last executing test programs: 39m0.332722087s ago: executing program 4 (id=357): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x5, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3cb39000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) madvise(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x16) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='pagemap\x00') pread64(r3, &(0x7f0000001240)=""/102400, 0x19000, 0x1000000000) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r4, &(0x7f0000d84000)={0xa, 0x2}, 0x1c) sendto$inet6(r4, &(0x7f0000000f80)="372fbb6f04c4bb391970ae2fee1b1a745e3d1c4f6d9b77169414cca86601cf98f0349909abe408210c38af788d8f2951747f60", 0x33, 0x20000014, &(0x7f0000b63fe4)={0xa, 0x2, 0x18115, @rand_addr=' \x01\x00', 0x983a}, 0x1c) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r4, 0x0, r5, 0x0, 0x406f413, 0x0) sendmmsg$unix(r2, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f0000000ec0)=[{{&(0x7f0000000280)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @local}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000300)=""/105, 0x69}, {&(0x7f00000000c0)=""/9, 0x9}, {&(0x7f0000000380)=""/148, 0x94}, {&(0x7f0000000440)=""/131, 0x83}, {&(0x7f0000000180)=""/47, 0x2f}, {&(0x7f0000000500)=""/165, 0xa5}, {&(0x7f0000000680)=""/175, 0xaf}], 0x7, &(0x7f0000000740)=""/63, 0x3f}}, {{&(0x7f0000000780)=@nfc, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000800)=""/250, 0xfa}, {&(0x7f0000000940)=""/134, 0x86}], 0x2, &(0x7f0000000a40)=""/97, 0x61}}, {{&(0x7f0000000ac0)=@rc={0x1f, @none}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000b40)=""/54, 0x36}, {&(0x7f0000000b80)=""/99, 0x63}, {&(0x7f000001a240)=""/4096, 0x1000}, {&(0x7f0000000c00)=""/94, 0x5e}, {&(0x7f0000000c80)=""/154, 0x9a}, {&(0x7f0000000d40)=""/53, 0x35}, {&(0x7f0000000d80)=""/35, 0x23}, {&(0x7f0000000dc0)=""/75, 0x4b}], 0x8}, 0x3}], 0x3, 0x2, 0x0) r6 = socket$igmp6(0xa, 0x3, 0x2) r7 = socket(0x2, 0x1, 0xfffffff7) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x181000, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'netpci0\x00', 0x1}) socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x8805}, 0x20008850) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_bond\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f000001b240)=@newtfilter={0x47c, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r10, {0xf000, 0xffff}, {}, {0x7, 0x4}}, [@filter_kind_options=@f_bpf={{0x8}, {0x450, 0x2, [@TCA_BPF_CLASSID={0x8, 0x3, {0x8, 0x4}}, @TCA_BPF_POLICE={0x444, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0x5, 0x10000000, 0x0, 0x8000, 0x3, {0xd, 0x2, 0x8001, 0x7, 0x7, 0x99}, {0x7, 0x0, 0x800, 0x7, 0x9, 0x6}, 0xfffffff3, 0x7fffffff, 0xfffffff5}}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8599, 0x8, 0x0, 0x0, 0x8, 0x7, 0x35, 0x57c4, 0x1, 0x3, 0x8, 0x7, 0x80000000, 0x9, 0x10000, 0x1, 0x5, 0x2, 0x80000000, 0x9, 0x80000000, 0x3, 0x6, 0x6, 0xe, 0x17559a84, 0xd81c, 0x7, 0x0, 0x6, 0x70, 0xef, 0x4, 0x4892, 0x36, 0x1000, 0x2, 0xfffffff7, 0x3, 0x6, 0x2, 0x4, 0x1, 0x1c000000, 0xe60, 0xffffffff, 0x3, 0x1, 0x8, 0x40000, 0x6a2, 0xffffff81, 0x8, 0x4, 0x800, 0x81, 0x7, 0x9, 0x1, 0x9, 0xb, 0x9, 0x5, 0x7, 0xd6, 0x3, 0x7, 0xda, 0xc81e, 0x6, 0x3, 0x4, 0x2a36, 0x4, 0xffffffff, 0x8, 0xc3c, 0xb, 0x80000000, 0x0, 0xffffff75, 0x7f, 0x7ff, 0x7f, 0x0, 0x7fffffff, 0x4, 0x3, 0x8, 0x7fff, 0x1, 0x7, 0x8000, 0x7fff, 0x0, 0x7, 0x5, 0xfffff39c, 0x2, 0x5, 0x0, 0x1, 0xb648, 0x800, 0x9, 0x8, 0x9, 0x80f2, 0x0, 0x6, 0x9, 0x81, 0x9, 0x7ff, 0x2, 0x67f7, 0x9, 0x1, 0x4, 0x7, 0x4, 0x1, 0x2, 0x5, 0x5, 0x9136, 0xf9, 0xe2c1, 0x5, 0x5, 0x800, 0xfffffff8, 0x8001, 0x1, 0x8, 0x7f, 0xe, 0x1, 0x40, 0x7, 0xd930, 0xa, 0x0, 0x8, 0x80000000, 0x0, 0x4, 0x1ee, 0x3, 0x0, 0xe, 0x2, 0x80000001, 0x8, 0x4, 0x1, 0x0, 0x96bd, 0x9, 0x6, 0x5, 0x6, 0x2, 0x8, 0xe8f, 0x5, 0x88f39f4, 0x0, 0x9, 0x1, 0x9, 0x8, 0x10, 0x40, 0x8, 0x2, 0x3ff, 0x101, 0x10, 0xde58, 0x9, 0xe, 0x7fff, 0x39a, 0x1, 0x4dd, 0x8, 0x1, 0x454, 0x6, 0x925, 0x6, 0x9, 0xfffffff7, 0x40, 0x3, 0x8000, 0x10, 0x9b, 0x9b, 0x250f, 0x2, 0x3, 0xe48, 0x7, 0x4, 0x6, 0x9, 0xffffffff, 0x7fff, 0x401, 0x4, 0xf, 0x3, 0x7f, 0x8, 0xfffffffe, 0xffffff01, 0x9, 0x2, 0x80000000, 0xf, 0xa5, 0x3, 0x785c, 0x0, 0x8, 0x1, 0x1000, 0x0, 0x1, 0xa, 0x9, 0x3ff, 0x0, 0x4, 0x800, 0xfffffffb, 0x9, 0x3, 0x5800000, 0x4, 0x9, 0x0, 0x2, 0x8, 0x4, 0x3, 0x8, 0x5, 0xd7e, 0x0, 0xffffc7fe, 0xfff, 0x0, 0xb8]}]}]}}]}, 0x47c}, 0x1, 0xa0000000, 0x0, 0x80}, 0x20000800) r11 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r11) 38m57.337618095s ago: executing program 4 (id=367): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000300)={@in={{0x2, 0x4e24, @loopback}}, 0x0, 0x0, 0x2d, 0x0, "ee8b0e650926a96ecc136e7fb980e989db9e8bf9b93129488f651a8de213eb94cd46f672f2a7a018444a131f4da58ae36556dd38ea6c029607462029add09240005c6776267517308f3d40aa1c788df6"}, 0xd8) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback, 0xfffffffd}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6731f234db1cc7f3f382ad796bd667cb12ea99509873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000040)=0x2, 0x4) writev(r0, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1f) shutdown(r0, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$pptp(0xffffffffffffffff, 0x0, 0xffffffffffffffba) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400010bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x16ba82, 0x10) write$selinux_load(r2, 0x0, 0x10c) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x6000050) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000014000000000000000000000000a60000000060a090400000000000000000200fffe0900020073797a3200000000090001007379"], 0x88}, 0x1, 0x0, 0x0, 0x24044800}, 0x0) mincore(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x0) r4 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000240)='/dev/comedi3\x00', 0x400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r4, 0x40946400, &(0x7f00000003c0)={'pcl730\x00', [0x4f23, 0x7f, 0x1, 0x0, 0x1, 0x5, 0xc, 0x3, 0xa, 0xfd, 0xfffffffa, 0xffffffff, 0x401, 0x1, 0x6, 0x101, 0xf7fffffe, 0x7f, 0x2, 0x40000001, 0x8c, 0xca9f, 0x0, 0x20001e58, 0xb, 0xc3, 0x3, 0x4, 0x4083, 0x0, 0xc6]}) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 38m56.097823523s ago: executing program 32 (id=368): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() ioctl$IOMMU_VFIO_IOMMU_GET_INFO(0xffffffffffffffff, 0x3b70, &(0x7f00000003c0)={0x30}) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000002e00090027bd7000000000000400000008000c00", @ANYRES32=0x0, @ANYBLOB="6482ab839ffe4f5c7ec2f8430f0112fe36a3a4ca2d826923efd4ba91e7baf9bd91ca28726330078a37cc7399a63ece6d5c4a56da3a47dd2a631e8f5cedee73f466f6746a4e339368181b6578231ce4095743000000000000000055f8385627795de028346d143485b0d124c4ffd8612edffb916be56cb88ded08c16715289b1b689321490666f7a77b5c70ba7dbdcf948a537f775f47751f7a2f80cc2e12e829ca2d20d535c3b8e37254f2d3fea280ee8e8912ce1696b48fd69c363c4af2e5be652ea65b87725f1f0904686b8535b1ea2ccd0672bcb35e6e758aba60712ea5e86811c66af617257f931a96401997d567c7"], 0x1c}, 0x1, 0x0, 0x0, 0x42804}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x6) ioctl$KVM_XEN_HVM_CONFIG(r8, 0x4038ae7a, &(0x7f0000000100)={0x2, 0x8c5, 0x0, 0x0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r9, &(0x7f0000013000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, &(0x7f0000000080)="0f08b9820400000f32b805000000b9050000000f01d966ba410066ed0fa80f01c40fc72a36f4c4e2fd40db66ba6100b83e9f0000ef", 0x35}], 0x0, 0x2c, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000000)=[{0x48, 0x7, 0x48, 0x1}, {0x6, 0x25, 0x3, 0x207}]}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000240)={'veth0_vlan\x00', 0x0}) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f0000000280)={0x98, 0x0, 0x10, 0x70bd2b, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x1c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r10}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}, @MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0xa}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x4c, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FLAGS={0x8}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @mcast1}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @ipv4={'\x00', '\xff\xff', @empty}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}, @MPTCP_PM_ATTR_TOKEN={0x8}]}, 0x98}, 0x1, 0x0, 0x0, 0x40004}, 0x4084) syz_kvm_setup_cpu$x86(r8, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f00000001c0)=[@textreal={0x8, 0x0}], 0x1, 0xd, 0x0, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r1, @ANYRESDEC=r1, @ANYRES32=r12, @ANYBLOB="50007a800c000300f3bc25f7ce07c78a240001"], 0x6c}, 0x1, 0x0, 0x0, 0x20002804}, 0x10) 38m56.093547365s ago: executing program 4 (id=371): r0 = socket(0xa, 0x3, 0x3a) ioctl$sock_kcm_SIOCKCMUNATTACH(r0, 0x89e1, 0x0) socket$inet6(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8e}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000140), 0x0, 0x8000) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x9) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r4 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'netdevsim0\x00', 0x0}) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x1, 0x7, 0x2261, 0x2, 0x0, 0xffffffffffffffff, 0x0, '\x00', r5}, 0x50) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000002c0)={{r6}, &(0x7f0000000240), &(0x7f0000000280)='%pI4 \x00'}, 0x20) r7 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000680)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x2, 0x5, 0x3}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000007c0)={0x6, 0x10, &(0x7f00000003c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x55}, [@snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}}]}, &(0x7f00000001c0)='GPL\x00', 0x4, 0x85, &(0x7f0000000440)=""/133, 0x41000, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000500)={0x8, 0x5}, 0x8, 0x10, &(0x7f0000000540)={0x0, 0xd, 0x3, 0x4}, 0x10, 0x0, 0x0, 0x6, &(0x7f0000000700)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r6, r7], &(0x7f0000000740)=[{0x0, 0x4, 0x3, 0xa}, {0x2, 0x1, 0x2, 0xb}, {0x1, 0x5, 0xd, 0x8}, {0x4, 0x4, 0x0, 0x4}, {0x0, 0x2, 0xc, 0xa}, {0x4, 0x3, 0x2, 0x6}], 0x10, 0x400}, 0x94) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x2, 0x0, 'syz1\x00', &(0x7f0000000180)=['\x00', '-[\'\x00'], 0x5}) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/asound/seq/clients\x00', 0x0, 0x0) r8 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZE(r8, 0x5609, &(0x7f0000000040)={0x1, 0x7, 0x3}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x81) unshare(0x64000600) socket$can_j1939(0x1d, 0x2, 0x7) 38m55.196306891s ago: executing program 4 (id=375): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x300) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) 38m55.07526484s ago: executing program 4 (id=377): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000180)='/dev/comedi3\x00', 0xc00, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r4}, 0x10) r5 = syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="d800000000000000f9ffffffffffffff05000000000000000200000000000000030000000000000002000000000000000500000008000010050000000000000009000000000000000000000000000000ff000000000000000300000000000000000000001494aa19d83f00000000ffffff7f57000000030000000080", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="040000000400000000000000000000000000200037050000000000002b000000090000003a2d285cc980000000c30000f3397dd86d4d928d24d3a461b60245898556c60000000000002b133b0000000000000000"], 0x0, 0x0, 0x0}) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f00000004c0)={{{@in6=@private0, @in6=@private2}}, {{@in6=@initdev}, 0x0, @in6=@ipv4={""/10, ""/2, @empty}}}, &(0x7f00000001c0)=0xe8) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4008891, 0x0, 0x0) ioctl$MON_IOCX_MFETCH(r5, 0xc0109207, &(0x7f0000000080)={0x0}) ioctl$MON_IOCH_MFLUSH(r5, 0x9208, 0x1000000000) syz_open_dev$usbfs(&(0x7f0000000000), 0x205, 0x44680) fsetxattr$security_ima(0xffffffffffffffff, &(0x7f0000000280), &(0x7f0000000380)=ANY=[@ANYBLOB="8136"], 0x2, 0x1) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000100)='0:,:\x00', 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'8255\x00', [0x40404f26, 0x5, 0x1, 0x401, 0x3, 0x9, 0x1003, 0x1c82, 0x5, 0x3bb, 0x802, 0x1600, 0x5, 0x20000001, 0x2, 0xe1cb, 0x13352f60, 0x0, 0x400, 0x8, 0x6, 0x5, 0xb, 0x402, 0x9, 0x3, 0x41, 0x5, 0x6, 0x8000003, 0xdffffffa]}) ioctl$COMEDI_BUFINFO(r0, 0xc02c640e, 0x0) 38m55.004458177s ago: executing program 1 (id=378): ioperm(0x2, 0x7ff, 0x8) ioperm(0x9, 0x6, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xe1}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000040)=0x4) socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000000)={'ip6tnl0\x00', 0x0}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000480)={'filter\x00', 0x104, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'dvmrp0\x00', 'macvlan0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28}}, {{@arp={@loopback, @multicast2, 0x0, 0x0, 0x0, 0x0, {@mac=@local}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'veth0\x00'}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xe0}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) sched_setaffinity(r1, 0x8, &(0x7f0000000080)=0x6) syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0xf, &(0x7f0000000000)=0x1001, 0x4) socket$inet_tcp(0x2, 0x1, 0x0) migrate_pages(r1, 0x3, &(0x7f0000000040)=0x7f, &(0x7f0000000300)=0x40008000a) setsockopt$inet6_group_source_req(r0, 0x29, 0x2b, &(0x7f0000000240)={0x0, {{0xa, 0x0, 0x0, @mcast1, 0x10000053}}, {{0xa, 0xce21, 0x0, @empty, 0x5}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000000380)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x190) 38m54.260436054s ago: executing program 4 (id=379): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000170a010200000000000000000008"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x90) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) mq_open(&(0x7f00000007c0)='eth0\x00\xdd\xad4=2k\xf1\x05\x9b\x91y\xe1;F\xa2\x8df\xe9\x8a\xe0U\xbc%\x05%\xfei\x96\xb0\x04\x00\x00\x00\x00\x0078z=\x8f\xd5F\xa4AR\xc7\x9f.\xdc\xdb\"A\x16\xd8\x19\xf1lZ\xc8\x93\xda\xf2\xc9\xe8h[u8\xc6\xfa\x9ep\xbe\a\xe2\xf5\xa3Y\x9f\xe1\x04gM\x99K$\r\xf1G\xee\xe1\xbd\x1e\xdf\xe1\x9c\x19\xda\xd3\x94EL\xca\x88\x85Q\x02\xd9L\x90\xeb%/\xb1\xeb\x11uP7\x1f\xd9b\xebF\xf8\x88\xf0\xac.\x94\xfc\v\xb1W\xef~+n\xb1\x9b\x02n]xr\xb3\x80\xbc>\xe8XX\xe6\x12\xf3\xc9\xd5\xf8\xd1\x8d\xcb9\xbf\xb0(<\xeb\x92\x8a\x16\xb7\x11^\xb6\xb7n\xd5\xb5\x00[\xdf\x94\x00\r\x95\x17\xa1h\xf8\x00\x00\x00\"\xa0\x05\xcc^\x90c\xc9}\xb8\ny\xf4\xe1\xb4.\xa4\a\x05\xbb}\x91\xf4C\xf5O\xf1a\x12\b\x86\xa16\xbb}C\xc9\x1d\\\xedD\x14\xb1w\x1e\xa0\xc1E\xb5\xf8\xab\xfb\xd9\x93\xb8vJ\x85p\xb5n\x1b\xe4\xd5g\xae\xe4\xeb\xca\xae\x1bs\xd4\xf0\xc0\xdag\x19R4\xd4\xd4\x04\xfc\x04Zb\xf6\xba\xf8B\xf6YU\xcd\xf2\xdb\xb5\xa2\x96yU\x9c\x0f\xda\xdf\x8dD\xef`\x13\x15$\xceq\xd7j\xd7\xe3V', 0x83, 0x10, 0x0) chdir(&(0x7f0000000140)='./bus\x00') lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@setlink={0x50, 0x13, 0x1, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x200}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0x1e, 0x0, 0x0, 0x35d}, {0x8, 0x20, 0x0, 0x0, 0xf41c}]}}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wlan1\x00'}]}, 0x50}}, 0x0) 38m54.018056708s ago: executing program 33 (id=379): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="14000000170a010200000000000000000008"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x90) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) creat(&(0x7f0000000440)='./file0/file0\x00', 0x188) mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xb8\x93\xc3C\xae\x9dc\xd1T\xdd\x14\xd3A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\v\x01\xbe\xeb\bLTrw\x88\x9e0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\x01\x00\x00\x00a%\xdcQ\xb3CuT\xcc7\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1J\xec\x926\xb5a0\xa0B\xae|\x00\x17\xc0\xa3\xd5\xf9\xaa\x98/\xa4v\xe4)I\xf3+[e\x95\x89\x99\xca\x8e\xc5\xd3\\T\xf0\x1a|5\xfff\xff\x99\xa4\xbb\x9e#oR\xa4\xf1\xba\x04c\xb3-\xf7R\xb85\xb5\xdb\xe9?\xfa/\xdf\xb4R\xbfx=\v_j\x8e\xb0\'\xf4\xe5\xff!\xe1\xbf\x82e\xb1\x9b\x8d\xf3L\t\xd21\x9cbwV\xc8\xcc\xe4\x96M_w\xbc\xdf9\b\r\xf6\x95\xae\xb5,\x92\x8c\xc0DQm\x80\xd1w\xa2\x1a\x12Z\xe5\xf4H\xf7D\n\x96J\x93\xfb\xf0$\x9f\xf7\xa2\xae$O\xa3\xb6\xf5\x98\xd3\v\x00\x86\xa5\x8b\x81\x04\xaf\x03s\xe5\x86>\x0e\xa6\xe6\x1aV\x17\x8b\xed\xa7\'\xd0\r_\xe8,XVR\x13\xe5%\xb9\x88\xb8W@D\'\x17A\xc8\x80\x02J\xd4V\x00wH(\xc5v\f\xc9\xb6\xdf..$\xe6P(_\xf1\'\xc1:\xa3\xcb\xd9\xd1\xc7\x13\x99Md\x1dc\xf1\'j\x03!\x13\xd1\xb8\xbf\xe6\xb2M\b/\rp\xa5\x00\x00\x00\x00', 0x40, 0x9, 0x0) mq_open(&(0x7f00000007c0)='eth0\x00\xdd\xad4=2k\xf1\x05\x9b\x91y\xe1;F\xa2\x8df\xe9\x8a\xe0U\xbc%\x05%\xfei\x96\xb0\x04\x00\x00\x00\x00\x0078z=\x8f\xd5F\xa4AR\xc7\x9f.\xdc\xdb\"A\x16\xd8\x19\xf1lZ\xc8\x93\xda\xf2\xc9\xe8h[u8\xc6\xfa\x9ep\xbe\a\xe2\xf5\xa3Y\x9f\xe1\x04gM\x99K$\r\xf1G\xee\xe1\xbd\x1e\xdf\xe1\x9c\x19\xda\xd3\x94EL\xca\x88\x85Q\x02\xd9L\x90\xeb%/\xb1\xeb\x11uP7\x1f\xd9b\xebF\xf8\x88\xf0\xac.\x94\xfc\v\xb1W\xef~+n\xb1\x9b\x02n]xr\xb3\x80\xbc>\xe8XX\xe6\x12\xf3\xc9\xd5\xf8\xd1\x8d\xcb9\xbf\xb0(<\xeb\x92\x8a\x16\xb7\x11^\xb6\xb7n\xd5\xb5\x00[\xdf\x94\x00\r\x95\x17\xa1h\xf8\x00\x00\x00\"\xa0\x05\xcc^\x90c\xc9}\xb8\ny\xf4\xe1\xb4.\xa4\a\x05\xbb}\x91\xf4C\xf5O\xf1a\x12\b\x86\xa16\xbb}C\xc9\x1d\\\xedD\x14\xb1w\x1e\xa0\xc1E\xb5\xf8\xab\xfb\xd9\x93\xb8vJ\x85p\xb5n\x1b\xe4\xd5g\xae\xe4\xeb\xca\xae\x1bs\xd4\xf0\xc0\xdag\x19R4\xd4\xd4\x04\xfc\x04Zb\xf6\xba\xf8B\xf6YU\xcd\xf2\xdb\xb5\xa2\x96yU\x9c\x0f\xda\xdf\x8dD\xef`\x13\x15$\xceq\xd7j\xd7\xe3V', 0x83, 0x10, 0x0) chdir(&(0x7f0000000140)='./bus\x00') lchown(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5}) ioctl$IOMMU_HWPT_ALLOC$NONE(r0, 0x3b89, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@setlink={0x50, 0x13, 0x1, 0x0, 0x80, {0x0, 0x0, 0x0, 0x0, 0x200}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET={0x18, 0x2, 0x0, 0x1, {0x14, 0x1, 0x0, 0x1, [{0x8, 0x1e, 0x0, 0x0, 0x35d}, {0x8, 0x20, 0x0, 0x0, 0xf41c}]}}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'wlan1\x00'}]}, 0x50}}, 0x0) 38m54.012094868s ago: executing program 1 (id=381): bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="08000000040000000400"], 0x48) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000001c0)='mm_page_alloc\x00', r0}, 0x16) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair(0x1, 0x20000000000001, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x0, 0x0) open$dir(0x0, 0x1e9240, 0x180) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = shmget$private(0x0, 0x4000, 0x78000000, &(0x7f0000145000/0x4000)=nil) shmat(r3, &(0x7f000048f000/0x4000)=nil, 0x5000) ioctl$sock_SIOCDELDLCI(r1, 0x8981, &(0x7f0000000000)={'veth0_macvtap\x00', 0x4}) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r4, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) bpf$MAP_CREATE(0x0, 0x0, 0x50) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000700)={'sit0\x00', 0x0}) sendmmsg$inet6(r4, &(0x7f0000002940), 0x40000000000017d, 0x811) 38m52.64487029s ago: executing program 1 (id=382): syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0xfffffffffffffebc}, 0x94) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x80000000000002, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) writev(r1, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000d00)=ANY=[@ANYBLOB="b70000008100003bbfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000071105400000000001d400500000000004704000001ed00000f030000000000009f440000000000006b0a00fe000000007313000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff31a8fd3c0fd8b7ff831028e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646c0200000000000000020000e35208b0bb0d2cd829e654400e2438ec649dc76128610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda82fc9c4d7ecc7a803bf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714f62ba7a54f0c33d39000d0bfed3a6a59ff616236fd8f2477184bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06fa2e04cfe0649226c697d9e8eaade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00023ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a83469620c6e74e1f46132559c4f8700a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88f15efaaeea83"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x1, 0x4}, 0x8}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) read$watch_queue(r2, &(0x7f0000000580)=""/98, 0x62) futex(&(0x7f000000cffc), 0xc, 0x1, 0x0, &(0x7f0000048000)=0x1, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f0000000180)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x98f911, 0x8000, '\x00', @string=&(0x7f00000000c0)}}) openat$uinput(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 38m51.739616255s ago: executing program 1 (id=387): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x300) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) r1 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) 38m51.63997581s ago: executing program 1 (id=388): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x41b4, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=@gettaction={0x4c, 0x32, 0x401, 0x70bd2b, 0x25dfdbfb, {}, [@action_gd=@TCA_ACT_TAB={0x4}, @action_dump_flags=@TCA_ROOT_FLAGS={0xc}, @action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x1c, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xfffffff7}}, {0x10, 0x16, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'mirred\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xfffffff7}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40d1}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = fsopen(&(0x7f00000001c0)='binder\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000240)='ro\x00', 0x0, 0x0) fsconfig$FSCONFIG_SET_FLAG(r1, 0x0, &(0x7f0000000000)='async\x00', 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x107842, 0x1) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000140)={'syztnl1\x00', 0x0, 0x2f, 0x8, 0x6, 0x0, 0x39, @dev={0x12, 0x80, '\x00', 0xfe}, @mcast2={0xff, 0x3}, 0x2000, 0xba08}}) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x1}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) pread64(r0, &(0x7f0000000380)=""/146, 0x92, 0x11) 38m50.796599533s ago: executing program 1 (id=389): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x840) write$nci(r1, &(0x7f0000000bc0)=@NCI_OP_RF_DISCOVER_SELECT_RSP={0x1, 0x1, 0x2, 0x4, 0x1, 0x1}, 0x4) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x1000000) 38m50.589579321s ago: executing program 34 (id=389): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, 0x0, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = openat$nci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r2) ioctl$IOCTL_GET_NCIDEV_IDX(r1, 0x0, &(0x7f00000000c0)=0x0) sendmsg$NFC_CMD_DEV_UP(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010026bd7000fcdbdf250200000008000100", @ANYRES32=r4], 0x1c}}, 0x840) write$nci(r1, &(0x7f0000000bc0)=@NCI_OP_RF_DISCOVER_SELECT_RSP={0x1, 0x1, 0x2, 0x4, 0x1, 0x1}, 0x4) syz_usb_connect$hid(0x5, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x1000000) 37m38.517345592s ago: executing program 6 (id=575): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) syz_open_procfs(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='dyn']) (fail_nth: 8) 37m37.433157867s ago: executing program 6 (id=579): socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) sendmmsg$inet(r2, &(0x7f0000000c40)=[{{&(0x7f0000000040)={0x2, 0x0, @multicast2}, 0x23, 0x0}}], 0x1e1730a30afb6559, 0x8014) listen(r2, 0x0) accept(r2, 0x0, 0x0) gettid() ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$IOMMU_GET_HW_INFO(0xffffffffffffffff, 0x3b8a, 0x0) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) r4 = shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) shmat(r4, &(0x7f0000ff9000/0x1000)=nil, 0x4000) shmctl$IPC_RMID(r4, 0x0) socket$kcm(0x10, 0x2, 0x0) r5 = memfd_secret(0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000300)=@mangle={'mangle\x00', 0x1f, 0x6, 0x598, 0x2e0, 0x2e0, 0x2e0, 0x210, 0x2e0, 0x4c8, 0x4c8, 0x4c8, 0x4c8, 0x4c8, 0x6, &(0x7f00000000c0), {[{{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x1}}, @inet=@rpfilter={{0x28}, {0x2}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@dev={0xfe, 0x80, '\x00', 0x2f}, @ipv6=@remote, 0x22, 0x35, 0x4}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x3, 0x2}}}, {{@ipv6={@mcast2, @private0={0xfc, 0x0, '\x00', 0x1}, [0xffffff00, 0x0, 0xff, 0xffffff00], [0xff000000, 0xff, 0xffffff00, 0xffffffff], 'veth1_to_hsr\x00', 'dummy0\x00', {}, {}, 0x2c, 0x4, 0x2, 0x1f}, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x7}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x5, 0x2}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@remote, @ipv4=@broadcast, 0x33, 0x4, 0x8001}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5f8) r6 = syz_io_uring_setup(0x8d2, &(0x7f0000000240)={0x0, 0x0, 0x1000, 0x6}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r3, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x20000044, 0x1}) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000280)=@newtfilter={0x44, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {}, {0xa, 0x1}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8035}, @TCA_FLOWER_KEY_ARP_SIP={0x8, 0x39, @broadcast}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000940)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000900)={&(0x7f00000001c0)=@mpls_newroute={0x34, 0x18, 0x20, 0x70bd2b, 0x25dfdbfb, {0x1c, 0x14, 0x0, 0x6, 0xfd, 0x1, 0x0, 0xb, 0x1400}, [@RTA_DST={0x8, 0x1, {0x4, 0x0, 0x1}}, @RTA_OIF={0x8, 0x4, r10}, @RTA_TTL_PROPAGATE={0x5, 0x1a, 0xf9}]}, 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x0) io_uring_enter(r6, 0x2afd, 0x308b, 0xc, 0x0, 0x0) 37m35.710103011s ago: executing program 6 (id=588): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_X86_SETUP_MCE(r2, 0x4008ae9c, &(0x7f0000000100)={0x10, 0x1, 