2523'. [ 1203.981842][T16851] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2523'. [ 1204.174673][T16855] netlink: 8 bytes leftover after parsing attributes in process `syz.7.2525'. [ 1204.587891][T16863] netlink: 1752 bytes leftover after parsing attributes in process `syz.8.2529'. [ 1204.986936][T16873] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2534'. [ 1205.013992][T16875] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2535'. [ 1205.039534][T16875] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2535'. [ 1205.484992][T16892] Set syz0 is full, maxelem 0 reached [ 1205.621345][T16896] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2544'. [ 1206.626076][T16927] netlink: 'syz.7.2547': attribute type 4 has an invalid length. [ 1207.224397][T16942] Set syz0 is full, maxelem 0 reached [ 1209.474777][T16956] pim6reg: entered allmulticast mode [ 1209.550888][T16956] pim6reg: left allmulticast mode [ 1209.824460][T16956] 9pnet_virtio: no channels available for device syz [ 1209.858012][T16956] __nla_validate_parse: 10 callbacks suppressed [ 1209.858022][T16956] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2569'. [ 1210.041415][T16972] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2573'. [ 1210.357548][T16980] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2576'. [ 1210.393023][T16980] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2576'. [ 1210.669436][T16992] Set syz0 is full, maxelem 0 reached [ 1210.779554][T16994] netlink: 1688 bytes leftover after parsing attributes in process `syz.8.2582'. [ 1212.467931][T17003] pim6reg: entered allmulticast mode [ 1212.837132][T17002] netlink: 'syz.4.2581': attribute type 4 has an invalid length. [ 1212.875459][T17005] pim6reg: left allmulticast mode [ 1213.077881][T17007] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2586'. [ 1214.953831][T17009] pim6reg: entered allmulticast mode [ 1214.995573][T17009] pim6reg: left allmulticast mode [ 1215.068527][T17013] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2588'. [ 1215.103237][T17013] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2588'. [ 1215.193967][T17009] 9pnet_virtio: no channels available for device syz [ 1215.228317][T17009] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2587'. [ 1215.348983][ T28] audit: type=1800 audit(1786935050.315:84): pid=17020 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2591" name="bmControls" dev="configfs" ino=54242 res=0 errno=0 [ 1215.376819][T17020] netlink: 'syz.8.2591': attribute type 1 has an invalid length. [ 1215.686813][T17027] netlink: 96 bytes leftover after parsing attributes in process `syz.8.2591'. [ 1216.263510][T17036] binder: BINDER_SET_CONTEXT_MGR already set [ 1216.289923][T17036] binder: 17035:17036 ioctl 4018620d 200000004a80 returned -16 [ 1216.590670][T17038] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2597'. [ 1216.661305][T17041] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2598'. [ 1216.714553][T17041] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2598'. [ 1218.705413][T17047] socket: no more sockets [ 1218.782017][T17049] pim6reg: entered allmulticast mode [ 1218.812247][T17049] pim6reg: left allmulticast mode [ 1218.984852][T17049] 9pnet_virtio: no channels available for device syz [ 1218.993079][T17049] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2602'. [ 1219.128176][T17059] netlink: 'syz.7.2606': attribute type 1 has an invalid length. [ 1219.151690][T17061] binder: 17060:17061 ioctl c0306201 0 returned -14 [ 1219.840337][T17066] pim6reg: entered allmulticast mode [ 1221.278314][T17065] pim6reg: left allmulticast mode [ 1221.435425][T17068] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2606'. [ 1221.537733][T17070] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2609'. [ 1221.817491][T17076] netlink: 'syz.8.2605': attribute type 4 has an invalid length. [ 1221.908873][T17080] syzkaller0: entered promiscuous mode [ 1221.939650][T17080] syzkaller0: entered allmulticast mode [ 1222.311835][T17090] binder: 17086:17090 ioctl c0306201 0 returned -14 [ 1222.844315][T17098] pim6reg: entered allmulticast mode [ 1224.309844][T17097] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2620'. [ 1224.367938][T17096] pim6reg: left allmulticast mode [ 1224.734151][T17106] netlink: 'syz.4.2622': attribute type 1 has an invalid length. [ 1225.033725][T17109] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2622'. [ 1225.170780][T17116] syzkaller0: entered promiscuous mode [ 1225.234915][T17116] syzkaller0: entered allmulticast mode [ 1225.337253][T17118] 9pnet_virtio: no channels available for device syz [ 1225.547362][T17122] binder: 17121:17122 ioctl c0306201 0 returned -14 [ 1225.820730][T17124] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2630'. [ 1226.190745][T17130] pim6reg: entered allmulticast mode [ 1227.735954][T17129] pim6reg: left allmulticast mode [ 1228.036254][T17135] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1228.044693][T17135] CPU: 0 PID: 17135 Comm: syz.7.2633 Not tainted syzkaller #0 [ 1228.052140][T17135] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1228.062200][T17135] Call Trace: [ 1228.065469][T17135] [ 1228.068393][T17135] dump_stack_lvl+0x18c/0x250 [ 1228.073074][T17135] ? show_regs_print_info+0x20/0x20 [ 1228.078270][T17135] ? load_image+0x420/0x420 [ 1228.082781][T17135] sysfs_create_dir_ns+0x26e/0x2a0 [ 1228.087889][T17135] ? __lock_acquire+0x7d80/0x7d80 [ 1228.092910][T17135] ? sysfs_warn_dup+0xa0/0xa0 [ 1228.097579][T17135] ? rcu_is_watching+0x15/0xb0 [ 1228.102340][T17135] ? do_raw_spin_unlock+0x121/0x230 [ 1228.107541][T17135] kobject_add_internal+0x617/0xc90 [ 1228.112743][T17135] kobject_add+0x164/0x240 [ 1228.117157][T17135] ? kobject_init+0x1d0/0x1d0 [ 1228.121833][T17135] ? get_device_parent+0x366/0x390 [ 1228.126945][T17135] device_add+0x3fa/0xc40 [ 1228.131287][T17135] tty_register_device_attr+0x425/0x950 [ 1228.136833][T17135] ? tty_register_device+0x30/0x30 [ 1228.141943][T17135] ? tty_port_init+0x132/0x1a0 [ 1228.146697][T17135] ? gsm_dlci_alloc+0x32a/0x630 [ 1228.151550][T17135] ? __might_fault+0xaa/0x120 [ 1228.156230][T17135] gsm_activate_mux+0x110/0x2a0 [ 1228.161089][T17135] gsmld_ioctl+0x12ca/0x1900 [ 1228.165681][T17135] ? gsmld_write+0x120/0x120 [ 1228.170271][T17135] ? __init_ldsem+0x150/0x150 [ 1228.174942][T17135] ? __fget_files+0x28/0x460 [ 1228.179537][T17135] ? gsmld_write+0x120/0x120 [ 1228.184120][T17135] tty_ioctl+0x9b5/0xdc0 [ 1228.188359][T17135] ? tty_get_icount+0xb0/0xb0 [ 1228.193031][T17135] __se_sys_ioctl+0xfd/0x170 [ 1228.197622][T17135] do_syscall_64+0x55/0xb0 [ 1228.202033][T17135] ? clear_bhb_loop+0x40/0x90 [ 1228.206703][T17135] ? clear_bhb_loop+0x40/0x90 [ 1228.211378][T17135] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1228.217268][T17135] RIP: 0033:0x7f483759e0d9 [ 1228.221675][T17135] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1228.241275][T17135] RSP: 002b:00007f4838447028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1228.249681][T17135] RAX: ffffffffffffffda RBX: 00007f4837825fa0 RCX: 00007f483759e0d9 [ 1228.257652][T17135] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1228.265614][T17135] RBP: 00007f4837635024 R08: 0000000000000000 R09: 0000000000000000 [ 1228.273577][T17135] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1228.281538][T17135] R13: 00007f4837826038 R14: 00007f4837825fa0 R15: 00007ffc6d19a1d8 [ 1228.289508][T17135] [ 1228.430971][T17141] netlink: 'syz.4.2636': attribute type 1 has an invalid length. [ 1228.534427][T17135] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1228.555827][T17145] 9pnet_virtio: no channels available for device syz [ 1228.705584][T17148] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2636'. [ 1229.649629][T17166] pim6reg: entered allmulticast mode [ 1231.441208][T17167] netlink: 'syz.8.2637': attribute type 4 has an invalid length. [ 1231.489124][T17164] pim6reg: left allmulticast mode [ 1231.782498][T17175] 9pnet_virtio: no channels available for device syz [ 1231.967182][ T28] audit: type=1800 audit(1786935066.935:85): pid=17179 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2649" name="bmControls" dev="configfs" ino=54985 res=0 errno=0 [ 1231.996468][T17179] netlink: 'syz.7.2649': attribute type 1 has an invalid length. [ 1232.302832][T17190] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2649'. [ 1234.236766][T17202] pim6reg: entered allmulticast mode [ 1234.715526][T17203] pim6reg: left allmulticast mode [ 1234.969278][T17208] 9pnet_virtio: no channels available for device syz [ 1235.707970][T17233] netlink: 1624 bytes leftover after parsing attributes in process `syz.8.2669'. [ 1237.658905][T17236] pim6reg: entered allmulticast mode [ 1237.715700][T17237] pim6reg: left allmulticast mode [ 1238.023744][T17240] 9pnet_virtio: no channels available for device syz [ 1238.103989][T17241] netlink: 'syz.4.2668': attribute type 4 has an invalid length. [ 1238.674558][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1240.391842][T17256] pim6reg: entered allmulticast mode [ 1240.419475][T17256] pim6reg: left allmulticast mode [ 1241.628807][T17266] pim6reg: entered allmulticast mode [ 1242.249982][T17267] pim6reg: left allmulticast mode [ 1242.735873][T17282] Set syz0 is full, maxelem 0 reached [ 1242.967385][T17285] netlink: 'syz.5.2679': attribute type 4 has an invalid length. [ 1243.123044][T17289] 9pnet_virtio: no channels available for device syz [ 1243.743140][T17303] binder_alloc: binder_alloc_mmap_handler: 17302 200000ffd000-200001000000 already mapped failed -16 [ 1244.931995][T17312] pim6reg: entered allmulticast mode [ 1245.860794][T17311] pim6reg: left allmulticast mode [ 1245.988136][T17303] syz.4.2688 (17303): drop_caches: 2 [ 1246.167876][T17320] 9pnet_virtio: no channels available for device syz [ 1246.534948][T17335] Set syz0 is full, maxelem 0 reached [ 1248.385825][T17343] pim6reg: entered allmulticast mode [ 1248.531520][T17345] pim6reg: left allmulticast mode [ 1248.785627][T17353] 9pnet_virtio: no channels available for device syz [ 1250.690959][T17357] pim6reg: entered allmulticast mode [ 1250.703846][T17357] pim6reg: left allmulticast mode [ 1250.899061][T17357] 9pnet_virtio: no channels available for device syz [ 1251.199968][T17376] Set syz0 is full, maxelem 0 reached [ 1252.508821][T17381] pim6reg: entered allmulticast mode [ 1253.075481][T17378] pim6reg: left allmulticast mode [ 1253.277811][T17386] 9pnet_virtio: no channels available for device syz [ 1253.387007][T17389] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1253.466540][T17389] CPU: 0 PID: 17389 Comm: syz.8.2718 Not tainted syzkaller #0 [ 1253.474046][T17389] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1253.484092][T17389] Call Trace: [ 1253.487363][T17389] [ 1253.490287][T17389] dump_stack_lvl+0x18c/0x250 [ 1253.494965][T17389] ? show_regs_print_info+0x20/0x20 [ 1253.500162][T17389] ? load_image+0x420/0x420 [ 