0x8}) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000480)={0x26, 'hash\x00', 0x0, 0x0, 'nhpoly1305-sse2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="8a", 0x440) accept4(r3, 0x0, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x31}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SCAUSEDIAG(r8, 0x541b, 0x0) bind$inet(r4, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x12, &(0x7f00000001c0), 0x5f) connect$inet(r4, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r9 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x22902, 0x0) ioctl$FBIOBLANK(r9, 0x4611, 0x3) 37m34.072694868s ago: executing program 6 (id=592): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={0x0, r0}, 0x18) keyctl$join(0x1, &(0x7f0000000280)={'syz', 0x1}) request_key(&(0x7f0000000440)='keyring\x00', &(0x7f0000000100)={'syz', 0x1}, 0x0, 0xfffffffffffffffe) 37m33.901492848s ago: executing program 6 (id=595): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x300) r0 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x40000, 0x120) r1 = openat$autofs(0xffffffffffffff9c, 0x0, 0x888000, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r1, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r0, {0x1}}, './file0\x00'}) 37m33.633758072s ago: executing program 6 (id=596): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec85000000750000000400000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc044560f, &(0x7f0000000080)=@mmap={0x0, 0x2, 0x4, 0x0, 0x7, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "10110401"}}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) getpid() 37m18.484953691s ago: executing program 35 (id=596): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec85000000750000000400000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc044560f, &(0x7f0000000080)=@mmap={0x0, 0x2, 0x4, 0x0, 0x7, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "10110401"}}) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) getpid() 16m54.233003961s ago: executing program 7 (id=4975): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$kcm(0xa, 0x3, 0x87) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x5cd241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket(0x2b, 0x80801, 0x1) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e27, 0x2, @private2, 0xfffffffe}, 0x1c) listen(r3, 0x1) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000030400000000fbdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="20000000100000001c001280090001006970697027d6fc6015b652eea28f3b"], 0x3c}}, 0x20000000) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="034886dd010000000000140000006000000003088700fe88a43de1a400000000000000007d01ff020000000000000000000000000001"], 0xfdef) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a58000000160a03020002000000000000020000000900020073797a30000000000900010073797a30000000002c00038008000140000000000800024000000000180003801400010073797a5f74756e00000000000000000014000000110001"], 0x80}}, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000240)={@remote, @local, @val={@val={0x88a8, 0x6, 0x1, 0x2}, {0x8100, 0x7, 0x0, 0x44}}, {@ipv4={0x800, @generic={{0x5, 0x4, 0x3, 0x29, 0x14, 0x68, 0x0, 0x40, 0x2f, 0x0, @empty, @broadcast}}}}}, 0x0) 16m53.580066128s ago: executing program 7 (id=4976): r0 = syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003ac9bcc20d118af1ebb5a0102030109022400010700800b0904"], &(0x7f0000000780)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$printer(0x3, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x8, 0x50, 0x7, [{{0x9, 0x4, 0x0, 0x6, 0x2, 0x7, 0x1, 0x3, 0x7f, "", {{{0x9, 0x5, 0x1, 0x2, 0x10, 0x2, 0x4, 0x5}}, [{{0x9, 0x5, 0x82, 0x2, 0x0, 0x6, 0x8, 0x8}}]}}}]}}]}}, &(0x7f0000000100)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x201, 0x4, 0x7, 0x6, 0xff, 0x38}, 0xd4, &(0x7f0000000180)={0x5, 0xf, 0xd4, 0x3, [@wireless={0xb, 0x10, 0x1, 0xc, 0x0, 0x9, 0x1, 0x6, 0x3}, @generic={0xb8, 0x10, 0xb, "e66b191c00c6e75ddce04eb5463830eae3623bedf855609bffaccecf102719a9a8f7da993c292349c9c5568b6d400d7038ade8405152fb956c0a07bf92de16c5765e7d862286babc9768001b1104286d573a0f7a47e55afc26638b6e46622918b72b0375990054b72e21b0c517fdb0d8cfdb5ff16e9438d88c8ec56df0495218128279be4d77541e1c2e27c25695e70a0e778c92345a895426ece56d7c934799903d3fd024e4546ae6456d0204b9f8d6bb8ac69ba0"}, @ssp_cap={0xc, 0x10, 0xa, 0x6c, 0x0, 0x5, 0xf00, 0x4}]}, 0x1, [{0x4, &(0x7f00000000c0)=@lang_id={0x4, 0x3, 0x2c09}}]}) r1 = socket$kcm(0x2b, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$inet(r1, &(0x7f0000000240)={&(0x7f00000000c0)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x300}, 0x200048cc) setsockopt$sock_attach_bpf(r1, 0x1, 0xd, &(0x7f0000000080), 0x24) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) r3 = socket$inet_icmp(0x2, 0x2, 0x1) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000440)=@nat={'nat\x00', 0x19, 0x1, 0x136, [0x200000000280, 0x0, 0x0, 0x20000000038e, 0x2000000003be], 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="000000000000000000000000000000000000000000000000000000feffffff7ec429f248649cfcc4e4d7cba901000000110000004200000088f870696d726567300000000000000000006970366772653000000000000000000076657468305f766972745f776966690069703608000000617030000000000000bbbbbbbbbbbbff000000ff00aaaaaaaaaaaaffff000000ff6e0000006e000000a60000006172707265706c7900000000000000000000000000000000000000000000000010000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000001000000feffffff00"/297]}, 0x1a1) socket$rds(0x15, 0x5, 0x0) ioctl$IOCTL_GET_NCIDEV_IDX(0xffffffffffffffff, 0x0, &(0x7f0000000000)) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$RDS_GET_MR_FOR_DEST(r4, 0x114, 0x7, &(0x7f0000000280)={@tipc=@id={0x1e, 0x3, 0x1, {0x4e21, 0x2}}, {&(0x7f0000000140)=""/156, 0x9c}, &(0x7f0000000040), 0x2}, 0xa0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) close(r1) syz_usb_control_io(r0, 0x0, &(0x7f0000000e80)={0x44, &(0x7f0000000140)=ANY=[@ANYBLOB="400d02"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 16m52.758395401s ago: executing program 7 (id=4980): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40ffff0100000003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x855}, 0x40) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a4c0000000e0a010100000000000000000a0000060900020073797a31000000000900010073797a3100000000200003801c0000800c00018006"], 0x74}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 16m51.926006438s ago: executing program 7 (id=4981): syz_usb_connect(0x0, 0x0, 0x0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x4, &(0x7f0000000180)=@lang_id={0x4, 0x3, 0x403}}]}) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4e23, 0xffffffff, @loopback, 0x8}, 0x1c) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) r1 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)={0x20, r1, 0x1, 0x70bd27, 0x25dfd3fb, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$SMC_PNETID_GET(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, r1, 0x8, 0x70bd2b, 0x25dfdbff, {}, [@SMC_PNETID_IBPORT={0x5, 0x4, 0x2}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4b, 0x0, 0x0) sendmsg$sock(0xffffffffffffffff, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, 0x0, 0x0) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000002300), 0x2, 0x0) r6 = socket$l2tp6(0xa, 0x2, 0x73) getsockopt$inet6_opts(r6, 0x29, 0x39, 0x0, &(0x7f00000000c0)) ioctl$VHOST_SET_MEM_TABLE(r5, 0x4008af03, &(0x7f00000005c0)) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r7 = fcntl$dupfd(r0, 0x0, r0) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[], 0x14}}, 0x4000) sendmsg$WG_CMD_GET_DEVICE(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[], 0x2b08}}, 0x4000806) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x2, &(0x7f0000000340)=@ccm_128={{0x303}, "49c2ac006b511400", "e0ffd4a271e30000516600", "1c14bf00", "c962b0c0b5d958c9"}, 0x28) recvmmsg(r0, &(0x7f0000001040)=[{{0x0, 0x0, 0x0}, 0x2002}, {{0x0, 0x22, &(0x7f0000000100)=[{&(0x7f00000007c0)=""/94, 0x5e}], 0x1}, 0x4}], 0x2, 0x40002042, 0x0) 16m50.936789454s ago: executing program 7 (id=4984): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff}) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000004500), 0x0, &(0x7f0000000100)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@version_9p2000}]}}) write$P9_RVERSION(r2, 0x0, 0x15) 16m50.002417878s ago: executing program 7 (id=4989): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) syz_usb_connect(0x0, 0x6e3, &(0x7f0000000340)={{0x12, 0x1, 0x201, 0xfa, 0x88, 0x1e, 0x28, 0x46d, 0x8f0, 0xb5c7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6d1, 0x2, 0x3, 0x2, 0x20, 0x10, [{{0x9, 0x4, 0xa8, 0xd, 0xf, 0x1, 0x1, 0xaf, 0x56, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "d876fb6a9822"}, {0x5, 0x24, 0x0, 0xf}, {0xd, 0x24, 0xf, 0x1, 0xa3, 0xff, 0x1, 0x9}, [@obex={0x5, 0x24, 0x15, 0x1}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0x8}, @acm={0x4, 0x24, 0x2, 0x6}]}], [{{0x9, 0x5, 0xd, 0x0, 0x200, 0x7, 0x6, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x9, 0x7}]}}, {{0x9, 0x5, 0x71bd533cf95f0c5a, 0x8, 0x3ff, 0x0, 0x6}}, {{0x9, 0x5, 0xf, 0x0, 0x40, 0x1, 0x0, 0x5}}, {{0x9, 0x5, 0x80, 0x8, 0x10, 0xa2, 0x8e, 0x3, [@generic={0x49, 0x4, "a8cc1ccdba2aeb1eaa4c22a64f61944b045a7eb35d4f5249d4383b1fb878b9b87f95b788303d11c1d6ac14dedd174f7011c5e5de964e2a141210ce987a0bd343b763f8ba6d94a6"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x4}]}}, {{0x9, 0x5, 0x4, 0x3, 0x0, 0x3, 0x36, 0x26, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x57c}]}}, {{0x9, 0x5, 0x9, 0x1, 0x40, 0xf9, 0xd, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x2, 0xffff}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xc9, 0x6}]}}, {{0x9, 0x5, 0xd, 0x4, 0x20, 0xab, 0x80, 0xd, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x8, 0x3}]}}, {{0x9, 0x5, 0x1, 0xc, 0x20, 0x40, 0x1, 0x7, [@generic={0xa5, 0x6, "23d253a131d9ce42217b33ef52ad6e7bf016faf0aad96b4eb3532aa5d86196e49c2efa76c91c2935e0905c745074a78f49b04eedb5e73cca05d5f1ece42e614fb000f63ea75418d075a56d777e703946a3edcd1cbea140334ec7d4d191373ee96f8a47941d4a7b88b90d970692562e26e29d1007a4bbdb2dbdb31e97f4e975b7d517b0d7b33bff5cc4ded32a6c32db06164f10b4cd4810f957f31726f18364e9b133ba"}, @generic={0xa, 0x5, "6c5768f75ee4f6ab"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0x49, 0x6, 0xff}}, {{0x9, 0x5, 0xa, 0x8, 0x200, 0x6, 0x4, 0x1, [@generic={0x3f, 0x9, "5884de1da7e52780c210afa9d74ad5afee8af8e18790ae582014e0a21c96eb71b2479cb5b1530ac20eba7badaa85e2766209d4ba0fa2b516d272f42e51"}, @generic={0x8d, 0x23, "9775dc61cfce2804de9bf92226f107f542bf8e71829cb6918cc2c2ccebbc32f6e8c5167f3c634fd095ce02e02d8c39bb3f210b8b358af2ac7d169c8315183869c63469eb76b84ec0483d0d5d8adb35c74db601ae8c45e62ec6f032b20a06e2f577b18de68cb6fd51d8c8758ee0decc7fa0609ce583292ed7914542ed246078e1dc16d92b3cea04293f0c7b"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x200, 0x2, 0x6, 0xa, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x7, 0x4}]}}, {{0x9, 0x5, 0x1, 0x0, 0x20, 0x2, 0x7, 0x4, [@generic={0x69, 0xf, "42af88c747eb147ce094ad69b0cc18e59f28ce7d0addf393229f79a39a54038d9353d6f628133654027be10dc73cc90c7dae22b3a76e516605d09033fc41bf2cab2eda64e063f3a5b9fe53721cb4682cabdf3fe68fbeadb998dbed0f6ac7e3edcb6e8eda788c65"}]}}, {{0x9, 0x5, 0x0, 0xc, 0x20, 0x3, 0x40, 0xb0, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x81, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5}]}}, {{0x9, 0x5, 0xe, 0x1, 0x400, 0xa0, 0x23, 0xff}}, {{0x9, 0x5, 0xc, 0x18, 0x8, 0x3a, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x28, 0x7}]}}]}}, {{0x9, 0x4, 0x4e, 0x7, 0x7, 0x11, 0xb5, 0xf6, 0x0, [], [{{0x9, 0x5, 0x9, 0x10, 0x200, 0x1, 0xfc, 0x6, [@generic={0x62, 0x23, "225cf2c88173a77da2253d39d81c1c7c15271d4e5162b7e58ed6857888872226346ab951b34cbce8fa2bb02582937f2159f1891a953919bf1db064666fa696936f418612c069dd513c520167b70e6f90b4fe5cee797109af66585e9424d02c59"}, @generic={0xfa, 0xf, "fa598f665d41836050777f2f37ef61d8a37c9f207c2cd5867cbf1820d2270733c0fd571c35dd320de607e0015748346bd9f5a94cd5cc9d75a3d30883abb93d5fb6b23095e4ba5da6f1e2268de93968aa85e3baddac79883947fb21efbc987882f7d196d1f74fdfaa17679a4f197f45b1996439117af9ede2ef530d2f0c89cfac68d3e58fe725d570b2812e71df598fb6ad9e667b994f578f0cb1eb0f8c2508d4022a4d100e0ca8d36f005085eb21ed4b17f628cacc2cf212a5285e7250cc44c4accb9f91f536aad5cda2bc205684dcefe43beadcd0b16de401bde52fd3948d8bdbd11990114ee67c232dee3fab9b57ecbb0336ee33259c4a"}]}}, {{0x9, 0x5, 0xc, 0x8, 0x3ff, 0x6, 0x6, 0x4, [@generic={0x9a, 0x23, "86520e46fbbdcc88f6e67acd152c62f34842e4424ea8f32a73df487b94e6c06819a1407a23dff6612cb7e6b364c5b7f2314a21fd94408fcb8be97d1aa273161332f94a2b57631aa9e9615a2dd2c387ee7c774ef8d9f490dd452d73f1a49df45e6ba1a842612fa84f0285b090457d87b640c7aafe5d6b1fd515bf70c939c5d3663ac9a4751a74e2a44209590b2c9e84d57b1ab4aabf40dd8f"}]}}, {{0x9, 0x5, 0x7, 0x7e6c2853b6f6e26b, 0x400, 0x9, 0x3, 0x2}}, {{0x9, 0x5, 0x7, 0x8, 0x20, 0x81, 0x3, 0x7, [@generic={0x48, 0x31, "fd6a67b308d915f570b35318f912f83d0f0a4fa2b171268eb55fe5ac19d959889a45d5919c06aaa04a3e22899356b2c3c2ffd41332a3a699e7bf6ccd64ac2132f79d7d0d3d56"}, @generic={0xff, 0x21, "a95ae2814fd92f9343afe18aaaefe17b3d8b85fce440d7387356ed8fd8e4f8eed0f529cd6cde6b19f3464a215a22ced4033a251636e0aa92dba8c1a37e81b9d64cad12235f81d8ab7df6b5b3d5141b57d9f424cf23263318860a61f9040ab4109cb4b9d01c17bb1bec615073324ffbfd2fc050bb91935227bf7491139336a190d6ae87fb3f2cfd10eed2eafe0936b1215ebe126942a028f28655cdfdb3a6962038c6003e1bbae22367d57c5ff79992bae27d2bd9032782e4a5a2f49b9313e9150d165009133a2209299be091a09f30ef3bc2093bfd6147dad098de82a4aa59e479ea7dd0efab5f3fc3caf7ce1b126dce408f94736cb814ef89d66d7b4d"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x400, 0x8, 0x8, 0x68}}, {{0x9, 0x5, 0xa, 0x3, 0x3ff, 0x40, 0x82, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x7, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x2, 0x4}]}}, {{0x9, 0x5, 0x7, 0x8, 0x10, 0x4, 0x19, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f, 0xfa}]}}]}}]}}]}}, &(0x7f0000000d80)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x110, 0x4, 0x5, 0x4, 0x8, 0xbb}, 0x27, &(0x7f0000000a40)={0x5, 0xf, 0x27, 0x3, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x4, 0x45, 0x4e, 0x2, 0xffff, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "cb3b2de9a073a758ff61ab6138b8af77"}]}, 0x5, [{0xfa, &(0x7f0000000a80)=@string={0xfa, 0x3, "4660b6a57467021ee9bee7a2ddabcf0b08fdaca0c2542d871c78274012830287dac71aa4de17bc5a995af03b1d2fd8c2a18451390426cd0201cd53969ead21a2bf8139d60adb646fd307e341db34ce88ac47f42143e50e74319d3f02904b59c05f40f9472d67ee871b3905f40a1556d87d177940b5bc6d5eb550cc2f588b94f63282d7df6a61c54377de803f3b7cc68e47e7230d49a75dc23f4f953066e92da0a4ba09c02282af21ae69b01fa188c3716c18da15d270d00f3c35afe019183856857b4b3450dfe7e32a752cb6b4fdeccc7d77c4a7689c5b7f239b9b145b689c8d61c36840307e46123556fecf4d82e2b54b995828287346f0"}}, {0x8, &(0x7f0000000b80)=@string={0x8, 0x3, "546b85194a4c"}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x40f}}, {0xb9, &(0x7f0000000c00)=@string={0xb9, 0x3, "1b95fde14148461398f259acc8239f3ff2a9dba1dc2f446cad120007f6f830bde3424aa4bee9bff1858b9b28ef63a8d643c84c78f2cd87fcd003c8b311991a98de8be8b1a288df16cce5476b94ec5f75163d7fed249d35f1a8ff022cda3168117c808fc5fc8871314e84b55783209b29104142f7b0d2a90b9c08bbaf716c13a397a07c566c7cc5378b7145376bdbde30e45ea2de7f183a429b6f7c45fca1b2eed518ac5d0f8cb6bbcdf3fed607e70a601294a08b7374b4"}}, {0xa0, &(0x7f0000000cc0)=@string={0xa0, 0x3, "565aca7d6e126cc1672b41bd0a1951465027a398c7de3ad6eb57e9d302b6f084df5e0ee3864c3628e1e03b4190fb0884db6fd7a203993fed3979fe3a81bb4f9574108a6d1a733f3a07f5e1471111f3803c98bceb75c070a641a6f2a4d8757b04c591973b1960451e1eb5df356a3d109238bef8c1a1a61f14d6989df67ff5ec66631c4d4849eb204bd99e2ebfb5807a8bcfbd92a66c25ec9e5716efe234b6"}}]}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) fstatfs(r3, &(0x7f0000000140)=""/226) write$P9_RWALK(r3, &(0x7f0000000080)={0x16, 0x6f, 0x2, {0x1, [{0x40, 0x0, 0x4}]}}, 0x16) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x4801) 16m33.922967533s ago: executing program 36 (id=4989): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) syz_usb_connect(0x0, 0x6e3, &(0x7f0000000340)={{0x12, 0x1, 0x201, 0xfa, 0x88, 0x1e, 0x28, 0x46d, 0x8f0, 0xb5c7, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6d1, 0x2, 0x3, 0x2, 0x20, 0x10, [{{0x9, 0x4, 0xa8, 0xd, 0xf, 0x1, 0x1, 0xaf, 0x56, [@cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "d876fb6a9822"}, {0x5, 0x24, 0x0, 0xf}, {0xd, 0x24, 0xf, 0x1, 0xa3, 0xff, 0x1, 0x9}, [@obex={0x5, 0x24, 0x15, 0x1}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0x8}, @acm={0x4, 0x24, 0x2, 0x6}]}], [{{0x9, 0x5, 0xd, 0x0, 0x200, 0x7, 0x6, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x9, 0x7}]}}, {{0x9, 0x5, 0x71bd533cf95f0c5a, 0x8, 0x3ff, 0x0, 0x6}}, {{0x9, 0x5, 0xf, 0x0, 0x40, 0x1, 0x0, 0x5}}, {{0x9, 0x5, 0x80, 0x8, 0x10, 0xa2, 0x8e, 0x3, [@generic={0x49, 0x4, "a8cc1ccdba2aeb1eaa4c22a64f61944b045a7eb35d4f5249d4383b1fb878b9b87f95b788303d11c1d6ac14dedd174f7011c5e5de964e2a141210ce987a0bd343b763f8ba6d94a6"}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x9, 0x4}]}}, {{0x9, 0x5, 0x4, 0x3, 0x0, 0x3, 0x36, 0x26, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x2, 0x57c}]}}, {{0x9, 0x5, 0x9, 0x1, 0x40, 0xf9, 0xd, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x2, 0xffff}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0xc9, 0x6}]}}, {{0x9, 0x5, 0xd, 0x4, 0x20, 0xab, 0x80, 0xd, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x8, 0x3}]}}, {{0x9, 0x5, 0x1, 0xc, 0x20, 0x40, 0x1, 0x7, [@generic={0xa5, 0x6, "23d253a131d9ce42217b33ef52ad6e7bf016faf0aad96b4eb3532aa5d86196e49c2efa76c91c2935e0905c745074a78f49b04eedb5e73cca05d5f1ece42e614fb000f63ea75418d075a56d777e703946a3edcd1cbea140334ec7d4d191373ee96f8a47941d4a7b88b90d970692562e26e29d1007a4bbdb2dbdb31e97f4e975b7d517b0d7b33bff5cc4ded32a6c32db06164f10b4cd4810f957f31726f18364e9b133ba"}, @generic={0xa, 0x5, "6c5768f75ee4f6ab"}]}}, {{0x9, 0x5, 0x80, 0x0, 0x3ff, 0x49, 0x6, 0xff}}, {{0x9, 0x5, 0xa, 0x8, 0x200, 0x6, 0x4, 0x1, [@generic={0x3f, 0x9, "5884de1da7e52780c210afa9d74ad5afee8af8e18790ae582014e0a21c96eb71b2479cb5b1530ac20eba7badaa85e2766209d4ba0fa2b516d272f42e51"}, @generic={0x8d, 0x23, "9775dc61cfce2804de9bf92226f107f542bf8e71829cb6918cc2c2ccebbc32f6e8c5167f3c634fd095ce02e02d8c39bb3f210b8b358af2ac7d169c8315183869c63469eb76b84ec0483d0d5d8adb35c74db601ae8c45e62ec6f032b20a06e2f577b18de68cb6fd51d8c8758ee0decc7fa0609ce583292ed7914542ed246078e1dc16d92b3cea04293f0c7b"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x200, 0x2, 0x6, 0xa, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x7, 0x4}]}}, {{0x9, 0x5, 0x1, 0x0, 0x20, 0x2, 0x7, 0x4, [@generic={0x69, 0xf, "42af88c747eb147ce094ad69b0cc18e59f28ce7d0addf393229f79a39a54038d9353d6f628133654027be10dc73cc90c7dae22b3a76e516605d09033fc41bf2cab2eda64e063f3a5b9fe53721cb4682cabdf3fe68fbeadb998dbed0f6ac7e3edcb6e8eda788c65"}]}}, {{0x9, 0x5, 0x0, 0xc, 0x20, 0x3, 0x40, 0xb0, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x81, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x1, 0x5}]}}, {{0x9, 0x5, 0xe, 0x1, 0x400, 0xa0, 0x23, 0xff}}, {{0x9, 0x5, 0xc, 0x18, 0x8, 0x3a, 0x7, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x28, 0x7}]}}]}}, {{0x9, 0x4, 0x4e, 0x7, 0x7, 0x11, 0xb5, 0xf6, 0x0, [], [{{0x9, 0x5, 0x9, 0x10, 0x200, 0x1, 0xfc, 0x6, [@generic={0x62, 0x23, "225cf2c88173a77da2253d39d81c1c7c15271d4e5162b7e58ed6857888872226346ab951b34cbce8fa2bb02582937f2159f1891a953919bf1db064666fa696936f418612c069dd513c520167b70e6f90b4fe5cee797109af66585e9424d02c59"}, @generic={0xfa, 0xf, "fa598f665d41836050777f2f37ef61d8a37c9f207c2cd5867cbf1820d2270733c0fd571c35dd320de607e0015748346bd9f5a94cd5cc9d75a3d30883abb93d5fb6b23095e4ba5da6f1e2268de93968aa85e3baddac79883947fb21efbc987882f7d196d1f74fdfaa17679a4f197f45b1996439117af9ede2ef530d2f0c89cfac68d3e58fe725d570b2812e71df598fb6ad9e667b994f578f0cb1eb0f8c2508d4022a4d100e0ca8d36f005085eb21ed4b17f628cacc2cf212a5285e7250cc44c4accb9f91f536aad5cda2bc205684dcefe43beadcd0b16de401bde52fd3948d8bdbd11990114ee67c232dee3fab9b57ecbb0336ee33259c4a"}]}}, {{0x9, 0x5, 0xc, 0x8, 0x3ff, 0x6, 0x6, 0x4, [@generic={0x9a, 0x23, "86520e46fbbdcc88f6e67acd152c62f34842e4424ea8f32a73df487b94e6c06819a1407a23dff6612cb7e6b364c5b7f2314a21fd94408fcb8be97d1aa273161332f94a2b57631aa9e9615a2dd2c387ee7c774ef8d9f490dd452d73f1a49df45e6ba1a842612fa84f0285b090457d87b640c7aafe5d6b1fd515bf70c939c5d3663ac9a4751a74e2a44209590b2c9e84d57b1ab4aabf40dd8f"}]}}, {{0x9, 0x5, 0x7, 0x7e6c2853b6f6e26b, 0x400, 0x9, 0x3, 0x2}}, {{0x9, 0x5, 0x7, 0x8, 0x20, 0x81, 0x3, 0x7, [@generic={0x48, 0x31, "fd6a67b308d915f570b35318f912f83d0f0a4fa2b171268eb55fe5ac19d959889a45d5919c06aaa04a3e22899356b2c3c2ffd41332a3a699e7bf6ccd64ac2132f79d7d0d3d56"}, @generic={0xff, 0x21, "a95ae2814fd92f9343afe18aaaefe17b3d8b85fce440d7387356ed8fd8e4f8eed0f529cd6cde6b19f3464a215a22ced4033a251636e0aa92dba8c1a37e81b9d64cad12235f81d8ab7df6b5b3d5141b57d9f424cf23263318860a61f9040ab4109cb4b9d01c17bb1bec615073324ffbfd2fc050bb91935227bf7491139336a190d6ae87fb3f2cfd10eed2eafe0936b1215ebe126942a028f28655cdfdb3a6962038c6003e1bbae22367d57c5ff79992bae27d2bd9032782e4a5a2f49b9313e9150d165009133a2209299be091a09f30ef3bc2093bfd6147dad098de82a4aa59e479ea7dd0efab5f3fc3caf7ce1b126dce408f94736cb814ef89d66d7b4d"}]}}, {{0x9, 0x5, 0xf, 0x0, 0x400, 0x8, 0x8, 0x68}}, {{0x9, 0x5, 0xa, 0x3, 0x3ff, 0x40, 0x82, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x7, 0x8}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x2, 0x4}]}}, {{0x9, 0x5, 0x7, 0x8, 0x10, 0x4, 0x19, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x7f, 0xfa}]}}]}}]}}]}}, &(0x7f0000000d80)={0xa, &(0x7f00000002c0)={0xa, 0x6, 0x110, 0x4, 0x5, 0x4, 0x8, 0xbb}, 0x27, &(0x7f0000000a40)={0x5, 0xf, 0x27, 0x3, [@ptm_cap={0x3}, @wireless={0xb, 0x10, 0x1, 0x4, 0x45, 0x4e, 0x2, 0xffff, 0x6}, @ss_container_id={0x14, 0x10, 0x4, 0x8, "cb3b2de9a073a758ff61ab6138b8af77"}]}, 0x5, [{0xfa, &(0x7f0000000a80)=@string={0xfa, 0x3, "4660b6a57467021ee9bee7a2ddabcf0b08fdaca0c2542d871c78274012830287dac71aa4de17bc5a995af03b1d2fd8c2a18451390426cd0201cd53969ead21a2bf8139d60adb646fd307e341db34ce88ac47f42143e50e74319d3f02904b59c05f40f9472d67ee871b3905f40a1556d87d177940b5bc6d5eb550cc2f588b94f63282d7df6a61c54377de803f3b7cc68e47e7230d49a75dc23f4f953066e92da0a4ba09c02282af21ae69b01fa188c3716c18da15d270d00f3c35afe019183856857b4b3450dfe7e32a752cb6b4fdeccc7d77c4a7689c5b7f239b9b145b689c8d61c36840307e46123556fecf4d82e2b54b995828287346f0"}}, {0x8, &(0x7f0000000b80)=@string={0x8, 0x3, "546b85194a4c"}}, {0x4, &(0x7f0000000bc0)=@lang_id={0x4, 0x3, 0x40f}}, {0xb9, &(0x7f0000000c00)=@string={0xb9, 0x3, "1b95fde14148461398f259acc8239f3ff2a9dba1dc2f446cad120007f6f830bde3424aa4bee9bff1858b9b28ef63a8d643c84c78f2cd87fcd003c8b311991a98de8be8b1a288df16cce5476b94ec5f75163d7fed249d35f1a8ff022cda3168117c808fc5fc8871314e84b55783209b29104142f7b0d2a90b9c08bbaf716c13a397a07c566c7cc5378b7145376bdbde30e45ea2de7f183a429b6f7c45fca1b2eed518ac5d0f8cb6bbcdf3fed607e70a601294a08b7374b4"}}, {0xa0, &(0x7f0000000cc0)=@string={0xa0, 0x3, "565aca7d6e126cc1672b41bd0a1951465027a398c7de3ad6eb57e9d302b6f084df5e0ee3864c3628e1e03b4190fb0884db6fd7a203993fed3979fe3a81bb4f9574108a6d1a733f3a07f5e1471111f3803c98bceb75c070a641a6f2a4d8757b04c591973b1960451e1eb5df356a3d109238bef8c1a1a61f14d6989df67ff5ec66631c4d4849eb204bd99e2ebfb5807a8bcfbd92a66c25ec9e5716efe234b6"}}]}) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff}) pipe(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000000)='.\x00', &(0x7f0000000040), 0x0, &(0x7f00000000c0)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}}) fstatfs(r3, &(0x7f0000000140)=""/226) write$P9_RWALK(r3, &(0x7f0000000080)={0x16, 0x6f, 0x2, {0x1, [{0x40, 0x0, 0x4}]}}, 0x16) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r5, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x90) syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x4801) 8m17.830625279s ago: executing program 5 (id=6763): r0 = accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x0, 0x0, @host}, 0x10, 0x80800) r1 = openat$snapshot(0xffffff9c, &(0x7f0000000000), 0x20000, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) dup3(r2, r1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000900)={0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2}, 0x94) syz_io_uring_setup(0x24fa, &(0x7f0000000b80)={0x0, 0x2000000, 0x10100, 0x0, 0x215}, &(0x7f0000000280)=0x0, &(0x7f0000000240)=0x0) sendmsg$IPSET_CMD_TYPE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='8'], 0x38}}, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f0000000180)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_FADVISE={0x18, 0x8, 0x0, @fd, 0x10, 0x0, 0xfffdfff9, 0x5, 0x259792cd96d38d81}) recvmmsg(r0, &(0x7f0000000840)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)=""/181, 0xb5}], 0x1, &(0x7f0000000140)=""/219, 0xdb}, 0xffff}, {{0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000280)=""/157, 0x9d}, {&(0x7f0000000340)=""/89, 0x59}, {&(0x7f00000003c0)=""/44, 0x2c}, {&(0x7f0000000400)=""/124, 0x7c}, {&(0x7f0000000480)}, {&(0x7f00000004c0)=""/233, 0xe9}, {&(0x7f00000005c0)}, {&(0x7f0000000600)=""/113, 0x71}, {&(0x7f0000000680)=""/23, 0x17}], 0x9, &(0x7f0000000780)=""/130, 0x82}, 0xff}], 0x2, 0x78afc7f32d47ce5c, &(0x7f00000008c0)) socket$inet_sctp(0x2, 0x1, 0x84) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000600)={{0xa, 0x0, 0x8, @local, 0xc}, {0xa, 0x4e24, 0x0, @empty}, 0x1}, 0x5c) setsockopt$MRT6_ADD_MFC_PROXY(r6, 0x29, 0xd2, &(0x7f0000000000)={{0xa, 0x4e24, 0x100, @local, 0x4}, {0xa, 0x4e23, 0x7, @empty, 0xd473}, 0x0, {[0x4, 0x7, 0x3, 0x8001, 0xe10, 0xe, 0x3]}}, 0x5c) (fail_nth: 4) 8m15.775294295s ago: executing program 5 (id=6771): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x1, 0x4800100b, r0, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/pm_test', 0x141a82, 0x0) sendfile(r0, r2, 0x0, 0x4) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r3 = openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x200000, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040)={r3}, 0x4) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) socket$packet(0x11, 0xa, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="19000000040000000400000008"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000001500000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001c80)={{r4}, &(0x7f0000001c00)=0x8000000, &(0x7f0000001c40)=r5}, 0x20) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000840)=@bpf_lsm={0x1d, 0xf, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000000020000000000000104000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7020000140000009c030000008500000083000000bf0900000000000055090100000000009500000000010000bf9100000000000070bb9320bb5627b7020000020000008500000085000000b70000000000000095"], &(0x7f0000000180)='GPL\x00', 0x7fff, 0x7f, &(0x7f00000004c0)=""/127, 0x41100, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000000280)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000000680)={0x4, 0xc, 0x8, 0x8001}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000780)=[r4], 0x0, 0x10, 0xd8fb}, 0x94) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x4) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000080"], 0x48) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r6, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r9}, &(0x7f0000bbdffc)) 8m14.470903229s ago: executing program 5 (id=6774): openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000000300)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) connect$unix(r1, &(0x7f0000000280)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) connect$unix(r1, 0x0, 0x0) accept4$unix(r0, 0x0, 0x0, 0x80800) 8m14.426528601s ago: executing program 5 (id=6776): ioctl$I2C_SMBUS(0xffffffffffffffff, 0x720, &(0x7f00000002c0)={0x1, 0xff, 0xa, 0x0}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x0}, 0x0) bpf$MAP_CREATE(0x100000000000000, &(0x7f00000000c0)=ANY=[@ANYBLOB="1600000000000000b40000007f00000000000000", @ANYBLOB="0000000000000800000000000000000000000000016c965536a4dfe5b700444ddb28eca660b2cccdbd0bd2813f15acb9bdd781516a8419a47267d80a7649613669ce59710a4765aee852d9133e1053080c042a1a24c6a6e6fd7936d2c3a3b38fcc24b7fca4378aa4337b0bd8ff0ca075c5ca379035e380f312b9aac77ff3bcd39123c2feac4f9aa6da2c381a3f5469e34ae9039ba30792402b4a745d0a878272393b0bc55f14fccaeb2cced82585d5b9b546b825c8db83bdce25dad50865d73ba46e39b20adf8353d67691011d3c877b7a560ab3a25c7dce4cb970de611041e167b0363922160c57b86d5a1738cb79f7c01f8a293e21189906687bdb365bf21361849edd4bae2432fa7d5fa8285e1b5c"], 0x50) open_tree(0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00', 0x80801) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000002480)=[{{0x0, 0x0, &(0x7f0000001780)=[{&(0x7f00000005c0)="f2b314c96d50", 0x6}], 0x1}}], 0x1, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300), 0x0, &(0x7f0000000b40)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @hoplimit={{0x14, 0x29, 0x34, 0xfffffffd}}, @dstopts_2292={{0xf0, 0x29, 0x4, {0x4, 0x1a, '\x00', [@calipso={0x7, 0x10, {0x1, 0x2, 0x9, 0x9f, [0x8]}}, @generic={0xfe, 0x64, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989"}, @calipso={0x7, 0x38, {0x1, 0xc, 0x7a, 0x8001, [0x5, 0x4, 0x6, 0x4, 0x400, 0xb]}}, @ra={0x5, 0x2, 0xa7e}, @pad1, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}, @generic={0x93}]}}}, @hoplimit={{0x14}}, @hopopts={{0x1a0, 0x29, 0x36, {0x5e, 0x30, '\x00', [@generic={0xff, 0x34, "50d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b45ef9de99984e143ca7c3509a971b2ec42"}, @pad1, @pad1, @calipso={0x7, 0x38, {0x3, 0xc, 0x0, 0xfff, [0x2, 0x966, 0x7, 0xfffffffffffffff7, 0x1, 0x1]}}, @calipso={0x7, 0x10, {0x0, 0x2, 0x7, 0x6, [0x7fff]}}, @generic={0x8, 0xdb, "c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab0900a5e6fcac1cd41c91c97f6826ff706c41edc4e00205bbb53218ed58a1122d993b55a1b9a870a17e7869e3fc704b388202add651f628963a90fea5d8196d5e0373fd13584ae57b4f1c03d4f67005cdb5938591d5ea712014e358ea0808807873fd7290c6d4f033de64c7e86ab309f93fd8146e6672c844ca0c43cde3afb3f9b0e9c19b929779"}, @calipso={0x7, 0x18, {0x3, 0x4, 0x3, 0x7, [0x0, 0x8000]}}, @generic={0x1}]}}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x73, 0x0, '\x00', [@pad1]}}}, @rthdr={{0x18, 0x29, 0x39, {0x62}}}, @rthdr_2292={{0x38, 0x29, 0x39, {0x3a, 0x4, 0x2, 0x70, 0x0, [@mcast1, @mcast2]}}}], 0x348}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount$bpf(0x0, &(0x7f0000000300)='./file0\x00', &(0x7f0000000340), 0x800, &(0x7f0000000600)={[{@gid}, {@gid}, {@mode={'mode', 0x3d, 0x1}}, {}, {}], [{@euid_gt}, {@fsuuid={'fsuuid', 0x3d, {[0x37, 0x36, 0x33, 0x36, 0x32, 0x66, 0x7, 0x61], 0x2d, [0x30, 0x38, 0x36, 0x54], 0x2d, [0x33, 0x36, 0x37, 0x34], 0x2d, [0x34, 0x31, 0x38, 0x32], 0x2d, [0x30, 0x64, 0x62, 0x35, 0x37, 0x34, 0x38, 0x32]}}}, {@subj_role={'subj_role', 0x3d, '\x00'}}, {@audit}, {@obj_user={'obj_user', 0x3d, '\x14)@\x0f#'}}, {@mask={'mask', 0x3d, 'MAY_APPEND'}}, {@smackfsfloor={'smackfsfloor', 0x3d, 'cbc-cast5-avx\x00'}}]}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 8m13.366214924s ago: executing program 5 (id=6780): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) r1 = getpgrp(0x0) r2 = syz_open_dev$swradio(&(0x7f00000000c0), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000200)={0xfffffffa, 0x9, 0x0, "a0e0165b2000221b0116acc6bf584c71af9cd40007499dcb43c4bdf45200", 0x49323159}) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0x4, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000002c0), 0x80042, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000000)=0x40) ioctl$PTP_PEROUT_REQUEST2(r3, 0x40383d0c, &(0x7f0000000300)={{0x4, 0x8}, {0x4, 0x8}, 0x9, 0x5}) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$sg(&(0x7f00000002c0), 0xe6, 0xa0e82) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = socket(0x2, 0x5, 0x0) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000280)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_cmd={0x2, 0x6, 0x10, 0x3, 0xe8, 0x3, 0x0, 0x6, 0x1, 0x2, 0xfffffffd, 0x0, 0x200, 0xb, 0x47, 0x3, [0x100, 0xfffffff9]}}) setsockopt$inet6_tcp_TCP_CONGESTION(r6, 0x6, 0xd, &(0x7f0000000180)='hybla', 0x65) bind$inet6(r6, &(0x7f0000000080)={0xa, 0x8006, 0x4, @loopback, 0xb}, 0x1c) sendto$inet6(r6, &(0x7f0000001b00), 0x0, 0x20000045, &(0x7f0000000140)={0xa, 0x2, 0xffff, @loopback, 0x3}, 0x1c) syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000dae11c105e0484028fa4010203010902240001000000000904000002437d67000905fc57d4"], 0x0) write$UHID_CREATE2(r0, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x5, @any, 0x5}, 0xe) 8m9.980832707s ago: executing program 5 (id=6793): socket(0xf, 0x5, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001340)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) (async) r4 = syz_open_dev$video(&(0x7f0000000b40), 0x7, 0x20000) preadv(r4, &(0x7f0000001200)=[{&(0x7f0000000040)=""/113, 0x71}], 0x1, 0x4, 0xb) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x200040d0) (async) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180500000000c800000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) prlimit64(0x0, 0xf, &(0x7f0000000140)={0x4, 0x84}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) (rerun: 64) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x8, 0x143100) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) setrlimit(0x2, &(0x7f0000000040)={0x1c2, 0x8}) (async) socket$caif_stream(0x25, 0x1, 0x5) (async) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1fffffffffe, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x5}, 0x0, &(0x7f00000002c0)={0x3fb, 0x8003, 0x7, 0x9, 0x40000000000000, 0xf, 0x80000002, 0x2}, 0x0, 0x0) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) socket$unix(0x1, 0x1, 0x0) 7m53.056578722s ago: executing program 37 (id=6793): socket(0xf, 0x5, 0x0) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001340)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000300)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r3) (async) r4 = syz_open_dev$video(&(0x7f0000000b40), 0x7, 0x20000) preadv(r4, &(0x7f0000001200)=[{&(0x7f0000000040)=""/113, 0x71}], 0x1, 0x4, 0xb) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) (async) sendmsg$TIPC_CMD_ENABLE_BEARER(0xffffffffffffffff, 0x0, 0x200040d0) (async) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="180500000000c800000000004b64ffec850000007d000000850000002a00000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 64) prlimit64(0x0, 0xf, &(0x7f0000000140)={0x4, 0x84}, 0x0) (async, rerun: 64) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) (rerun: 64) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x8, 0x143100) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) setrlimit(0x2, &(0x7f0000000040)={0x1c2, 0x8}) (async) socket$caif_stream(0x25, 0x1, 0x5) (async) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x1fffffffffe, 0xfffffffffffffffd, 0x0, 0x0, 0x1000001000, 0x5}, 0x0, &(0x7f00000002c0)={0x3fb, 0x8003, 0x7, 0x9, 0x40000000000000, 0xf, 0x80000002, 0x2}, 0x0, 0x0) (async) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) socket$unix(0x1, 0x1, 0x0) 3.789122908s ago: executing program 3 (id=8493): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2c2e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x10}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x7, {[@main=@item_012={0x1, 0x0, 0xa, "e4"}, @global=@item_4={0x3, 0x1, 0x4}]}}, 0x0}, 0x0) 2.869906866s ago: executing program 0 (id=8504): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x1fe, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000005700)=[@text16={0x10, 0x0}], 0x1, 0x14, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000005740)) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000240)=[@text32={0x20, &(0x7f00000008c0)="65660fc736b9230200000f320fc5b0040000000f0f10970fe8fa6426660f35c4e21d4501c744240000000000c74424021c320000c744240600000000c4e17de69222ad2eec0e476e04b8200fae82ef66bafc0c66b8004066ef66b8296c", 0x5d}], 0x1, 0x9, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.004839286s ago: executing program 0 (id=8510): bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000ac0)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={0xffffffffffffffff, 0x3, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005345c0f63cdc2e82818254950ee03568b8809a1f04c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab66c1aae9314d7381fcfeb970bea672010000000000000043144648a07a975bd89dc398712376610faa54f12495b4659be8673086f6f3543205d4bc4ce05b8b961103673dff7f158052e62bfbdcddde6985f3f1ac5d9a94cc53207899762a07282a1914452d11858e795a3ca30a101af5574f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5ed44039aab46419496362e54cfad05b4004ac71a003d7b85d07191bed4e5a8908263722d4146f7ed569985439baa355cf3d8731f5e7a237bc06d035a8d601f21746d880819f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c5b9f87d988c9fbd2b9d9b4e2d71753b1549fa734f0b2e5fcf9549804cddad721971637f9c9730a9cc384eed30345979db9c93e1c52f42cad0a4d4f9436d3f39b0ed09c395dc6e970366087a8e4daeeb1b017006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f710c490ecd085d2811a7555c53030000007f00000000bfa6478eb96b079c277e2910b7ccdc3d672ed34aa65278c549e2abb549ad954884289130bc71cee2b7de62bf48129ae1af052a2d46a6165eb0954dac7265f1f425735acf6377793946b3229e861d8ea49806b3b533345d36ecef9df700000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c000000aaae37f044bcadeb0f6846582b7653665aa336db9f0384d3c7ddf79c2e0000000000000000000000000000000000000000000000e154aa0d3e41986a668ee1e5ef93a8ceac75f44aae95e26742f895f287111f8ee86f7e3ffb63cfb0e345cf7fc63dd2b0d30977899c6f03640040af4db71f7452bfc79a05118d8bb42b63b195771e42f9942ec626bd4b5461b74324012164e8"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock}, 0x70) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000240)=ANY=[@ANYRES32=r1, @ANYRES32=r0, @ANYBLOB="02"], 0x10) 1.888655656s ago: executing program 0 (id=8512): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_GET(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x14, 0x1, 0x9, 0x301, 0x0, 0x0, {0xa, 0x0, 0xa}}, 0x14}}, 0x40000010) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) 1.874529859s ago: executing program 3 (id=8513): r0 = socket$inet_udp(0x2, 0x2, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x4) writev(r1, &(0x7f0000000300)=[{&(0x7f0000000340)="580000001400192340834b80040d8c560a117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000c0c100000204e00224e0000", 0x58}], 0x1) r2 = socket$inet6(0xa, 0xa, 0x9) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e24, 0x101, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x7f}, 0x1c) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x4e25, 0x2, @mcast1, 0x7}, 0x1c) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x8927, &(0x7f0000001040)={'sit0\x00', 0x0}) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0xca03, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000040)={0x7fffffff, "bbdeffd245d82ca2a609504890fd8b8615d797ca3712819d01df22e3582b59f6"}) 1.356748493s ago: executing program 3 (id=8516): r0 = socket$netlink(0x10, 0x3, 0x9) fstat(r0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(0x0, r1, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000010880)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000108c0)={{0x14, 0x3ed, 0x1, 0x0, 0x0, {0x5}}, [], {0x14, 0x3f5, 0x1, 0x0, 0x0, {0x7}}}, 0x28}}, 0x4000044) 1.098025656s ago: executing program 3 (id=8518): ppoll(0x0, 0x0, 0x0, 0x0, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0x8, &(0x7f0000000100)=0x40049, 0x4) recvmmsg(r0, &(0x7f0000000480)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) syz_emit_ethernet(0x32, &(0x7f00000003c0)={@broadcast, @broadcast, @val={@val={0x88a8, 0x0, 0x0, 0x4}, {0x8100, 0x5}}, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x3, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x12}, @dev={0xac, 0x14, 0x14, 0x31}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x3e}, @private=0xa010102}}}}, 0x0) 937.157214ms ago: executing program 2 (id=8522): socket$inet6(0xa, 0x3, 0xff) r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000000300), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r1, 0x0) r2 = socket(0xa, 0x3, 0xff) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e20, 0x2, @remote, 0x6}, 0x1c) sendmmsg$inet6(r2, &(0x7f0000000080)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=[@pktinfo={{0x24, 0x29, 0x32, {@private1={0xfc, 0x1, '\x00', 0x1}}}}], 0x28}}], 0x1, 0x8080) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0xffa8) 891.609763ms ago: executing program 0 (id=8523): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001a0007000000000000000000e0000001000000000000000000000000fe8000000000000000000000000000bbffff0000000000020000a00006", @ANYBLOB], 0x104}}, 0x4000) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x7, 0x7, 0xe1, 0xc, 0x6, 0xd9, 0x40, 0x41, 0xfb, 0x5e, 0xc, 0x0, 0x8, 0x40, 0x1, 0x5}}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x1000000000000, 0x7, 0x4000000000020, 0x3, 0x0, 0x106c, 0x80000001, 0x8000000000000, 0x80000004000080, 0x0, 0x8, 0x0, 0x4, 0x2, 0x8001], 0x6000, 0x3c4202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 781.257139ms ago: executing program 2 (id=8525): unshare(0x600) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r0 = socket$unix(0x1, 0x2, 0x0) connect$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) 724.9977ms ago: executing program 2 (id=8527): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f00000000c0)) 571.74009ms ago: executing program 8 (id=8531): bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x4, &(0x7f0000000700)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000800)="d2ff03076003008cb89e08f086dd", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) 525.25107ms ago: executing program 0 (id=8532): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_MSRS_cpu(r2, 0xc008ae88, &(0x7f0000001340)={0x1, 0x0, [{0x4d0, 0x0, 0x5}]}) 513.67024ms ago: executing program 2 (id=8533): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000a40)=@base={0x6, 0x4, 0xdd, 0xa}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa10000000000000701"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x54, '\x00', 0x0, @fallback=0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000023c0)={0x0, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180200009b1aecb600000000000000008d0000007500000095"], 0x0}, 0x94) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x2, 0x1, 0x1, 0x1}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="1800000000000000000000000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000940)='percpu_alloc_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 510.937511ms ago: executing program 9 (id=8534): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$IP_VS_SO_GET_TIMEOUT(r0, 0x0, 0x486, &(0x7f0000000680), 0xfffffffffffffffd) 459.346631ms ago: executing program 9 (id=8535): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/246, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0x73, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) openat$kvm(0xffffffffffffff9c, 0x0, 0x8000, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="660f388084000072baf80c66b860b4498c66efbafc0c66b80e00000066ef64f30fc7b000100f850100f30fc7b1030066b9800000c00f326635000400000f30d2bc0a000f23c80f21f86635040040000f23f8b8f4008ee0", 0x57}], 0x1, 0x48, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5}, 0x94) 405.145907ms ago: executing program 8 (id=8536): capset(&(0x7f0000000080)={0x19980330}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x961c81, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000280)={[0x60000000004, 0x1000000000, 0x80000000000005, 0x41, 0x2000000, 0x0, 0x2004cb, 0xffffffffeffffffe, 0xa1d, 0x9, 0x5, 0x0, 0x3, 0x2, 0x2], 0x10000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000340)=@x86={0x10, 0xa, 0x81, 0x0, 0x2, 0x4, 0x0, 0x8, 0x9, 0x7f, 0x3, 0x4, 0x0, 0x5, 0x7, 0x9, 0xc7, 0x3, 0xf1, '\x00', 0x9, 0xff80000000000000}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x0, 0xdddd0000, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2, 0x0, 0x9, 0x9, 0x7}, {0xffff1000, 0xeeee0000, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7}, {0x6000, 0x5000, 0x8, 0xff, 0x7, 0x4, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfc}, {0x3000, 0xffff0fff, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x8, 0x0, 0x6}, {0xeeee8000, 0xffff1000, 0x9, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x3c}, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5}, {0x0, 0x0, 0xa, 0xfe, 0x0, 0x0, 0x3}, {0x0, 0x3000, 0x0, 0x0, 0x0, 0x1, 0x1, 0xca, 0x26}, {0x2}, {0xdddd1000}, 0xddf8ffdb, 0x0, 0x10000, 0x50, 0x0, 0x7801, 0x0, [0x0, 0x0, 0x1, 0x40000000000000]}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 404.943705ms ago: executing program 2 (id=8537): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x4, 0x3c}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=@newtfilter={0x58, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0x5}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x2c, 0x2, [@TCA_U32_POLICE={0x4}, @TCA_U32_SEL={0x24, 0x5, {0xd, 0x7, 0x1, 0x3d3f, 0x0, 0xfff, 0x3, 0x58f, [{0x0, 0x20008000, 0x4, 0x1}]}}]}}]}, 0x58}}, 0x24040084) 369.111671ms ago: executing program 0 (id=8538): socket$nl_xfrm(0x10, 0x3, 0x6) r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r0, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000080)=[{0x28, 0x0, 0x0, 0xfffff034}, {0x48}, {0x6, 0x37, 0x0, 0x9}]}, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) r1 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r1, &(0x7f0000000200)={&(0x7f0000000000)={0x2, 0x3, @empty}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000000180)="0800a9fc0da6b30a2576", 0xa}], 0x1, &(0x7f0000000080)=ANY=[], 0x2}, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, 0x0}], 0x1, 0x43, 0x0, 0x0) 321.021141ms ago: executing program 9 (id=8539): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = fsopen(&(0x7f00000001c0)='devpts\x00', 0x0) setrlimit(0x7, &(0x7f0000000400)) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0xf) fsconfig$FSCONFIG_CMD_RECONFIGURE(r1, 0x7, 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x100002, &(0x7f0000000300)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x8000}}) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$igmp6(0xa, 0x3, 0x2) close_range(r0, 0xffffffffffffffff, 0x400000000000000) 256.922528ms ago: executing program 8 (id=8540): openat$hwrng(0xffffffffffffff9c, 0x0, 0x80000, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'syz_tun\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r0, &(0x7f00000000c0)="3f033608260812002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe90c, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) recvmmsg(r0, &(0x7f0000003140)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f00000001c0)=""/91, 0x5b}], 0x1}, 0x80000000}, {{0x0, 0x0, 0x0}, 0x6}], 0x2, 0x10040, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x4000000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=@newlink={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbf9, {0x0, 0x0, 0x0, 0x0, 0x48815, 0x40003}, [@IFLA_GROUP={0x8}, @IFLA_TXQLEN={0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) 256.802787ms ago: executing program 2 (id=8541): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0xe, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}, 0x0, 0x1}, 0xe) setsockopt$sock_linger(r0, 0x1, 0xd, &(0x7f0000000040)={0x1, 0xfffffffd}, 0x8) shutdown(r0, 0x1) 256.711644ms ago: executing program 9 (id=8542): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)=@ipv4_getnetconf={0x14, 0x52, 0x311, 0x0, 0x20000}, 0x14}}, 0x0) read(r0, &(0x7f00000004c0)=""/4093, 0xffd) 204.702282ms ago: executing program 9 (id=8543): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-160-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000180)="10", 0x1) r1 = accept$alg(r0, 0x0, 0x0) readv(r1, &(0x7f0000000880)=[{&(0x7f00000002c0)=""/77, 0x4d}], 0x1) 177.212625ms ago: executing program 8 (id=8544): bind$unix(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x167) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='devpts\x00', 0x20140c4, 0x0) chroot(&(0x7f0000000b80)='./file0\x00') umount2(&(0x7f0000000140)='./file0\x00', 0x3) syz_clone(0x81022000, 0x0, 0x0, 0x0, 0x0, 0x0) 109.160922ms ago: executing program 3 (id=8545): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001c40)={0x8, 0x3, &(0x7f0000001300)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000001200)='syzkaller\x00'}, 0x80) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r3, 0x8) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000580)={r0, r2, 0x0, 0x0, @val=@netkit}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f00000004c0)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "088435", 0x14, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x2}}}}}}}, 0x0) 90.161095ms ago: executing program 8 (id=8546): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000007044f16c01b1fbfd000000000000008af65f0df9928941994cc8c173fac5688671085a86d143c59fed0e57feb97f422c51d8e63b4ed9e295df3ccd1a55752dfc2f32f14b6c8f0e7413c3e9caaad30dcb412d0f54623f388bb2c63d2b1f7d83cd0cc021867bb4aee9967a6ee83e1b18fd8beca7d7eddcd96634"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0xfffffffffffffcb4}, 0x80) 69.420731ms ago: executing program 9 (id=8547): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="4dc07f947163300c", 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmsg(r1, &(0x7f0000001280)={0x0, 0x0, 0x0}, 0x2) 1.172727ms ago: executing program 3 (id=8548): syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000240)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000001540), 0x0, 0x0) ioctl$EVIOCGLED(r0, 0x5452, &(0x7f0000000240)=""/77) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0xa, 0x2002) write$evdev(r1, &(0x7f0000000040)=[{{}, 0x0, 0x2}], 0x37) 0s ago: executing program 8 (id=8549): add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) ustat(0x1, 0x0) munmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000) mlock(&(0x7f0000ffb000/0x3000)=nil, 0x3000) r0 = inotify_init() r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r2, 0x4068aea3, &(0x7f0000000080)={0x74, 0x0, 0xf1}) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f0000000140)={0x79, 0x0, 0x4cd}) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x3, &(0x7f0000000040)=@framed={{0x66, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x70}}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) r3 = openat$yama_ptrace_scope(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) read(r3, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000a80)={0x11, 0xb, &(0x7f00000002c0)=ANY=[@ANYBLOB="18000000fdff00000000000000000000180100002020702500000000002120207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0xe, '\x00', 0x0, @fallback=0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='kfree\x00', r4}, 0x10) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x400) kernel console output (not intermixed with test programs): vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 2344.023120][ T2085] vhci_hcd vhci_hcd.0: Device attached [ 2344.067192][ T5833] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 2344.067743][T13603] Bluetooth: hci2: command 0x1003 tx timeout [ 2344.143519][T20231] usb 4-1: new high-speed USB device number 120 using dummy_hcd [ 2344.163773][T20231] usb 4-1: device descriptor read/8, error -71 [ 2344.173885][T18055] usb 9-1: new high-speed USB device number 108 using dummy_hcd [ 2344.335636][ T48] usb 37-1: new high-speed USB device number 6 using vhci_hcd [ 2344.356674][T18055] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2344.370761][T18055] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 2344.382185][T18055] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2344.391883][T18055] usb 9-1: config 0 descriptor?? [ 2344.419843][T20231] usb 4-1: new high-speed USB device number 121 using dummy_hcd [ 2344.441759][T20231] usb 4-1: device descriptor