1253.504673][T17389] sysfs_create_dir_ns+0x26e/0x2a0 [ 1253.509777][T17389] ? __lock_acquire+0x7d80/0x7d80 [ 1253.514805][T17389] ? sysfs_warn_dup+0xa0/0xa0 [ 1253.519471][T17389] ? rcu_is_watching+0x15/0xb0 [ 1253.524235][T17389] ? do_raw_spin_unlock+0x121/0x230 [ 1253.529431][T17389] kobject_add_internal+0x617/0xc90 [ 1253.534642][T17389] kobject_add+0x164/0x240 [ 1253.539065][T17389] ? kobject_init+0x1d0/0x1d0 [ 1253.543742][T17389] ? get_device_parent+0x366/0x390 [ 1253.548848][T17389] device_add+0x3fa/0xc40 [ 1253.553175][T17389] tty_register_device_attr+0x425/0x950 [ 1253.558721][T17389] ? tty_register_device+0x30/0x30 [ 1253.563833][T17389] ? tty_port_init+0x132/0x1a0 [ 1253.568590][T17389] ? gsm_dlci_alloc+0x32a/0x630 [ 1253.573434][T17389] ? __might_fault+0xaa/0x120 [ 1253.578104][T17389] gsm_activate_mux+0x110/0x2a0 [ 1253.582953][T17389] gsmld_ioctl+0x12ca/0x1900 [ 1253.587546][T17389] ? gsmld_write+0x120/0x120 [ 1253.592136][T17389] ? __init_ldsem+0x150/0x150 [ 1253.596808][T17389] ? __fget_files+0x28/0x460 [ 1253.601404][T17389] ? gsmld_write+0x120/0x120 [ 1253.605986][T17389] tty_ioctl+0x9b5/0xdc0 [ 1253.610227][T17389] ? tty_get_icount+0xb0/0xb0 [ 1253.614898][T17389] __se_sys_ioctl+0xfd/0x170 [ 1253.619490][T17389] do_syscall_64+0x55/0xb0 [ 1253.623900][T17389] ? clear_bhb_loop+0x40/0x90 [ 1253.628653][T17389] ? clear_bhb_loop+0x40/0x90 [ 1253.633330][T17389] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1253.639222][T17389] RIP: 0033:0x7ff84639e0d9 [ 1253.643632][T17389] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1253.663238][T17389] RSP: 002b:00007ff847310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1253.671652][T17389] RAX: ffffffffffffffda RBX: 00007ff846626090 RCX: 00007ff84639e0d9 [ 1253.679629][T17389] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000005 [ 1253.687595][T17389] RBP: 00007ff846435024 R08: 0000000000000000 R09: 0000000000000000 [ 1253.695560][T17389] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1253.703523][T17389] R13: 00007ff846626128 R14: 00007ff846626090 R15: 00007fffe44c89e8 [ 1253.711498][T17389] [ 1254.250302][T17389] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1254.278557][T17397] netlink: 'syz.7.2716': attribute type 4 has an invalid length. [ 1256.473258][T17402] pim6reg: entered allmulticast mode [ 1256.506381][T17402] pim6reg: left allmulticast mode [ 1256.614759][T17402] 9pnet_virtio: no channels available for device syz [ 1256.720201][T17405] gadgetfs: bound to dummy_udc driver [ 1256.861245][T17409] Set syz0 is full, maxelem 0 reached [ 1257.025404][ T6518] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1257.045289][T13800] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1258.588277][ C0] gadgetfs: connected [ 1258.623717][ T6518] gadgetfs: disconnected [ 1258.740740][T17412] pim6reg: entered allmulticast mode [ 1258.807913][T13800] usb 6-1: config 0 has no interfaces? [ 1258.865114][T13800] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1258.887814][T13800] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1258.896815][T17411] pim6reg: left allmulticast mode [ 1258.929710][T13800] usb 6-1: Product: syz [ 1258.933873][T13800] usb 6-1: Manufacturer: syz [ 1258.975338][T13800] usb 6-1: SerialNumber: syz [ 1258.998619][T13800] usb 6-1: config 0 descriptor?? [ 1259.036736][ C0] gadgetfs: connected [ 1259.044862][ T6518] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1259.092170][ T6518] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1259.133466][ C0] gadgetfs: configuration #1 [ 1259.154476][ T6518] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input8 [ 1259.240056][ C0] usbtouchscreen 1-1:1.0: usbtouch_irq - usb_submit_urb failed with result: -1 [ 1259.331450][T17405] gadgetfs: suspended from state 3 [ 1259.366135][ T6518] usb 1-1: USB disconnect, device number 2 [ 1259.372014][T17405] gadgetfs: disconnected [ 1259.425691][ T9] usb 6-1: USB disconnect, device number 4 [ 1259.465302][T13792] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1259.655494][T13792] usb 9-1: Using ep0 maxpacket: 8 [ 1259.668988][T13792] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 1259.693398][T13792] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1259.751114][T13792] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1259.775855][T17427] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1259.784289][T17427] CPU: 0 PID: 17427 Comm: syz.4.2733 Not tainted syzkaller #0 [ 1259.791828][T17427] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1259.801874][T17427] Call Trace: [ 1259.805234][T17427] [ 1259.808160][T17427] dump_stack_lvl+0x18c/0x250 [ 1259.812843][T17427] ? show_regs_print_info+0x20/0x20 [ 1259.818039][T17427] ? load_image+0x420/0x420 [ 1259.822560][T17427] sysfs_create_dir_ns+0x26e/0x2a0 [ 1259.827668][T17427] ? __lock_acquire+0x7d80/0x7d80 [ 1259.832694][T17427] ? sysfs_warn_dup+0xa0/0xa0 [ 1259.837360][T17427] ? rcu_is_watching+0x15/0xb0 [ 1259.842125][T17427] ? do_raw_spin_unlock+0x121/0x230 [ 1259.847332][T17427] kobject_add_internal+0x617/0xc90 [ 1259.852537][T17427] kobject_add+0x164/0x240 [ 1259.856951][T17427] ? kobject_init+0x1d0/0x1d0 [ 1259.861641][T17427] ? get_device_parent+0x366/0x390 [ 1259.866753][T17427] device_add+0x3fa/0xc40 [ 1259.871098][T17427] tty_register_device_attr+0x425/0x950 [ 1259.876659][T17427] ? tty_register_device+0x30/0x30 [ 1259.881790][T17427] ? tty_port_init+0x132/0x1a0 [ 1259.886545][T17427] ? gsm_dlci_alloc+0x32a/0x630 [ 1259.891388][T17427] ? __might_fault+0xaa/0x120 [ 1259.896059][T17427] gsm_activate_mux+0x110/0x2a0 [ 1259.900908][T17427] gsmld_ioctl+0x12ca/0x1900 [ 1259.905509][T17427] ? gsmld_write+0x120/0x120 [ 1259.910104][T17427] ? __init_ldsem+0x150/0x150 [ 1259.914787][T17427] ? __fget_files+0x28/0x460 [ 1259.919384][T17427] ? gsmld_write+0x120/0x120 [ 1259.923990][T17427] tty_ioctl+0x9b5/0xdc0 [ 1259.928230][T17427] ? tty_get_icount+0xb0/0xb0 [ 1259.932908][T17427] __se_sys_ioctl+0xfd/0x170 [ 1259.937498][T17427] do_syscall_64+0x55/0xb0 [ 1259.941909][T17427] ? clear_bhb_loop+0x40/0x90 [ 1259.946578][T17427] ? clear_bhb_loop+0x40/0x90 [ 1259.951248][T17427] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1259.957134][T17427] RIP: 0033:0x7f4d6dd9e0d9 [ 1259.961553][T17427] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1259.981150][T17427] RSP: 002b:00007f4d6ec7c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1259.989574][T17427] RAX: ffffffffffffffda RBX: 00007f4d6e026090 RCX: 00007f4d6dd9e0d9 [ 1259.997539][T17427] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000005 [ 1260.005514][T17427] RBP: 00007f4d6de35024 R08: 0000000000000000 R09: 0000000000000000 [ 1260.013475][T17427] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1260.021450][T17427] R13: 00007f4d6e026128 R14: 00007f4d6e026090 R15: 00007ffc7e9f4e98 [ 1260.029427][T17427] [ 1260.103673][T13792] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1260.191946][T13792] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1260.273517][T17427] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1260.318079][T13792] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1260.390188][T13792] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1260.541569][T17429] netlink: 1624 bytes leftover after parsing attributes in process `syz.5.2734'. [ 1260.690479][T13792] usb 9-1: usb_control_msg returned -71 [ 1260.735028][T13792] usbtmc 9-1:16.0: can't read capabilities [ 1260.831766][T13792] usb 9-1: USB disconnect, device number 2 [ 1260.956017][T17433] netlink: 'syz.7.2732': attribute type 4 has an invalid length. [ 1262.786000][T17436] pim6reg: entered allmulticast mode [ 1262.910338][T17438] pim6reg: left allmulticast mode [ 1263.177156][T17441] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2737'. [ 1263.764732][T17452] binder: BINDER_SET_CONTEXT_MGR already set [ 1263.803372][T17452] binder: 17451:17452 ioctl 4018620d 200000004a80 returned -16 [ 1263.843984][T17452] binder_alloc: binder_alloc_mmap_handler: 17451 200000ffd000-200001000000 already mapped failed -16 [ 1263.970446][T17456] netlink: 'syz.8.2738': attribute type 4 has an invalid length. [ 1264.412928][T17452] syz.5.2742 (17452): drop_caches: 2 [ 1265.628614][T17468] pim6reg: entered allmulticast mode [ 1267.063733][T17467] pim6reg: left allmulticast mode [ 1269.422650][T17476] pim6reg: entered allmulticast mode [ 1269.463885][T17476] pim6reg: left allmulticast mode [ 1269.730871][T17476] 9pnet_virtio: no channels available for device syz [ 1269.809629][T17484] 9pnet_virtio: no channels available for device syz [ 1270.235109][T17495] pim6reg: entered allmulticast mode [ 1271.986465][T17493] pim6reg: left allmulticast mode [ 1272.119494][T17503] netlink: 'syz.4.2753': attribute type 4 has an invalid length. [ 1272.526893][T17516] 9pnet_virtio: no channels available for device syz [ 1274.522777][T17522] pim6reg: entered allmulticast mode [ 1274.574027][T17522] pim6reg: left allmulticast mode [ 1276.263791][T17531] pim6reg: entered allmulticast mode [ 1276.473559][T17532] pim6reg: left allmulticast mode [ 1277.002798][T17544] 9pnet_virtio: no channels available for device syz [ 1279.571440][T17563] pim6reg: entered allmulticast mode [ 1280.946390][T17555] pim6reg: entered allmulticast mode [ 1280.960210][T17561] netlink: 1688 bytes leftover after parsing attributes in process `syz.8.2782'. [ 1281.012046][T17555] pim6reg: left allmulticast mode [ 1281.219136][T17555] 9pnet_virtio: no channels available for device syz [ 1281.405823][T17575] 9pnet_virtio: no channels available for device syz [ 1283.185542][T17587] pim6reg: left allmulticast mode [ 1283.794529][T17589] netlink: 1688 bytes leftover after parsing attributes in process `syz.4.2793'. [ 1283.977088][T17594] netlink: 'syz.8.2788': attribute type 4 has an invalid length. [ 1284.053380][T17597] netlink: 'syz.5.2789': attribute type 4 has an invalid length. [ 1284.313928][T17605] tipc: Enabling of bearer rejected, failed to enable media [ 1284.386304][T17607] 9pnet_virtio: no channels available for device syz [ 1284.832943][T17623] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2800'. [ 1284.882373][T17623] Set syz0 is full, maxelem 0 reached [ 1286.750348][T17631] pim6reg: entered allmulticast mode [ 1287.262003][T17630] pim6reg: left allmulticast mode [ 1287.354461][T17633] netlink: 1688 bytes leftover after parsing attributes in process `syz.5.2804'. [ 1287.592798][T17641] 9pnet_virtio: no channels available for device syz [ 1287.777308][T17648] binder: 17647:17648 ioctl 4018620d 0 returned -22 [ 1288.095435][T17659] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2814'. [ 1288.135814][T17659] Set syz0 is full, maxelem 0 reached [ 1288.819924][T17662] pim6reg: entered allmulticast mode [ 1289.919076][T17661] pim6reg: left allmulticast mode [ 1290.275674][T17669] netlink: 'syz.5.2812': attribute type 4 has an invalid length. [ 1290.342262][T17674] 9pnet_virtio: no channels available for device