read/8, error -71 [ 2344.559134][T20231] usb usb4-port1: unable to enumerate USB device [ 2344.580955][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2344.614039][T18055] usbhid 9-1:0.0: can't add hid device: -71 [ 2344.620094][T18055] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 2344.629405][T18055] usb 9-1: USB disconnect, device number 108 [ 2344.644275][T32522] usb 10-1: new high-speed USB device number 47 using dummy_hcd [ 2344.804886][T32522] usb 10-1: Using ep0 maxpacket: 8 [ 2344.811989][T32522] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 2344.820405][T32522] usb 10-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 2344.831022][T32522] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2344.833642][ T2094] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2344.841257][T32522] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2344.861511][T32522] usb 10-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 2344.861550][ T2094] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2344.874825][T32522] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2344.892921][T32522] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2344.904191][T32522] usbtmc 10-1:16.0: bulk endpoints not found [ 2345.104101][T23856] usb 9-1: new full-speed USB device number 109 using dummy_hcd [ 2345.265898][T23856] usb 9-1: config index 0 descriptor too short (expected 36, got 27) [ 2345.274107][T23856] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2345.287077][T23856] usb 9-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.40 [ 2345.296748][T23856] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2345.306441][T23856] usb 9-1: config 0 descriptor?? [ 2345.313175][T23856] pegasus_notetaker 9-1:0.0: Invalid number of endpoints [ 2345.320348][T23856] pegasus_notetaker 9-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 2345.330628][T23856] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 2345.356481][ T2086] vhci_hcd: connection reset by peer [ 2345.364223][ T5950] vhci_hcd vhci_hcd.2: stop threads [ 2345.373430][ T5950] vhci_hcd vhci_hcd.2: release socket [ 2345.379098][ T5950] vhci_hcd vhci_hcd.2: disconnect device [ 2345.527245][T32522] usb 9-1: USB disconnect, device number 109 [ 2345.693926][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2346.121916][T14335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2346.205351][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2346.749500][ T2115] overlayfs: failed to resolve './file1': -2 [ 2346.891528][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2347.641217][T18055] usb 10-1: USB disconnect, device number 47 [ 2347.775361][ T2128] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(8) [ 2347.781896][ T2128] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 2347.822762][ T2133] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿ0x00000000000000070xffffffffffffffff00000000000000000000' [ 2347.850133][ T5950] Bluetooth: hci2: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 2347.887280][ T5950] Bluetooth: hci2: Frame reassembly failed (-84) [ 2347.901194][ T2128] vhci_hcd vhci_hcd.0: Device attached [ 2347.912692][ T2134] vivid-002: ================= START STATUS ================= [ 2347.947086][ T2134] vivid-002: Radio HW Seek Mode: Bounded [ 2347.953934][ T5950] Bluetooth: hci2: Frame reassembly failed (-84) [ 2348.001917][T17517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2348.023337][ T2134] vivid-002: Radio Programmable HW Seek: false [ 2348.036207][ T2134] vivid-002: RDS Rx I/O Mode: Block I/O [ 2348.042060][ T2134] vivid-002: Generate RBDS Instead of RDS: false [ 2348.052143][ T2134] vivid-002: RDS Reception: true [ 2348.077259][ T2134] vivid-002: RDS Program Type: 0 inactive [ 2348.084060][ T2134] vivid-002: RDS PS Name: inactive [ 2348.090943][ T2134] vivid-002: RDS Radio Text: inactive [ 2348.150829][T18055] usb 51-1: new high-speed USB device number 5 using vhci_hcd [ 2348.173064][T26249] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2348.200306][ T2134] vivid-002: RDS Traffic Announcement: false inactive [ 2348.213389][ T2134] vivid-002: RDS Traffic Program: false inactive [ 2348.332781][ T2134] vivid-002: RDS Music: false inactive [ 2348.371196][ T2134] vivid-002: ================== END STATUS ================== [ 2348.824355][T17517] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 2348.986150][T17517] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2348.996562][T17517] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 2349.005607][T17517] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2349.104976][T17517] usb 3-1: config 0 descriptor?? [ 2349.112652][T17517] pwc: Askey VC010 type 2 USB webcam detected. [ 2349.119625][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2349.486057][ T2129] vhci_hcd: connection reset by peer [ 2349.486237][T20231] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2349.524530][T14426] vhci_hcd vhci_hcd.9: stop threads [ 2349.529887][T14426] vhci_hcd vhci_hcd.9: release socket [ 2349.540465][T14426] vhci_hcd vhci_hcd.9: disconnect device [ 2349.752827][T17517] pwc: recv_control_msg error -32 req 02 val 2b00 [ 2349.761989][T17517] pwc: recv_control_msg error -32 req 02 val 2700 [ 2349.771175][T17517] pwc: recv_control_msg error -32 req 02 val 2c00 [ 2349.786893][ T48] vhci_hcd vhci_hcd.2: vhci_device speed not set [ 2349.798422][T17517] pwc: recv_control_msg error -32 req 04 val 1000 [ 2350.276979][ T5833] Bluetooth: hci2: Opcode 0x1003 failed: -110 [ 2350.300445][ T5819] Bluetooth: hci2: command 0x1003 tx timeout [ 2350.359101][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2350.387054][T17517] pwc: recv_control_msg error -32 req 04 val 1300 [ 2350.413757][T17517] pwc: recv_control_msg error -32 req 04 val 1400 [ 2350.438378][T17517] pwc: recv_control_msg error -32 req 02 val 2000 [ 2350.586135][T17517] pwc: recv_control_msg error -71 req 02 val 2100 [ 2350.593515][T17517] pwc: recv_control_msg error -71 req 04 val 1500 [ 2350.600909][T17517] pwc: recv_control_msg error -71 req 02 val 2500 [ 2350.616373][T17517] pwc: recv_control_msg error -71 req 02 val 2400 [ 2350.631645][T17517] pwc: recv_control_msg error -71 req 02 val 2600 [ 2350.659637][T17517] pwc: recv_control_msg error -71 req 02 val 2900 [ 2350.689620][T17517] pwc: recv_control_msg error -71 req 02 val 2800 [ 2350.708594][ T2156] kvm: pic: non byte write [ 2350.724184][T17517] pwc: recv_control_msg error -71 req 04 val 1100 [ 2350.735078][T17517] pwc: recv_control_msg error -71 req 04 val 1200 [ 2350.760831][T17517] pwc: Registered as video103. [ 2350.779497][T17517] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input112 [ 2350.810160][T17517] usb 3-1: USB disconnect, device number 20 [ 2351.221016][ T5897] usb 10-1: new high-speed USB device number 48 using dummy_hcd [ 2351.235902][ T2166] vivid-002: ================= START STATUS ================= [ 2351.243647][ T2166] vivid-002: Radio HW Seek Mode: Bounded [ 2351.249285][ T2166] vivid-002: Radio Programmable HW Seek: false [ 2351.255564][ T2166] vivid-002: RDS Rx I/O Mode: Block I/O [ 2351.261118][ T2166] vivid-002: Generate RBDS Instead of RDS: false [ 2351.267503][ T2166] vivid-002: RDS Reception: true [ 2351.272604][ T2166] vivid-002: RDS Program Type: 0 inactive [ 2351.278365][ T2166] vivid-002: RDS PS Name: inactive [ 2351.283607][ T2166] vivid-002: RDS Radio Text: inactive [ 2351.289062][ T2166] vivid-002: RDS Traffic Announcement: false inactive [ 2351.295889][ T2166] vivid-002: RDS Traffic Program: false inactive [ 2351.302235][ T2166] vivid-002: RDS Music: false inactive [ 2351.307739][ T2166] vivid-002: ================== END STATUS ================== [ 2351.492641][ T5897] usb 10-1: Using ep0 maxpacket: 16 [ 2351.608426][T17517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2351.626203][ T5897] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 11 [ 2351.700153][ T5897] usb 10-1: config 1 interface 0 altsetting 3 endpoint 0xB has invalid wMaxPacketSize 0 [ 2351.904621][ T5897] usb 10-1: config 1 interface 0 altsetting 3 bulk endpoint 0xB has invalid maxpacket 0 [ 2351.993235][ T5897] usb 10-1: config 1 interface 0 altsetting 3 endpoint 0x8A has invalid wMaxPacketSize 0 [ 2352.014856][ T5897] usb 10-1: config 1 interface 0 altsetting 3 bulk endpoint 0x8A has invalid maxpacket 0 [ 2352.302884][T14335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2352.352342][ T5897] usb 10-1: config 1 interface 0 has no altsetting 0 [ 2352.359078][ T5897] usb 10-1: New USB device found, idVendor=04e6, idProduct=0003, bcdDevice= 1.77 [ 2352.407197][ T5897] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2352.459777][ T5897] ums-sddr09 10-1:1.0: USB Mass Storage device detected [ 2352.706013][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2352.714141][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2353.307213][ T5897] scsi host1: usb-storage 10-1:1.0 [ 2353.379781][ T5897] usb 10-1: USB disconnect, device number 48 [ 2353.647103][ T3652] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2353.676095][T18055] vhci_hcd vhci_hcd.9: vhci_device speed not set [ 2353.817597][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2355.205826][ T2211] syz.2.7886: attempt to access beyond end of device [ 2355.205826][ T2211] ram200: rw=2048, sector=521328, nr_sectors = 8 limit=8192 [ 2355.337836][T17517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2355.639813][ T2215] vivid-000: ================= START STATUS ================= [ 2355.647527][ T2215] vivid-000: Radio HW Seek Mode: Bounded [ 2355.653153][ T2215] vivid-000: Radio Programmable HW Seek: false [ 2355.659397][ T2215] vivid-000: RDS Rx I/O Mode: Block I/O [ 2355.664936][ T2215] vivid-000: Generate RBDS Instead of RDS: false [ 2355.671283][ T2215] vivid-000: RDS Reception: true [ 2355.676214][ T2215] vivid-000: RDS Program Type: 0 inactive [ 2355.681958][ T2215] vivid-000: RDS PS Name: inactive [ 2355.687160][ T2215] vivid-000: RDS Radio Text: inactive [ 2355.693895][ T2215] vivid-000: RDS Traffic Announcement: false inactive [ 2355.700762][ T2215] vivid-000: RDS Traffic Program: false inactive [ 2355.707079][ T2215] vivid-000: RDS Music: false inactive [ 2355.712573][ T2215] vivid-000: ================== END STATUS ================== [ 2355.957288][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2356.272529][T18055] usb 10-1: new high-speed USB device number 49 using dummy_hcd [ 2356.457581][T18055] usb 10-1: Using ep0 maxpacket: 16 [ 2356.465210][T18055] usb 10-1: config index 0 descriptor too short (expected 16456, got 72) [ 2356.487108][T18055] usb 10-1: config 0 has an invalid interface number: 125 but max is 1 [ 2356.497929][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2356.516922][T18055] usb 10-1: config 0 has an invalid interface number: 125 but max is 1 [ 2356.549328][T18055] usb 10-1: config 0 has an invalid interface number: 125 but max is 1 [ 2356.571045][T18055] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 2356.596360][T18055] usb 10-1: config 0 has no interface number 0 [ 2356.602577][T18055] usb 10-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 2356.651770][T18055] usb 10-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 2356.684773][T18055] usb 10-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 2356.714094][T18055] usb 10-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2356.875777][T18055] usb 10-1: too many endpoints for config 0 interface 125 altsetting 255: 255, using maximum allowed: 30 [ 2357.047072][T18055] usb 10-1: config 0 interface 125 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 2357.094545][T18055] usb 10-1: config 0 interface 125 has no altsetting 0 [ 2357.101702][T18055] usb 10-1: config 0 interface 125 has no altsetting 2 [ 2357.822669][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2357.853986][T18055] usb 10-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 2357.950184][T18055] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2357.967849][T18055] usb 10-1: Product: syz [ 2357.978885][T18055] usb 10-1: Manufacturer: syz [ 2357.987285][ T30] audit: type=1800 audit(1765462604.057:1617): pid=2239 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.8.7894" name="bus" dev="ramfs" ino=167699 res=0 errno=0 [ 2358.012048][T18055] usb 10-1: SerialNumber: syz [ 2358.195448][T18055] usb 10-1: config 0 descriptor?? [ 2358.269978][T18055] usb 10-1: selecting invalid altsetting 2 [ 2358.442345][T25715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2358.490972][ C0] usb 10-1: async_complete: urb error -71 [ 2358.496859][ C0] usb 10-1: async_complete: urb error -71 [ 2358.502633][ C0] usb 10-1: async_complete: urb error -71 [ 2358.508383][ C0] usb 10-1: async_complete: urb error -71 [ 2358.516015][T18055] get_1284_register: usb error -71 [ 2358.521346][T18055] uss720 10-1:0.125: probe with driver uss720 failed with error -71 [ 2358.532237][T18055] usb 10-1: USB disconnect, device number 49 [ 2358.578731][ T2256] loop6: detected capacity change from 0 to 2640 [ 2358.715758][ T2256] buffer_io_error: 8 callbacks suppressed [ 2358.715775][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.809718][ T30] audit: type=1800 audit(1765462604.834:1618): pid=2251 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.7896" name="bus" dev="ramfs" ino=167719 res=0 errno=0 [ 2358.835885][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.881055][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.900568][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.909835][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.918687][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.926911][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.935290][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.944688][ T2256] ldm_validate_partition_table(): Disk read failed. [ 2358.957696][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2358.969479][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.979688][ T2256] Buffer I/O error on dev loop6, logical block 0, async page read [ 2358.988198][ T2256] Dev loop6: unable to read RDB block 0 [ 2358.995267][ T2256] loop6: unable to read partition table [ 2359.003077][ T2256] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 2359.267808][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2359.814775][ T65] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2360.081323][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2361.075352][ T2281] Process accounting resumed [ 2361.172908][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2361.478373][ T30] audit: type=1400 audit(1765462607.340:1619): avc: denied { getopt } for pid=2303 comm="syz.3.7913" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 2361.593321][ T30] audit: type=1800 audit(1765462607.443:1620): pid=2294 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.7908" name="bus" dev="ramfs" ino=168709 res=0 errno=0 [ 2361.616035][T27098] usb 9-1: new high-speed USB device number 110 using dummy_hcd [ 2361.865579][T27098] usb 9-1: Using ep0 maxpacket: 8 [ 2362.214504][T27098] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 2362.222778][T27098] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2362.232707][T27098] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2362.243654][T27098] usb 9-1: config 16 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 2362.283386][T27098] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2362.308863][T27098] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2362.309207][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2362.341921][T27098] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2362.375996][T27098] usbtmc 9-1:16.0: bulk endpoints not found [ 2362.588359][ T5833] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2362.708446][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2362.718126][ T2320] Cannot find add_set index 0 as target [ 2363.364460][ T5819] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2363.377202][ T5819] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2363.386042][ T5819] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2363.393814][ T5819] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2363.408664][ T5819] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2363.416146][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2363.708709][ T5819] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2363.836765][T15208] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2364.518973][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2364.565304][T27098] usb 9-1: USB disconnect, device number 110 [ 2364.998297][ T2333] chnl_net:caif_netlink_parms(): no params data found [ 2365.621150][ T5819] Bluetooth: hci2: command tx timeout [ 2365.657289][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2365.747035][ T2333] bridge0: port 1(bridge_slave_0) entered blocking state [ 2365.881356][ T2333] bridge0: port 1(bridge_slave_0) entered disabled state [ 2365.891157][ T2333] bridge_slave_0: entered allmulticast mode [ 2365.898751][ T2333] bridge_slave_0: entered promiscuous mode [ 2365.923921][ T2333] bridge0: port 2(bridge_slave_1) entered blocking state [ 2365.993030][ T2368] Process accounting resumed [ 2366.419813][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2366.428381][T15208] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2366.484007][ T2333] bridge0: port 2(bridge_slave_1) entered disabled state [ 2366.518701][ T2333] bridge_slave_1: entered allmulticast mode [ 2366.715111][ T5819] Bluetooth: hci7: unexpected Set CIG Parameters response data [ 2366.724605][ T5819] Bluetooth: hci7: unexpected event for opcode 0x2062 [ 2366.734204][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2366.748583][ T2333] bridge_slave_1: entered promiscuous mode [ 2366.774175][T27098] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 2366.872422][ T2333] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2366.895428][ T2333] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2366.952718][ T2333] team0: Port device team_slave_0 added [ 2366.968825][ T2333] team0: Port device team_slave_1 added [ 2366.988179][T27098] usb 3-1: Using ep0 maxpacket: 32 [ 2366.995146][T27098] usb 3-1: config 0 has an invalid interface number: 71 but max is 0 [ 2367.005935][T27098] usb 3-1: config 0 has no interface number 0 [ 2367.027782][T27098] usb 3-1: config 0 interface 71 has no altsetting 0 [ 2367.038349][ T2333] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2367.048139][T27098] usb 3-1: New USB device found, idVendor=185b, idProduct=d001, bcdDevice=dc.ab [ 2367.058929][T27098] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2367.070358][ T2333] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2367.106401][ T2333] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2367.107472][T27098] usb 3-1: Product: syz [ 2367.119220][ T2333] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2367.128756][T27098] usb 3-1: Manufacturer: syz [ 2367.133643][ T2333] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2367.133660][T27098] usb 3-1: SerialNumber: syz [ 2367.133711][ T2333] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2367.243094][T27098] usb 3-1: config 0 descriptor?? [ 2367.255814][T14335] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2367.274516][T27098] dvb-usb: found a 'Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb)' in warm state. [ 2367.295879][T27098] dvb-usb: bulk message failed: -22 (3/0) [ 2367.334476][T27098] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2367.390359][T27098] dvbdev: DVB: registering new adapter (Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb)) [ 2367.453067][T14335] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2367.485501][T27098] usb 3-1: media controller created [ 2367.502038][ T2333] hsr_slave_0: entered promiscuous mode [ 2367.519026][ T2333] hsr_slave_1: entered promiscuous mode [ 2367.531278][ T2333] debugfs: 'hsr0' already exists in 'hsr' [ 2367.542896][T27098] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2367.551326][ T2333] Cannot create hsr debugfs directory [ 2367.603281][T14335] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2367.668498][T27098] dvb-usb: bulk message failed: -22 (6/0) [ 2367.681018][T27098] dvb-usb: no frontend was attached by 'Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb)' [ 2367.737800][T27098] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input113 [ 2367.752308][T14335] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2367.868435][ T5819] Bluetooth: hci2: command tx timeout [ 2367.897625][T27098] dvb-usb: schedule remote query interval to 150 msecs. [ 2367.904631][T27098] dvb-usb: bulk message failed: -22 (3/0) [ 2367.939183][T27098] dvb-usb: Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb) successfully initialized and connected. [ 2367.939813][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2367.957283][T27098] usb 3-1: USB disconnect, device number 21 [ 2368.047153][T27098] dvb-usb: Compro Videomate DVB-U2000 - DVB-T USB1 successfully deinitialized and disconnected. [ 2368.303301][ T2405] fuse: Unknown parameter 'ÿÿÿÿÿÿÿÿ0xffffffffffffffff0xffffffffffffffff00000000000000000000' [ 2368.473329][ T12] Bluetooth: hci4: Frame reassembly failed (-84) [ 2368.495413][ T12] Bluetooth: hci4: Frame reassembly failed (-84) [ 2369.054808][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2369.237930][T14335] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2369.259323][T14335] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2369.275642][T14335] bond0 (unregistering): Released all slaves [ 2369.379920][T14335] tipc: Disabling bearer [ 2369.398235][ T6099] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2369.413307][T14335] tipc: Left network mode [ 2369.639777][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2369.832273][T14335] hsr_slave_0: left promiscuous mode [ 2369.838017][T14335] hsr_slave_1: left promiscuous mode [ 2369.846083][T14335] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2369.855023][T14335] batadv0: mtu less than device minimum [ 2369.861115][T14335] batman_adv: batadv0: Forced to purge local tt entries to fit new maximum fragment MTU (-320) [ 2369.881933][T14335] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2369.890011][T14335] batman_adv: batadv0: Interface deactivated: dummy0 [ 2369.897025][T14335] batman_adv: batadv0: Removing interface: dummy0 [ 2369.909681][T14335] veth1_macvtap: left promiscuous mode [ 2369.915196][T14335] veth0_macvtap: left promiscuous mode [ 2369.921335][T14335] veth1_vlan: left promiscuous mode [ 2369.926658][T14335] veth0_vlan: left promiscuous mode [ 2370.066894][ T5833] Bluetooth: hci2: command tx timeout [ 2370.710303][ T5833] Bluetooth: hci4: command 0x1003 tx timeout [ 2370.720526][ T5819] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2371.007438][ T5819] Bluetooth: hci7: Controller not accepting commands anymore: ncmd = 0 [ 2371.018961][ T5819] Bluetooth: hci7: Injecting HCI hardware error event [ 2371.029261][ T5833] Bluetooth: hci7: hardware error 0x00 [ 2371.267894][ T2435] Process accounting resumed [ 2371.478061][ T6539] net_ratelimit: 19 callbacks suppressed [ 2371.478075][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2372.139504][T29330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2372.290285][ T5819] Bluetooth: hci2: command tx timeout [ 2372.688187][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2373.192419][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2373.320365][ T5833] Bluetooth: hci7: Opcode 0x0c03 failed: -110 [ 2373.419892][ T2432] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2373.475170][ T2466] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2373.573474][ T2333] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 2373.624646][ T2333] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 2373.700401][ T2333] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 2373.740146][ T2333] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 2373.855690][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2374.402856][ T2333] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2374.454815][T14335] IPVS: stop unused estimator thread 0... [ 2374.462394][ T2333] 8021q: adding VLAN 0 to HW filter on device team0 [ 2374.527719][T15659] bridge0: port 1(bridge_slave_0) entered blocking state [ 2374.534837][T15659] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2374.599121][ T1054] bridge0: port 2(bridge_slave_1) entered blocking state [ 2374.606265][ T1054] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2374.967801][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.007906][ T1054] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.027995][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.036850][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.244182][ T2333] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2375.548083][ T3499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2375.758079][ T30] audit: type=1800 audit(1765462620.698:1621): pid=2512 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.7957" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 2376.059255][ T2508] Process accounting resumed [ 2376.111116][ T2523] vivid-001: ================= START STATUS ================= [ 2376.119277][ T2523] vivid-001: Radio HW Seek Mode: Bounded [ 2376.125005][ T2523] vivid-001: Radio Programmable HW Seek: false [ 2376.131249][ T2523] vivid-001: RDS Rx I/O Mode: Block I/O [ 2376.136782][ T2523] vivid-001: Generate RBDS Instead of RDS: false [ 2376.143285][ T2523] vivid-001: RDS Reception: true [ 2376.148203][ T2523] vivid-001: RDS Program Type: 0 inactive [ 2376.153958][ T2523] vivid-001: RDS PS Name: inactive [ 2376.159159][ T2523] vivid-001: RDS Radio Text: inactive [ 2376.166001][ T2523] vivid-001: RDS Traffic Announcement: false inactive [ 2376.172826][ T2523] vivid-001: RDS Traffic Program: false inactive [ 2376.179157][ T2523] vivid-001: RDS Music: false inactive [ 2376.184662][ T2523] vivid-001: ================== END STATUS ================== [ 2376.295521][ T2333] veth0_vlan: entered promiscuous mode [ 2376.337330][ T2333] veth1_vlan: entered promiscuous mode [ 2376.344579][ T2527] xt_bpf: check failed: parse error [ 2376.499274][ T2333] veth0_macvtap: entered promiscuous mode [ 2376.966368][ T2532] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2376.989553][ T2333] veth1_macvtap: entered promiscuous mode [ 2377.056019][ T2333] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2377.114376][ T2333] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2377.129725][ T30] audit: type=1400 audit(1765462621.979:1622): avc: denied { mounton } for pid=2539 comm="syz.3.7962" path=2F3333322FE91F7189591E9233614B dev="tmpfs" ino=1790 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 2377.131977][ T1054] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2377.169114][ T5833] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2377.169715][ T1054] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2377.195295][ T1054] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2377.298153][ T7534] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2377.337150][T23856] net_ratelimit: 2 callbacks suppressed [ 2377.337169][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2377.457735][ T7534] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2377.485959][ T7534] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2377.543510][ T2546] netlink: 40 bytes leftover after parsing attributes in process `syz.0.7963'. [ 2377.554860][ T2546] tipc: Started in network mode [ 2377.559785][ T2546] tipc: Node identity , cluster identity 4711 [ 2377.566040][ T2546] tipc: Failed to obtain node identity [ 2377.574502][ T2546] tipc: Enabling of bearer rejected, failed to enable media [ 2377.604940][ T7534] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2377.631473][ T7534] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2378.277516][ T3499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2378.524191][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2379.361499][ T2573] Process accounting resumed [ 2379.731318][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2380.002823][T17517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2381.117646][ T6099] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2381.141605][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2382.223333][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2382.435699][ T30] audit: type=1800 audit(1765462626.937:1623): pid=2604 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.7974" name="bus" dev="ramfs" ino=171184 res=0 errno=0 [ 2383.850899][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2383.905663][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2384.253342][ T2627] Process accounting resumed [ 2384.317127][T18055] usb 9-1: new high-speed USB device number 111 using dummy_hcd [ 2384.467363][ T30] audit: type=1800 audit(1765462628.845:1624): pid=2613 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.3.7977" name="bus" dev="ramfs" ino=171270 res=0 errno=0 [ 2384.990670][T18055] usb 9-1: Using ep0 maxpacket: 32 [ 2384.997623][T18055] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 2385.025777][T18055] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2385.050864][T18055] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 2385.062873][T18055] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 2385.080027][T18055] usb 9-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 2385.097315][ T2640] netlink: 24 bytes leftover after parsing attributes in process `syz.0.7982'. [ 2385.107793][T18055] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2385.126504][T18055] usb 9-1: Product: syz [ 2385.130130][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2385.130914][T18055] usb 9-1: Manufacturer: syz [ 2385.147307][T18055] usb 9-1: SerialNumber: syz [ 2385.157897][T18055] usb 9-1: config 0 descriptor?? [ 2385.169444][T18055] input: Generic X-Box pad as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input114 [ 2385.186940][ T5171] xpad 9-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 2385.208849][ T5171] xpad 9-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 2385.282222][ T5171] xpad 9-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 2385.312070][ T5171] xpad 9-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 2385.444587][ T2624] xpad 9-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 2385.480802][T18055] usb 9-1: USB disconnect, device number 111 [ 2386.264734][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2386.413047][T27292] usb 4-1: new high-speed USB device number 122 using dummy_hcd [ 2386.997174][ T5819] Bluetooth: hci3: SCO packet for unknown connection handle 200 [ 2387.002009][T27292] usb 4-1: config 4 has an invalid interface number: 28 but max is 0 [ 2387.035824][T27292] usb 4-1: config 4 has no interface number 0 [ 2387.048910][T27292] usb 4-1: New USB device found, idVendor=05c3, idProduct=0245, bcdDevice= a.3a [ 2387.059254][T27292] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2387.087510][T27292] usb 4-1: Product: syz [ 2387.091794][T27292] usb 4-1: Manufacturer: syz [ 2387.096474][T27292] usb 4-1: SerialNumber: syz [ 2387.101448][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2387.164026][T27292] usbhid 4-1:4.28: couldn't find an input interrupt endpoint [ 2387.173664][ T4268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2387.343142][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2388.483385][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2389.075473][ T2708] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2389.668364][T17517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2390.031927][T29640] usb 4-1: USB disconnect, device number 122 [ 2390.346908][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2391.706538][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2392.489790][ T5833] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2392.837853][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2393.754523][ T5950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2393.762717][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2393.895661][ T2771] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2393.948588][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2394.067054][ T5819] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2394.320717][ T30] audit: type=1400 audit(1765462638.050:1625): avc: denied { view } for pid=2772 comm="syz.8.8012" scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:kernel_t tclass=key permissive=1 [ 2394.342722][ T2776] FAULT_INJECTION: forcing a failure. [ 2394.342722][ T2776] name failslab, interval 1, probability 0, space 0, times 0 [ 2394.370423][ T2776] CPU: 0 UID: 0 PID: 2776 Comm: syz.2.8013 Tainted: G L syzkaller #0 PREEMPT(full) [ 2394.370454][ T2776] Tainted: [L]=SOFTLOCKUP [ 2394.370461][ T2776] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2394.370470][ T2776] Call Trace: [ 2394.370475][ T2776] [ 2394.370481][ T2776] dump_stack_lvl+0x16c/0x1f0 [ 2394.370506][ T2776] should_fail_ex+0x512/0x640 [ 2394.370526][ T2776] ? __kmalloc_noprof+0xca/0x910 [ 2394.370548][ T2776] should_failslab+0xc2/0x120 [ 2394.370564][ T2776] __kmalloc_noprof+0xeb/0x910 [ 2394.370580][ T2776] ? fib_create_info+0x53f/0x4680 [ 2394.370597][ T2776] ? fib_create_info+0x53f/0x4680 [ 2394.370610][ T2776] ? rtnl_is_locked+0x15/0x20 [ 2394.370624][ T2776] fib_create_info+0x53f/0x4680 [ 2394.370644][ T2776] ? rcu_is_watching+0x12/0xc0 [ 2394.370656][ T2776] ? __pfx_fib_create_info+0x10/0x10 [ 2394.370671][ T2776] ? fib_table_lookup+0x75a/0x2300 [ 2394.370684][ T2776] fib_table_insert+0x177/0x1c60 [ 2394.370695][ T2776] ? __inet_dev_addr_type+0x30f/0x830 [ 2394.370711][ T2776] ? __pfx___inet_dev_addr_type+0x10/0x10 [ 2394.370723][ T2776] ? __pfx___mutex_lock+0x10/0x10 [ 2394.370735][ T2776] ? __pfx_fib_table_insert+0x10/0x10 [ 2394.370750][ T2776] ? bpf_lsm_capable+0x9/0x10 [ 2394.370762][ T2776] ? security_capable+0x7e/0x260 [ 2394.370780][ T2776] ? ip_rt_ioctl+0x81e/0x13f0 [ 2394.370791][ T2776] ip_rt_ioctl+0x81e/0x13f0 [ 2394.370804][ T2776] ? __pfx_ip_rt_ioctl+0x10/0x10 [ 2394.370827][ T2776] inet_ioctl+0x344/0x3f0 [ 2394.370841][ T2776] ? __pfx_inet_ioctl+0x10/0x10 [ 2394.370860][ T2776] ? tomoyo_path_number_perm+0x18d/0x580 [ 2394.370882][ T2776] sock_do_ioctl+0x118/0x280 [ 2394.370893][ T2776] ? __pfx_sock_do_ioctl+0x10/0x10 [ 2394.370907][ T2776] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 2394.370920][ T2776] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 2394.370935][ T2776] sock_ioctl+0x227/0x6b0 [ 2394.370947][ T2776] ? __pfx_sock_ioctl+0x10/0x10 [ 2394.370957][ T2776] ? hook_file_ioctl_common+0x144/0x410 [ 2394.370975][ T2776] ? selinux_file_ioctl+0x180/0x270 [ 2394.370990][ T2776] ? selinux_file_ioctl+0xb4/0x270 [ 2394.371002][ T2776] ? __pfx_sock_ioctl+0x10/0x10 [ 2394.371014][ T2776] __x64_sys_ioctl+0x18e/0x210 [ 2394.371027][ T2776] do_syscall_64+0xcd/0xf80 [ 2394.371038][ T2776] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2394.371049][ T2776] RIP: 0033:0x7f34c058f749 [ 2394.371059][ T2776] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2394.371069][ T2776] RSP: 002b:00007f34c13f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2394.371080][ T2776] RAX: ffffffffffffffda RBX: 00007f34c07e5fa0 RCX: 00007f34c058f749 [ 2394.371086][ T2776] RDX: 0000200000000080 RSI: 000000000000890b RDI: 0000000000000003 [ 2394.371093][ T2776] RBP: 00007f34c13f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2394.371099][ T2776] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2394.371105][ T2776] R13: 00007f34c07e6038 R14: 00007f34c07e5fa0 R15: 00007ffc72ff2a18 [ 2394.371119][ T2776] [ 2394.783387][ T2779] autofs: Unknown parameter 'fd0x0000000000000000' [ 2394.821288][ T2779] overlayfs: failed to resolve './file1': -2 [ 2394.955111][ T2788] FAULT_INJECTION: forcing a failure. [ 2394.955111][ T2788] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2394.965113][T18055] usb 4-1: new high-speed USB device number 123 using dummy_hcd [ 2395.154531][ T2788] CPU: 0 UID: 0 PID: 2788 Comm: syz.8.8017 Tainted: G L syzkaller #0 PREEMPT(full) [ 2395.154565][ T2788] Tainted: [L]=SOFTLOCKUP [ 2395.154572][ T2788] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2395.154583][ T2788] Call Trace: [ 2395.154589][ T2788] [ 2395.154598][ T2788] dump_stack_lvl+0x16c/0x1f0 [ 2395.154622][ T2788] should_fail_ex+0x512/0x640 [ 2395.154648][ T2788] _copy_from_user+0x2e/0xd0 [ 2395.154670][ T2788] memdup_user+0x6b/0xe0 [ 2395.154689][ T2788] strndup_user+0x78/0xe0 [ 2395.154708][ T2788] __x64_sys_mount+0x136/0x310 [ 2395.154727][ T2788] ? __pfx___x64_sys_mount+0x10/0x10 [ 2395.154751][ T2788] do_syscall_64+0xcd/0xf80 [ 2395.154771][ T2788] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2395.154790][ T2788] RIP: 0033:0x7fb389f8f749 [ 2395.154804][ T2788] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2395.154821][ T2788] RSP: 002b:00007fb38ad53038 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 2395.154840][ T2788] RAX: ffffffffffffffda RBX: 00007fb38a1e5fa0 RCX: 00007fb389f8f749 [ 2395.154851][ T2788] RDX: 0000200000000340 RSI: 00002000000000c0 RDI: 0000000000000000 [ 2395.154862][ T2788] RBP: 00007fb38ad53090 R08: 0000200000000240 R09: 0000000000000000 [ 2395.154872][ T2788] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2395.154882][ T2788] R13: 00007fb38a1e6038 R14: 00007fb38a1e5fa0 R15: 00007fff662b5da8 [ 2395.154906][ T2788] [ 2395.251701][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2395.277385][T18055] usb 4-1: Using ep0 maxpacket: 32 [ 2395.310252][T26643] Bluetooth: hci4: Frame reassembly failed (-84) [ 2395.326427][T18055] usb 4-1: config 0 has an invalid interface number: 71 but max is 0 [ 2395.334649][T18055] usb 4-1: config 0 has no interface number 0 [ 2395.340999][T18055] usb 4-1: config 0 interface 71 has no altsetting 0 [ 2395.349638][T18055] usb 4-1: New USB device found, idVendor=185b, idProduct=d001, bcdDevice=dc.ab [ 2395.359035][T18055] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2395.367140][T18055] usb 4-1: Product: syz [ 2395.372532][T18055] usb 4-1: Manufacturer: syz [ 2395.379098][T18055] usb 4-1: SerialNumber: syz [ 2395.387096][T18055] usb 4-1: config 0 descriptor?? [ 2395.396384][T18055] dvb-usb: found a 'Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb)' in warm state. [ 2395.416623][T18055] dvb-usb: bulk message failed: -22 (3/0) [ 2395.450650][T18055] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2395.463253][T18055] dvbdev: DVB: registering new adapter (Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb)) [ 2395.480274][ T2792] syzkaller0: entered promiscuous mode [ 2395.486209][ T2792] syzkaller0: entered allmulticast mode [ 2395.496094][T18055] usb 4-1: media controller created [ 2395.550274][T18055] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2395.603234][T18055] dvb-usb: bulk message failed: -22 (6/0) [ 2395.613445][T18055] dvb-usb: no frontend was attached by 'Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb)' [ 2395.849641][T18055] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.3/usb4/4-1/input/input115 [ 2395.937029][T18055] dvb-usb: schedule remote query interval to 150 msecs. [ 2395.944877][T18055] dvb-usb: bulk message failed: -22 (3/0) [ 2395.969944][T18055] dvb-usb: Compro Videomate DVB-U2000 - DVB-T USB1.1 (please confirm to linux-dvb) successfully initialized and connected. [ 2395.999821][ T5819] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 2396.012307][T18055] usb 4-1: USB disconnect, device number 123 [ 2396.073270][T18055] dvb-usb: Compro Videomate DVB-U2000 - DVB-T USB1 successfully deinitialized and disconnected. [ 2396.324572][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2397.234466][T18055] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2397.369271][ T5833] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2397.432955][ T30] audit: type=1326 audit(1765462640.903:1626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2827 comm="syz.9.8029" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3f2718f749 code=0x0 [ 2397.468515][ T2820] vivid-001: ================= START STATUS ================= [ 2397.476153][ T2820] vivid-001: Radio HW Seek Mode: Bounded [ 2397.482066][ T2820] vivid-001: Radio Programmable HW Seek: false [ 2397.488292][ T2820] vivid-001: RDS Rx I/O Mode: Block I/O [ 2397.493817][ T2820] vivid-001: Generate RBDS Instead of RDS: false [ 2397.500143][ T2820] vivid-001: RDS Reception: true [ 2397.505070][ T2820] vivid-001: RDS Program Type: 0 inactive [ 2397.511877][ T2820] vivid-001: RDS PS Name: inactive [ 2397.517073][ T2820] vivid-001: RDS Radio Text: inactive [ 2397.522653][ T2820] vivid-001: RDS Traffic Announcement: false inactive [ 2397.529427][ T2820] vivid-001: RDS Traffic Program: false inactive [ 2397.535797][ T2820] vivid-001: RDS Music: false inactive [ 2397.541249][ T2820] vivid-001: ================== END STATUS ================== [ 2397.554500][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2397.664162][ T2838] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(12) [ 2397.670771][ T2838] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 2397.678611][ T2838] vhci_hcd vhci_hcd.0: Device attached [ 2397.969151][ T48] usb 51-1: new high-speed USB device number 6 using vhci_hcd [ 2398.745205][T17517] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2398.777306][ T2839] vhci_hcd: connection reset by peer [ 2398.798422][ T3652] vhci_hcd vhci_hcd.9: stop threads [ 2398.804586][T26643] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2398.847081][ T3652] vhci_hcd vhci_hcd.9: release socket [ 2398.879894][ T3652] vhci_hcd vhci_hcd.9: disconnect device [ 2399.034060][ T30] audit: type=1800 audit(1765462642.455:1627): pid=2826 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.8.8028" name="bus" dev="ramfs" ino=171737 res=0 errno=0 [ 2399.498177][T25715] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2399.564404][ T2867] FAULT_INJECTION: forcing a failure. [ 2399.564404][ T2867] name failslab, interval 1, probability 0, space 0, times 0 [ 2399.579019][ T2867] CPU: 0 UID: 0 PID: 2867 Comm: syz.9.8034 Tainted: G L syzkaller #0 PREEMPT(full) [ 2399.579051][ T2867] Tainted: [L]=SOFTLOCKUP [ 2399.579057][ T2867] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2399.579067][ T2867] Call Trace: [ 2399.579073][ T2867] [ 2399.579080][ T2867] dump_stack_lvl+0x16c/0x1f0 [ 2399.579105][ T2867] should_fail_ex+0x512/0x640 [ 2399.579135][ T2867] ? __kmalloc_cache_noprof+0x5f/0x800 [ 2399.579164][ T2867] should_failslab+0xc2/0x120 [ 2399.579188][ T2867] __kmalloc_cache_noprof+0x80/0x800 [ 2399.579214][ T2867] ? route4_change+0x15a5/0x2500 [ 2399.579243][ T2867] ? route4_change+0x15a5/0x2500 [ 2399.579264][ T2867] ? lockdep_rtnl_is_held+0x26/0x40 [ 2399.579284][ T2867] route4_change+0x15a5/0x2500 [ 2399.579315][ T2867] ? __pfx_route4_change+0x10/0x10 [ 2399.579349][ T2867] ? __pfx_route4_change+0x10/0x10 [ 2399.579371][ T2867] tc_new_tfilter+0xa35/0x2340 [ 2399.579405][ T2867] ? __pfx_tc_new_tfilter+0x10/0x10 [ 2399.579431][ T2867] ? __lock_acquire+0x436/0x2890 [ 2399.579465][ T2867] ? find_held_lock+0x2b/0x80 [ 2399.579490][ T2867] ? __pfx_tc_new_tfilter+0x10/0x10 [ 2399.579505][ T2867] ? rtnetlink_rcv_msg+0x93a/0xe90 [ 2399.579531][ T2867] ? __pfx_tc_new_tfilter+0x10/0x10 [ 2399.579549][ T2867] rtnetlink_rcv_msg+0x95e/0xe90 [ 2399.579580][ T2867] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2399.579612][ T2867] ? ref_tracker_free+0x37c/0x830 [ 2399.579639][ T2867] netlink_rcv_skb+0x158/0x420 [ 2399.579656][ T2867] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2399.579684][ T2867] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2399.579710][ T2867] ? netlink_deliver_tap+0x1ae/0xd30 [ 2399.579742][ T2867] netlink_unicast+0x5aa/0x870 [ 2399.579762][ T2867] ? __pfx_netlink_unicast+0x10/0x10 [ 2399.579788][ T2867] netlink_sendmsg+0x8c8/0xdd0 [ 2399.579810][ T2867] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2399.579837][ T2867] ____sys_sendmsg+0xa5d/0xc30 [ 2399.579857][ T2867] ? copy_msghdr_from_user+0x10a/0x160 [ 2399.579881][ T2867] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2399.579910][ T2867] ___sys_sendmsg+0x134/0x1d0 [ 2399.579935][ T2867] ? __pfx____sys_sendmsg+0x10/0x10 [ 2399.579989][ T2867] __sys_sendmsg+0x16d/0x220 [ 2399.580017][ T2867] ? __pfx___sys_sendmsg+0x10/0x10 [ 2399.580057][ T2867] do_syscall_64+0xcd/0xf80 [ 2399.580078][ T2867] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2399.580095][ T2867] RIP: 0033:0x7f3f2718f749 [ 2399.580110][ T2867] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2399.580132][ T2867] RSP: 002b:00007f3f2805a038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2399.580149][ T2867] RAX: ffffffffffffffda RBX: 00007f3f273e5fa0 RCX: 00007f3f2718f749 [ 2399.580161][ T2867] RDX: 0000000020000800 RSI: 0000200000000900 RDI: 0000000000000006 [ 2399.580171][ T2867] RBP: 00007f3f2805a090 R08: 0000000000000000 R09: 0000000000000000 [ 2399.580182][ T2867] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2399.580192][ T2867] R13: 00007f3f273e6038 R14: 00007f3f273e5fa0 R15: 00007fff3ff65208 [ 2399.580217][ T2867] [ 2399.882825][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2400.539187][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2401.084295][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2401.441001][ T2881] Process accounting resumed [ 2401.667077][ T5833] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2402.337249][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2403.059016][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2403.067438][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2403.847614][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2403.858311][ T2909] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2403.886800][T21294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2403.925366][ T2909] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2404.020039][T17172] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 2404.158948][T17172] usb 3-1: device descriptor read/64, error -71 [ 2404.212423][ T48] vhci_hcd vhci_hcd.9: vhci_device speed not set [ 2404.536074][T17172] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 2404.682889][T17172] usb 3-1: device descriptor read/64, error -71 [ 2404.809800][T17172] usb usb3-port1: attempt power cycle [ 2404.961583][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2404.970315][ T6099] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2405.228084][T17172] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 2405.271349][T17172] usb 3-1: device descriptor read/8, error -71 [ 2405.528677][T17172] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 2405.588569][T17172] usb 3-1: device descriptor read/8, error -71 [ 2405.646168][T29330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2405.709643][T17172] usb usb3-port1: unable to enumerate USB device [ 2406.075452][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2406.462763][ T30] audit: type=1400 audit(1765462649.415:1628): avc: denied { ioctl } for pid=2965 comm="syz.8.8061" path="uts:[4026534176]" dev="nsfs" ino=4026534176 ioctlcmd=0xb701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 2407.950192][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2407.994532][ T2972] Process accounting resumed [ 2408.033147][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2408.166485][ T30] audit: type=1326 audit(1765462651.005:1629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=2980 comm="syz.9.8065" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3f2718f749 code=0x0 [ 2408.424907][T29640] usb 9-1: new high-speed USB device number 112 using dummy_hcd [ 2408.906644][T29640] usb 9-1: Using ep0 maxpacket: 16 [ 2408.976554][T29640] usb 9-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 2409.033893][T29640] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2409.075782][T29640] usb 9-1: Product: syz [ 2409.100663][T29640] usb 9-1: Manufacturer: syz [ 2409.105923][T29640] usb 9-1: SerialNumber: syz [ 2409.120812][T29640] usb 9-1: config 0 descriptor?? [ 2409.185706][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2409.578661][T29640] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 2409.606154][T29640] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2409.616236][T29640] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 2409.625415][T29640] usb 9-1: media controller created [ 2409.657707][T29640] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2409.863566][T29640] zl10353_read_register: readreg error (reg=127, ret==0) [ 2409.886606][T29640] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 2409.913276][T29640] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 2409.953283][T29640] usb 9-1: USB disconnect, device number 112 [ 2410.267039][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2411.047105][T29640] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 2411.144992][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2411.364740][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2411.377749][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2412.496049][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2413.398331][ T3058] netlink: 20 bytes leftover after parsing attributes in process `syz.3.8078'. [ 2413.653070][ T3044] syzkaller0: entered promiscuous mode [ 2413.659786][ T3044] syzkaller0: entered allmulticast mode [ 2413.687930][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2414.079877][ T5897] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 2414.297535][ T5897] usb 3-1: Using ep0 maxpacket: 8 [ 2414.378212][ T5897] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 2414.414509][ T5897] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2414.578626][ T5897] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2414.602649][ T5897] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 2414.622342][ T5897] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2414.635715][T17172] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2414.660416][ T5897] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2414.677411][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2414.808329][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2414.924643][ T5897] usb 3-1: usb_control_msg returned -32 [ 2414.930223][ T5897] usbtmc 3-1:16.0: can't read capabilities [ 2414.962215][ T5897] usb 3-1: USB disconnect, device number 26 [ 2415.437539][ T5897] usb 10-1: new high-speed USB device number 50 using dummy_hcd [ 2415.520356][ T3088] FAULT_INJECTION: forcing a failure. [ 2415.520356][ T3088] name failslab, interval 1, probability 0, space 0, times 0 [ 2415.533059][ T3088] CPU: 1 UID: 0 PID: 3088 Comm: syz.8.8091 Tainted: G L syzkaller #0 PREEMPT(full) [ 2415.533088][ T3088] Tainted: [L]=SOFTLOCKUP [ 2415.533094][ T3088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2415.533104][ T3088] Call Trace: [ 2415.533111][ T3088] [ 2415.533118][ T3088] dump_stack_lvl+0x16c/0x1f0 [ 2415.533141][ T3088] should_fail_ex+0x512/0x640 [ 2415.533163][ T3088] ? fs_reclaim_acquire+0xae/0x150 [ 2415.533188][ T3088] should_failslab+0xc2/0x120 [ 2415.533210][ T3088] __kmalloc_noprof+0xeb/0x910 [ 2415.533237][ T3088] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2415.533262][ T3088] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2415.533281][ T3088] tomoyo_realpath_from_path+0xc2/0x6e0 [ 2415.533304][ T3088] ? tomoyo_profile+0x47/0x60 [ 2415.533328][ T3088] tomoyo_path_number_perm+0x245/0x580 [ 2415.533353][ T3088] ? tomoyo_path_number_perm+0x237/0x580 [ 2415.533381][ T3088] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2415.533409][ T3088] ? find_held_lock+0x2b/0x80 [ 2415.533457][ T3088] ? find_held_lock+0x2b/0x80 [ 2415.533481][ T3088] ? hook_file_ioctl_common+0x144/0x410 [ 2415.533509][ T3088] ? __fget_files+0x20e/0x3c0 [ 2415.533537][ T3088] security_file_ioctl+0x9b/0x240 [ 2415.533557][ T3088] __x64_sys_ioctl+0xb7/0x210 [ 2415.533583][ T3088] do_syscall_64+0xcd/0xf80 [ 2415.533604][ T3088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2415.533619][ T3088] RIP: 0033:0x7fb389f8f749 [ 2415.533633][ T3088] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2415.533647][ T3088] RSP: 002b:00007fb3881d5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2415.533663][ T3088] RAX: ffffffffffffffda RBX: 00007fb38a1e6180 RCX: 00007fb389f8f749 [ 2415.533673][ T3088] RDX: 0000200000001200 RSI: 0000000040047452 RDI: 0000000000000005 [ 2415.533683][ T3088] RBP: 00007fb3881d5090 R08: 0000000000000000 R09: 0000000000000000 [ 2415.533692][ T3088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2415.533701][ T3088] R13: 00007fb38a1e6218 R14: 00007fb38a1e6180 R15: 00007fff662b5da8 [ 2415.533725][ T3088] [ 2415.742588][ T5897] usb 10-1: device descriptor read/64, error -71 [ 2415.781259][ T3088] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2415.909881][T14335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2415.918863][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2416.014916][ T5897] usb 10-1: new high-speed USB device number 51 using dummy_hcd [ 2416.485882][ T5897] usb 10-1: device descriptor read/64, error -71 [ 2416.604468][ T5897] usb usb10-port1: attempt power cycle [ 2417.025399][ T5897] usb 10-1: new high-speed USB device number 52 using dummy_hcd [ 2417.082577][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2417.095109][ T5897] usb 10-1: device descriptor read/8, error -71 [ 2417.281079][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2417.351408][ T5897] usb 10-1: new high-speed USB device number 53 using dummy_hcd [ 2417.386493][ T5897] usb 10-1: device descriptor read/8, error -71 [ 2417.503510][ T5897] usb usb10-port1: unable to enumerate USB device [ 2417.880499][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2418.232778][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2419.590798][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2420.952880][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2421.272955][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2421.483358][T15208] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2421.787706][T26394] usb 9-1: new high-speed USB device number 113 using dummy_hcd [ 2421.952189][T26394] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2422.022612][T26394] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2422.040902][T26394] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2422.277098][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2422.277658][T26394] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2422.333556][T26394] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2422.342841][T26394] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2422.351069][T26394] usb 9-1: Product: syz [ 2422.355506][T26394] usb 9-1: Manufacturer: syz [ 2422.455435][T26394] cdc_wdm 9-1:1.0: skipping garbage [ 2422.538355][ T30] audit: type=1400 audit(1765462664.447:1630): avc: denied { connect } for pid=3160 comm="syz.2.8111" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 2423.437801][T26394] cdc_wdm 9-1:1.0: skipping garbage [ 2423.448809][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2423.459927][ T7534] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2423.478229][T26394] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 2423.752123][T26394] cdc_wdm 9-1:1.0: Unknown control protocol [ 2423.786371][T26523] usb 9-1: USB disconnect, device number 113 [ 2423.815467][ T3168] netlink: 'syz.2.8113': attribute type 1 has an invalid length. [ 2423.836171][ T3168] netlink: 260 bytes leftover after parsing attributes in process `syz.2.8113'. [ 2423.876012][ T3168] FAULT_INJECTION: forcing a failure. [ 2423.876012][ T3168] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2423.910418][ T3168] CPU: 0 UID: 0 PID: 3168 Comm: syz.2.8113 Tainted: G L syzkaller #0 PREEMPT(full) [ 2423.910447][ T3168] Tainted: [L]=SOFTLOCKUP [ 2423.910454][ T3168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2423.910463][ T3168] Call Trace: [ 2423.910470][ T3168] [ 2423.910476][ T3168] dump_stack_lvl+0x16c/0x1f0 [ 2423.910498][ T3168] should_fail_ex+0x512/0x640 [ 2423.910525][ T3168] _copy_from_user+0x2e/0xd0 [ 2423.910547][ T3168] move_addr_to_kernel+0x65/0x170 [ 2423.910569][ T3168] __copy_msghdr+0x386/0x470 [ 2423.910594][ T3168] copy_msghdr_from_user+0xc1/0x160 [ 2423.910618][ T3168] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2423.910645][ T3168] ? __pfx__kstrtoull+0x10/0x10 [ 2423.910675][ T3168] ___sys_sendmsg+0xfe/0x1d0 [ 2423.910700][ T3168] ? __pfx____sys_sendmsg+0x10/0x10 [ 2423.910746][ T3168] ? __pfx___might_resched+0x10/0x10 [ 2423.910769][ T3168] __sys_sendmmsg+0x200/0x420 [ 2423.910803][ T3168] ? __pfx___sys_sendmmsg+0x10/0x10 [ 2423.910838][ T3168] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2423.910869][ T3168] ? fput+0x70/0xf0 [ 2423.910894][ T3168] ? ksys_write+0x1ac/0x250 [ 2423.910914][ T3168] ? __pfx_ksys_write+0x10/0x10 [ 2423.910940][ T3168] __x64_sys_sendmmsg+0x9c/0x100 [ 2423.910964][ T3168] ? lockdep_hardirqs_on+0x7c/0x110 [ 2423.910981][ T3168] do_syscall_64+0xcd/0xf80 [ 2423.911001][ T3168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2423.911019][ T3168] RIP: 0033:0x7f34c058f749 [ 2423.911033][ T3168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2423.911049][ T3168] RSP: 002b:00007f34c13f5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 2423.911066][ T3168] RAX: ffffffffffffffda RBX: 00007f34c07e5fa0 RCX: 00007f34c058f749 [ 2423.911077][ T3168] RDX: 0400000000000235 RSI: 0000200000000000 RDI: 0000000000000003 [ 2423.911088][ T3168] RBP: 00007f34c13f5090 R08: 0000000000000000 R09: 0000000000000000 [ 2423.911098][ T3168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2423.911108][ T3168] R13: 00007f34c07e6038 R14: 00007f34c07e5fa0 R15: 00007ffc72ff2a18 [ 2423.911132][ T3168] [ 2424.553528][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2424.561692][T21294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2425.230954][ T3188] fuse: Bad value for 'fd' [ 2425.752672][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2425.763169][ T5833] Bluetooth: hci1: Ignoring HCI_Connection_Complete for existing connection [ 2426.856521][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2427.569298][ T1054] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2428.045534][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2428.098717][T17172] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2429.003862][ T48] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 2429.168847][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2429.177179][ T48] usb 3-1: Using ep0 maxpacket: 32 [ 2429.184363][ T48] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 2429.201426][ T48] usb 3-1: config 0 has no interface number 0 [ 2429.212678][ T48] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2429.230271][ T48] usb 3-1: config 0 interface 85 has no altsetting 0 [ 2429.594512][ T4268] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2429.604170][ T48] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 2429.613331][ T48] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2429.638210][ T48] usb 3-1: Product: syz [ 2429.645172][ T48] usb 3-1: Manufacturer: syz [ 2429.651808][ T48] usb 3-1: SerialNumber: syz [ 2429.663429][ T48] usb 3-1: config 0 descriptor?? [ 2430.339818][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2430.630790][ T48] appletouch 3-1:0.85: Geyser mode initialized. [ 2430.790008][ T48] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input117 [ 2430.919605][ T48] usb 3-1: USB disconnect, device number 27 [ 2430.925588][ C1] appletouch 3-1:0.85: atp_complete: usb_submit_urb failed with result -19 [ 2430.950073][ T48] appletouch 3-1:0.85: input: appletouch disconnected [ 2431.438530][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2431.474108][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2432.181758][ T1098] nci: nci_extract_activation_params_iso_dep: unsupported activation_rf_tech_and_mode 0x80 [ 2432.382312][ T5833] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 2432.585885][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2432.654069][ T3297] sock: sock_timestamping_bind_phc: sock not bind to device [ 2432.682206][ T48] usb 10-1: new high-speed USB device number 54 using dummy_hcd [ 2432.841964][ T48] usb 10-1: Using ep0 maxpacket: 8 [ 2432.853869][ T48] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 2432.862430][ T48] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2432.875110][ T48] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 2432.885218][ T48] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 2432.895264][ T48] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 2432.905346][ T48] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2432.919357][ T48] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 2432.957926][ T48] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2432.986789][ T48] usbtmc 10-1:16.0: probe with driver usbtmc failed with error -22 [ 2433.295281][ T3293] syz.9.8145 (3293): drop_caches: 4 [ 2433.508293][ T3293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2433.517301][ T3293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2433.699057][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2433.708415][ T6099] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2434.884725][T21294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2434.915189][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2435.284523][T21294] usb 10-1: USB disconnect, device number 54 [ 2435.616867][T17172] usb 9-1: new high-speed USB device number 114 using dummy_hcd [ 2435.648708][ T5833] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci2/hci2:201' [ 2435.659044][ T5833] CPU: 1 UID: 0 PID: 5833 Comm: kworker/u9:10 Tainted: G L syzkaller #0 PREEMPT(full) [ 2435.659077][ T5833] Tainted: [L]=SOFTLOCKUP [ 2435.659084][ T5833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2435.659097][ T5833] Workqueue: hci2 hci_rx_work [ 2435.659130][ T5833] Call Trace: [ 2435.659137][ T5833] [ 2435.659144][ T5833] dump_stack_lvl+0x16c/0x1f0 [ 2435.659165][ T5833] sysfs_warn_dup+0x7f/0xa0 [ 2435.659187][ T5833] sysfs_create_dir_ns+0x24b/0x2b0 [ 2435.659208][ T5833] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 2435.659229][ T5833] ? find_held_lock+0x2b/0x80 [ 2435.659263][ T5833] ? do_raw_spin_unlock+0x172/0x230 [ 2435.659288][ T5833] kobject_add_internal+0x2c4/0x9d0 [ 2435.659315][ T5833] kobject_add+0x16e/0x240 [ 2435.659336][ T5833] ? __pfx_kobject_add+0x10/0x10 [ 2435.659360][ T5833] ? kobject_put+0xaf/0x6f0 [ 2435.659377][ T5833] ? _raw_spin_unlock+0x28/0x50 [ 2435.659411][ T5833] device_add+0x288/0x1980 [ 2435.659439][ T5833] ? __pfx_dev_set_name+0x10/0x10 [ 2435.659456][ T5833] ? __pfx_device_add+0x10/0x10 [ 2435.659482][ T5833] ? mgmt_send_event_skb+0x2fb/0x460 [ 2435.659516][ T5833] hci_conn_add_sysfs+0x1a8/0x260 [ 2435.659536][ T5833] le_conn_complete_evt+0x11ed/0x1fa0 [ 2435.659567][ T5833] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 2435.659596][ T5833] hci_le_conn_complete_evt+0x23c/0x3a0 [ 2435.659624][ T5833] hci_le_meta_evt+0x357/0x610 [ 2435.659637][ T5833] ? __pfx_hci_le_conn_complete_evt+0x10/0x10 [ 2435.659667][ T5833] hci_event_packet+0x685/0x1210 [ 2435.659693][ T5833] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 2435.659711][ T5833] ? __pfx_hci_event_packet+0x10/0x10 [ 2435.659740][ T5833] ? kcov_remote_start+0x399/0x680 [ 2435.659760][ T5833] ? lockdep_hardirqs_on+0x7c/0x110 [ 2435.659783][ T5833] hci_rx_work+0x2c9/0x1020 [ 2435.659814][ T5833] process_one_work+0x9ba/0x1b20 [ 2435.659848][ T5833] ? __pfx_process_one_work+0x10/0x10 [ 2435.659878][ T5833] ? assign_work+0x1a0/0x250 [ 2435.659902][ T5833] worker_thread+0x6c8/0xf10 [ 2435.659933][ T5833] ? __kthread_parkme+0x19e/0x250 [ 2435.659951][ T5833] ? __pfx_worker_thread+0x10/0x10 [ 2435.659972][ T5833] kthread+0x3c5/0x780 [ 2435.659991][ T5833] ? __pfx_kthread+0x10/0x10 [ 2435.660022][ T5833] ? rcu_is_watching+0x12/0xc0 [ 2435.660040][ T5833] ? __pfx_kthread+0x10/0x10 [ 2435.660065][ T5833] ret_from_fork+0x983/0xb10 [ 2435.660087][ T5833] ? __pfx_ret_from_fork+0x10/0x10 [ 2435.660111][ T5833] ? __switch_to+0x7af/0x10d0 [ 2435.660136][ T5833] ? __pfx_kthread+0x10/0x10 [ 2435.660160][ T5833] ret_from_fork_asm+0x1a/0x30 [ 2435.660200][ T5833] [ 2435.660224][ T5833] kobject: kobject_add_internal failed for hci2:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 2435.926891][ T1054] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2435.929249][ T5833] Bluetooth: hci2: failed to register connection device [ 2436.006557][T17172] usb 9-1: Using ep0 maxpacket: 32 [ 2436.021848][T17172] usb 9-1: config 0 has an invalid interface number: 85 but max is 0 [ 2436.028201][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2436.048499][T17172] usb 9-1: config 0 has no interface number 0 [ 2436.055323][T17172] usb 9-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2436.066473][T17172] usb 9-1: config 0 interface 85 altsetting 7 endpoint 0x82 has invalid wMaxPacketSize 0 [ 2436.076521][T17172] usb 9-1: config 0 interface 85 has no altsetting 0 [ 2436.085451][T17172] usb 9-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 2436.094911][T17172] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2436.103086][T17172] usb 9-1: Product: syz [ 2436.107435][T17172] usb 9-1: Manufacturer: syz [ 2436.112266][T17172] usb 9-1: SerialNumber: syz [ 2436.120501][T17172] usb 9-1: config 0 descriptor?? [ 2436.706892][ T5815] libceph: connect (1)[c::]:6789 error -101 [ 2436.737954][ T5815] libceph: mon0 (1)[c::]:6789 connect error [ 2437.142850][ T5815] libceph: connect (1)[c::]:6789 error -101 [ 2437.157734][ T5815] libceph: mon0 (1)[c::]:6789 connect error [ 2437.740968][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2437.760468][ T3375] overlayfs: workdir and upperdir must reside under the same mount [ 2437.827292][ T3373] vivid-000: ================= START STATUS ================= [ 2437.835041][ T3373] vivid-000: Radio HW Seek Mode: Bounded [ 2437.840716][ T3373] vivid-000: Radio Programmable HW Seek: false [ 2437.846892][ T3373] vivid-000: RDS Rx I/O Mode: Block I/O [ 2437.852438][ T3373] vivid-000: Generate RBDS Instead of RDS: false [ 2437.858909][ T3373] vivid-000: RDS Reception: true [ 2437.863847][ T3373] vivid-000: RDS Program Type: 0 inactive [ 2437.869605][ T3373] vivid-000: RDS PS Name: inactive [ 2437.874806][ T3373] vivid-000: RDS Radio Text: inactive [ 2437.880302][ T3373] vivid-000: RDS Traffic Announcement: false inactive [ 2437.887099][ T3373] vivid-000: RDS Traffic Program: false inactive [ 2437.893485][ T3373] vivid-000: RDS Music: false inactive [ 2437.899000][ T3373] vivid-000: ================== END STATUS ================== [ 2438.145715][T21294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2438.358249][ T3396] netlink: 28 bytes leftover after parsing attributes in process `syz.9.8173'. [ 2438.359080][T29640] libceph: connect (1)[c::]:6789 error -101 [ 2438.381949][T29640] libceph: mon0 (1)[c::]:6789 connect error [ 2438.471635][ T3398] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8172'. [ 2438.927088][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2439.115582][ T3364] ceph: No mds server is up or the cluster is laggy [ 2439.265500][T17172] appletouch 9-1:0.85: Failed to read mode from device. [ 2439.272885][T17172] appletouch 9-1:0.85: probe with driver appletouch failed with error -5 [ 2439.284969][T17172] usb 9-1: USB disconnect, device number 114 [ 2439.855494][ T3499] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2440.092198][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2440.600798][ T3426] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2440.633415][T17172] IPVS: starting estimator thread 0... [ 2440.742457][ T3429] IPVS: using max 82 ests per chain, 196800 per kthread [ 2441.224510][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2442.400501][T15659] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2442.408720][T21294] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2442.442623][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2442.509151][ T2088] Bluetooth: hci2: command 0x0406 tx timeout [ 2443.310737][ T7507] Bluetooth: hci4: Frame reassembly failed (-84) [ 2443.599822][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2444.823063][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2445.243518][ T3478] xt_bpf: check failed: parse error [ 2445.414034][ T5833] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2445.679783][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2445.693400][ T7507] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2445.707741][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2445.753321][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2445.928604][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2446.014072][ T3652] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2447.210197][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2447.495487][ T3504] vivid-000: ================= START STATUS ================= [ 2447.503260][ T3504] vivid-000: Radio HW Seek Mode: Bounded [ 2447.508893][ T3504] vivid-000: Radio Programmable HW Seek: false [ 2447.515049][ T3504] vivid-000: RDS Rx I/O Mode: Block I/O [ 2447.520659][ T3504] vivid-000: Generate RBDS Instead of RDS: false [ 2447.526966][ T3504] vivid-000: RDS Reception: true [ 2447.531922][ T3504] vivid-000: RDS Program Type: 0 inactive [ 2447.538064][ T3504] vivid-000: RDS PS Name: inactive [ 2447.543296][ T3504] vivid-000: RDS Radio Text: inactive [ 2447.548746][ T3504] vivid-000: RDS Traffic Announcement: false inactive [ 2447.555574][ T3504] vivid-000: RDS Traffic Program: false inactive [ 2447.561890][ T3504] vivid-000: RDS Music: false inactive [ 2447.567379][ T3504] vivid-000: ================== END STATUS ================== [ 2447.630178][ T3521] kAFS: unable to lookup cell 'Þ({^ú@' [ 2447.787306][T26394] usb 10-1: new high-speed USB device number 55 using dummy_hcd [ 2447.930299][T26394] usb 10-1: device descriptor read/64, error -71 [ 2448.067816][ T7507] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2448.237062][T26394] usb 10-1: new high-speed USB device number 56 using dummy_hcd [ 2449.341754][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2449.361298][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2449.539822][T26394] usb 10-1: device descriptor read/64, error -71 [ 2449.569195][ T3533] netlink: 204 bytes leftover after parsing attributes in process `syz.8.8210'. [ 2449.578340][ T3533] netlink: 72 bytes leftover after parsing attributes in process `syz.8.8210'. [ 2449.587405][ T3533] netlink: 16 bytes leftover after parsing attributes in process `syz.8.8210'. [ 2449.659014][T26394] usb usb10-port1: attempt power cycle [ 2449.935059][ T30] audit: type=1326 audit(1765462690.077:1631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3546 comm="syz.3.8213" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f196458f749 code=0x0 [ 2450.032414][T26394] usb 10-1: new high-speed USB device number 57 using dummy_hcd [ 2450.069094][ T3550] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(12) [ 2450.075732][ T3550] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 2450.083677][ T3550] vhci_hcd vhci_hcd.0: Device attached [ 2450.402630][T29640] usb 39-1: new high-speed USB device number 7 using vhci_hcd [ 2450.470110][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2451.054148][ T3551] vhci_hcd: connection reset by peer [ 2451.165147][T15208] vhci_hcd vhci_hcd.3: stop threads [ 2451.217970][T15208] vhci_hcd vhci_hcd.3: release socket [ 2451.297790][T15208] vhci_hcd vhci_hcd.3: disconnect device [ 2451.406385][ T3560] netlink: 40 bytes leftover after parsing attributes in process `syz.9.8219'. [ 2451.486895][ T3652] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2451.495747][T30304] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2451.504343][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2451.550679][T26394] usb 10-1: device not accepting address 57, error -71 [ 2451.926008][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2451.934258][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2452.394999][ T3576] kAFS: unable to lookup cell 'Þ({^ú@' [ 2453.033365][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2453.219696][ T3586] overlayfs: failed to resolve './file0': -2 [ 2454.548138][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2455.164025][T32522] net_ratelimit: 1 callbacks suppressed [ 2455.164044][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2455.325289][ T3613] vivid-000: ================= START STATUS ================= [ 2455.332928][ T3613] vivid-000: Radio HW Seek Mode: Bounded [ 2455.338616][ T3613] vivid-000: Radio Programmable HW Seek: false [ 2455.344751][ T3613] vivid-000: RDS Rx I/O Mode: Block I/O [ 2455.350355][ T3613] vivid-000: Generate RBDS Instead of RDS: false [ 2455.356715][ T3613] vivid-000: RDS Reception: true [ 2455.361650][ T3613] vivid-000: RDS Program Type: 0 inactive [ 2455.367393][ T3613] vivid-000: RDS PS Name: inactive [ 2455.372581][ T3613] vivid-000: RDS Radio Text: inactive [ 2455.378106][ T3613] vivid-000: RDS Traffic Announcement: false inactive [ 2455.384873][ T3613] vivid-000: RDS Traffic Program: false inactive [ 2455.391252][ T3613] vivid-000: RDS Music: false inactive [ 2455.396696][ T3613] vivid-000: ================== END STATUS ================== [ 2455.471829][ T3619] kAFS: unable to lookup cell 'Þ({^ú@' [ 2455.689070][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2455.944506][T29640] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 2456.062475][ T3628] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2456.438820][T29330] Bluetooth: hci4: Frame reassembly failed (-84) [ 2456.445210][T15659] Bluetooth: hci4: Frame reassembly failed (-84) [ 2456.491038][T15659] Bluetooth: hci4: received HCILL_GO_TO_SLEEP_ACK in state 0 [ 2456.518715][T29330] Bluetooth: received HCILL_WAKE_UP_ACK in state 2 [ 2456.799852][T26523] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2457.647211][T29330] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2457.657191][T15659] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2457.755573][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2457.764476][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2457.912782][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2458.586330][ T5833] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2458.594881][ T2088] Bluetooth: hci4: command 0x1003 tx timeout [ 2459.024286][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2459.385125][ T3679] kAFS: unable to lookup cell 'Þ({^ú@' [ 2459.492961][ T3674] vivid-000: ================= START STATUS ================= [ 2459.500651][ T3674] vivid-000: Radio HW Seek Mode: Bounded [ 2459.506305][ T3674] vivid-000: Radio Programmable HW Seek: false [ 2459.512467][ T3674] vivid-000: RDS Rx I/O Mode: Block I/O [ 2459.518007][ T3674] vivid-000: Generate RBDS Instead of RDS: false [ 2459.524325][ T3674] vivid-000: RDS Reception: true [ 2459.529270][ T3674] vivid-000: RDS Program Type: 0 inactive [ 2459.536833][ T3674] vivid-000: RDS PS Name: inactive [ 2459.542064][ T3674] vivid-000: RDS Radio Text: inactive [ 2459.547580][ T3674] vivid-000: RDS Traffic Announcement: false inactive [ 2459.554330][ T3674] vivid-000: RDS Traffic Program: false inactive [ 2459.560679][ T3674] vivid-000: RDS Music: false inactive [ 2459.566129][ T3674] vivid-000: ================== END STATUS ================== [ 2459.835637][ T48] usb 9-1: new high-speed USB device number 115 using dummy_hcd [ 2460.008587][ T48] usb 9-1: Using ep0 maxpacket: 32 [ 2460.019716][ T48] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 2460.037999][ T48] usb 9-1: can't read configurations, error -61 [ 2460.136123][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2460.254528][ T48] usb 9-1: new high-speed USB device number 116 using dummy_hcd [ 2460.551824][ T48] usb 9-1: Using ep0 maxpacket: 32 [ 2460.574802][ T48] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 2460.586004][ T48] usb 9-1: can't read configurations, error -61 [ 2460.592785][ T48] usb usb9-port1: attempt power cycle [ 2461.087222][T32522] net_ratelimit: 1 callbacks suppressed [ 2461.087241][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2461.247026][ T48] usb 9-1: new high-speed USB device number 117 using dummy_hcd [ 2461.255193][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2461.279443][ T48] usb 9-1: Using ep0 maxpacket: 32 [ 2461.286451][ T48] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 2461.294335][ T48] usb 9-1: can't read configurations, error -61 [ 2461.470086][ T48] usb 9-1: new high-speed USB device number 118 using dummy_hcd [ 2461.526944][ T48] usb 9-1: Using ep0 maxpacket: 32 [ 2461.538043][ T48] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 2461.545819][ T48] usb 9-1: can't read configurations, error -61 [ 2461.565298][ T48] usb usb9-port1: unable to enumerate USB device [ 2462.201046][T28891] Bluetooth: hci4: Frame reassembly failed (-84) [ 2462.348500][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2462.363977][ T3717] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2462.376261][ T3717] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2462.572442][T17172] usb 10-1: new high-speed USB device number 59 using dummy_hcd [ 