syz [ 1290.526170][T17677] kAFS: bad VL server IP address [ 1290.545339][ T28] audit: type=1800 audit(1786935125.505:86): pid=17678 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2823" name="bmControls" dev="configfs" ino=57796 res=0 errno=0 [ 1290.573743][T17678] netlink: 'syz.7.2823': attribute type 1 has an invalid length. [ 1290.812638][T17690] gadgetfs: bound to dummy_udc driver [ 1290.930060][T17692] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2823'. [ 1291.146262][T13792] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1291.155323][ T9] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1291.204891][ C0] gadgetfs: connected [ 1291.210238][T13792] gadgetfs: disconnected [ 1291.379680][ T9] usb 9-1: config 0 has no interfaces? [ 1291.405427][ C0] gadgetfs: connected [ 1291.415372][T13792] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1291.445541][ T9] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1291.468761][T13792] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1291.481651][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.872553][ C0] gadgetfs: configuration #1 [ 1292.113795][T17700] pim6reg: entered allmulticast mode [ 1292.361995][ T9] usb 9-1: Product: syz [ 1292.979674][T13792] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input9 [ 1293.305056][ T9] usb 9-1: Manufacturer: syz [ 1293.339050][ T9] usb 9-1: SerialNumber: syz [ 1293.346963][T17699] pim6reg: left allmulticast mode [ 1293.408880][ T9] usb 9-1: config 0 descriptor?? [ 1293.564573][T17702] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2829'. [ 1293.610313][T17702] Set syz0 is full, maxelem 0 reached [ 1293.682132][T13792] usb 9-1: USB disconnect, device number 3 [ 1293.690612][T17688] gadgetfs: suspended from state 3 [ 1293.725019][ T9] usb 1-1: USB disconnect, device number 3 [ 1293.732771][T17688] gadgetfs: disconnected [ 1293.964649][T17713] 9pnet_virtio: no channels available for device syz [ 1294.097234][T17718] kAFS: bad VL server IP address [ 1294.164353][T17724] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1294.269098][T17724] CPU: 0 PID: 17724 Comm: syz.5.2836 Not tainted syzkaller #0 [ 1294.276577][T17724] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1294.286623][T17724] Call Trace: [ 1294.289894][T17724] [ 1294.292821][T17724] dump_stack_lvl+0x18c/0x250 [ 1294.297496][T17724] ? show_regs_print_info+0x20/0x20 [ 1294.302685][T17724] ? load_image+0x420/0x420 [ 1294.307202][T17724] sysfs_create_dir_ns+0x26e/0x2a0 [ 1294.312303][T17724] ? __lock_acquire+0x7d80/0x7d80 [ 1294.317323][T17724] ? sysfs_warn_dup+0xa0/0xa0 [ 1294.321993][T17724] ? rcu_is_watching+0x15/0xb0 [ 1294.326755][T17724] ? do_raw_spin_unlock+0x121/0x230 [ 1294.331952][T17724] kobject_add_internal+0x617/0xc90 [ 1294.337152][T17724] kobject_add+0x164/0x240 [ 1294.341584][T17724] ? kobject_init+0x1d0/0x1d0 [ 1294.346270][T17724] ? get_device_parent+0x366/0x390 [ 1294.351392][T17724] device_add+0x3fa/0xc40 [ 1294.355727][T17724] tty_register_device_attr+0x425/0x950 [ 1294.361274][T17724] ? tty_register_device+0x30/0x30 [ 1294.366399][T17724] ? tty_port_init+0x132/0x1a0 [ 1294.371183][T17724] ? gsm_dlci_alloc+0x32a/0x630 [ 1294.376032][T17724] ? __might_fault+0xaa/0x120 [ 1294.380716][T17724] gsm_activate_mux+0x110/0x2a0 [ 1294.385569][T17724] gsmld_ioctl+0x12ca/0x1900 [ 1294.390160][T17724] ? gsmld_write+0x120/0x120 [ 1294.394757][T17724] ? __init_ldsem+0x150/0x150 [ 1294.399432][T17724] ? __fget_files+0x28/0x460 [ 1294.404025][T17724] ? gsmld_write+0x120/0x120 [ 1294.408630][T17724] tty_ioctl+0x9b5/0xdc0 [ 1294.412870][T17724] ? tty_get_icount+0xb0/0xb0 [ 1294.417542][T17724] __se_sys_ioctl+0xfd/0x170 [ 1294.422129][T17724] do_syscall_64+0x55/0xb0 [ 1294.426536][T17724] ? clear_bhb_loop+0x40/0x90 [ 1294.431204][T17724] ? clear_bhb_loop+0x40/0x90 [ 1294.435878][T17724] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1294.441768][T17724] RIP: 0033:0x7fca5eb9e0d9 [ 1294.446184][T17724] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1294.465805][T17724] RSP: 002b:00007fca5faf5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1294.474211][T17724] RAX: ffffffffffffffda RBX: 00007fca5ee26090 RCX: 00007fca5eb9e0d9 [ 1294.482177][T17724] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1294.490140][T17724] RBP: 00007fca5ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 1294.498114][T17724] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1294.506075][T17724] R13: 00007fca5ee26128 R14: 00007fca5ee26090 R15: 00007ffce474f5a8 [ 1294.514064][T17724] [ 1295.165843][T17724] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1295.543315][T17751] netlink: 'syz.8.2840': attribute type 4 has an invalid length. [ 1295.667831][T17756] kAFS: bad VL server IP address [ 1296.070806][T17770] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2848'. [ 1296.112088][T17770] Set syz0 is full, maxelem 0 reached [ 1296.617675][ T28] audit: type=1800 audit(1786935131.585:87): pid=17772 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.2850" name="bmControls" dev="configfs" ino=58422 res=0 errno=0 [ 1296.646003][T17772] netlink: 'syz.7.2850': attribute type 1 has an invalid length. [ 1296.963737][T17775] netlink: 96 bytes leftover after parsing attributes in process `syz.7.2850'. [ 1297.497801][T17788] gadgetfs: bound to dummy_udc driver [ 1297.628537][T17791] kAFS: bad VL server IP address [ 1297.815340][ T6518] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1297.822876][ T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1297.853786][ C0] gadgetfs: connected [ 1297.858220][ T6518] gadgetfs: disconnected [ 1297.963131][T17805] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2860'. [ 1297.994121][T17805] Set syz0 is full, maxelem 0 reached [ 1298.035531][ C0] gadgetfs: connected [ 1298.040817][ T9] usb 5-1: config 0 has no interfaces? [ 1298.048089][ T6518] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1298.073437][ T9] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1298.090551][ T6518] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1298.107031][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1298.133251][ C0] gadgetfs: configuration #1 [ 1298.149506][ T9] usb 5-1: Product: syz [ 1298.157750][ T6518] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input10 [ 1298.183279][ T9] usb 5-1: Manufacturer: syz [ 1298.205335][ T9] usb 5-1: SerialNumber: syz [ 1298.247148][ T9] usb 5-1: config 0 descriptor?? [ 1298.497761][T17788] gadgetfs: suspended from state 3 [ 1298.503270][ T6518] usb 1-1: USB disconnect, device number 4 [ 1298.521064][T17788] gadgetfs: disconnected [ 1298.571234][ T9] usb 5-1: USB disconnect, device number 3 [ 1298.619293][T17807] netlink: 'syz.5.2861': attribute type 4 has an invalid length. [ 1299.202478][ T28] audit: type=1800 audit(1786935134.165:88): pid=17822 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2867" name="bmControls" dev="configfs" ino=58777 res=0 errno=0 [ 1299.227955][T17822] netlink: 'syz.8.2867': attribute type 1 has an invalid length. [ 1299.443404][T17827] kAFS: bad VL server IP address [ 1299.529641][T17835] netlink: 96 bytes leftover after parsing attributes in process `syz.8.2867'. [ 1300.061616][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.515619][T17839] pim6reg: entered allmulticast mode [ 1301.570242][T17839] pim6reg: left allmulticast mode [ 1301.888526][T17839] 9pnet_virtio: no channels available for device syz [ 1302.031157][T17847] netlink: 'syz.4.2874': attribute type 1 has an invalid length. [ 1302.111890][T17847] bond14: entered promiscuous mode [ 1302.124911][T17853] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2873'. [ 1302.145798][T17847] 8021q: adding VLAN 0 to HW filter on device bond14 [ 1302.157943][T17853] Set syz0 is full, maxelem 0 reached [ 1303.765023][T17854] bond14: (slave bridge7): making interface the new active one [ 1303.983269][T17854] bridge7: entered promiscuous mode [ 1304.021550][T17854] bond14: (slave bridge7): Enslaving as an active interface with an up link [ 1304.223565][T17867] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2879'. [ 1304.235125][T17868] gadgetfs: bound to dummy_udc driver [ 1304.280534][T17867] netlink: 48 bytes leftover after parsing attributes in process `syz.8.2879'. [ 1304.535441][ T6518] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1304.570468][ C0] gadgetfs: connected [ 1304.577945][ T9] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 1304.592090][ T6518] gadgetfs: disconnected [ 1304.795504][ C0] gadgetfs: connected [ 1304.800434][ T6518] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1304.810575][ T9] usb 8-1: config 0 has no interfaces? [ 1306.120241][ T9] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1306.179991][ T6518] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1306.466372][T17878] pim6reg: entered allmulticast mode [ 1306.495542][T17878] pim6reg: left allmulticast mode [ 1306.513692][ C0] gadgetfs: configuration #1 [ 1306.525234][ T9] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1306.561942][ T6518] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input11 [ 1306.605222][ T9] usb 8-1: Product: syz [ 1306.633656][ T9] usb 8-1: Manufacturer: syz [ 1306.681112][ T9] usb 8-1: SerialNumber: syz [ 1306.741837][ T9] usb 8-1: config 0 descriptor?? [ 1306.979906][T17878] 9pnet_virtio: no channels available for device syz [ 1307.077928][T17868] gadgetfs: suspended from state 3 [ 1307.083338][T13785] usb 1-1: USB disconnect, device number 5 [ 1307.116523][T17868] gadgetfs: disconnected [ 1307.131743][T17896] netlink: 'syz.5.2882': attribute type 4 has an invalid length. [ 1307.141026][T17895] 9pnet_virtio: no channels available for device syz [ 1307.184897][ T9] usb 8-1: USB disconnect, device number 3 [ 1307.477578][T17906] Set syz0 is full, maxelem 0 reached [ 1307.666832][T17910] gadgetfs: bound to dummy_udc driver [ 1307.821984][T17914] netlink: 'syz.7.2891': attribute type 1 has an invalid length. [ 1307.891762][T17914] bond11: entered promiscuous mode [ 1307.908511][T17914] 8021q: adding VLAN 0 to HW filter on device bond11 [ 1307.943856][T17917] bond11: (slave bridge9): making interface the new active one [ 1307.951708][ T9] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1307.965943][T13785] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1307.980869][ C0] gadgetfs: connected [ 1307.995314][ T9] gadgetfs: disconnected [ 1308.186688][T13785] usb 9-1: config 0 has no interfaces? [ 1308.415429][ C0] gadgetfs: connected [ 1308.485236][ T9] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1308.494273][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1309.247844][T13785] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1309.419356][T17917] bridge9: entered promiscuous mode [ 1309.863440][T13785] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1309.873637][T17917] bond11: (slave bridge9): Enslaving as an active interface with an up link [ 1309.901581][ C0] gadgetfs: configuration #1 [ 1309.910830][ T9] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input12 [ 1309.929490][T13785] usb 9-1: Product: syz [ 1309.956399][T13785] usb 9-1: Manufacturer: syz [ 1309.961011][T13785] usb 9-1: SerialNumber: syz [ 1310.028801][T13785] usb 9-1: config 0 descriptor?? [ 1310.783476][T17922] pim6reg: entered allmulticast mode [ 1311.986044][T17923] gadgetfs: suspended from state 3 [ 1311.996672][ T9] usb 1-1: USB disconnect, device number 6 [ 1312.030311][T17921] pim6reg: left allmulticast mode [ 1312.041932][T17923] gadgetfs: disconnected [ 1312.061679][ T6517] usb 9-1: USB disconnect, device number 4 [ 1312.135623][T17926] binder: BINDER_SET_CONTEXT_MGR already set [ 1312.171882][T17926] binder: 17925:17926 ioctl 4018620d 200000004a80 returned -16 [ 1312.293366][T17930] gadgetfs: bound to dummy_udc driver [ 1312.311135][T17932] 9pnet_virtio: no channels available for device syz [ 1312.403559][T17934] socket: no more sockets [ 1312.413327][T17934] socket: no more sockets [ 1312.428329][T17934] socket: no more sockets [ 1312.440692][T17934] socket: no more sockets [ 1312.595662][T13785] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1312.665406][ T9] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1312.689827][ C0] gadgetfs: connected [ 1312.701279][ T9] gadgetfs: disconnected [ 1312.791510][T17943] Set syz0 is full, maxelem 0 reached [ 1312.800436][T13785] usb 6-1: config 0 has no interfaces? [ 1312.815494][T13785] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1312.834557][T13785] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1312.858467][T13785] usb 6-1: Product: syz [ 1312.870904][T13785] usb 6-1: Manufacturer: syz [ 1312.881798][T13785] usb 6-1: SerialNumber: syz [ 1312.888044][ C0] gadgetfs: connected [ 1312.896938][ T9] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1312.910305][T17945] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2901'. [ 1312.923089][T13785] usb 6-1: config 0 descriptor?? [ 1312.936558][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1312.959523][T17945] netlink: 36 bytes leftover after parsing attributes in process `syz.8.2901'. [ 1312.982850][ C0] gadgetfs: configuration #1 [ 1313.008512][ T9] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input13 [ 1313.128687][T17947] netlink: 'syz.7.2902': attribute type 1 has an invalid length. [ 1313.151376][T17930] gadgetfs: suspended from state 3 [ 1313.174814][ T9] usb 1-1: USB disconnect, device number 7 [ 1313.182718][T17930] gadgetfs: disconnected [ 1313.222615][T13785] usb 6-1: USB disconnect, device number 5 [ 1313.280754][T17947] bond12: entered promiscuous mode [ 1314.661270][T17947] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1315.168329][T17951] bond12: (slave bridge10): making interface the new active one [ 1315.223266][T17951] bridge10: entered promiscuous mode [ 1315.257569][T17951] bond12: (slave bridge10): Enslaving as an active interface with an up link [ 1315.541580][T17960] socket: no more sockets [ 1315.587002][T17960] socket: no more sockets [ 1315.613976][T17960] socket: no more sockets [ 1315.649679][T17960] socket: no more sockets [ 1315.763262][T17970] netlink: 'syz.8.2903': attribute type 4 has an invalid length. [ 1315.990850][T17975] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2911'. [ 1316.014197][T17975] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2911'. [ 1316.178153][T17978] gadgetfs: bound to dummy_udc driver [ 1316.339416][T17984] Set syz0 is full, maxelem 0 reached [ 1316.445257][ T6518] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1316.467465][ C0] gadgetfs: connected [ 1316.479133][ T6518] gadgetfs: disconnected [ 1316.505306][ T6517] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 1316.665532][ C0] gadgetfs: connected [ 1316.671946][ T6518] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1316.710427][ T6517] usb 8-1: config 0 has no interfaces? [ 1316.801906][ T6518] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1316.810437][ T6517] usb 8-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1316.826426][T17988] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2917'. [ 1316.840046][ T6517] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1316.858703][ C0] gadgetfs: configuration #1 [ 1316.866187][ T6518] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input14 [ 1316.891470][ T6517] usb 8-1: Product: syz [ 1316.922210][ T6517] usb 8-1: Manufacturer: syz [ 1316.948960][ T6517] usb 8-1: SerialNumber: syz [ 1316.979957][ T6517] usb 8-1: config 0 descriptor?? [ 1317.227065][T17978] gadgetfs: suspended from state 3 [ 1317.256004][T17978] gadgetfs: disconnected [ 1317.265011][ T6518] usb 1-1: USB disconnect, device number 8 [ 1317.300249][ T6517] usb 8-1: USB disconnect, device number 4 [ 1317.673740][T18001] kAFS: bad VL server IP address [ 1317.818434][T18006] 9pnet_virtio: no channels available for device syz [ 1318.152074][T18009] pim6reg: entered allmulticast mode [ 1319.655779][T18008] pim6reg: left allmulticast mode [ 1319.871060][T18013] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2926'. [ 1320.140647][T18025] Set syz0 is full, maxelem 0 reached [ 1320.278813][T18031] socket: no more sockets [ 1320.316948][T18031] socket: no more sockets [ 1320.358927][T18031] socket: no more sockets [ 1320.939545][T18036] kAFS: bad VL server IP address [ 1320.967879][T18040] netlink: 'syz.7.2930': attribute type 4 has an invalid length. [ 1321.161447][T18044] gadgetfs: bound to dummy_udc driver [ 1321.465993][ T6517] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1321.475263][ T6518] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1322.089059][T18052] pim6reg: entered allmulticast mode [ 1323.210358][ C0] gadgetfs: connected [ 1323.229056][ T6517] gadgetfs: disconnected [ 1323.267150][ T6518] usb 9-1: config 0 has no interfaces? [ 1323.417931][ T6518] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1323.431741][T18050] pim6reg: left allmulticast mode [ 1323.450112][ T6518] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1323.506262][T18053] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2939'. [ 1323.517162][ T6518] usb 9-1: Product: syz [ 1323.521325][ T6518] usb 9-1: Manufacturer: syz [ 1323.551977][ T6518] usb 9-1: SerialNumber: syz [ 1323.565632][ C0] gadgetfs: connected [ 1323.570901][ T6517] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1323.593852][ T6518] usb 9-1: config 0 descriptor?? [ 1323.605869][ T6517] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1323.675571][ C0] gadgetfs: configuration #1 [ 1323.721084][ T6517] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input15 [ 1323.756648][T18056] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2940'. [ 1323.827730][T18056] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2940'. [ 1323.845600][T18044] gadgetfs: suspended from state 3 [ 1323.878131][T18044] gadgetfs: disconnected [ 1323.882740][T13785] usb 1-1: USB disconnect, device number 9 [ 1323.882777][ C0] usbtouchscreen 1-1:1.0: usbtouch_irq - usb_submit_urb failed with result: -19 [ 1323.939623][ T6518] usb 9-1: USB disconnect, device number 5 [ 1324.410135][T18070] Set syz0 is full, maxelem 0 reached [ 1324.536042][T18075] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1324.618398][T18075] CPU: 0 PID: 18075 Comm: syz.7.2946 Not tainted syzkaller #0 [ 1324.625875][T18075] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1324.635924][T18075] Call Trace: [ 1324.639196][T18075] [ 1324.642122][T18075] dump_stack_lvl+0x18c/0x250 [ 1324.646822][T18075] ? show_regs_print_info+0x20/0x20 [ 1324.652024][T18075] ? load_image+0x420/0x420 [ 1324.656535][T18075] sysfs_create_dir_ns+0x26e/0x2a0 [ 1324.661651][T18075] ? __lock_acquire+0x7d80/0x7d80 [ 1324.666679][T18075] ? sysfs_warn_dup+0xa0/0xa0 [ 1324.671345][T18075] ? rcu_is_watching+0x15/0xb0 [ 1324.676110][T18075] ? do_raw_spin_unlock+0x121/0x230 [ 1324.681310][T18075] kobject_add_internal+0x617/0xc90 [ 1324.686509][T18075] kobject_add+0x164/0x240 [ 1324.690925][T18075] ? kobject_init+0x1d0/0x1d0 [ 1324.695603][T18075] ? get_device_parent+0x366/0x390 [ 1324.700712][T18075] device_add+0x3fa/0xc40 [ 1324.705035][T18075] tty_register_device_attr+0x425/0x950 [ 1324.710668][T18075] ? tty_register_device+0x30/0x30 [ 1324.715777][T18075] ? tty_port_init+0x132/0x1a0 [ 1324.720545][T18075] ? gsm_dlci_alloc+0x32a/0x630 [ 1324.725394][T18075] ? __might_fault+0xaa/0x120 [ 1324.730075][T18075] gsm_activate_mux+0x110/0x2a0 [ 1324.734923][T18075] gsmld_ioctl+0x12ca/0x1900 [ 1324.739517][T18075] ? gsmld_write+0x120/0x120 [ 1324.744110][T18075] ? __init_ldsem+0x150/0x150 [ 1324.748785][T18075] ? __fget_files+0x28/0x460 [ 1324.753398][T18075] ? gsmld_write+0x120/0x120 [ 1324.757980][T18075] tty_ioctl+0x9b5/0xdc0 [ 1324.762219][T18075] ? tty_get_icount+0xb0/0xb0 [ 1324.766887][T18075] __se_sys_ioctl+0xfd/0x170 [ 1324.771477][T18075] do_syscall_64+0x55/0xb0 [ 1324.775887][T18075] ? clear_bhb_loop+0x40/0x90 [ 1324.780570][T18075] ? clear_bhb_loop+0x40/0x90 [ 1324.785243][T18075] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1324.791136][T18075] RIP: 0033:0x7f483759e0d9 [ 1324.795542][T18075] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1324.815141][T18075] RSP: 002b:00007f4838426028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1324.823546][T18075] RAX: ffffffffffffffda RBX: 00007f4837826090 RCX: 00007f483759e0d9 [ 1324.831508][T18075] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1324.839468][T18075] RBP: 00007f4837635024 R08: 0000000000000000 R09: 0000000000000000 [ 1324.847432][T18075] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1324.855397][T18075] R13: 00007f4837826128 R14: 00007f4837826090 R15: 00007ffc6d19a1d8 [ 1324.863392][T18075] [ 1324.943583][T18077] gadgetfs: bound to dummy_udc driver [ 1325.295246][T13785] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1325.302986][ C0] raw-gadget.0 gadget.8: ignoring, device is not running [ 1325.415210][T13792] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1325.423360][ C0] gadgetfs: connected [ 1325.897956][T18081] pim6reg: entered allmulticast mode [ 1326.897620][T13792] gadgetfs: disconnected [ 1326.931467][T18075] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1326.957687][T18082] pim6reg: left allmulticast mode [ 1327.056752][T13785] usb 9-1: device descriptor read/64, error -32 [ 1327.125501][ C0] gadgetfs: connected [ 1327.131803][T13792] usb 1-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 1327.180380][T13792] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1327.262553][ C0] gadgetfs: configuration #1 [ 1327.375239][T13785] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1327.413311][T13792] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/input/input16 [ 1327.490802][T18084] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2950'. [ 1327.700827][T13785] usb 9-1: config 0 has no interfaces? [ 1327.752833][T13785] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1327.815198][T13785] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1327.881250][T13785] usb 9-1: Product: syz [ 1327.897311][T13785] usb 9-1: Manufacturer: syz [ 1327.902001][T13785] usb 9-1: SerialNumber: syz [ 1327.999279][T13785] usb 9-1: config 0 descriptor?? [ 1328.018354][T18077] gadgetfs: suspended from state 3 [ 1328.072345][ C0] usbtouchscreen 1-1:1.0: usbtouch_irq - usb_submit_urb failed with result: -1 [ 1328.088328][T13785] usb 9-1: can't set config #0, error -71 [ 1328.094124][T18077] gadgetfs: disconnected [ 1328.116480][T13792] usb 1-1: USB disconnect, device number 10 [ 1328.157464][T13785] usb 9-1: USB disconnect, device number 7 [ 1328.770852][T18107] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2960'. [ 1329.274515][T18116] netlink: 'syz.8.2955': attribute type 4 has an invalid length. [ 1329.921597][T18125] 9pnet_virtio: no channels available for device syz [ 1330.241298][T18129] binder: BINDER_SET_CONTEXT_MGR already set [ 1330.304229][T18129] binder: 18128:18129 ioctl 4018620d 200000004a80 returned -16 [ 1330.368017][T18131] binder: 18128:18131 ioctl c0306201 0 returned -14 [ 1330.647693][T18138] netlink: 16 bytes leftover after parsing attributes in process `syz.7.2970'. [ 1331.209045][T18152] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1331.293267][T18152] CPU: 0 PID: 18152 Comm: syz.7.2974 Not tainted syzkaller #0 [ 1331.300747][T18152] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1331.310793][T18152] Call Trace: [ 1331.314065][T18152] [ 1331.316998][T18152] dump_stack_lvl+0x18c/0x250 [ 1331.321678][T18152] ? show_regs_print_info+0x20/0x20 [ 1331.326869][T18152] ? load_image+0x420/0x420 [ 1331.331379][T18152] sysfs_create_dir_ns+0x26e/0x2a0 [ 1331.336484][T18152] ? __lock_acquire+0x7d80/0x7d80 [ 1331.341506][T18152] ? sysfs_warn_dup+0xa0/0xa0 [ 1331.346176][T18152] ? rcu_is_watching+0x15/0xb0 [ 1331.350941][T18152] ? do_raw_spin_unlock+0x121/0x230 [ 1331.356136][T18152] kobject_add_internal+0x617/0xc90 [ 1331.361337][T18152] kobject_add+0x164/0x240 [ 1331.365756][T18152] ? kobject_init+0x1d0/0x1d0 [ 1331.370442][T18152] ? get_device_parent+0x366/0x390 [ 1331.375553][T18152] device_add+0x3fa/0xc40 [ 1331.379877][T18152] tty_register_device_attr+0x425/0x950 [ 1331.385424][T18152] ? tty_register_device+0x30/0x30 [ 1331.390549][T18152] ? tty_port_init+0x132/0x1a0 [ 1331.395302][T18152] ? gsm_dlci_alloc+0x32a/0x630 [ 1331.400159][T18152] ? __might_fault+0xaa/0x120 [ 1331.404833][T18152] gsm_activate_mux+0x110/0x2a0 [ 1331.409689][T18152] gsmld_ioctl+0x12ca/0x1900 [ 1331.414281][T18152] ? gsmld_write+0x120/0x120 [ 1331.418873][T18152] ? __init_ldsem+0x150/0x150 [ 1331.423544][T18152] ? __fget_files+0x28/0x460 [ 1331.428146][T18152] ? gsmld_write+0x120/0x120 [ 1331.432731][T18152] tty_ioctl+0x9b5/0xdc0 [ 1331.436968][T18152] ? tty_get_icount+0xb0/0xb0 [ 1331.441638][T18152] __se_sys_ioctl+0xfd/0x170 [ 1331.446240][T18152] do_syscall_64+0x55/0xb0 [ 1331.450651][T18152] ? clear_bhb_loop+0x40/0x90 [ 1331.455320][T18152] ? clear_bhb_loop+0x40/0x90 [ 1331.459994][T18152] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1331.465878][T18152] RIP: 0033:0x7f483759e0d9 [ 1331.470288][T18152] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1331.489884][T18152] RSP: 002b:00007f4838426028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1331.498290][T18152] RAX: ffffffffffffffda RBX: 00007f4837826090 RCX: 00007f483759e0d9 [ 1331.506257][T18152] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1331.514233][T18152] RBP: 00007f4837635024 R08: 0000000000000000 R09: 0000000000000000 [ 1331.522193][T18152] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1331.530155][T18152] R13: 00007f4837826128 R14: 00007f4837826090 R15: 00007ffc6d19a1d8 [ 1331.538140][T18152] [ 1331.541225][ C0] vkms_vblank_simulate: vblank timer overrun [ 1331.824217][T18152] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1331.873502][T18154] 9pnet_virtio: no channels available for device syz [ 1332.215027][T18163] binder: 18160:18163 ioctl c0306201 0 returned -14 [ 1332.467147][T18168] netlink: 16 bytes leftover after parsing attributes in process `syz.5.2981'. [ 1332.484641][ T28] audit: type=1800 audit(1786935167.445:89): pid=18170 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2982" name="bmControls" dev="configfs" ino=61319 res=0 errno=0 [ 1332.505148][ C0] vkms_vblank_simulate: vblank timer overrun [ 1332.521007][T18170] netlink: 'syz.4.2982': attribute type 1 has an invalid length. [ 1332.765682][T18170] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2982'. [ 1333.004253][T18183] 9pnet_virtio: no channels available for device syz [ 1333.327679][T18192] netlink: 'syz.7.2983': attribute type 4 has an invalid length. [ 1333.497257][T18199] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2993'. [ 1333.631206][T18205] Set syz0 is full, maxelem 0 reached [ 1333.842988][T18210] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1333.941361][T18210] CPU: 0 PID: 18210 Comm: syz.8.2996 Not tainted syzkaller #0 [ 1333.948836][T18210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1333.958881][T18210] Call Trace: [ 1333.962166][T18210] [ 1333.965094][T18210] dump_stack_lvl+0x18c/0x250 [ 1333.969770][T18210] ? show_regs_print_info+0x20/0x20 [ 1333.974971][T18210] ? load_image+0x420/0x420 [ 1333.979488][T18210] sysfs_create_dir_ns+0x26e/0x2a0 [ 1333.984594][T18210] ? __lock_acquire+0x7d80/0x7d80 [ 1333.989612][T18210] ? sysfs_warn_dup+0xa0/0xa0 [ 1333.994282][T18210] ? rcu_is_watching+0x15/0xb0 [ 1333.999057][T18210] ? do_raw_spin_unlock+0x121/0x230 [ 1334.004255][T18210] kobject_add_internal+0x617/0xc90 [ 1334.009600][T18210] kobject_add+0x164/0x240 [ 1334.014038][T18210] ? kobject_init+0x1d0/0x1d0 [ 1334.018726][T18210] ? get_device_parent+0x366/0x390 [ 1334.023834][T18210] device_add+0x3fa/0xc40 [ 1334.028168][T18210] tty_register_device_attr+0x425/0x950 [ 1334.033713][T18210] ? tty_register_device+0x30/0x30 [ 1334.038833][T18210] ? tty_port_init+0x132/0x1a0 [ 1334.043588][T18210] ? gsm_dlci_alloc+0x32a/0x630 [ 1334.048443][T18210] ? __might_fault+0xaa/0x120 [ 1334.053115][T18210] gsm_activate_mux+0x110/0x2a0 [ 1334.057964][T18210] gsmld_ioctl+0x12ca/0x1900 [ 1334.062562][T18210] ? gsmld_write+0x120/0x120 [ 1334.067163][T18210] ? __init_ldsem+0x150/0x150 [ 1334.071837][T18210] ? __fget_files+0x28/0x460 [ 1334.076439][T18210] ? gsmld_write+0x120/0x120 [ 1334.081031][T18210] tty_ioctl+0x9b5/0xdc0 [ 1334.085271][T18210] ? tty_get_icount+0xb0/0xb0 [ 1334.089953][T18210] __se_sys_ioctl+0xfd/0x170 [ 1334.094556][T18210] do_syscall_64+0x55/0xb0 [ 1334.098974][T18210] ? clear_bhb_loop+0x40/0x90 [ 1334.103653][T18210] ? clear_bhb_loop+0x40/0x90 [ 1334.108326][T18210] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1334.114213][T18210] RIP: 0033:0x7ff84639e0d9 [ 1334.118621][T18210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1334.138218][T18210] RSP: 002b:00007ff847310028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1334.146627][T18210] RAX: ffffffffffffffda RBX: 00007ff846626090 RCX: 00007ff84639e0d9 [ 1334.154596][T18210] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1334.162559][T18210] RBP: 00007ff846435024 R08: 0000000000000000 R09: 0000000000000000 [ 1334.170531][T18210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1334.178501][T18210] R13: 00007ff846626128 R14: 00007ff846626090 R15: 00007fffe44c89e8 [ 1334.186477][T18210] [ 1334.189601][ C0] vkms_vblank_simulate: vblank timer overrun [ 1334.413767][T18212] netlink: 'syz.4.2997': attribute type 1 has an invalid length. [ 1334.439585][ T28] audit: type=1800 audit(1786935169.375:90): pid=18212 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.2997" name="bmControls" dev="configfs" ino=61631 res=0 errno=0 [ 1334.484168][T18212] netlink: 96 bytes leftover after parsing attributes in process `syz.4.2997'. [ 1334.639453][T18210] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1334.708424][T18216] gadgetfs: bound to dummy_udc driver [ 1335.325907][T18225] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3003'. [ 1335.393214][T18229] tipc: Enabling of bearer rejected, failed to enable media [ 1335.652161][ T28] audit: type=1800 audit(1786935170.615:91): pid=18241 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3008" name="bmControls" dev="configfs" ino=61853 res=0 errno=0 [ 1335.675608][T18241] netlink: 'syz.8.3008': attribute type 1 has an invalid length. [ 1335.805543][T18251] Set syz0 is full, maxelem 0 reached [ 1336.024440][T18257] netlink: 96 bytes leftover after parsing attributes in process `syz.8.3008'. [ 1336.277666][T18262] gadgetfs: bound to dummy_udc driver [ 1337.262423][T18276] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3016'. [ 1337.568334][T18283] netlink: 'syz.4.3018': attribute type 1 has an invalid length. [ 1337.677002][T18283] bond15: entered promiscuous mode [ 1337.704263][T18283] 8021q: adding VLAN 0 to HW filter on device bond15 [ 1339.541273][T18287] bond15: (slave bridge8): making interface the new active one [ 1339.576650][T18287] bridge8: entered promiscuous mode [ 1339.592415][T18287] bond15: (slave bridge8): Enslaving as an active interface with an up link [ 1339.694286][T18292] overlayfs: failed to resolve './file0': -2 [ 1339.713231][T18293] netlink: 'syz.8.3015': attribute type 4 has an invalid length. [ 1339.939485][T18301] binder_alloc: 18300: binder_alloc_buf, no vma [ 1340.141082][ T28] audit: type=1800 audit(1786935175.105:92): pid=18303 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3024" name="bmControls" dev="configfs" ino=62208 res=0 errno=0 [ 1340.165415][T18303] netlink: 'syz.4.3024': attribute type 1 has an invalid length. [ 1340.207865][T13792] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1340.392067][T18305] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3024'. [ 1340.450382][T13792] usb 6-1: config 0 has no interfaces? [ 1340.480415][T13792] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1340.542937][T18310] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1340.556768][T13792] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1340.622356][T18310] CPU: 0 PID: 18310 Comm: syz.7.3026 Not tainted syzkaller #0 [ 1340.629824][T18310] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1340.639869][T18310] Call Trace: [ 1340.643141][T18310] [ 1340.646064][T18310] dump_stack_lvl+0x18c/0x250 [ 1340.650748][T18310] ? show_regs_print_info+0x20/0x20 [ 1340.655952][T18310] ? load_image+0x420/0x420 [ 1340.660475][T18310] sysfs_create_dir_ns+0x26e/0x2a0 [ 1340.665596][T18310] ? __lock_acquire+0x7d80/0x7d80 [ 1340.670630][T18310] ? sysfs_warn_dup+0xa0/0xa0 [ 1340.675297][T18310] ? rcu_is_watching+0x15/0xb0 [ 1340.680072][T18310] ? do_raw_spin_unlock+0x121/0x230 [ 1340.685281][T18310] kobject_add_internal+0x617/0xc90 [ 1340.690488][T18310] kobject_add+0x164/0x240 [ 1340.694930][T18310] ? kobject_init+0x1d0/0x1d0 [ 1340.699633][T18310] ? get_device_parent+0x366/0x390 [ 1340.704754][T18310] device_add+0x3fa/0xc40 [ 1340.709093][T18310] tty_register_device_attr+0x425/0x950 [ 1340.714663][T18310] ? tty_register_device+0x30/0x30 [ 1340.719779][T18310] ? tty_port_init+0x132/0x1a0 [ 1340.724537][T18310] ? gsm_dlci_alloc+0x32a/0x630 [ 1340.729381][T18310] ? __might_fault+0xaa/0x120 [ 1340.734053][T18310] gsm_activate_mux+0x110/0x2a0 [ 1340.738902][T18310] gsmld_ioctl+0x12ca/0x1900 [ 1340.743511][T18310] ? gsmld_write+0x120/0x120 [ 1340.748103][T18310] ? __init_ldsem+0x150/0x150 [ 1340.752796][T18310] ? __fget_files+0x28/0x460 [ 1340.757392][T18310] ? gsmld_write+0x120/0x120 [ 1340.761979][T18310] tty_ioctl+0x9b5/0xdc0 [ 1340.766217][T18310] ? tty_get_icount+0xb0/0xb0 [ 1340.770888][T18310] __se_sys_ioctl+0xfd/0x170 [ 1340.775476][T18310] do_syscall_64+0x55/0xb0 [ 1340.779888][T18310] ? clear_bhb_loop+0x40/0x90 [ 1340.784561][T18310] ? clear_bhb_loop+0x40/0x90 [ 1340.789233][T18310] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1340.795119][T18310] RIP: 0033:0x7f483759e0d9 [ 1340.799541][T18310] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1340.819136][T18310] RSP: 002b:00007f4838426028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1340.827540][T18310] RAX: ffffffffffffffda RBX: 00007f4837826090 RCX: 00007f483759e0d9 [ 1340.835502][T18310] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1340.843464][T18310] RBP: 00007f4837635024 R08: 0000000000000000 R09: 0000000000000000 [ 1340.851429][T18310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1340.859390][T18310] R13: 00007f4837826128 R14: 00007f4837826090 R15: 00007ffc6d19a1d8 [ 1340.867374][T18310] [ 1340.870443][ C0] vkms_vblank_simulate: vblank timer overrun [ 1340.887055][T13792] usb 6-1: Product: syz [ 1340.891224][T13792] usb 6-1: Manufacturer: syz [ 1340.914931][T13792] usb 6-1: SerialNumber: syz [ 1340.994885][T13792] usb 6-1: config 0 descriptor?? [ 1341.282816][T13785] usb 6-1: USB disconnect, device number 6 [ 1341.343606][T18316] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3027'. [ 1341.546465][T18310] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1342.019944][T18324] binder_alloc: 18323: binder_alloc_buf, no vma [ 1342.261811][T18332] binder: BINDER_SET_CONTEXT_MGR already set [ 1342.310025][T18332] binder: 18330:18332 ioctl 4018620d 200000004a80 returned -16 [ 1342.371823][ T28] audit: type=1800 audit(1786935177.335:93): pid=18338 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3036" name="bmControls" dev="configfs" ino=62459 res=0 errno=0 [ 1342.395911][T18338] netlink: 'syz.5.3036': attribute type 1 has an invalid length. [ 1342.664818][T18342] netlink: 96 bytes leftover after parsing attributes in process `syz.5.3036'. [ 1342.735062][T18344] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3037'. [ 1343.461448][T18360] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1343.532403][T18360] CPU: 0 PID: 18360 Comm: syz.5.3042 Not tainted syzkaller #0 [ 1343.539894][T18360] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1343.549943][T18360] Call Trace: [ 1343.553220][T18360] [ 1343.556145][T18360] dump_stack_lvl+0x18c/0x250 [ 1343.560824][T18360] ? show_regs_print_info+0x20/0x20 [ 1343.566018][T18360] ? load_image+0x420/0x420 [ 1343.570530][T18360] sysfs_create_dir_ns+0x26e/0x2a0 [ 1343.575635][T18360] ? __lock_acquire+0x7d80/0x7d80 [ 1343.580651][T18360] ? sysfs_warn_dup+0xa0/0xa0 [ 1343.585316][T18360] ? rcu_is_watching+0x15/0xb0 [ 1343.590092][T18360] ? do_raw_spin_unlock+0x121/0x230 [ 1343.595286][T18360] kobject_add_internal+0x617/0xc90 [ 1343.600518][T18360] kobject_add+0x164/0x240 [ 1343.604969][T18360] ? kobject_init+0x1d0/0x1d0 [ 1343.609669][T18360] ? get_device_parent+0x366/0x390 [ 1343.614775][T18360] device_add+0x3fa/0xc40 [ 1343.619101][T18360] tty_register_device_attr+0x425/0x950 [ 1343.624668][T18360] ? tty_register_device+0x30/0x30 [ 1343.629781][T18360] ? tty_port_init+0x132/0x1a0 [ 1343.634536][T18360] ? gsm_dlci_alloc+0x32a/0x630 [ 1343.639382][T18360] ? __might_fault+0xaa/0x120 [ 1343.644054][T18360] gsm_activate_mux+0x110/0x2a0 [ 1343.648909][T18360] gsmld_ioctl+0x12ca/0x1900 [ 1343.653514][T18360] ? gsmld_write+0x120/0x120 [ 1343.658113][T18360] ? __init_ldsem+0x150/0x150 [ 1343.662799][T18360] ? __fget_files+0x28/0x460 [ 1343.667405][T18360] ? gsmld_write+0x120/0x120 [ 1343.672035][T18360] tty_ioctl+0x9b5/0xdc0 [ 1343.676277][T18360] ? tty_get_icount+0xb0/0xb0 [ 1343.680949][T18360] __se_sys_ioctl+0xfd/0x170 [ 1343.685548][T18360] do_syscall_64+0x55/0xb0 [ 1343.689957][T18360] ? clear_bhb_loop+0x40/0x90 [ 1343.694628][T18360] ? clear_bhb_loop+0x40/0x90 [ 1343.699299][T18360] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1343.705185][T18360] RIP: 0033:0x7fca5eb9e0d9 [ 1343.709606][T18360] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1343.729203][T18360] RSP: 002b:00007fca5faf5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1343.737610][T18360] RAX: ffffffffffffffda RBX: 00007fca5ee26090 RCX: 00007fca5eb9e0d9 [ 1343.745570][T18360] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1343.753551][T18360] RBP: 00007fca5ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 1343.761540][T18360] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1343.769503][T18360] R13: 00007fca5ee26128 R14: 00007fca5ee26090 R15: 00007ffce474f5a8 [ 1343.777479][T18360] [ 1343.780498][ C0] vkms_vblank_simulate: vblank timer overrun [ 1343.829856][T13785] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1344.057357][T18360] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1344.093302][T13785] usb 5-1: config 0 has no interfaces? [ 1344.173022][T13785] usb 5-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1344.271129][T18366] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3047'. [ 1344.286463][T13785] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1344.343125][T13785] usb 5-1: Product: syz [ 1344.380455][T13785] usb 5-1: Manufacturer: syz [ 1344.419273][T13785] usb 5-1: SerialNumber: syz [ 1344.457409][T13785] usb 5-1: config 0 descriptor?? [ 1344.707218][T13785] usb 5-1: USB disconnect, device number 4 [ 1344.804856][T18374] binder_alloc: 18373: binder_alloc_buf, no vma [ 1347.242737][T18385] pim6reg: entered allmulticast mode [ 1347.250228][T18385] pim6reg: left allmulticast mode [ 1347.629480][T18390] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3056'. [ 1347.642460][T18385] 9pnet_virtio: no channels available for device syz [ 1347.663999][T18385] netlink: 56 bytes leftover after parsing attributes in process `syz.4.3054'. [ 1347.947678][T18402] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1348.011939][T18401] binder_alloc: 18400: binder_alloc_buf, no vma [ 1348.041517][T18402] CPU: 0 PID: 18402 Comm: syz.7.3059 Not tainted syzkaller #0 [ 1348.049010][T18402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1348.059070][T18402] Call Trace: [ 1348.062343][T18402] [ 1348.065282][T18402] dump_stack_lvl+0x18c/0x250 [ 1348.069969][T18402] ? show_regs_print_info+0x20/0x20 [ 1348.075162][T18402] ? load_image+0x420/0x420 [ 1348.079687][T18402] sysfs_create_dir_ns+0x26e/0x2a0 [ 1348.084795][T18402] ? __lock_acquire+0x7d80/0x7d80 [ 1348.089825][T18402] ? sysfs_warn_dup+0xa0/0xa0 [ 1348.094490][T18402] ? rcu_is_watching+0x15/0xb0 [ 1348.099254][T18402] ? do_raw_spin_unlock+0x121/0x230 [ 1348.104460][T18402] kobject_add_internal+0x617/0xc90 [ 1348.109660][T18402] kobject_add+0x164/0x240 [ 1348.114086][T18402] ? kobject_init+0x1d0/0x1d0 [ 1348.118762][T18402] ? get_device_parent+0x366/0x390 [ 1348.123873][T18402] device_add+0x3fa/0xc40 [ 1348.128201][T18402] tty_register_device_attr+0x425/0x950 [ 1348.133748][T18402] ? tty_register_device+0x30/0x30 [ 1348.138873][T18402] ? tty_port_init+0x132/0x1a0 [ 1348.143630][T18402] ? gsm_dlci_alloc+0x32a/0x630 [ 1348.148474][T18402] ? __might_fault+0xaa/0x120 [ 1348.153144][T18402] gsm_activate_mux+0x110/0x2a0 [ 1348.157998][T18402] gsmld_ioctl+0x12ca/0x1900 [ 1348.162602][T18402] ? gsmld_write+0x120/0x120 [ 1348.167196][T18402] ? __init_ldsem+0x150/0x150 [ 1348.171876][T18402] ? __fget_files+0x28/0x460 [ 1348.176467][T18402] ? gsmld_write+0x120/0x120 [ 1348.181051][T18402] tty_ioctl+0x9b5/0xdc0 [ 1348.185300][T18402] ? tty_get_icount+0xb0/0xb0 [ 1348.189984][T18402] __se_sys_ioctl+0xfd/0x170 [ 1348.194572][T18402] do_syscall_64+0x55/0xb0 [ 1348.198993][T18402] ? clear_bhb_loop+0x40/0x90 [ 1348.203668][T18402] ? clear_bhb_loop+0x40/0x90 [ 1348.208342][T18402] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1348.214232][T18402] RIP: 0033:0x7f483759e0d9 [ 1348.218651][T18402] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1348.238249][T18402] RSP: 002b:00007f4838426028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1348.246654][T18402] RAX: ffffffffffffffda RBX: 00007f4837826090 RCX: 00007f483759e0d9 [ 1348.254617][T18402] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1348.262578][T18402] RBP: 00007f4837635024 R08: 0000000000000000 R09: 0000000000000000 [ 1348.270543][T18402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1348.278515][T18402] R13: 00007f4837826128 R14: 00007f4837826090 R15: 00007ffc6d19a1d8 [ 1348.286491][T18402] [ 1348.289550][ C0] vkms_vblank_simulate: vblank timer overrun [ 1348.589284][T18402] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1348.657244][T18414] Set syz0 is full, maxelem 0 reached [ 1348.765408][T13792] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1348.947805][T13792] usb 9-1: config 0 has no interfaces? [ 1348.956196][T13792] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1348.971175][T13792] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1349.003981][T13792] usb 9-1: Product: syz [ 1349.022000][T13792] usb 9-1: Manufacturer: syz [ 1349.039053][T13792] usb 9-1: SerialNumber: syz [ 1349.075859][T13792] usb 9-1: config 0 descriptor?? [ 1349.302325][T13785] usb 9-1: USB disconnect, device number 8 [ 1349.511942][T18424] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3068'. [ 1350.335854][T18456] Set syz0 is full, maxelem 0 reached [ 1350.541590][T18454] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3079'. [ 1350.765569][T18463] overlayfs: failed to resolve './file0': -2 [ 1350.995649][T13792] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1351.171259][T18471] 9pnet_virtio: no channels available for device syz [ 1351.203972][T13792] usb 9-1: config 0 has no interfaces? [ 1351.218965][T13792] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1351.265675][T13792] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1351.307155][T13792] usb 9-1: Product: syz [ 1351.311327][T13792] usb 9-1: Manufacturer: syz [ 1351.348098][T13792] usb 9-1: SerialNumber: syz [ 1351.377871][T13792] usb 9-1: config 0 descriptor?? [ 1351.617247][ T6518] usb 9-1: USB disconnect, device number 9 [ 1351.791420][T18483] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3090'. [ 1352.021231][T18493] overlayfs: failed to resolve './file0': -2 [ 1352.131172][T18499] Set syz0 is full, maxelem 0 reached [ 1352.173667][T18501] 9pnet_virtio: no channels available for device syz [ 1352.922723][T18515] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3102'. [ 1353.164264][T18522] overlayfs: failed to resolve './file0': -2 [ 1353.319182][T18528] 9pnet_virtio: no channels available for device syz [ 1353.475299][ T6518] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1353.665558][T18541] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1353.698365][ T6518] usb 6-1: config 0 has no interfaces? [ 1353.723075][ T6518] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1353.904920][ T6518] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.934967][T18543] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3115'. [ 1353.961412][ T6518] usb 6-1: Product: syz [ 1353.977564][ T6518] usb 6-1: Manufacturer: syz [ 1353.982213][ T6518] usb 6-1: SerialNumber: syz [ 1354.028415][ T6518] usb 6-1: config 0 descriptor?? [ 1354.283068][ T6518] usb 6-1: USB disconnect, device number 7 [ 1354.410887][T18556] netlink: 'syz.7.3112': attribute type 4 has an invalid length. [ 1354.543576][T18560] 9pnet_virtio: no channels available for device syz [ 1355.177607][T18569] gadgetfs: bound to dummy_udc driver [ 1355.378167][T18572] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3125'. [ 1355.776372][T18584] 9pnet_virtio: no channels available for device syz [ 1356.115607][T13785] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1356.338482][T13785] usb 9-1: config 0 has no interfaces? [ 1356.467140][T18600] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3136'. [ 1356.491240][T13785] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1356.514349][T13785] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1356.564378][T13785] usb 9-1: Product: syz [ 1356.576113][T13785] usb 9-1: Manufacturer: syz [ 1356.602492][T13785] usb 9-1: SerialNumber: syz [ 1356.643386][T13785] usb 9-1: config 0 descriptor?? [ 1356.893781][T13792] usb 9-1: USB disconnect, device number 10 [ 1357.053443][T18613] 9pnet_virtio: no channels available for device syz [ 1357.751995][T18624] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3147'. [ 1357.983197][T18630] netlink: 'syz.7.3143': attribute type 4 has an invalid length. [ 1359.725938][T18632] pim6reg: entered allmulticast mode [ 1359.759685][T18633] pim6reg: left allmulticast mode [ 1360.290396][T18650] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 1360.424286][T18650] CPU: 0 PID: 18650 Comm: syz.5.3154 Not tainted syzkaller #0 [ 1360.431762][T18650] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1360.441822][T18650] Call Trace: [ 1360.445096][T18650] [ 1360.448020][T18650] dump_stack_lvl+0x18c/0x250 [ 1360.452696][T18650] ? show_regs_print_info+0x20/0x20 [ 1360.457893][T18650] ? load_image+0x420/0x420 [ 1360.462404][T18650] sysfs_create_dir_ns+0x26e/0x2a0 [ 1360.467509][T18650] ? __lock_acquire+0x7d80/0x7d80 [ 1360.472527][T18650] ? sysfs_warn_dup+0xa0/0xa0 [ 1360.477197][T18650] ? rcu_is_watching+0x15/0xb0 [ 1360.481961][T18650] ? do_raw_spin_unlock+0x121/0x230 [ 1360.487158][T18650] kobject_add_internal+0x617/0xc90 [ 1360.492360][T18650] kobject_add+0x164/0x240 [ 1360.496801][T18650] ? kobject_init+0x1d0/0x1d0 [ 1360.501489][T18650] ? get_device_parent+0x366/0x390 [ 1360.506613][T18650] device_add+0x3fa/0xc40 [ 1360.510939][T18650] tty_register_device_attr+0x425/0x950 [ 1360.516486][T18650] ? tty_register_device+0x30/0x30 [ 1360.521644][T18650] ? tty_port_init+0x132/0x1a0 [ 1360.526404][T18650] ? gsm_dlci_alloc+0x32a/0x630 [ 1360.531249][T18650] ? __might_fault+0xaa/0x120 [ 1360.535922][T18650] gsm_activate_mux+0x110/0x2a0 [ 1360.540783][T18650] gsmld_ioctl+0x12ca/0x1900 [ 1360.545373][T18650] ? gsmld_write+0x120/0x120 [ 1360.549969][T18650] ? __init_ldsem+0x150/0x150 [ 1360.554643][T18650] ? __fget_files+0x28/0x460 [ 1360.559244][T18650] ? gsmld_write+0x120/0x120 [ 1360.563832][T18650] tty_ioctl+0x9b5/0xdc0 [ 1360.568069][T18650] ? tty_get_icount+0xb0/0xb0 [ 1360.572743][T18650] __se_sys_ioctl+0xfd/0x170 [ 1360.577344][T18650] do_syscall_64+0x55/0xb0 [ 1360.581754][T18650] ? clear_bhb_loop+0x40/0x90 [ 1360.586425][T18650] ? clear_bhb_loop+0x40/0x90 [ 1360.591098][T18650] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 1360.596986][T18650] RIP: 0033:0x7fca5eb9e0d9 [ 1360.601397][T18650] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1360.621001][T18650] RSP: 002b:00007fca5faf5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1360.629428][T18650] RAX: ffffffffffffffda RBX: 00007fca5ee26090 RCX: 00007fca5eb9e0d9 [ 1360.637396][T18650] RDX: 0000200000000040 RSI: 00000000404c4701 RDI: 0000000000000006 [ 1360.645361][T18650] RBP: 00007fca5ec35024 R08: 0000000000000000 R09: 0000000000000000 [ 1360.653323][T18650] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1360.661299][T18650] R13: 00007fca5ee26128 R14: 00007fca5ee26090 R15: 00007ffce474f5a8 [ 1360.669273][T18650] [ 1360.672341][ C0] vkms_vblank_simulate: vblank timer overrun [ 1360.968112][T18650] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 1361.205283][T13792] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 1361.396689][ T28] audit: type=1800 audit(1786935196.355:94): pid=18655 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3156" name="bmControls" dev="configfs" ino=65220 res=0 errno=0 [ 1361.417200][ C0] vkms_vblank_simulate: vblank timer overrun [ 1361.428993][T18655] netlink: 'syz.4.3156': attribute type 1 has an invalid length. [ 1361.442391][T13792] usb 9-1: config 0 has no interfaces? [ 1361.478414][T13792] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1361.505521][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.536526][T13792] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.591042][T13792] usb 9-1: Product: syz [ 1361.609906][T13792] usb 9-1: Manufacturer: syz [ 1361.614524][T13792] usb 9-1: SerialNumber: syz [ 1361.655887][T13792] usb 9-1: config 0 descriptor?? [ 1361.875796][T18659] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3157'. [ 1361.978081][T18656] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3156'. [ 1362.041775][T13792] usb 9-1: USB disconnect, device number 11 [ 1363.101578][T18674] pim6reg: entered allmulticast mode [ 1364.144453][T18672] pim6reg: left allmulticast mode [ 1366.116350][T18681] gadgetfs: bound to dummy_udc driver [ 1366.326417][T18685] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3168'. [ 1366.453877][T18688] pim6reg: entered allmulticast mode [ 1366.510607][T18678] pim6reg: left allmulticast mode [ 1366.547686][ T28] audit: type=1800 audit(1786935201.515:95): pid=18690 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.3169" name="bmControls" dev="configfs" ino=65379 res=0 errno=0 [ 1366.576446][T18690] netlink: 'syz.4.3169': attribute type 1 has an invalid length. [ 1366.590397][T18678] 9pnet_virtio: no channels available for device syz [ 1366.598556][T18678] netlink: 56 bytes leftover after parsing attributes in process `syz.8.3165'. [ 1366.790551][T18690] netlink: 96 bytes leftover after parsing attributes in process `syz.4.3169'. [ 1367.055569][T18698] netlink: 'syz.5.3167': attribute type 4 has an invalid length. [ 1367.355219][T13785] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1368.877090][T13785] usb 9-1: config 0 has no interfaces? [ 1368.902605][T13785] usb 9-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice= 1.00 [ 1368.935292][T13785] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1368.977430][T13785] usb 9-1: Product: syz [ 1368.981601][T13785] usb 9-1: Manufacturer: syz [ 1369.025841][T13785] usb 9-1: SerialNumber: syz [ 1369.071528][T13785] usb 9-1: config 0 descriptor?? [ 1369.345383][T13785] usb 9-1: USB disconnect, device number 12 [ 1370.017779][T18729] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1370.030641][T18729] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1370.038327][T18729] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1370.046545][T18729] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1370.054353][T18729] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3 [ 1370.061740][T18729] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1372.001247][T18728] pim6reg: entered allmulticast mode [ 1372.051187][T18728] pim6reg: left allmulticast mode [ 1372.107280][T18729] Bluetooth: hci2: command tx timeout [ 1372.343051][T18728] 9pnet_virtio: no channels available for device syz [ 1372.378129][ T28] audit: type=1800 audit(1786935207.345:96): pid=18746 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3181" name="bmControls" dev="configfs" ino=65762 res=0 errno=0 [ 1372.400758][T18728] netlink: 48 bytes leftover after parsing attributes in process `syz.8.3180'. [ 1372.425700][T18746] netlink: 'syz.5.3181': attribute type 1 has an invalid length. [ 1372.630776][T18726] chnl_net:caif_netlink_parms(): no params data found [ 1372.839051][T18754] netlink: 96 bytes leftover after parsing attributes in process `syz.5.3181'. [ 1372.941586][T18726] bridge0: port 1(bridge_slave_0) entered blocking state [ 1373.000471][T18726] bridge0: port 1(bridge_slave_0) entered disabled state [ 1373.057060][T18726] bridge_slave_0: entered allmulticast mode [ 1373.906569][T18726] bridge_slave_0: entered promiscuous mode [ 1374.202562][T18729] Bluetooth: hci2: command tx timeout [ 1374.728746][T18726] bridge0: port 2(bridge_slave_1) entered blocking state [ 1374.781688][T18726] bridge0: port 2(bridge_slave_1) entered disabled state [ 1374.849761][T18726] bridge_slave_1: entered allmulticast mode [ 1374.914017][T18726] bridge_slave_1: entered promiscuous mode [ 1375.029142][T18726] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1375.106734][T18726] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1375.239238][T18726] team0: Port device team_slave_0 added [ 1375.284688][T18726] team0: Port device team_slave_1 added [ 1375.400407][T18726] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1375.430763][T18726] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1375.456687][ C0] vkms_vblank_simulate: vblank timer overrun [ 1375.574200][T18726] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1375.636524][T18726] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1375.664453][T18726] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1375.690348][ C0] vkms_vblank_simulate: vblank timer overrun [ 1376.265317][T18729] Bluetooth: hci2: command tx timeout [ 1377.471767][T18726] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1377.506532][T18784] kAFS: bad VL server IP address [ 1377.727346][T18726] hsr_slave_0: entered promiscuous mode [ 1378.345255][T18729] Bluetooth: hci2: command tx timeout [ 1379.416599][T18726] hsr_slave_1: entered promiscuous mode [ 1379.464661][T18726] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1379.504857][T18726] Cannot create hsr debugfs directory [ 1379.616139][ T28] audit: type=1800 audit(1786935214.585:97): pid=18799 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.3195" name="bmControls" dev="configfs" ino=66087 res=0 errno=0 [ 1379.636655][ C0] vkms_vblank_simulate: vblank timer overrun [ 1379.673052][T18799] netlink: 'syz.7.3195': attribute type 1 has an invalid length. [ 1380.050596][T18806] netlink: 96 bytes leftover after parsing attributes in process `syz.7.3195'. [ 1380.291752][T18809] tipc: Started in network mode [ 1380.323005][T18809] tipc: Node identity a6045ca6903e, cluster identity 4711 [ 1380.388375][T18809] tipc: Enabled bearer , priority 0 [ 1380.500240][T18810] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1380.538196][T18809] tipc: Resetting bearer [ 1380.638912][T18808] tipc: Disabling bearer [ 1380.914402][T18820] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3202'. [ 1382.579859][T18726] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1382.643650][T18726] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1382.692570][T18726] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1382.739417][T18726] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1383.020245][T18726] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1383.042382][ T28] audit: type=1800 audit(1786935218.005:98): pid=18835 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.3207" name="bmControls" dev="configfs" ino=66544 res=0 errno=0 [ 1383.098743][T18835] netlink: 'syz.7.3207': attribute type 1 has an invalid length. [ 1383.122925][T18726] 8021q: adding VLAN 0 to HW filter on device team0 [ 1383.196420][T10199] bridge0: port 1(bridge_slave_0) entered blocking state [ 1383.203653][T10199] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1383.257752][T10199] bridge0: port 2(bridge_slave_1) entered blocking state [ 1383.264890][T10199] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1383.291923][T18835] netlink: 96 bytes leftover after parsing attributes in process `syz.7.3207'. [ 1384.028223][T18854] netlink: 'syz.5.3209': attribute type 4 has an invalid length. [ 1384.109368][T18726] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1386.541048][T18726] veth0_vlan: entered promiscuous mode [ 1386.594357][T18726] veth1_vlan: entered promiscuous mode [ 1386.674146][T18726] veth0_macvtap: entered promiscuous mode [ 1386.742700][T18726] veth1_macvtap: entered promiscuous mode [ 1386.821047][T18726] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1386.837385][T18873] netlink: 48 bytes leftover after parsing attributes in process `syz.8.3217'. [ 1386.873337][T18726] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1386.900452][T18726] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1386.929584][T18726] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1388.761543][T18726] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1388.891357][T18726] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1388.975164][T18726] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1389.035201][T18726] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1389.055584][ T28] audit: type=1800 audit(1786935224.015:99): pid=18883 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3220" name="bmControls" dev="configfs" ino=66991 res=0 errno=0 [ 1389.089728][T18726] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1389.110174][T18886] netlink: 'syz.8.3220': attribute type 1 has an invalid length. [ 1389.143790][T18726] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1389.192841][T18875] 9pnet_virtio: no channels available for device syz [ 1389.226545][T18875] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3218'. [ 1389.434181][T18884] pim6reg: entered allmulticast mode [ 1389.471010][T18726] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1389.516138][T18726] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1389.571476][T18726] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1389.617527][T18726] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1389.682321][T18889] netlink: 96 bytes leftover after parsing attributes in process `syz.8.3220'. [ 1391.811744][ T6026] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1391.856903][ T6026] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1391.947663][T12784] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1391.990397][T12784] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1392.468359][T18909] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3178'. [ 1393.237203][T18924] netlink: 'syz.5.3227': attribute type 4 has an invalid length. [ 1395.165518][T18928] pim6reg: left allmulticast mode [ 1395.454174][T18928] 9pnet_virtio: no channels available for device syz [ 1395.461830][T18928] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3231'. [ 1397.319733][T18941] overlayfs: missing 'lowerdir' [ 1397.678322][T18946] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3236'. [ 1398.049320][T18958] 9pnet_virtio: no channels available for device syz [ 1399.211302][T18964] overlayfs: missing 'lowerdir' [ 1399.970393][T18964] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1401.968236][T18973] pim6reg: entered allmulticast mode [ 1402.036443][T18973] pim6reg: left allmulticast mode [ 1402.361448][T18985] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3246'. [ 1402.421853][T18973] 9pnet_virtio: no channels available for device syz [ 1402.455717][T18973] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3243'. [ 1402.694252][T18996] overlayfs: missing 'lowerdir' [ 1404.731767][T19014] binder_alloc: binder_alloc_mmap_handler: 19013 200000ffd000-200001000000 already mapped failed -16 [ 1404.999434][T19022] 9pnet_virtio: no channels available for device syz [ 1405.115548][ T998] ------------[ cut here ]------------ [ 1405.122160][ T998] WARNING: CPU: 0 PID: 998 at io_uring/io_uring.c:3214 io_ring_exit_work+0x3b9/0x830 [ 1405.131890][ T998] Modules linked in: [ 1405.135916][ T998] CPU: 0 PID: 998 Comm: kworker/u4:5 Not tainted syzkaller #0 [ 1405.143389][ T998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1405.153525][ T998] Workqueue: iou_exit io_ring_exit_work [ 1405.159127][ T998] RIP: 0010:io_ring_exit_work+0x3b9/0x830 [ 1405.164869][ T998] Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 91 00 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 b1 f0 00 f7 e9 b1 fd ff ff e8 a7 f0 00 f7 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 [ 1405.184533][ T998] RSP: 0018:ffffc90004527a40 EFLAGS: 00010293 [ 1405.190778][ T998] RAX: ffffffff8a868179 RBX: ffff888140ab4000 RCX: ffff888022c30000 [ 1405.198808][ T998] RDX: 0000000000000000 RSI: fffffffffffffffe RDI: 0000000000000000 [ 1405.206940][ T998] RBP: ffffc90004527bb0 R08: ffffc900045279c7 R09: 1ffff920008a4f38 [ 1405.214925][ T998] R10: dffffc0000000000 R11: fffff520008a4f39 R12: dffffc0000000000 [ 1405.223754][ T998] R13: 000000010001af0b R14: 000000010001af0d R15: ffff888140ab4510 [ 1405.231917][ T998] FS: 0000000000000000(0000) GS:ffff8880b8e00000(0000) knlGS:0000000000000000 [ 1405.241013][ T998] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1405.247681][ T998] CR2: 00007ffb4ebed158 CR3: 000000005f96f000 CR4: 00000000003506f0 [ 1405.255687][ T998] Call Trace: [ 1405.258964][ T998] [ 1405.261914][ T998] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 1405.267779][ T998] ? _raw_spin_unlock_irq+0x23/0x50 [ 1405.273063][ T998] ? process_scheduled_works+0x975/0x1600 [ 1405.278838][ T998] ? process_scheduled_works+0x975/0x1600 [ 1405.284595][ T998] process_scheduled_works+0xa60/0x1600 [ 1405.290210][ T998] ? worker_attach_to_pool+0x370/0x370 [ 1405.295718][ T998] ? assign_work+0x3cc/0x5d0 [ 1405.300309][ T998] worker_thread+0xa5e/0xfe0 [ 1405.304907][ T998] ? _raw_spin_unlock+0x40/0x40 [ 1405.309794][ T998] ? __kthread_parkme+0x71/0x1c0 [ 1405.314758][ T998] kthread+0x2fa/0x390 [ 1405.318861][ T998] ? pr_cont_work+0x550/0x550 [ 1405.324337][ T998] ? kthread_blkcg+0xd0/0xd0 [ 1405.329051][ T998] ret_from_fork+0x48/0x80 [ 1405.333481][ T998] ? kthread_blkcg+0xd0/0xd0 [ 1405.338103][ T998] ret_from_fork_asm+0x11/0x20 [ 1405.342882][ T998] [ 1405.345945][ T998] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1405.353210][ T998] CPU: 0 PID: 998 Comm: kworker/u4:5 Not tainted syzkaller #0 [ 1405.360655][ T998] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1405.370701][ T998] Workqueue: iou_exit io_ring_exit_work [ 1405.376260][ T998] Call Trace: [ 1405.379532][ T998] [ 1405.382461][ T998] dump_stack_lvl+0x18c/0x250 [ 1405.387140][ T998] ? show_regs_print_info+0x20/0x20 [ 1405.392328][ T998] ? load_image+0x420/0x420 [ 1405.396834][ T998] panic+0x2ca/0x720 [ 1405.400738][ T998] ? bpf_jit_dump+0xd0/0xd0 [ 1405.405248][ T998] ? ret_from_fork_asm+0x11/0x20 [ 1405.410195][ T998] __warn+0x2e0/0x470 [ 1405.414184][ T998] ? io_ring_exit_work+0x3b9/0x830 [ 1405.419301][ T998] ? io_ring_exit_work+0x3b9/0x830 [ 1405.424406][ T998] report_bug+0x2be/0x4f0 [ 1405.428728][ T998] ? io_ring_exit_work+0x3b9/0x830 [ 1405.433839][ T998] ? io_ring_exit_work+0x3b9/0x830 [ 1405.438960][ T998] ? io_ring_exit_work+0x3bb/0x830 [ 1405.444079][ T998] handle_bug+0xcf/0x120 [ 1405.448322][ T998] exc_invalid_op+0x1a/0x50 [ 1405.452832][ T998] asm_exc_invalid_op+0x1a/0x20 [ 1405.457680][ T998] RIP: 0010:io_ring_exit_work+0x3b9/0x830 [ 1405.463396][ T998] Code: fd 48 8b 7c 24 40 48 8b 74 24 10 e8 91 00 11 00 48 85 c0 41 bf 00 20 00 00 75 1d e8 b1 f0 00 f7 e9 b1 fd ff ff e8 a7 f0 00 f7 <0f> 0b b8 70 17 00 00 48 89 44 24 10 eb c1 c7 84 24 90 00 00 00 00 [ 1405.483001][ T998] RSP: 0018:ffffc90004527a40 EFLAGS: 00010293 [ 1405.489058][ T998] RAX: ffffffff8a868179 RBX: ffff888140ab4000 RCX: ffff888022c30000 [ 1405.497019][ T998] RDX: 0000000000000000 RSI: fffffffffffffffe RDI: 0000000000000000 [ 1405.504982][ T998] RBP: ffffc90004527bb0 R08: ffffc900045279c7 R09: 1ffff920008a4f38 [ 1405.512946][ T998] R10: dffffc0000000000 R11: fffff520008a4f39 R12: dffffc0000000000 [ 1405.520908][ T998] R13: 000000010001af0b R14: 000000010001af0d R15: ffff888140ab4510 [ 1405.528878][ T998] ? io_ring_exit_work+0x3b9/0x830 [ 1405.533997][ T998] ? io_ring_ctx_wait_and_kill+0x2b0/0x2b0 [ 1405.539810][ T998] ? _raw_spin_unlock_irq+0x23/0x50 [ 1405.545021][ T998] ? process_scheduled_works+0x975/0x1600 [ 1405.550742][ T998] ? process_scheduled_works+0x975/0x1600 [ 1405.556463][ T998] process_scheduled_works+0xa60/0x1600 [ 1405.562023][ T998] ? worker_attach_to_pool+0x370/0x370 [ 1405.567481][ T998] ? assign_work+0x3cc/0x5d0 [ 1405.572077][ T998] worker_thread+0xa5e/0xfe0 [ 1405.576682][ T998] ? _raw_spin_unlock+0x40/0x40 [ 1405.581526][ T998] ? __kthread_parkme+0x71/0x1c0 [ 1405.586462][ T998] kthread+0x2fa/0x390 [ 1405.590522][ T998] ? pr_cont_work+0x550/0x550 [ 1405.595192][ T998] ? kthread_blkcg+0xd0/0xd0 [ 1405.599803][ T998] ret_from_fork+0x48/0x80 [ 1405.604241][ T998] ? kthread_blkcg+0xd0/0xd0 [ 1405.608826][ T998] ret_from_fork_asm+0x11/0x20 [ 1405.613605][ T998] [ 1405.616671][ T998] Kernel Offset: disabled [ 1405.621064][ T998] Rebooting in 86400 seconds..