2462.732808][T17172] usb 10-1: Using ep0 maxpacket: 16 [ 2462.739610][T17172] usb 10-1: config 0 has an invalid interface number: 41 but max is 0 [ 2462.749888][T17172] usb 10-1: config 0 has no interface number 0 [ 2462.757878][T17172] usb 10-1: config 0 interface 41 has no altsetting 0 [ 2462.777094][T15208] Bluetooth: hci5: Frame reassembly failed (-84) [ 2462.778979][T17172] usb 10-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 2462.785356][T15208] Bluetooth: hci5: Frame reassembly failed (-84) [ 2462.793063][T17172] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2462.807408][T17172] usb 10-1: Product: syz [ 2462.811791][T17172] usb 10-1: Manufacturer: syz [ 2462.816505][T17172] usb 10-1: SerialNumber: syz [ 2462.822814][T17172] usb 10-1: config 0 descriptor?? [ 2462.830033][T17172] CoreChips 10-1:0.41: probe with driver CoreChips failed with error -22 [ 2463.477138][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2463.807285][ T3652] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2463.819818][T30304] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2463.829219][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2463.857063][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2464.039946][ T3733] kAFS: unable to lookup cell 'Þ({^ú@' [ 2464.412338][ T5833] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2464.425822][ T5819] Bluetooth: hci4: command 0x1003 tx timeout [ 2464.693285][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2464.915311][ T2088] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 2466.087908][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2466.542539][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2466.631978][T17172] usb 10-1: USB disconnect, device number 59 [ 2467.309442][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2467.495336][ T3770] loop6: detected capacity change from 0 to 2640 [ 2467.534661][ T3770] buffer_io_error: 7 callbacks suppressed [ 2467.534709][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.592720][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.714203][ T3776] loop6: detected capacity change from 2640 to 524287999 [ 2467.728060][T17172] usb 4-1: new low-speed USB device number 124 using dummy_hcd [ 2467.735404][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.752647][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.761119][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.769447][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.777754][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.785954][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.803283][ T3770] ldm_validate_partition_table(): Disk read failed. [ 2467.810264][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.819296][ T3770] Buffer I/O error on dev loop6, logical block 0, async page read [ 2467.827595][ T3770] Dev loop6: unable to read RDB block 0 [ 2467.834453][ T3770] loop6: unable to read partition table [ 2467.883316][ T3770] loop_reread_partitions: partition scan of loop6 (ir¡c‡’ úÒVUŸX¯ÃG¨½›˜ñZtM<IÆ i8NL í á·ùWû@©àQ6ÒÝ%ž…û¥¡Úè) failed (rc=-5) [ 2467.939128][T17172] usb 4-1: device descriptor read/64, error -71 [ 2468.173799][ T2088] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2468.334763][T17172] usb 4-1: new low-speed USB device number 125 using dummy_hcd [ 2468.421000][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2468.494995][T17172] usb 4-1: device descriptor read/64, error -71 [ 2468.594563][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2468.601132][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2468.616236][T17172] usb usb4-port1: attempt power cycle [ 2468.946079][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2468.991579][ T30] audit: type=1326 audit(1765462707.905:1632): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3791 comm="syz.9.8280" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f2718f749 code=0x7ffc0000 [ 2469.039886][ T30] audit: type=1326 audit(1765462707.924:1633): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3791 comm="syz.9.8280" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3f2718f749 code=0x7ffc0000 [ 2469.677657][T29616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2469.893547][T17172] usb 4-1: new low-speed USB device number 126 using dummy_hcd [ 2469.898575][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2469.925521][T17172] usb 4-1: device descriptor read/8, error -71 [ 2469.957528][ T3800] Process accounting resumed [ 2470.046682][T28891] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2470.084832][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2470.095062][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2470.723904][T17172] usb 4-1: new low-speed USB device number 127 using dummy_hcd [ 2471.020308][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2471.101280][T17172] usb 4-1: device descriptor read/8, error -71 [ 2471.242846][T17172] usb usb4-port1: unable to enumerate USB device [ 2472.015764][ T1054] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2472.098095][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2472.430094][T29640] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 2472.621026][T29640] usb 3-1: Using ep0 maxpacket: 32 [ 2472.632154][T29640] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 2472.658931][T29640] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2472.826511][ T5819] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 2472.852436][T29640] usb 3-1: config 0 descriptor?? [ 2473.101835][ T5819] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 2473.221370][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2473.569086][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2473.595859][T29640] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 2473.660544][T29640] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2473.670571][T29640] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 2473.677803][T29640] usb 3-1: media controller created [ 2473.697349][T29640] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2473.733864][ T3849] netlink: 10 bytes leftover after parsing attributes in process `syz.0.8295'. [ 2473.960799][ T3858] ieee802154 phy0 wpan0: encryption failed: -22 [ 2474.113133][T29640] az6027: usb out operation failed. (-71) [ 2474.234356][T29640] stb0899_attach: Driver disabled by Kconfig [ 2474.241331][T29640] az6027: no front-end attached [ 2474.241331][T29640] [ 2474.250583][T29640] az6027: usb out operation failed. (-71) [ 2474.256335][T29640] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 2474.265842][T29640] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input120 [ 2474.282997][T29640] dvb-usb: schedule remote query interval to 400 msecs. [ 2474.292116][T29640] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 2474.303070][T29640] usb 3-1: USB disconnect, device number 28 [ 2474.767088][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2474.790157][T29640] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 2474.890202][ T3853] netlink: 24 bytes leftover after parsing attributes in process `syz.0.8295'. [ 2475.067098][ T3865] Process accounting resumed [ 2475.472291][ T65] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2476.011050][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2476.066452][ T3881] Process accounting resumed [ 2476.406182][ T2088] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 2476.589359][ T3899] block nbd0: NBD_DISCONNECT [ 2476.598595][ T3899] block nbd0: Disconnected due to user request. [ 2476.609700][ T3899] block nbd0: shutting down sockets [ 2476.802221][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2477.146107][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2478.298561][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2478.348362][T15208] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2479.583860][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2480.057746][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2480.093967][ T3917] Process accounting resumed [ 2480.191406][ T3933] netlink: 44 bytes leftover after parsing attributes in process `syz.3.8316'. [ 2480.423016][ T5833] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 2480.759727][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2481.394429][ T3954] FAULT_INJECTION: forcing a failure. [ 2481.394429][ T3954] name failslab, interval 1, probability 0, space 0, times 0 [ 2481.407210][ T3954] CPU: 1 UID: 0 PID: 3954 Comm: syz.0.8321 Tainted: G L syzkaller #0 PREEMPT(full) [ 2481.407239][ T3954] Tainted: [L]=SOFTLOCKUP [ 2481.407245][ T3954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2481.407255][ T3954] Call Trace: [ 2481.407263][ T3954] [ 2481.407270][ T3954] dump_stack_lvl+0x16c/0x1f0 [ 2481.407291][ T3954] should_fail_ex+0x512/0x640 [ 2481.407312][ T3954] ? fs_reclaim_acquire+0xae/0x150 [ 2481.407335][ T3954] should_failslab+0xc2/0x120 [ 2481.407357][ T3954] __kmalloc_noprof+0xeb/0x910 [ 2481.407383][ T3954] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2481.407407][ T3954] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 2481.407424][ T3954] tomoyo_realpath_from_path+0xc2/0x6e0 [ 2481.407445][ T3954] ? tomoyo_profile+0x47/0x60 [ 2481.407467][ T3954] tomoyo_path_number_perm+0x245/0x580 [ 2481.407492][ T3954] ? tomoyo_path_number_perm+0x237/0x580 [ 2481.407519][ T3954] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 2481.407546][ T3954] ? find_held_lock+0x2b/0x80 [ 2481.407591][ T3954] ? find_held_lock+0x2b/0x80 [ 2481.407613][ T3954] ? hook_file_ioctl_common+0x144/0x410 [ 2481.407647][ T3954] ? __fget_files+0x20e/0x3c0 [ 2481.407673][ T3954] security_file_ioctl+0x9b/0x240 [ 2481.407693][ T3954] __x64_sys_ioctl+0xb7/0x210 [ 2481.407713][ T3954] do_syscall_64+0xcd/0xf80 [ 2481.407731][ T3954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2481.407748][ T3954] RIP: 0033:0x7ffbccd8f749 [ 2481.407762][ T3954] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2481.407777][ T3954] RSP: 002b:00007ffbcdc93038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 2481.407792][ T3954] RAX: ffffffffffffffda RBX: 00007ffbccfe5fa0 RCX: 00007ffbccd8f749 [ 2481.407803][ T3954] RDX: 00002000000006c0 RSI: 0000000000004c05 RDI: 0000000000000005 [ 2481.407813][ T3954] RBP: 00007ffbcdc93090 R08: 0000000000000000 R09: 0000000000000000 [ 2481.407822][ T3954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2481.407831][ T3954] R13: 00007ffbccfe6038 R14: 00007ffbccfe5fa0 R15: 00007fffacbb5c28 [ 2481.407855][ T3954] [ 2481.407862][ T3954] ERROR: Out of memory at tomoyo_realpath_from_path. [ 2481.431241][T14426] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2481.849001][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2482.136295][ T48] usb 9-1: new full-speed USB device number 119 using dummy_hcd [ 2482.576131][ T3972] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2482.612224][ T3971] Process accounting resumed [ 2482.768827][ T48] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2482.797769][ T48] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2482.916693][ T48] usb 9-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 2482.925816][ T48] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2483.409979][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2483.420179][ T48] usb 9-1: config 0 descriptor?? [ 2483.435708][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2483.892372][ T48] dragonrise 0003:0079:0006.0018: hidraw0: USB HID v0.00 Device [HID 0079:0006] on usb-dummy_hcd.8-1/input0 [ 2483.904968][ T48] dragonrise 0003:0079:0006.0018: no inputs found [ 2483.918441][ T48] dragonrise 0003:0079:0006.0018: force feedback init failed [ 2484.369192][ T4463] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2484.388976][T27098] usb 9-1: USB disconnect, device number 119 [ 2484.500011][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2484.798622][ T5833] Bluetooth: hci2: Ignoring HCI_Connection_Complete for existing connection [ 2485.236694][T27292] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 2485.439629][T27292] usb 4-1: Using ep0 maxpacket: 32 [ 2485.449157][T27292] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2485.468838][T27292] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2485.490416][T27292] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2485.499850][T27292] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2485.531054][T27292] usb 4-1: config 0 descriptor?? [ 2485.547149][T27292] hub 4-1:0.0: USB hub found [ 2485.699306][T29640] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2485.816648][ T4022] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2486.153894][ T4006] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2486.162569][ T4006] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2486.201051][T27292] hub 4-1:0.0: config failed, can't read hub descriptor (err -22) [ 2486.225054][T27292] usbhid 4-1:0.0: can't add hid device: -71 [ 2486.240992][T27292] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2486.382621][T27292] usb 4-1: USB disconnect, device number 2 [ 2486.844851][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2486.888140][T17172] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2487.554703][ T4026] Process accounting resumed [ 2487.751023][T14335] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2487.933142][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2488.064936][T17172] IPVS: starting estimator thread 0... [ 2488.128965][ T4044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2488.153322][ T4044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2488.199513][ T4040] IPVS: using max 54 ests per chain, 129600 per kthread [ 2488.927104][ T7586] Bluetooth: hci4: Frame reassembly failed (-84) [ 2488.934576][ T7586] Bluetooth: hci4: Frame reassembly failed (-84) [ 2489.032271][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2490.278366][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2490.286514][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2490.391147][ T30] audit: type=1800 audit(1765462727.923:1634): pid=4065 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.2.8350" name="bus" dev="ramfs" ino=182195 res=0 errno=0 [ 2490.487064][ T4463] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2491.084323][ T5833] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2491.084333][ T5819] Bluetooth: hci4: command 0x1003 tx timeout [ 2491.276760][ T5897] usb 10-1: new high-speed USB device number 60 using dummy_hcd [ 2491.331126][ T4044] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 2491.501466][ T5897] usb 10-1: Using ep0 maxpacket: 8 [ 2491.793453][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2491.814042][ T5897] usb 10-1: unable to get BOS descriptor or descriptor too short [ 2491.840709][ T5897] usb 10-1: config 12 has an invalid descriptor of length 0, skipping remainder of the config [ 2491.856620][ T5897] usb 10-1: config 12 interface 0 has no altsetting 0 [ 2491.870958][ T5897] usb 10-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 2492.058920][ T5897] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2492.126487][ T5897] usb 10-1: Product: syz [ 2492.144462][ T4082] Process accounting resumed [ 2492.178686][ T5897] usb 10-1: Manufacturer: syz [ 2492.185962][ T5897] usb 10-1: SerialNumber: syz [ 2492.924187][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2493.480819][T29616] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2493.565469][T27098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2493.677343][ T5897] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 2493.693149][ T5897] usb 10-1: selecting invalid altsetting 0 [ 2493.767676][ T5897] snd-usb-audio 10-1:12.0: probe with driver snd-usb-audio failed with error -2 [ 2493.789281][ T5897] usb 10-1: USB disconnect, device number 60 [ 2494.025100][ T6539] usb 9-1: new low-speed USB device number 120 using dummy_hcd [ 2494.078092][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2494.100574][T23856] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 2494.198276][ T6539] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 2494.206629][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2494.236096][ T6539] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2494.255557][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2494.280172][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2494.302275][T23856] usb 3-1: Using ep0 maxpacket: 16 [ 2494.316794][T23856] usb 3-1: config 0 has an invalid descriptor of length 170, skipping remainder of the config [ 2494.327973][T23856] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2494.339065][ T6539] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 2494.346506][T23856] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0x37, changing to 0x7 [ 2494.358811][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2494.369600][T23856] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has an invalid bInterval 240, changing to 11 [ 2494.380751][ T6539] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2494.404190][T23856] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid maxpacket 49986, setting to 1024 [ 2494.415479][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2494.447066][T23856] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2494.464949][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2494.482059][T23856] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 2494.497184][T23856] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 2494.515319][ T6539] usb 9-1: config 168 descriptor has 1 excess byte, ignoring [ 2494.523118][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 2494.569386][ T6539] usb 9-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2494.581140][T23856] usb 3-1: Manufacturer: syz [ 2494.586585][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2494.599029][T23856] usb 3-1: config 0 descriptor?? [ 2494.612903][ T6539] usb 9-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 2494.729803][ T5897] usb 10-1: new high-speed USB device number 61 using dummy_hcd [ 2494.744067][ T6539] usb 9-1: string descriptor 0 read error: -22 [ 2494.750370][ T6539] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 2494.766357][ T6539] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2494.830251][ T6539] adutux 9-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 2494.986578][T23856] rc_core: IR keymap rc-hauppauge not found [ 2494.992902][T23856] Registered IR keymap rc-empty [ 2495.378346][ T5897] usb 10-1: Using ep0 maxpacket: 16 [ 2495.385726][ T5897] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2495.396958][ T5897] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2495.414671][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2495.431978][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2495.447399][ T5897] usb 10-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 2495.457036][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2495.466434][ T5897] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2495.466741][T27292] usb 9-1: USB disconnect, device number 120 [ 2495.481521][T23856] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 2495.488252][ T5897] usb 10-1: config 0 descriptor?? [ 2495.694282][T23856] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input121 [ 2495.893005][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2495.939871][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2495.962991][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.001613][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.178048][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.300862][ T4148] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2496.310408][ T4148] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2496.354694][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.487296][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.515466][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.537195][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.548462][ T5897] HID 045e:07da: Invalid code 65791 type 1 [ 2496.559172][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2496.568897][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.590817][T23856] mceusb 3-1:0.0: Error: mce write urb status = -71 [ 2496.630616][T23856] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 90 [ 2496.647548][ T4463] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2496.990406][T17172] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2497.008758][ T5897] input: HID 045e:07da as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/0003:045E:07DA.0019/input/input122 [ 2497.020968][T23856] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 2497.024303][T23856] usb 3-1: USB disconnect, device number 29 [ 2497.053028][ T5897] microsoft 0003:045E:07DA.0019: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.9-1/input0 [ 2497.402522][ T48] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 2497.681847][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2497.682254][ T5833] Bluetooth: hci0: Ignoring HCI_Connection_Complete for existing connection [ 2497.813322][ T48] usb 4-1: config 0 has an invalid interface number: 141 but max is 0 [ 2497.824721][ T48] usb 4-1: config 0 has no interface number 0 [ 2497.837693][ T48] usb 4-1: New USB device found, idVendor=2001, idProduct=3c1e, bcdDevice=1f.d7 [ 2497.934288][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2497.946137][ T48] usb 4-1: Product: syz [ 2497.952302][ T48] usb 4-1: Manufacturer: syz [ 2497.960133][ T48] usb 4-1: SerialNumber: syz [ 2497.968621][ T48] usb 4-1: rejected 1 configuration due to insufficient available bus power [ 2497.982040][ T48] usb 4-1: no configuration chosen from 1 choice [ 2498.182810][ T2088] Bluetooth: hci2: command 0x0406 tx timeout [ 2498.515691][T17172] usb 10-1: USB disconnect, device number 61 [ 2498.674632][ T5897] usb 9-1: new high-speed USB device number 121 using dummy_hcd [ 2498.792799][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2499.037777][ T5897] usb 9-1: Using ep0 maxpacket: 8 [ 2499.044518][ T5897] usb 9-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2499.113344][ T5897] usb 9-1: config 0 interface 0 has no altsetting 0 [ 2499.120131][ T5897] usb 9-1: New USB device found, idVendor=1532, idProduct=011b, bcdDevice= 0.00 [ 2499.129485][ T5897] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2499.141235][ T5897] usb 9-1: config 0 descriptor?? [ 2499.437079][ T1098] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2499.591033][ T4189] netlink: 'syz.2.8382': attribute type 1 has an invalid length. [ 2499.627638][ T4189] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 2499.684666][ T5897] razer 0003:1532:011B.001A: hidraw0: USB HID vff.ff Device [HID 1532:011b] on usb-dummy_hcd.8-1/input0 [ 2499.703086][ T4189] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 2499.751148][ T4191] bond1: (slave bridge1): Enslaving as an active interface with a down link [ 2499.814491][ T4189] macvlan2: entered promiscuous mode [ 2499.829315][ T4189] macvlan2: entered allmulticast mode [ 2499.839964][ T4189] bond1: entered promiscuous mode [ 2499.848005][ T4189] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2499.857922][ T4189] bond1: left promiscuous mode [ 2499.894377][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2500.278442][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2500.422518][T32522] usb 4-1: USB disconnect, device number 3 [ 2501.145892][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2502.318260][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2502.801923][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2503.187036][T27292] usb 9-1: USB disconnect, device number 121 [ 2503.256973][ T4226] block nbd2: NBD_DISCONNECT [ 2503.277282][ T4226] block nbd2: Disconnected due to user request. [ 2503.312656][ T30] audit: type=1400 audit(1765462740.008:1635): avc: denied { bind } for pid=4229 comm="syz.8.8394" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2503.323807][ T4226] block nbd2: shutting down sockets [ 2503.428211][ T4232] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2504.377108][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2504.385277][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2504.693251][ T12] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2504.703617][T32754] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2504.726143][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2505.538688][ T5950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2505.734291][ T4249] Process accounting resumed [ 2505.949397][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2506.255521][ T4269] bond0: (slave gretap0): Error: Device type is different from other slaves [ 2507.591739][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2507.872694][ T4285] netlink: 12 bytes leftover after parsing attributes in process `syz.2.8409'. [ 2508.365911][ T4291] macvlan2: entered promiscuous mode [ 2508.394944][ T4291] macvlan2: entered allmulticast mode [ 2508.422117][ T4291] bond2: entered promiscuous mode [ 2508.497970][ T4291] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 2508.516385][ T4291] bond2: left promiscuous mode [ 2508.702791][ T48] net_ratelimit: 1 callbacks suppressed [ 2508.702810][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2508.959548][ T5950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2508.982295][ T4309] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 2509.822725][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2510.959550][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2511.290692][T32754] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2511.805059][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2512.038444][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2513.180436][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2513.774905][ T6539] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 2513.868413][ T30] audit: type=1326 audit(1765462749.886:1636): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4393 comm="syz.8.8432" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb389f8f749 code=0x0 [ 2514.058429][ T6539] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2514.068782][ T6539] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 2514.119940][ T6539] usb 4-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 2514.140682][ T6539] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2514.161665][ T6539] usb 4-1: config 0 descriptor?? [ 2514.264737][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2515.075604][ T4388] raw_sendmsg: syz.3.8430 forgot to set AF_INET. Fix it! [ 2515.087224][ T6539] Bluetooth: Can't get version to change to load ram patch err [ 2515.089384][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2515.095323][ T6539] Bluetooth: Loading patch file failed [ 2515.118712][ T5950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2515.135499][ T6539] ath3k 4-1:0.0: probe with driver ath3k failed with error -71 [ 2515.383812][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2515.551566][ T6539] usb 4-1: USB disconnect, device number 4 [ 2516.490364][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2517.608336][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2518.296016][ T5950] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2518.367214][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2518.886514][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2518.958574][T23856] usb 10-1: new high-speed USB device number 62 using dummy_hcd [ 2519.017276][ T4464] netlink: 48 bytes leftover after parsing attributes in process `syz.0.8444'. [ 2519.243344][T23856] usb 10-1: Using ep0 maxpacket: 16 [ 2519.267018][ T4467] overlay: filesystem on ./bus not supported [ 2519.274598][T23856] usb 10-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 2519.284414][T23856] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2519.303464][T23856] usb 10-1: Product: syz [ 2519.348158][T23856] usb 10-1: Manufacturer: syz [ 2519.394064][T23856] usb 10-1: SerialNumber: syz [ 2519.427783][T23856] usb 10-1: config 0 descriptor?? [ 2520.050052][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2521.204576][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2521.580940][ T30] audit: type=1400 audit(1765462757.098:1637): avc: denied { write } for pid=4443 comm="syz.9.8445" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 2521.617304][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2521.626443][ T4514] block nbd0: NBD_DISCONNECT [ 2521.631240][ T4514] block nbd0: Disconnected due to user request. [ 2521.638067][ T4514] block nbd0: shutting down sockets [ 2521.658301][T23856] ums-onetouch 10-1:0.0: USB Mass Storage device detected [ 2521.729444][T23856] usb 10-1: USB disconnect, device number 62 [ 2521.799728][ T4517] netlink: 'syz.2.8461': attribute type 4 has an invalid length. [ 2521.808273][ T4517] netlink: 17 bytes leftover after parsing attributes in process `syz.2.8461'. [ 2522.307513][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2523.548867][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2523.756553][ T3652] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2524.316163][T15659] Bluetooth: hci4: Frame reassembly failed (-84) [ 2524.703702][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2524.866892][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2525.807665][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2526.536866][ T2088] Bluetooth: hci4: command 0x1003 tx timeout [ 2526.537688][ T5819] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 2526.700611][ T5819] Bluetooth: hci3: Ignoring HCI_Connection_Complete for existing connection [ 2526.919433][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2527.009660][ T4618] netlink: 'syz.0.8485': attribute type 1 has an invalid length. [ 2527.042450][ T4618] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2527.075436][ T4618] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2527.090543][ T4618] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 2527.107840][ T4618] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 2527.192713][ T4622] veth3: entered promiscuous mode [ 2527.202462][ T4622] bond1: (slave veth3): Enslaving as an active interface with a down link [ 2527.246185][ T4618] netlink: 28 bytes leftover after parsing attributes in process `syz.0.8485'. [ 2527.495478][ T4636] kvm: apic: phys broadcast and lowest prio [ 2527.514045][ T4636] kvm: apic: phys broadcast and lowest prio [ 2527.713703][ T4647] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8496'. [ 2527.726727][ T4647] netlink: 40 bytes leftover after parsing attributes in process `syz.0.8496'. [ 2527.741847][ T5897] usb 10-1: new high-speed USB device number 63 using dummy_hcd [ 2527.839106][ T6539] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 2527.869002][ T4652] SELinux: Context : is not valid (left unmapped). [ 2527.886788][ T30] audit: type=1400 audit(1765462762.982:1638): avc: denied { relabelto } for pid=4642 comm="syz.2.8494" name="rdma.current" dev="tmpfs" ino=1701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=":" [ 2528.036831][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2528.109820][ T30] audit: type=1400 audit(1765462763.000:1639): avc: denied { associate } for pid=4642 comm="syz.2.8494" name="rdma.current" dev="tmpfs" ino=1701 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon=":" [ 2528.157650][T26394] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2528.172073][ T6539] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2528.200036][ T6539] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2c2e, bcdDevice= 0.00 [ 2528.223290][ T6539] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2528.244821][ T5897] usb 10-1: Using ep0 maxpacket: 16 [ 2528.252146][ T6539] usb 4-1: config 0 descriptor?? [ 2528.254062][ T5897] usb 10-1: New USB device found, idVendor=34ef, idProduct=202b, bcdDevice=36.09 [ 2528.276913][ T5897] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2528.298929][ T5897] usb 10-1: Product: syz [ 2528.303250][ T5897] usb 10-1: Manufacturer: syz [ 2528.307942][ T5897] usb 10-1: SerialNumber: syz [ 2528.452840][ T30] audit: type=1400 audit(1765462763.524:1640): avc: denied { read open } for pid=4665 comm="syz.8.8503" path="/" dev="configfs" ino=1127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 2528.494366][ T30] audit: type=1400 audit(1765462763.524:1641): avc: denied { watch } for pid=4665 comm="syz.8.8503" path="/" dev="configfs" ino=1127 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=dir permissive=1 [ 2528.600702][ T30] audit: type=1400 audit(1765462763.665:1642): avc: denied { unlink } for pid=30791 comm="syz-executor" name="rdma.current" dev="tmpfs" ino=1701 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon=":" [ 2528.710353][ T6539] lua 0003:1E7D:2C2E.001B: unbalanced collection at end of report description [ 2528.725930][ T6539] lua 0003:1E7D:2C2E.001B: parse failed [ 2528.731582][ T6539] lua 0003:1E7D:2C2E.001B: probe with driver lua failed with error -22 [ 2528.931663][ T5815] usb 9-1: new full-speed USB device number 122 using dummy_hcd [ 2528.967454][ T6539] usb 4-1: USB disconnect, device number 5 [ 2529.136231][ T5815] usb 9-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 2529.163630][ T5815] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2529.172224][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2529.231849][ T5815] usb 9-1: config 0 descriptor?? [ 2529.272727][ T5815] cp210x 9-1:0.0: cp210x converter detected [ 2529.311131][ T30] audit: type=1400 audit(1765462764.329:1643): avc: denied { call } for pid=4680 comm="syz.2.8509" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=binder permissive=1 [ 2529.485958][ T7507] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2529.704196][ T5815] usb 9-1: cp210x converter now attached to ttyUSB0 [ 2529.949685][ T5815] usb 9-1: USB disconnect, device number 122 [ 2530.020286][ T5815] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 2530.254776][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2530.264347][ T5815] cp210x 9-1:0.0: device disconnected [ 2530.529378][ T4714] SELinux: failed to load policy [ 2530.586420][ T5897] usb 10-1: USB disconnect, device number 63 [ 2531.012841][ T4741] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 2531.163198][ T4753] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2531.366632][ T6539] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2531.375081][ T5897] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2531.398157][ T4775] [ 2531.400520][ T4775] ===================================================== [ 2531.407445][ T4775] WARNING: SOFTIRQ-safe -> SOFTIRQ-unsafe lock order detected [ 2531.414903][ T4775] syzkaller #0 Tainted: G L [ 2531.420884][ T4775] ----------------------------------------------------- [ 2531.427807][ T4775] syz.3.8548/4775 [HC0[0]:SC0[0]:HE0:SE1] is trying to acquire: [ 2531.435420][ T4775] ffff88803aff4c90 (&new->fa_lock){....}-{3:3}, at: kill_fasync+0x138/0x510 [ 2531.444103][ T4775] [ 2531.444103][ T4775] and this task is already holding: [ 2531.451459][ T4775] ffff88803b9d8028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0x10e/0x9b0 [ 2531.461273][ T4775] which would create a new lock dependency: [ 2531.467137][ T4775] (&client->buffer_lock){..-.}-{3:3} -> (&new->fa_lock){....}-{3:3} [ 2531.475201][ T4775] [ 2531.475201][ T4775] but this new dependency connects a SOFTIRQ-irq-safe lock: [ 2531.484619][ T4775] (&client->buffer_lock){..-.}-{3:3} [ 2531.484636][ T4775] [ 2531.484636][ T4775] ... which became SOFTIRQ-irq-safe at: [ 2531.497645][ T4775] lock_acquire+0x179/0x330 [ 2531.502225][ T4775] _raw_spin_lock+0x2e/0x40 [ 2531.506808][ T4775] evdev_pass_values+0x10e/0x9b0 [ 2531.511812][ T4775] evdev_events+0x1bb/0x390 [ 2531.516377][ T4775] input_pass_values+0x74e/0x880 [ 2531.521377][ T4775] input_handle_event+0xb29/0x14d0 [ 2531.526549][ T4775] input_inject_event+0x1e8/0x3b0 [ 2531.531635][ T4775] led_set_brightness+0x217/0x290 [ 2531.536720][ T4775] led_trigger_event+0xda/0x270 [ 2531.541652][ T4775] kbd_bh+0x247/0x330 [ 2531.545692][ T4775] tasklet_action_common+0x254/0x3f0 [ 2531.551040][ T4775] handle_softirqs+0x219/0x950 [ 2531.555866][ T4775] run_ksoftirqd+0x3a/0x60 [ 2531.560348][ T4775] smpboot_thread_fn+0x3f7/0xae0 [ 2531.565351][ T4775] kthread+0x3c5/0x780 [ 2531.569508][ T4775] ret_from_fork+0x983/0xb10 [ 2531.574168][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2531.578992][ T4775] [ 2531.578992][ T4775] to a SOFTIRQ-irq-unsafe lock: [ 2531.585979][ T4775] (tasklist_lock){.+.+}-{3:3} [ 2531.585995][ T4775] [ 2531.585995][ T4775] ... which became SOFTIRQ-irq-unsafe at: [ 2531.598579][ T4775] ... [ 2531.598585][ T4775] lock_acquire+0x179/0x330 [ 2531.605708][ T4775] _raw_read_lock+0x5f/0x70 [ 2531.610309][ T4775] __do_wait+0x105/0x890 [ 2531.614639][ T4775] do_wait+0x21d/0x570 [ 2531.618801][ T4775] kernel_wait+0x9f/0x160 [ 2531.623201][ T4775] call_usermodehelper_exec_work+0xf1/0x170 [ 2531.629175][ T4775] process_one_work+0x9ba/0x1b20 [ 2531.634171][ T4775] worker_thread+0x6c8/0xf10 [ 2531.638825][ T4775] kthread+0x3c5/0x780 [ 2531.642959][ T4775] ret_from_fork+0x983/0xb10 [ 2531.647609][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2531.652436][ T4775] [ 2531.652436][ T4775] other info that might help us debug this: [ 2531.652436][ T4775] [ 2531.662634][ T4775] Chain exists of: [ 2531.662634][ T4775] &client->buffer_lock --> &new->fa_lock --> tasklist_lock [ 2531.662634][ T4775] [ 2531.675724][ T4775] Possible interrupt unsafe locking scenario: [ 2531.675724][ T4775] [ 2531.684018][ T4775] CPU0 CPU1 [ 2531.689367][ T4775] ---- ---- [ 2531.694702][ T4775] lock(tasklist_lock); [ 2531.698918][ T4775] local_irq_disable(); [ 2531.705662][ T4775] lock(&client->buffer_lock); [ 2531.713008][ T4775] lock(&new->fa_lock); [ 2531.719755][ T4775] [ 2531.723190][ T4775] lock(&client->buffer_lock); [ 2531.728191][ T4775] [ 2531.728191][ T4775] *** DEADLOCK *** [ 2531.728191][ T4775] [ 2531.736333][ T4775] 7 locks held by syz.3.8548/4775: [ 2531.741426][ T4775] #0: ffff888146bf2118 (&evdev->mutex){+.+.}-{4:4}, at: evdev_write+0x206/0x750 [ 2531.750547][ T4775] #1: ffff88801cb34230 (&dev->event_lock#2){..-.}-{3:3}, at: input_inject_event+0x9f/0x3b0 [ 2531.760629][ T4775] #2: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: input_inject_event+0xbb/0x3b0 [ 2531.770275][ T4775] #3: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: input_pass_values+0x80/0x880 [ 2531.779860][ T4775] #4: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: evdev_events+0x7b/0x390 [ 2531.788969][ T4775] #5: ffff88803b9d8028 (&client->buffer_lock){..-.}-{3:3}, at: evdev_pass_values+0x10e/0x9b0 [ 2531.799209][ T4775] #6: ffffffff8e3c9620 (rcu_read_lock){....}-{1:3}, at: kill_fasync+0x62/0x510 [ 2531.808234][ T4775] [ 2531.808234][ T4775] the dependencies between SOFTIRQ-irq-safe lock and the holding lock: [ 2531.818628][ T4775] -> (&client->buffer_lock){..-.}-{3:3} { [ 2531.824340][ T4775] IN-SOFTIRQ-W at: [ 2531.828306][ T4775] lock_acquire+0x179/0x330 [ 2531.834463][ T4775] _raw_spin_lock+0x2e/0x40 [ 2531.840615][ T4775] evdev_pass_values+0x10e/0x9b0 [ 2531.847186][ T4775] evdev_events+0x1bb/0x390 [ 2531.853320][ T4775] input_pass_values+0x74e/0x880 [ 2531.859888][ T4775] input_handle_event+0xb29/0x14d0 [ 2531.866629][ T4775] input_inject_event+0x1e8/0x3b0 [ 2531.873283][ T4775] led_set_brightness+0x217/0x290 [ 2531.879937][ T4775] led_trigger_event+0xda/0x270 [ 2531.886416][ T4775] kbd_bh+0x247/0x330 [ 2531.892022][ T4775] tasklet_action_common+0x254/0x3f0 [ 2531.898945][ T4775] handle_softirqs+0x219/0x950 [ 2531.905339][ T4775] run_ksoftirqd+0x3a/0x60 [ 2531.911402][ T4775] smpboot_thread_fn+0x3f7/0xae0 [ 2531.917965][ T4775] kthread+0x3c5/0x780 [ 2531.923663][ T4775] ret_from_fork+0x983/0xb10 [ 2531.929882][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2531.936277][ T4775] INITIAL USE at: [ 2531.940149][ T4775] lock_acquire+0x179/0x330 [ 2531.946196][ T4775] _raw_spin_lock+0x2e/0x40 [ 2531.952246][ T4775] evdev_pass_values+0x10e/0x9b0 [ 2531.958728][ T4775] evdev_events+0x1bb/0x390 [ 2531.964778][ T4775] input_pass_values+0x74e/0x880 [ 2531.971260][ T4775] input_handle_event+0xf00/0x14d0 [ 2531.977930][ T4775] input_event+0x8e/0xd0 [ 2531.983716][ T4775] rc_keydown+0x57/0x210 [ 2531.989501][ T4775] su3000_rc_query+0x1c5/0x200 [ 2531.995809][ T4775] dvb_usb_read_remote_control+0xdd/0x1c0 [ 2532.003081][ T4775] process_one_work+0x9ba/0x1b20 [ 2532.009565][ T4775] worker_thread+0x6c8/0xf10 [ 2532.015696][ T4775] kthread+0x3c5/0x780 [ 2532.021308][ T4775] ret_from_fork+0x983/0xb10 [ 2532.027437][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2532.033747][ T4775] } [ 2532.036222][ T4775] ... key at: [] __key.88+0x0/0x40 [ 2532.043395][ T4775] [ 2532.043395][ T4775] the dependencies between the lock to be acquired [ 2532.043401][ T4775] and SOFTIRQ-irq-unsafe lock: [ 2532.056863][ T4775] -> (tasklist_lock){.+.+}-{3:3} { [ 2532.062136][ T4775] HARDIRQ-ON-R at: [ 2532.066264][ T4775] lock_acquire+0x179/0x330 [ 2532.072750][ T4775] _raw_read_lock+0x5f/0x70 [ 2532.079233][ T4775] __do_wait+0x105/0x890 [ 2532.085449][ T4775] do_wait+0x21d/0x570 [ 2532.091494][ T4775] kernel_wait+0x9f/0x160 [ 2532.097798][ T4775] call_usermodehelper_exec_work+0xf1/0x170 [ 2532.105671][ T4775] process_one_work+0x9ba/0x1b20 [ 2532.112588][ T4775] worker_thread+0x6c8/0xf10 [ 2532.119154][ T4775] kthread+0x3c5/0x780 [ 2532.125198][ T4775] ret_from_fork+0x983/0xb10 [ 2532.131761][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2532.138505][ T4775] SOFTIRQ-ON-R at: [ 2532.142634][ T4775] lock_acquire+0x179/0x330 [ 2532.149112][ T4775] _raw_read_lock+0x5f/0x70 [ 2532.155596][ T4775] __do_wait+0x105/0x890 [ 2532.161826][ T4775] do_wait+0x21d/0x570 [ 2532.167872][ T4775] kernel_wait+0x9f/0x160 [ 2532.174176][ T4775] call_usermodehelper_exec_work+0xf1/0x170 [ 2532.182049][ T4775] process_one_work+0x9ba/0x1b20 [ 2532.188962][ T4775] worker_thread+0x6c8/0xf10 [ 2532.195546][ T4775] kthread+0x3c5/0x780 [ 2532.201593][ T4775] ret_from_fork+0x983/0xb10 [ 2532.208157][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2532.214900][ T4775] INITIAL USE at: [ 2532.218942][ T4775] lock_acquire+0x179/0x330 [ 2532.225348][ T4775] _raw_write_lock_irq+0x36/0x50 [ 2532.232179][ T4775] copy_process+0x4668/0x7430 [ 2532.238750][ T4775] kernel_clone+0xfc/0x910 [ 2532.245051][ T4775] user_mode_thread+0xc8/0x110 [ 2532.251715][ T4775] rest_init+0x23/0x2b0 [ 2532.257760][ T4775] start_kernel+0x3ef/0x4d0 [ 2532.264246][ T4775] x86_64_start_reservations+0x18/0x30 [ 2532.271593][ T4775] x86_64_start_kernel+0x130/0x190 [ 2532.278592][ T4775] common_startup_64+0x13e/0x148 [ 2532.285431][ T4775] INITIAL READ USE at: [ 2532.289910][ T4775] lock_acquire+0x179/0x330 [ 2532.296736][ T4775] _raw_read_lock+0x5f/0x70 [ 2532.303568][ T4775] __do_wait+0x105/0x890 [ 2532.310132][ T4775] do_wait+0x21d/0x570 [ 2532.316523][ T4775] kernel_wait+0x9f/0x160 [ 2532.323176][ T4775] call_usermodehelper_exec_work+0xf1/0x170 [ 2532.331394][ T4775] process_one_work+0x9ba/0x1b20 [ 2532.338657][ T4775] worker_thread+0x6c8/0xf10 [ 2532.345570][ T4775] kthread+0x3c5/0x780 [ 2532.351960][ T4775] ret_from_fork+0x983/0xb10 [ 2532.358885][ T4775] ret_from_fork_asm+0x1a/0x30 [ 2532.365989][ T4775] } [ 2532.368638][ T4775] ... key at: [] tasklist_lock+0x18/0x40 [ 2532.376509][ T4775] ... acquired at: [ 2532.380463][ T4775] _raw_read_lock+0x5f/0x70 [ 2532.385125][ T4775] send_sigurg+0xed/0xc80 [ 2532.389607][ T4775] sk_send_sigurg+0x76/0x360 [ 2532.394349][ T4775] unix_stream_sendmsg+0xfa3/0x1320 [ 2532.399715][ T4775] ____sys_sendmsg+0xa5d/0xc30 [ 2532.404630][ T4775] ___sys_sendmsg+0x134/0x1d0 [ 2532.409460][ T4775] __sys_sendmmsg+0x200/0x420 [ 2532.414292][ T4775] __x64_sys_sendmmsg+0x9c/0x100 [ 2532.419383][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.424036][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.430082][ T4775] [ 2532.432383][ T4775] -> (&f_owner->lock){....}-{3:3} { [ 2532.437656][ T4775] INITIAL USE at: [ 2532.441612][ T4775] lock_acquire+0x179/0x330 [ 2532.447847][ T4775] _raw_write_lock_irq+0x36/0x50 [ 2532.454504][ T4775] __f_setown+0x61/0x3c0 [ 2532.460458][ T4775] do_fcntl+0x1010/0x1660 [ 2532.466500][ T4775] __x64_sys_fcntl+0x163/0x200 [ 2532.472977][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.479194][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.486799][ T4775] INITIAL READ USE at: [ 2532.491193][ T4775] lock_acquire+0x179/0x330 [ 2532.497844][ T4775] _raw_read_lock_irqsave+0x74/0x90 [ 2532.505196][ T4775] send_sigurg+0x5f/0xc80 [ 2532.511673][ T4775] sk_send_sigurg+0x76/0x360 [ 2532.518415][ T4775] unix_stream_sendmsg+0xfa3/0x1320 [ 2532.525765][ T4775] ____sys_sendmsg+0xa5d/0xc30 [ 2532.532679][ T4775] ___sys_sendmsg+0x134/0x1d0 [ 2532.539506][ T4775] __sys_sendmmsg+0x200/0x420 [ 2532.546335][ T4775] __x64_sys_sendmmsg+0x9c/0x100 [ 2532.553429][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.560077][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.568115][ T4775] } [ 2532.570676][ T4775] ... key at: [] __key.1+0x0/0x40 [ 2532.577848][ T4775] ... acquired at: [ 2532.581713][ T4775] _raw_read_lock_irqsave+0x74/0x90 [ 2532.587067][ T4775] send_sigio+0x31/0x3e0 [ 2532.591461][ T4775] kill_fasync+0x214/0x510 [ 2532.596025][ T4775] sock_wake_async+0xf1/0x160 [ 2532.600860][ T4775] sk_send_sigurg+0x179/0x360 [ 2532.605688][ T4775] unix_stream_sendmsg+0xfa3/0x1320 [ 2532.611040][ T4775] ____sys_sendmsg+0xa5d/0xc30 [ 2532.615953][ T4775] ___sys_sendmsg+0x134/0x1d0 [ 2532.620782][ T4775] __sys_sendmmsg+0x200/0x420 [ 2532.625615][ T4775] __x64_sys_sendmmsg+0x9c/0x100 [ 2532.630710][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.635362][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.641402][ T4775] [ 2532.643721][ T4775] -> (&new->fa_lock){....}-{3:3} { [ 2532.648821][ T4775] INITIAL USE at: [ 2532.652687][ T4775] lock_acquire+0x179/0x330 [ 2532.658737][ T4775] _raw_write_lock_irq+0x36/0x50 [ 2532.665219][ T4775] fasync_remove_entry+0xb2/0x1e0 [ 2532.671782][ T4775] fasync_helper+0xaf/0xd0 [ 2532.677737][ T4775] sock_fasync+0x92/0x140 [ 2532.683605][ T4775] __fput+0x96b/0xb70 [ 2532.689124][ T4775] task_work_run+0x150/0x240 [ 2532.695256][ T4775] exit_to_user_mode_loop+0xfb/0x540 [ 2532.702085][ T4775] do_syscall_64+0x4ee/0xf80 [ 2532.708214][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.715650][ T4775] INITIAL READ USE at: [ 2532.719953][ T4775] lock_acquire+0x179/0x330 [ 2532.726432][ T4775] _raw_read_lock_irqsave+0x74/0x90 [ 2532.733611][ T4775] kill_fasync+0x138/0x510 [ 2532.740001][ T4775] sock_wake_async+0xf1/0x160 [ 2532.746660][ T4775] sk_send_sigurg+0x179/0x360 [ 2532.753315][ T4775] unix_stream_sendmsg+0xfa3/0x1320 [ 2532.760490][ T4775] ____sys_sendmsg+0xa5d/0xc30 [ 2532.767229][ T4775] ___sys_sendmsg+0x134/0x1d0 [ 2532.773884][ T4775] __sys_sendmmsg+0x200/0x420 [ 2532.780540][ T4775] __x64_sys_sendmmsg+0x9c/0x100 [ 2532.787462][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.793938][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.801804][ T4775] } [ 2532.804278][ T4775] ... key at: [] __key.0+0x0/0x40 [ 2532.811360][ T4775] ... acquired at: [ 2532.815137][ T4775] lock_acquire+0x179/0x330 [ 2532.819793][ T4775] _raw_read_lock_irqsave+0x74/0x90 [ 2532.825146][ T4775] kill_fasync+0x138/0x510 [ 2532.829712][ T4775] evdev_pass_values+0x619/0x9b0 [ 2532.834806][ T4775] evdev_events+0x1bb/0x390 [ 2532.839465][ T4775] input_pass_values+0x74e/0x880 [ 2532.844564][ T4775] input_handle_event+0xf00/0x14d0 [ 2532.849830][ T4775] input_inject_event+0x1e8/0x3b0 [ 2532.855009][ T4775] evdev_write+0x457/0x750 [ 2532.859579][ T4775] vfs_write+0x2a0/0x11d0 [ 2532.864061][ T4775] ksys_write+0x1f8/0x250 [ 2532.868544][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.873200][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.879242][ T4775] [ 2532.881541][ T4775] [ 2532.881541][ T4775] stack backtrace: [ 2532.887416][ T4775] CPU: 0 UID: 0 PID: 4775 Comm: syz.3.8548 Tainted: G L syzkaller #0 PREEMPT(full) [ 2532.887436][ T4775] Tainted: [L]=SOFTLOCKUP [ 2532.887441][ T4775] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2532.887450][ T4775] Call Trace: [ 2532.887455][ T4775] [ 2532.887460][ T4775] dump_stack_lvl+0x116/0x1f0 [ 2532.887475][ T4775] check_irq_usage+0x8e6/0xbc0 [ 2532.887488][ T4775] ? tracing_record_taskinfo_sched_switch+0x54/0x400 [ 2532.887508][ T4775] ? check_path.constprop.0+0x24/0x50 [ 2532.887523][ T4775] ? __lock_acquire+0x167f/0x2890 [ 2532.887537][ T4775] __lock_acquire+0x167f/0x2890 [ 2532.887558][ T4775] lock_acquire+0x179/0x330 [ 2532.887572][ T4775] ? kill_fasync+0x138/0x510 [ 2532.887587][ T4775] _raw_read_lock_irqsave+0x74/0x90 [ 2532.887607][ T4775] ? kill_fasync+0x138/0x510 [ 2532.887619][ T4775] kill_fasync+0x138/0x510 [ 2532.887632][ T4775] evdev_pass_values+0x619/0x9b0 [ 2532.887653][ T4775] evdev_events+0x1bb/0x390 [ 2532.887671][ T4775] input_pass_values+0x74e/0x880 [ 2532.887691][ T4775] input_handle_event+0xf00/0x14d0 [ 2532.887709][ T4775] ? _copy_from_user+0x59/0xd0 [ 2532.887726][ T4775] input_inject_event+0x1e8/0x3b0 [ 2532.887746][ T4775] evdev_write+0x457/0x750 [ 2532.887766][ T4775] ? __pfx_evdev_write+0x10/0x10 [ 2532.887785][ T4775] ? bpf_lsm_file_permission+0x9/0x10 [ 2532.887798][ T4775] ? security_file_permission+0x71/0x210 [ 2532.887814][ T4775] ? rw_verify_area+0xcf/0x6c0 [ 2532.887828][ T4775] ? __pfx_evdev_write+0x10/0x10 [ 2532.887846][ T4775] vfs_write+0x2a0/0x11d0 [ 2532.887863][ T4775] ? __pfx_vfs_write+0x10/0x10 [ 2532.887877][ T4775] ? find_held_lock+0x2b/0x80 [ 2532.887896][ T4775] ? __fget_files+0x204/0x3c0 [ 2532.887914][ T4775] ? __fget_files+0x20e/0x3c0 [ 2532.887933][ T4775] ksys_write+0x1f8/0x250 [ 2532.887947][ T4775] ? __pfx_ksys_write+0x10/0x10 [ 2532.887965][ T4775] do_syscall_64+0xcd/0xf80 [ 2532.887978][ T4775] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2532.887990][ T4775] RIP: 0033:0x7f196458f749 [ 2532.888003][ T4775] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2532.888016][ T4775] RSP: 002b:00007f19653b5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 2532.888030][ T4775] RAX: ffffffffffffffda RBX: 00007f19647e5fa0 RCX: 00007f196458f749 [ 2532.888039][ T4775] RDX: 0000000000000037 RSI: 0000200000000040 RDI: 0000000000000004 [ 2532.888047][ T4775] RBP: 00007f1964613f91 R08: 0000000000000000 R09: 0000000000000000 [ 2532.888055][ T4775] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2532.888063][ T4775] R13: 00007f19647e6038 R14: 00007f19647e5fa0 R15: 00007fffa39580e8 [ 2532.888076][ T4775] [ 2533.152636][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2534.276543][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2534.282845][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2534.290131][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2534.616509][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2535.388130][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2535.655411][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2536.501089][ T48] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2537.612652][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2537.866573][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2538.732819][T27292] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2539.749451][ T7586] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2539.834064][T23856] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2540.956333][ T5815] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 2541.116458][T32522] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog