last executing test programs: 33m42.482072603s ago: executing program 32 (id=178): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000feffff10850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = creat(&(0x7f00000001c0)='./file0\x00', 0x0) write(r3, &(0x7f0000000300)='(', 0x1) write$uinput_user_dev(r3, &(0x7f0000000400)={'syz0\x00', {0x7, 0x4, 0x6, 0xfffa}, 0x1d, [0x6, 0xc95a, 0xfffffff3, 0x9, 0x80, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0xffffffee, 0x5f, 0xa, 0x3, 0xffff2d37, 0x1dd2, 0x6, 0x7, 0x0, 0x80000001, 0x4, 0x7, 0x3, 0x3c5b, 0x1, 0x24, 0xffffffff, 0x1, 0x1f461e2c, 0x2, 0xe661, 0x4, 0x7, 0x3, 0x7fff, 0x4c74, 0x8f00, 0x642, 0x3, 0xa, 0x0, 0x71, 0x7, 0x7, 0x103, 0x0, 0x5, 0x3c, 0x8f, 0x6, 0x6, 0x3, 0x5, 0x4, 0x8, 0x0, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0xffff, 0x12f, 0x8000, 0x10, 0xfffffff3, 0x129432e6, 0xcb, 0xf9, 0xd, 0x2bf, 0x6c9, 0x9, 0xfffffffc, 0x3, 0x0, 0x7, 0x5, 0x2f, 0xcbc1, 0x312, 0x78, 0xea4, 0xa, 0x4, 0x4, 0x8000, 0x9, 0x400, 0x3, 0x6, 0x1, 0xff, 0x1005, 0x7ff, 0x5f31, 0x4, 0x0, 0x6, 0x2, 0x9, 0x4, 0x9, 0x8, 0x9, 0x6, 0x5, 0x0, 0x1, 0x8000, 0xffff, 0x2, 0x7f, 0x9, 0x5, 0x3, 0x4, 0x1, 0x7, 0x6, 0x9, 0x48c93690, 0x2, 0xff], [0x7, 0x4, 0x0, 0x64e, 0xfffffdfe, 0x7fffffff, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x20000b, 0x4, 0x5, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x86, 0x3, 0x10000009, 0x3e7, 0x2, 0x5, 0x2, 0x2, 0xf, 0x8, 0x4, 0x6d01, 0x5, 0x3b, 0x3, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x0, 0xa2, 0x7, 0x6, 0x5, 0x6, 0x54fe12d2, 0xbf, 0x5, 0x3, 0x400000, 0xfffffff9, 0x0, 0x1, 0x5, 0x0, 0x6, 0x0, 0x120000, 0x3, 0x6, 0xc, 0x4, 0x3], [0x9, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x2005, 0xce7, 0x1ff, 0x6, 0x7, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7fff, 0xffff, 0xa620, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0xc8, 0x3, 0x9, 0xffff, 0x3, 0x9, 0x100, 0x9602, 0xa, 0x2, 0x4, 0x6, 0x1, 0x10000, 0x5, 0x8, 0x2b91, 0xa1f, 0x8, 0x9, 0x1, 0x6c1b, 0x0, 0x4, 0x0, 0xb1c, 0x1, 0x200, 0xffff3441, 0xfff]}, 0x45c) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000012c0)={r2, 0x0, 0x30, 0xe1515f8735398fb, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000002c0)=[0x45c], 0x0, 0x0, 0x1, 0x1}}, 0x3c) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x40000, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24}, 0x24}}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x34, 0x24, 0xf0b, 0x4, 0x25dfdbfe, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000800)=@newtfilter={0x48, 0x2c, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {}, {0x9}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_IPV6_DST={0x14, 0x10, @loopback}]}}]}, 0x48}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r6, &(0x7f00000002c0), 0x40000000000009f, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) getsockopt$sock_cred(r7, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) lstat(&(0x7f0000000180)='./file0\x00', &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0}) setresuid(r8, 0x0, r9) close_range(r0, 0xffffffffffffffff, 0x0) 33m35.836591618s ago: executing program 33 (id=191): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000000)={@local, @random="86082b9827c1", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "004001", 0x3c, 0x3a, 0x0, @private2, @mcast2, {[], @param_prob={0x4, 0x0, 0x0, 0x0, {0x0, 0x6, "974367", 0x0, 0x21, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, [], "e4073d2d9d9074f6738f6fe9"}}}}}}}, 0x0) dup3(r1, r0, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r2, &(0x7f0000000900)={&(0x7f00000000c0)={0xa, 0x4e24, 0x0, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=[@rthdr_2292={{0x28, 0x29, 0x5, {0x0, 0x2, 0x2, 0x9, 0x0, [@empty]}}}], 0x28}, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f0000000540)=[@transaction_sg={0x40486311, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60, 0x18, &(0x7f0000000240)={@fd={0x66642a85, 0x0, r2}, @fda={0x66646185, 0x6, 0x2, 0x4}, @ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/199, 0xc7, 0x1, 0xb}}, &(0x7f0000000140)={0x0, 0x18, 0x38}}, 0x400}], 0x0, 0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$EVIOCSKEYCODE_V2(0xffffffffffffffff, 0x40284504, &(0x7f0000000000)={0x7, 0xf, 0x9, 0x9, "4ff16929eeefd5ad06861377209e6b8b41abc722cc4380ea68155bfc59e4ead2"}) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000200700000000000000f4000000"]) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) getsockopt$inet6_mptcp_buf(r5, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYRESHEX=r1], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x48}}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="280500003d006888b8ab4e0701040000000c00018006000600800a0000", @ANYRES8=r4, @ANYRES16=r0, @ANYRES8], 0x528}}, 0xc880) 33m31.976409277s ago: executing program 34 (id=205): r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000100)={0x4e, 0x1, 0x3, "3ad38e26d209a50a00b50b09078e2303506c00000e0000001000"}) 30m46.88761709s ago: executing program 35 (id=619): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) r1 = socket$pppl2tp(0x18, 0x1, 0x1) sendmmsg$inet(r1, &(0x7f0000005f80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x8040) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r0, 0x4, 0x4002) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000500000000000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRES32=0x0, @ANYRES32], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000014c0)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x1d0, 0x0, 0x0, 0x0, 0x50, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x22, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r4}, &(0x7f0000000800), &(0x7f0000000840)=r5}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x19, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r6}, 0x10) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x803, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r7 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(0x0, 0xfffffef7, &(0x7f0000000740)=0x410000002) socket$can_raw(0x1d, 0x3, 0x1) syz_emit_ethernet(0x9e, &(0x7f0000000480)=ANY=[@ANYBLOB="aaaaaaaaaaaa000079b3fc151b5fb968843500680600fe8000000000000001000000000000bbfe8000080000000000000000000000aa00000000b41a5c7bae53371c4477060d226dc0c8f97fdbdd19bdb4674a18cb255a667599a7cdff0dd1684e449027abf8924d35d96e9538133661ae184445e7c94d69c910ff118962684ee15e42374b10ef11f9e19acaa2d835561c453376d90f7686747c588687064c3ba5a117a2ad1b806fc5ec56a93f838b039e38529fe5e49b5e11", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0) 28m38.46975143s ago: executing program 36 (id=965): sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6(0xa, 0x3, 0x8000000003c) set_mempolicy(0x3, &(0x7f0000000040)=0x3, 0x6) openat$udambuf(0xffffffffffffff9c, 0x0, 0x2) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000fa47ee2b528f5", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$TOKEN_CREATE(0x24, &(0x7f0000000200)={0x0, r2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x8, 0x24, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0xf}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x2, 0x3, 0xa, 0x9, 0xfe00}, {0x5, 0x0, 0xb, 0xa, 0x0, 0x2}, {0x3, 0x0, 0x3, 0xa, 0x9, 0xfff8}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0xfffffdff}, {}, {}, {0x7, 0x0, 0xc}, {0x18, 0x2, 0x2, 0x0, r2}, {0x6, 0x0, 0xb, 0x9, 0x0, 0x3}, {0x46, 0x8, 0xfff0, 0x76}}, @printk={@u, {0x3, 0x3, 0x3, 0x4, 0x9}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xfffffffe}}], {{0x7, 0x1, 0x7, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000980)='GPL\x00', 0xfffffffe, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, @void, @value}, 0x94) syz_clone3(&(0x7f0000000340)={0x80, 0x0, 0x0, 0x0, {0x15}, 0x0, 0x0, 0x0, 0x0}, 0x58) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x4, &(0x7f0000000040)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x25}], {0x95, 0x0, 0x700}}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) sendmsg$rds(0xffffffffffffffff, &(0x7f0000005c80)={&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, 0x0}, 0x4000000) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vxcan1\x00', 0x0}) connect$can_j1939(r4, &(0x7f0000000280)={0x1d, r5}, 0x18) sendmmsg(r4, &(0x7f0000000400)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000000)={@local, @empty, @val, {@ipv6={0x86dd, @gre_packet={0x0, 0x6, "5f1060", 0x24, 0x2f, 0x0, @private0, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x1, 0x8100}, {0x0, 0x0, 0x0, 0x0, 0x100}, {}, {0x8, 0x88be, 0x86ddffff}}}}}}}, 0x0) syz_extract_tcp_res(&(0x7f00000000c0), 0x8, 0xc5d) connect$inet6(r0, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x19}, 0x5}, 0x1c) r6 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$IP6T_SO_SET_REPLACE(r6, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0={0xfc, 0x0, '\x00', 0x1}, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@uncond, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x2, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x8, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmsg(r0, &(0x7f00000000c0)={0x0, 0x9511, &(0x7f0000000100)=[{&(0x7f0000000000)="2c10", 0x578}], 0x1, 0x0, 0x0, 0x2c}, 0x44004) 25m29.641836896s ago: executing program 37 (id=1435): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2000, 0x0) ioctl$KVM_CHECK_EXTENSION(r0, 0xae03, 0x2d) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f0000032680)=""/102392, 0x18ff8) timer_create(0x0, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400)=0x0) timer_delete(r3) timer_settime(r3, 0x1, &(0x7f0000000000)={{0x0, 0x989680}, {0x0, 0x989680}}, &(0x7f0000000040)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="2c000000070a0101"], 0x2c}, 0x1, 0x0, 0x0, 0x8800}, 0x0) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000140)={0x6}, 0x10) write(r5, &(0x7f0000000000)="1c0000001a005f0214f9f407000904001f000000ff02000200000000", 0x1c) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000240)=ANY=[], 0x1b0) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4) 22m54.092589605s ago: executing program 38 (id=1891): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000100)={0x1b, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ppoll(&(0x7f0000000180)=[{r1, 0x8049}, {r1, 0x6506}], 0x2, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, 0x0, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r0, 0x8008f513, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$inet6(0xa, 0x80002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmmsg$inet6(r2, 0x0, 0x0, 0x4000000) ioctl$VT_RESIZE(r0, 0x5609, 0x0) 22m48.684010291s ago: executing program 39 (id=1902): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) getrlimit(0xd, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x20, 0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000100)='.\x00', &(0x7f0000000200), 0x0, &(0x7f0000000280)) 20m47.601396667s ago: executing program 40 (id=2230): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) removexattr(0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x9b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000bc0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@broadcast, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x800}}, 0xb8}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@broadcast, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x2}}}, 0xb8}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=@getnexthop={0x18, 0x6a, 0x501, 0xfffffdfe, 0x25dfdbff}, 0x18}, 0x1, 0x0, 0x0, 0x40}, 0x20008000) r2 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r2, 0xc0505510, &(0x7f0000000300)={0x9, 0x1, 0x40096, 0xe6, &(0x7f0000000440)=[{}]}) r3 = socket$nl_route(0x10, 0x3, 0x0) keyctl$clear(0x3, 0xfffffffffffffffd) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000240)={0x1d, r4, 0x2, {0x0, 0x0, 0x2}}, 0x18) 19m0.294915277s ago: executing program 41 (id=2411): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a300000000058000000030a01040000000000000000010000000900030073797a300000000028000480080002400000000008000140000000051400030076657468315f746f5f626174616476000900010073797a30"], 0xa0}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) timer_create(0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x5, 0x1000087}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000940)={0x60, 0x20, 0x0, 0x0, 0x0, 0x10000000}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x2}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x5, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000f140000000000000000000000700000000000000c3e0ff000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0xfa, &(0x7f0000000140)=""/250, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100, @void, @value}, 0x94) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="9feb01001800000000000000240000002400000004000000000000000000000203000000020000000000000700000000000000000000000202000000000051"], 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r4 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000200)={@local, @random, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x0, @dev, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@lsrr={0x83, 0x3, 0xdf}, @timestamp={0x44, 0xc, 0x5, 0x3, 0x0, [0x6, 0x0]}, @cipso={0x86, 0x6}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) 18m0.914162448s ago: executing program 42 (id=2511): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000700)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a300000000058000000030a01040000000000000000010000000900030073797a300000000028000480080002400000000008000140000000051400030076657468315f746f5f626174616476000900010073797a30"], 0xa0}, 0x1, 0x0, 0x0, 0x10}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) timer_create(0x3, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x5, 0x1000087}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r1 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r1, 0x4601, &(0x7f0000000940)={0x60, 0x20, 0x0, 0x0, 0x0, 0x10000000}) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, 0x0, 0x0) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@dev, 0x0, 0x2}, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x5, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="18000000f140000000000000000000000700000000000000c3e0ff000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x8, 0xfa, &(0x7f0000000140)=""/250, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100, @void, @value}, 0x94) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="f80d00000000000000ff7f00000000000c"], 0x1c}}, 0x0) ioctl$FS_IOC_GETFSLABEL(r3, 0x400452c8, &(0x7f0000000100)) 16m20.147159798s ago: executing program 43 (id=2710): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) landlock_restrict_self(0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x80082) r2 = fcntl$dupfd(r1, 0x0, r1) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000080)=""/38) r3 = shmget$private(0x0, 0x3000, 0x386, &(0x7f0000ffa000/0x3000)=nil) shmctl$IPC_SET(r3, 0x1, &(0x7f0000000000)={{0x0, 0x0, 0x0, 0x0, 0x140}, 0x0, 0x0, 0x0, 0xffffffffffffffff}) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000100)=""/74) write$sndseq(r2, 0x0, 0x0) ioctl$IMGETVERSION(r2, 0x80044942, &(0x7f0000000000)) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x58, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8001}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040000}, 0x4c8c5) ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000340)={0x400, 0x640, 0x356, 0x480, 0x4, 0x1, 0x0, 0x0, {0x7, 0x80000000, 0x1}, {0xfffffff8, 0x200, 0x1}, {0x2d07, 0x5fffffff}, {0x0, 0x6, 0x1}, 0x3, 0x1b38417489379c1a, 0x7f, 0x2, 0x0, 0x5, 0x4d, 0x101, 0x200009, 0x9, 0xf3e8, 0x0, 0x4, 0x302, 0x1, 0x7}) 15m3.976936101s ago: executing program 44 (id=2899): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x1) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) io_submit(0x0, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x0, 0x80082) r2 = fcntl$dupfd(r1, 0x0, r1) semctl$GETALL(0x0, 0x0, 0xd, &(0x7f0000000080)=""/38) r3 = shmget$private(0x0, 0x3000, 0x386, &(0x7f0000ffa000/0x3000)=nil) shmctl$IPC_SET(r3, 0x1, &(0x7f0000000000)={{0x0, 0x0, 0x0, 0x0, 0x140}, 0x0, 0x0, 0x0, 0xffffffffffffffff}) shmctl$IPC_INFO(r3, 0x3, &(0x7f0000000100)=""/74) write$sndseq(r2, 0x0, 0x0) ioctl$IMGETVERSION(r2, 0x80044942, &(0x7f0000000000)) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000400)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x58, 0x0, 0x1, 0x70bd27, 0x25dfdbff, {}, [@TIPC_NLA_LINK={0x24, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}]}]}, @TIPC_NLA_PUBL={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8}]}, @TIPC_NLA_MON={0xc, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8001}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x4040000}, 0x4c8c5) ioctl$FBIOPAN_DISPLAY(0xffffffffffffffff, 0x4606, &(0x7f0000000340)={0x400, 0x640, 0x356, 0x480, 0x4, 0x1, 0x0, 0x0, {0x7, 0x80000000, 0x1}, {0xfffffff8, 0x200, 0x1}, {0x2d07, 0x5fffffff}, {0x0, 0x6, 0x1}, 0x3, 0x1b38417489379c1a, 0x7f, 0x2, 0x0, 0x5, 0x4d, 0x101, 0x200009, 0x9, 0xf3e8, 0x0, 0x4, 0x302, 0x1, 0x7}) 14m6.949516052s ago: executing program 45 (id=3042): syz_emit_ethernet(0x2a, &(0x7f00000002c0)=ANY=[@ANYBLOB="ffffffffffffaaaaaaaaaabb0806000608000604"], 0x0) r0 = io_uring_setup(0x1694, &(0x7f0000000080)) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mremap(&(0x7f00003eb000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000003000/0x1000)=nil) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x0, 0x0, 0x0, 0x2) r1 = socket(0x40000000015, 0x5, 0x0) connect$inet(r1, &(0x7f0000000240)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000e80)="632a1eb3f0c0d7e1f3e8d83e8279b7e98f2a563510c1fcfd07c0d1e58d723f809bb0322337f15e8d329d0926517a3148030a1d29dd671ac729d9cef6e520827a2201ccd77c7dc703e9116d512859f12dceb0dad478a2369aba7403b262e45c11c1290b59d473d3beb8d3a31bc7f5dcd1a708ed0be6f4770112b98b16c93db109594b2a4b04efb89f5ef215ff6d9d93fb8edbcf8d1c62b39759c68e1a184914791d5462c363b80e38ea6cd8556c46c6252445e967b63edceb1040badab4eef2ef162c734cb8052dabd2bfedbdfd0b22bdc6b9dc0fca9b566b32c4dc85d26161877f60652000000031ae091ccaa53c0faf409dee0d109e684a93bc32e715052d24d7349df7bdaa7aea658d7b0a53376ca1c71ad1a878ceacf5ce8a8c64ace50f4d18f1027b9efc61a4b4a61e4b323fad5c47e4341c1292d0d1c1e15582399572a3f2983e1a15eb78767b87da6d3da400d215326419919de0df00007736000000000000000000edd0c789d37a7dcf3f5b8c9aa5329c38e2ed4c0fe3a0eae2a169c0322b4e5b96dd251a4477da4961b81a965463617e444bfac080d03ac4fbf2d0c40e22aed01bea5ce1b4ca5e0b249366f1b777a13fcfad3d0a047371d2169230d0d0597e10f58c8e2b20cf205740044c15fab6d52121b0a6b2c122096848d4e29e968e20c1615b1e11c61d8e0c58fe667224e89b83ef29e04c0c6fdf73c50bf051d8651613e5bf65f9e91a91f5ce1080bcbad3aa36f82e9d367cb537444e25cdc8c21b60216d540ac605f39e02950b5af27d81a80cddc1a96754465fe43887165f7dc70939eefaf15dce85857c9329b2bbdcf10f5c85f110a42bcc3489b45f3ffd8a8fadf90cf9a6e35674a89b740ddc", 0x26f}, {&(0x7f0000000580)="1eac4d20f8509e8f36d2842c8fae7bbe58c5bf73985d5106bf5b5e7e5761716e35b468ea79633c916c4a8026f9408d0558de77df67c0e6fd0b1b3da5de5d003382ac95eade5dadad870ce3749452d2c1c3651ffff244be3078fdbfeb97d093bbbe0131e733d91c4ad38e7b52aa7afa9cb8e2351bd3f8a7a2a0425b071f6790992b8c2a51d964b0161c1856697820eb52f55c97fcdc19c2ef7c66ccc23c77a28a34b216c429444343ea056f171399dc03d56a1131ba74d31fc1012d3deff0e43309fc9e3b88bec90a7680aa74ccd581e02eb436a0009fa62097513d0c9533256d81978fae39288edcb833739d2988ccf5a564bc00edd1ab0853b873cbab3ef227f11325d72dbe2f435351610d09d0f74e180df6eaa94651336e7713414e49956fcb68a973e8239e343684255efba0d1b149b22c2d81f1ac5eaccaab01ab108178e97eb8a45d5d6cdeca0d6b9af9f88cfee58935be6902ac7c6915d60548367d164990b142d472b9b5700191b1f978fbe071de646385dcf5cb7adf1ec70baef4061d2da93d2f5eef8b1081374d58ab54532755c1b8bf303584296145e9aad2e3ccef93f30da9c109db5cfe346baba2fd3f157cb6e825e607365ff8c6187e216dc4072e582874ce63166405e21644015f99d5713165a377bfdc3143928e8469b4e312ce1f9dff83fe7c8d9fca791af2b46f1650e3937c9ab58978eb8b269ba2ef764d4505ed495fe156f0dcbb79d177e4f0b476", 0x212}], 0x2, 0x0, 0x0, 0x4090}, 0x0) sendmsg$alg(r1, &(0x7f0000000480)={0x0, 0x0, 0x0}, 0x0) read$alg(r1, &(0x7f0000004700)=""/4098, 0x1002) setsockopt$TIPC_GROUP_JOIN(r1, 0x10f, 0x87, &(0x7f0000000040)={0x41, 0x3, 0x3}, 0x10) ioctl$UI_SET_EVBIT(0xffffffffffffffff, 0x40045564, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r2, &(0x7f000003f300)=""/102400, 0x19000) sendmsg$NL80211_CMD_SET_STATION(0xffffffffffffffff, 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x84, 0x0, 0xffffffffffffffff, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b70300000000010a850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) statx(0xffffffffffffffff, 0x0, 0x1000, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f00004d9000/0x4000)=nil, 0x4000, 0x0, 0x11, r2, 0x379fe000) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x4, 0x0) 13m40.995617754s ago: executing program 46 (id=3140): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_FRAGMENT_INTERLEAVE(r0, 0x84, 0x12, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000640)={'wlan0\x00'}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, 0x0}, 0x20000044) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000140)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) syz_open_dev$ptys(0xc, 0x3, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000000c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x7, 0x0, 0x0, 0x3e, 0x11, 0x1}) io_uring_enter(0xffffffffffffffff, 0x47f6, 0x0, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000440)=0x8, 0x4) sendto$inet6(r0, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000004c0)="cc120d", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000b80)="bda033176eb146b36ef41f221a4e7ce4a02598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4d9f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720bf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e923a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d219206ddc35099101533cff5aee6c4783e00e6dd391f664052a6c66c62f62a49fde8fbe336543bf99b55e53b801e54c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14f03e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b019144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beacb8bc15f50c2663d684d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f93076aea55ed9cf12512ce3ac3df331695024bd1e53369a87caf6894fce811a64dad315402678de76", 0x390}, {&(0x7f0000000300)="439e9c06fc666cabc8569d63a866b31ff3ceda1e28f23f455e96a02001fc3fb089ed9e5234", 0x25}], 0x2}}], 0x2, 0x4048884) 12m27.735779591s ago: executing program 47 (id=3266): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) getdents64(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0xfffffe11, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000640)=""/102400, 0x19000) semget$private(0x0, 0x6, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r0, 0xc0182101, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000003c0)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r0, 0x40182103, &(0x7f0000000240)={r2, 0x0, r0}) 11m46.508313428s ago: executing program 1 (id=3405): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="83"], 0x4) r1 = socket(0x1, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fe050000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sched_switch\x00', r5, 0x0, 0x3}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xfffffecc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f0000000340)=ANY=[@ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="2c76657273696f6e3d39703230300000752c636163680f69e0d63d47504c00"]) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x5, 0x1, 0x0, @dev, @local, 0x700, 0x0, 0x3}}) 11m43.748906376s ago: executing program 1 (id=3410): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f00000053c0)=ANY=[@ANYBLOB="1800000000000000000000000000000495"], &(0x7f0000000200)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x0, 0x0) pread64(r5, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@bloom_filter={0x1e, 0x6, 0x8, 0x2, 0x20, r0, 0x726e, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0x8, @void, @value, @void, @value}, 0x48) read$alg(0xffffffffffffffff, &(0x7f00000001c0)=""/68, 0x44) r6 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'veth0_vlan\x00', &(0x7f0000000040)=@ethtool_ts_info={0x26}}) 11m38.459302086s ago: executing program 1 (id=3415): socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x1, 0x0) r4 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r4, 0x0) openat$dir(0xffffffffffffff9c, 0x0, 0x1, 0x0) truncate(&(0x7f0000000240)='./file0\x00', 0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x7f}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) ioctl$SNDRV_TIMER_IOCTL_SELECT(r6, 0x40345410, &(0x7f0000000140)={{0x0, 0x0, 0xfff, 0x1, 0x4}}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r5}, 0x10) 11m31.542818579s ago: executing program 7 (id=3437): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x28000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001140)={'batadv_slave_0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f00000011c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000001200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xe6, &(0x7f0000001240)=[{}], 0x8, 0x10, &(0x7f0000001280), &(0x7f00000012c0), 0x8, 0xbf, 0x8, 0x8, &(0x7f0000001300)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001500)={'ip6tnl0\x00', &(0x7f0000001480)={'ip6gre0\x00', 0x0, 0x2, 0x7, 0x0, 0xbd, 0x1b, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @remote, 0x8, 0x40, 0x4, 0x101}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000a80)=ANY=[@ANYBLOB="440000001800010000000000000000000a00000000000000000000001800160014000100040000000000000000001000fc00000008000400", @ANYRES32=r5, @ANYBLOB="060052fa08001177578d0901"], 0x44}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001540)={'wg0\x00'}) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'batadv_slave_1\x00'}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="84000000", @ANYRES16, @ANYBLOB="37040000000000000000010000006800088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392208000100", @ANYRES32=r9], 0x84}}, 0x0) 11m30.61618609s ago: executing program 1 (id=3440): r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@getchain={0x24, 0x66, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x8ec1fb72cf40ceac}, {}, {0x0, 0x3}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000700)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newlink={0x38, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r2}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x8, 0x2, 0x0, 0x1, [@IFLA_IPTUN_COLLECT_METADATA={0x4}]}}}]}, 0x38}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x4220}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_IPTUN_ENCAP_TYPE={0x6, 0xf, 0x7665823e4e1af2ee}]}}}]}, 0x3c}}, 0x20004090) 11m30.438311707s ago: executing program 1 (id=3442): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000400), 0x0, &(0x7f0000003880)=ANY=[@ANYBLOB='huge=always']) chdir(&(0x7f0000000140)='./file0\x00') r1 = creat(&(0x7f0000000000)='./bus\x00', 0x0) ftruncate(r1, 0x8208200) r2 = open(&(0x7f0000000780)='./bus\x00', 0x14117e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600402, 0x7ffffe, 0x4002011, r2, 0x0) truncate(&(0x7f0000000080)='./bus\x00', 0x4) arch_prctl$ARCH_SET_CPUID(0x1012, 0x0) shutdown(r0, 0x1) io_setup(0x401, &(0x7f00000004c0)=0x0) r4 = timerfd_create(0x0, 0x0) io_submit(r3, 0x1, &(0x7f0000000240)=[&(0x7f0000000580)={0x0, 0x0, 0x58, 0x1, 0x0, r4, 0x0}]) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={0xffffffffffffffff, 0xe0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x6, &(0x7f0000000040)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbc, &(0x7f0000000180)=[{}, {}, {}, {}, {}, {}, {}, {}, {}, {}], 0x50, 0x10, &(0x7f0000000200), &(0x7f0000000240), 0x8, 0xa4, 0x8, 0x8, &(0x7f0000000280)}}, 0x10) ioctl$sock_inet6_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000400)={@empty, @ipv4={'\x00', '\xff\xff', @local}, @mcast1, 0x200, 0x3, 0x4, 0x400, 0x10, 0x90, r5}) r6 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0xf, 0x8, &(0x7f0000000040)=@framed={{0x18, 0x6, 0x0, 0x0, 0x2}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}, {}, {0x85, 0x0, 0x0, 0xbb}}]}, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_device=0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x1f, &(0x7f0000000080)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}}, 0x90) 11m30.272474783s ago: executing program 7 (id=3443): openat$adsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$netlink(r0, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000001f00)}, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) syz_open_dev$dri(0x0, 0x1, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000400)=ANY=[@ANYRES32=0x0, @ANYBLOB="00000000000000000000000c00000000207dcb6b3c87d72240192cbf1b7bc0ae8d7eda40f8d334a79650d546155441399eb0498a7d69d80760", @ANYRES32=0x0, @ANYRES32=0x0], 0x48) prlimit64(0x0, 0xe, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB="1e000000ff0300030008000000000000602003000a405c09557d388c44abd3fbd12abf7db71ea6f4e09551a458813a5fa56fe8d237d710ba9f85599663310df2a9", @ANYRES32, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0100000002000000040000000200"/24, @ANYRES32, @ANYBLOB], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x18, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="09000000020000006d050000020000004e000000", @ANYRES32, @ANYBLOB="000000ad587400"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000100)='kmem_cache_free\x00', r3}, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x3, 0x2000000000000081, &(0x7f00000002c0)=ANY=[@ANYRESDEC, @ANYRESHEX=r0, @ANYRES64=r2], 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x400, @void, @value}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r4, 0xf, 0x0, 0x0, 0x0, 0x0, 0x3f08, 0x2000, 0x0, 0x0, 0x0, 0x0}, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000500)={0xffffffffffffffff, &(0x7f0000000b00)="f5cf88ba4cc367a4a66d823dcb3f046913435453d35b12bb93954753cccfdfdd5790e2899beccc64e2596848e1bd8f3b12b96dc3fe6a48aacefd21c408bd9ad6a0376062ff40f6d5f74dcd2d2d532d851c6b3ac9e411fcc9e58d3f530b9fd93fdcd65aa82a2463b56fdc1a49368ad027e347bc0d5a0625efae1197be1e674d8288813988769dd100ff0e0398f05dd7f517ffadbbd19002fd83bae65a798c993c249341b400f7fc77d0bd0a8ef6463cdb92d92f3abb38bc3ec44c9cad93029b06ede55a71d4f7c9ea1b24a5489e004818891690849ae9af1315140ff9df7f67932bca10dd9f06b0167eda1a9a0357fc53ab0521fc858201de8c28b979a1f2175c68471a2c6d6b1d186889ab077e7b9b6e12d6e8ebb44d9ebcd5642733945b6485727123f8ae53090012f455f429b5ab8ddaf21b098b03192340af0be6e7295fbed10dffa721830eb77dea848b3248a8555f14b6b1fb05be0381c3e54a6b5a2e2a77d1bca569921c3f102b8629975c8120e56b4d3cfe6358ba689fbdbeab180f15f333b042f4b96293ff68b7d074fa55f79db303a5381381d3e5eeaef28aef51e9767d142f916669f1ffc41be0967692f948b3ce910dbc93d46b5168214f940fc49a2f70a36f6a44dd4f7f31bdee57cac9e841a2d1b612d7600a84f7271d6f0ee84a9186422f27dd1f53a83a0f9e799cc31e2bc504cc2d4a2b1c04f8804a1b1797aeb1d8d4972cb9ac8bf85689e657f46224b4d85c4761ac78bda37028728d91f533c04d13d348174fce705e60f4b777e2bbb323aeddf6988e03d7065739b8325670d6b1b540a8e5d52e1e213bb5b0a4adb933fab552787ba57101dedd01e6199e25e8ce027462a964700400b1896fc4426ecc2590007b4db0d4577f53f9763ad8b1c8f5e829cac83a13d0e89e7b3a5422cf61f6aead3c643191212cbf8d0fd1f52efe1502e52ee87920b21cdc46b8756d54b146f9418e304f7f3f18267f70b66fd0a35bf9b6707102b0869b9eac20bbf20c573ccaaa9559f2eee73e4f243cda524a22c9186e8813d66f0d1ce784f46526e7f84c58d2322561d93a03b39c37b5c0575fe0c6fcc8a51be82692efc786f7aa71ddec940c536b7df827a6ea8c825de1477e26ac54104cc89d63eb0e29bba61b0cc344e7fc835b2d63dd693ee05c4aa3accc90c2b48d0c17691e710aae350bdd5b92d23738418672fde898c32ecc0d0cf4d36067206f90e32e1d095d589d542b750dd3834f131e7fc99837950dedf536b391c4d3e3097c60a42a4ca808a50415cbccd180eb42ee08ea1eb6cfc7dbf92630cf081832bbf4e21b15ad5f073665310ae4af1008a4316a3c06fc873674e2ec3e1057b08b5dcd407a0568af8300909bdb1ddf5a5d0e2bd9a26d4447b7bc36ae26bc9930840d28595ba5b8b24a793377064dc7012bf05bf9c51d00a7d7d5dedca4fc27debf3c232526f51a992a2e31fe7326f1ed838f9d106d5148e284d64b91d9e1815cfe5030bafd2ae59441574b4622ea50dcbf2b70564c948a097e37a4f0ac9305740fdaa2afd69eed07b77c1f69cf72d15defffb8291b619ebb25c6cdba8f34666a63f1ee126a54727e1a232f32c0cd30a7c9cde84e879f467beaea9387ecc221a7cc6762edf028f82c4c85cfb1e9d63fa2c97c978037ab8185613bfb74eb7c821228d1181d260b5a6c806b88b25a2a845b90ae6065e3faf3ae4621d58a19d8e72473b109a26e3db886f7fbb651b863a1572cd90da297f9596226bed94264d005092526493fa98a0cc0820bdf060f1d6a466de83fb97a886545c11c6f62761b50ad2f14697cace1f9465f4c43328eeaf5696cef8ba2643e1c990ae19e01a1cf1fa75ef4924d9708eff4033fc958e816ac2cf157431fa13b7a09d11baa9568ec02be65d202df63697c0ffee35e8ce9f9ebd8a6343b7cead952893f6d3d76c8af39cd26951aa150ae5166421c703e987cc873bdce6fe63a103efe01780477b1e77984b7159585b172ae6f3791059f4b31aa1e2a2795c6ca5966d88897287c7d7a98f42fd694009ea9b52fbb6d185706beb4ba53af431505bece89388e777d86ba92a5ca20928f83ed574b4b9a4d4a98ed5c37379231d23aa6d3c573ed3169e27d378461a83ab2cde3a262072ad3a50f3550f14b142e335e605ad49b7b320fd518359c0261ca5bcf27e86d7c264d7946262c5852617fa683a96930ba42388243e59b81c63a2f05a8cded9f9a9b7c791e812a7db58ace35bbdb50a7b039eeef14824631391ab09fc559eec4830493b0e330ed2eaec0cbc7fd641053e4dcbf028811d7aa14ca59627105737cb7706bb09cb99dbc5dc3a687f29891d53c8ead4a2019d8c6c4ee886c101fa57f554cbe276101c338b0276be2193c7b2ca7db81b23250a5b9f8cdd76c64b7611e55a700f7ef4ed888f3e8ffb0623d64daf68827a78c6d2818ab42c1ae6a773de9ac68c0384ab6615b72b26f192ec9694236de22390db995289e9a7f22fa32d21f4a439e1b3f221f0101f929725d4e69049d039ebf21914878c36331553fb9ccdb3f242e8c395a73c54a62c7ae55c2d62e8e52b167522e4a9f0a5b03ede33b2f612b7193f1e6e43dc75ad4ddc7ff022f135d74dde14a248a4fa3ffc978bfc89bd2b29040fe0d7ec9b41a78d32b272a9fafe1f26609cb33dd1d43183d77a8f6aa6fa0280e4ded7d7a449a9f6dbda08d9f7d5e56710c80bc61fcb1ef113d90e28d941505e69660cd45c91d080d2aa88a29769bffe2261463c0290bb207cf4b964b7a0f05676aab1e284ced3449c145b640a18b921ec9a7281cfe1d0d8a4f5eb4a3a6f766c6bf2354e0e6e61a28fbbfa8763e61b1df721fc43b19700838208bdc39a0d33c7e6d6bb7d8bf5034604a7b610b5ab773c01c96d8164fd895fac81b127e2471b65ba57dd64b9c27077937130e420569b7a2b546ccff3ee6dcf24a9bad0e22c9db9d4a55ae6581323c2e3d93b701a34e5dda766e1d689e709486aaaba264373d3119ec169a15d663d23328d81a9c374ee49f1517421bcb16e5d3a35210981cd52e6bad2ff78b2f7ec2bfc021122765b2d9aa513288ff407fc9a5158a8e2d3a18dbd0908daa3a17867f24cd19e0893ecd03f5fa18a7fe7fe3cea7d383964fac7b2eafc65601926eead77a04335be93056cf08ef7b83c83d174796bbc6b933f811f643bb8245e579c1c4957ce8f089e034a5b0e6d9fc1ba4d46f87391b6428cc8b20d94073e3fdeb41dcea515d0709e17c55eeb1be1071d08c27a0c402dd806002b76aaf6b6e600a37d7465d057fec74ac985ee712a5eef6dee9b5e3af51f7ee6d2af0ec6ca82771f155f6211404ef4400eb15aa04ead7041cb15e296f65d74be6ed781a988d1f6a989906e3f914a6023bdcf03b7d5f13d839952772e1a5f5dc5b7d71d96f8b08662ddd932966293e266e8796bddb7a97968a81afa2fc507352d745ca90356f4f59155c91a418baa18baef6bc1ab418f9dd1650f8e495b4b33cce0e020279e15b18f8b7f9cffe2246309fe1387bf9341fd587274f23fbdecb8a58641df56df6c762dc840537496636914f8303c378e4419669d301255f75849ee61a3b11b31fc539ade29930c444dbc3cc6e47eda4330c089e48ab36e8a88118e7e3c09acfe75d5f05d6e9e67b427e0bf2208012d7886c7e18c227a511a926e3db7358823cf38cd51106e5748c258f59a04d9c10b0a7c1987a297682fd4ea5c3817f588062dca927387cfcda8a7ac08ebfa60a0ff3aedcf7ff926121f6773817b996816e12c9fb3bdfb3cc3b8023aa5f93fd32b7a56fc9ef431f282fd6744b07020bd1eb6c40fcc9d2b9be435afdf3c1b0b1bb39ae9e0ebfee9c063c467cf1dfbdc8e3d3b4c9ee5daf4978d1ff32ec01216d23194494ac72fdcc5b4cdf963e1c5f0b8f687385649d9846e8703522437d6303b64f7d6c36462c819a90c577a04f6c1f13916db2fbc8168ea01b06e8b352a2db1553b8b29ea90754b51dc713f156f17c349eef37a2f6e0184dde92d1d9d8e8efd33c1d982474a69b91af9fae3b900235dc0357bc022e43ad3f10959a8a5b898c5a317e57986045984000d9b4f21b79798d0ff3ae930274657bd489072f21196f301691d3ac364fd941feb70adac2452955767d54b814cf45ef67a1e2ece5b0187d941400bfd92495977b8c7712188983ea9e5fcde1ba4539403d34c6b94cf318b5d5d64345187b30e22ea83149d9af29cc54c6ce08a659f47f0050ec7f2dbcad046032c8a228f2d7bb5976f40e477e924693a44dfbda4f91f5c1751ebdada3f6c96ae20b1cef1f48e9e4c0a8751ac32e94ecbfcdc64ca3bd26b24a67024f462839c7a9669011180e7336cfb9248160a4de8e3513cb96600023b4400d4490382af72ed30e0d2a1e2f3b49bc5e5b313d05e44132e5fb01f9acd2da15d63f8b1405f854e798536b0245d39e8619397075c49d0e5044904543dfc80445b477be89c167324300b6314b1f9b637c0b201605d90afffeef33b20c38bfbc413616cde3c53c2dfeead3d0d6f7ea0111c7c6c758089ab987a0d6d1e00a0924a11bd1b36525939b4521655be3bcbb3e8bd9893acb4c9818b17f6b7d94770a6da869bf0880ba38bf02a3c50839bb167577890439c33d1b16292d0381dbbe123c7d2153a145b049ec036e3c3ffa78c0cc36c026bfb874e235abded5eea8dd8b43e2b46a25cc7f67438ace8cb4e8aafa6c2e3c46bf1729fbee9198c4405a90e07268bcbb46ef84be2323e286c863bb4c024a7f29a49cc8936ab437aca57007a0716c00dcbf35f35562ae692c2782933c9851b626acaa27966607e26069faa360da86396bdb4c8a1855c0eeed9799f9fc9018360b693abe5f5669e5f7974a99fd2e3555e40805d81528972264d94d9ee85f6a7cc61803bfc893ea0019167e1607809b9b224f54b23919111f001b69200ae2d893374a2cf3358749d824d9c05f904546bafba2aafb632aec5eb6ba57d575c178832b0532d630b613bbb8944e2923b858646fb45141d22f17e9062816733a9eb3903add252f4fa9b9e42881783bb5f592f00d19d86e49b879f1f7501e8a0c34752b8e1a4e99d32e119375e6a968aa4b59ae69036d1c8a2eb633c0b61716ea5666760439d8361863701ebcd55a597dc121072ccc9a65337576d026cbed5aeb6119e11a9fedc9e0152f74b5cfe5a84587ff54056cd5e4ef40cd97f379786dd93093abbbcc802a194e698b854d98bcad3c9d5dc7449431ec3265760f16c685e2ba8c9187210eea1a480d92235d862078fe36aa07da1efb14b02c3d6c1b5b52b48d99d50c9814f1c0895da26443fa322550975052c00c93267888000a70f85cc20d5166d1007cb4fb61191f10c3f21791b6f78e510eca6e032ea0e78c8f8b392a347f1f2cc7bdecfb59cfedbae7322097dcba8443a002b9cb95cb1e3f0c3d347a40ce1c2bd8657086fb38e56e8bc829f8b49d34330ed48758d6d2d69baea1c0de22d45ee82d408932b35bbab59c7429526878ba1849ea22221bd1ac5eb74e1b25b38247c7e4417d9bdf544bbfcea9799ecd158407e71f540c6be3bc299e7adf1574c346141c96d0d381d891d74e0a58e042ec4ef1aa503e4d3c30ef54e909e4bff7bcc701630d279ca169111c801d67f64eba6850bc14634dc8b13abaa6f0c2b8cab45c56b202b4621b928ca766bebc2c3ac705b159232c4781784a39fe3df6c23d87a3b98c7e6cea8f5e7f975409f68af763356fd6d992dc93837df95e61db76fb33bea754ce9302ee2fbafd0ba593b9c6d0a26f807af6050c", &(0x7f00000004c0)=@tcp6=r6}, 0x20) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) r8 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r8, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) r9 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r9, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) syz_emit_ethernet(0xfdef, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa88a800008864"], 0x0) ioctl$BLKZEROOUT(r7, 0x127f, &(0x7f0000000240)={0x1000000, 0x1000000}) 11m29.959602736s ago: executing program 7 (id=3444): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000080)=ANY=[@ANYBLOB="83"], 0x4) r1 = socket(0x1, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_xfrm(0x10, 0x3, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fe050000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sched_switch\x00', r5, 0x0, 0x3}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xfffffecc) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f0000000340)=ANY=[@ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX=r3, @ANYBLOB="2c76657273696f6e3d39703230300000752c636163680f69e0d63d47504c00"]) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x1) r6 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x5, 0x1, 0x0, @dev, @local, 0x700, 0x0, 0x3}}) 11m29.958222533s ago: executing program 1 (id=3445): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) unshare(0x22020400) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3b, &(0x7f0000000300)=ANY=[@ANYRES8=r2, @ANYRES32=r0, @ANYBLOB="5698962a9153f27dc321b6a933b04fbc17564faf1643474847d40ce17d2b0ce180c1d5f1a8eb", @ANYRES8=r1, @ANYRESOCT=r2, @ANYRES16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff39, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) connect$inet(r1, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) 11m28.249673033s ago: executing program 7 (id=3449): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000000000000000000000000000850000008a000000850000000700000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1f, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$caif_stream(0x25, 0x1, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000700)={'syztnl2\x00', &(0x7f0000000680)={'syztnl1\x00', 0x0, 0x29, 0xb7, 0x6, 0x0, 0x8, @private1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x7, 0x7, 0xf, 0x9b}}) r3 = dup2(r1, r1) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000740)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x8, '\x00', r2, r3, 0x5, 0x4, 0x2, 0x0, @void, @value, @void, @value}, 0x50) recvmsg$unix(r0, &(0x7f0000000380)={&(0x7f0000000080)=@abs, 0x6e, &(0x7f0000000600)=[{&(0x7f00000001c0)=""/141, 0x8d}, {&(0x7f0000000280)=""/209, 0xd1}, {&(0x7f0000000400)=""/70, 0x46}, {&(0x7f0000000000)=""/43, 0x2b}, {&(0x7f0000000480)=""/121, 0x79}, {&(0x7f0000000500)=""/224, 0xe0}], 0x6}, 0x20) r4 = add_key(&(0x7f0000000900)='syzkaller\x00', &(0x7f0000000940)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffb) add_key(&(0x7f00000007c0)='trusted\x00', &(0x7f0000000800)={'syz', 0x3}, &(0x7f0000000840)="78455492aacdd7893cbeca6a21d31b4031bacea45662c8dd44e94552c897d93efca1a4e22bc9f2102bbd853be58933487c33f3e699eab53d41df08f74765b5d1e4bc5dd68050b64a0c61f92fb3986fcc1768e15edd58eea1fde0572f12d72e334800a370f82018077fdeb26b2e438e0ef7fd3cbbca5cc0782f8f4ec4de8765315919686de36f68bc1b476e88438303a8a9d8894206f2620ec6a25ee63acdd6cf9f", 0xa1, r4) 11m25.861926079s ago: executing program 7 (id=3454): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000080)={[{@dyn}]}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x16, &(0x7f0000000000)='/proc/0\x01\x00\x00\x19\xd9_,\xae\xf4t\x00AE\xf44'}, 0x30) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = syz_io_uring_setup(0x6de4, &(0x7f0000000180)={0x0, 0x95d3, 0x0, 0x2}, &(0x7f00000000c0), &(0x7f0000000140)) io_uring_enter(r4, 0x0, 0xe38e, 0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x12}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) 11m24.500247384s ago: executing program 7 (id=3461): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r0, &(0x7f00000002c0)=""/102384, 0x18ff0) r1 = creat(0x0, 0x0) syz_open_dev$dri(0x0, 0x1a73, 0x8001) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) creat(&(0x7f0000000280)='./file0\x00', 0x114) mmap$binder(&(0x7f00000a5000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='mpol=bind:0,N:3']) 11m14.902997717s ago: executing program 48 (id=3445): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[], 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) unshare(0x22020400) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x3b, &(0x7f0000000300)=ANY=[@ANYRES8=r2, @ANYRES32=r0, @ANYBLOB="5698962a9153f27dc321b6a933b04fbc17564faf1643474847d40ce17d2b0ce180c1d5f1a8eb", @ANYRES8=r1, @ANYRESOCT=r2, @ANYRES16], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0xffffffffffffff39, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102400, 0x19000) connect$inet(r1, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) 11m9.180965664s ago: executing program 49 (id=3461): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000000), 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r0, &(0x7f00000002c0)=""/102384, 0x18ff0) r1 = creat(0x0, 0x0) syz_open_dev$dri(0x0, 0x1a73, 0x8001) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x1) creat(&(0x7f0000000280)='./file0\x00', 0x114) mmap$binder(&(0x7f00000a5000/0x3000)=nil, 0x3000, 0x1, 0x11, r1, 0x3) mount$tmpfs(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000280), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='mpol=bind:0,N:3']) 10m47.820460698s ago: executing program 4 (id=3534): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000) r0 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/fib_trie\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f0000000300), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) lseek(r0, 0x7fffffffffffffff, 0x4000000) keyctl$get_persistent(0x16, 0x0, 0xfffffffffffffffc) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, r0, 0x4f) 10m45.765357274s ago: executing program 4 (id=3536): socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_ifreq(r0, 0x89a3, &(0x7f0000000000)={'bridge0\x00', @ifru_addrs=@l2={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x12}}}) fallocate(0xffffffffffffffff, 0x0, 0x0, 0x1000f4) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000100000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00', r1}, 0x10) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) r3 = gettid() fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) tkill(r3, 0xb) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec850000006d000000b40000000e00000095"], &(0x7f0000000080)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r4}, 0x10) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r5}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x9, 0x4, 0x8, 0xb, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00'}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113140000000000bf1000000000000025000200091b00003d030100000000008701000000000000bc26000000000000bf67000000000000150300000ee600f0670200001400000015030000ffffffffbf050000000000000f650000000000006507f4ff02000400070700004c0040001f75000000000000bf54000000000000070500000300f9ffad430100000000009500000000000000050000000000000095000000000000004d9bd591d56825c4bf261d1ec069e3a82983d58719d72183f2cb7f43dd55788be820b236dcb695dbfd737cbf719506d2d6b05fe70305863f970eac3510ac99b798f8125f1c322c2a154a8a8d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x4, 0x5, &(0x7f0000000340)=ANY=[@ANYBLOB="180200000000000000000000000000008500000061000000850000007d0000009500000000000000745f78de1d83cd00020000baa510f1d18f05c144ec4c2e518e52635439ca8f5c9c20658b60cd506b4d95ac679f5f628b004d3d5c40d0b634fbe74a9c1cf888e6ca0bea4716f566fceccdaef12fed21114c194ab238cd5bee7623e4b9319daec8349caaa1849d070b8742b504000000dc7f153173204e8cbd9f7e30e7983f5c227d1b1639014adfe9ec201a20998dc47fde982da9a36bd120268b819e5b948ea42e0122ba8a7726224a79cd27a96a1261c4f916a98986b1ca3c96d7711699fc343c8f1d95f1fed3aa61a6b3cd8580cc2debff2f8c3679eb944f7f3f0c4fee985f2cbaa05b3389acd1"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x46) sendto$inet6(0xffffffffffffffff, &(0x7f0000000180)="9000000018001f2fb9409b52ffff65580200be04020c06050a020b0243000400ffffff9e00c8388827a685a168d0bf47d32345653602648dcaaf6c26c291214549935ade4a460c20", 0x48, 0x0, 0x0, 0x0) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x2, [@enum, @struct={0x0, 0x1, 0x0, 0x4, 0x0, 0x0, [{0x0, 0x1}]}]}}, &(0x7f0000000100)=""/202, 0x3e, 0xca, 0x1, 0x0, 0x0, @void, @value}, 0x20) ioctl$KDFONTOP_GET(r7, 0x4b6a, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f88a8", 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r8 = socket(0x10, 0x3, 0x0) write(r8, &(0x7f0000000100)="1400000052004f7fb3e45f2024d2f1c9fb470000", 0x14) recvmmsg(r8, &(0x7f0000005c80), 0x1b, 0x10122, 0x0) 10m43.866905701s ago: executing program 4 (id=3541): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0xd0) 10m43.68416356s ago: executing program 4 (id=3542): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_CT_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x4000) ioctl$VIDIOC_EXPBUF(r0, 0x2, &(0x7f0000000140)={0x7, 0x6e, 0x0, 0x80080, 0xffffffffffffffff}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000040)={0x5, r1}) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=@framed={{}, [@printk={@llx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000800), 0xffffffffffffffff) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000100)=0x5) socket$nl_generic(0x10, 0x3, 0x10) 10m41.535231681s ago: executing program 4 (id=3549): r0 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CT_KEY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_CT_SREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x78}}, 0x4000) ioctl$VIDIOC_EXPBUF(r0, 0x2, &(0x7f0000000140)={0x7, 0x6e, 0x0, 0x80080, 0xffffffffffffffff}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000040)={0x5, r1}) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000040)=@framed={{}, [@printk={@llx, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x2d}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r9, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)={0x24, 0x0, 0xc4fc9e906872338b, 0x0, 0x0, {{0x15}, {@void, @void}}, [@NL80211_ATTR_TID_CONFIG={0x10, 0x11d, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NL80211_TID_CONFIG_ATTR_TX_RATE={0x8, 0xd, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x4, 0x3, 0x0, 0x0}]}]}]}]}, 0x24}}, 0x0) ioctl$DMA_BUF_IOCTL_SYNC(r3, 0x40086200, &(0x7f0000000100)=0x5) 10m37.818902562s ago: executing program 4 (id=3557): mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = creat(&(0x7f0000000340)='./file0/file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x10) chdir(&(0x7f0000000140)='./bus\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, 0x0) r2 = syz_open_dev$radio(0x0, 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f0000002280)={0x0, 0x1, 0x40}) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000200)=""/186, 0xba}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000002540)) 10m22.678724121s ago: executing program 50 (id=3557): mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r0 = creat(&(0x7f0000000340)='./file0/file0\x00', 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000000)=0x10) chdir(&(0x7f0000000140)='./bus\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x0, 0x0) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, 0x0) r2 = syz_open_dev$radio(0x0, 0x2, 0x2) ioctl$VIDIOC_S_FREQUENCY(r2, 0x402c5639, &(0x7f0000002280)={0x0, 0x1, 0x40}) readv(r2, &(0x7f0000000100)=[{&(0x7f0000000200)=""/186, 0xba}], 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) ioctl$FS_IOC_FSSETXATTR(r1, 0x401c5820, &(0x7f0000002540)) 9m14.828645267s ago: executing program 3 (id=3772): bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="60000000020601000000000600000000000000000e0003006269746d61703a697000000005000400000000000900020073797a30000000001800070000000000000000e50c0001800800014080ffffff050005000200000005000100506a7c5f324897126c099965eb06000000"], 0x60}}, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000004e80), 0x0, 0x100, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x2, 0x2) syz_open_procfs(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r2}, 0x10) r3 = bpf$ITER_CREATE(0x21, &(0x7f0000000040), 0x8) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0x80, 0x30, 0xb, 0x0, 0x0, {}, [{0x6c, 0x1, [@m_ct={0x68, 0x1, 0x0, 0x0, {{0x7}, {0x40, 0x2, 0x0, 0x1, [@TCA_CT_ZONE={0x6, 0x8, 0x2000}, @TCA_CT_LABELS={0x14, 0x7, "4614c334e344ae535af2f0a70ddeb37f"}, @TCA_CT_PARMS={0x18, 0x1, {0x0, 0x0, 0x0, 0x8}}, @TCA_CT_ZONE={0x6, 0x4, 0x1}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x80}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r3, 0x80049370, &(0x7f00000001c0)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000040)={'vxcan0\x00', 0x0}) sendmsg$can_raw(r6, &(0x7f0000000140)={&(0x7f0000000080)={0x1d, r7}, 0x10, &(0x7f0000000100)={&(0x7f00000000c0)=@can={{0x3, 0x1, 0x1}, 0x3, 0x0, 0x0, 0x0, "a42f1bd45489d60a"}, 0x10}, 0x1, 0x0, 0x0, 0x24008814}, 0xc000) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r8, 0xc0205649, &(0x7f0000000100)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000580)={0x98f90d, 0x6, '\x00', @ptr}}) r9 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r9, &(0x7f0000000180)={0x1a, 0x0, 0x80, 0x0, 0x0, 0x0, @multicast}, 0x10) r10 = openat$audio(0xffffffffffffff9c, &(0x7f0000000300), 0x400, 0x0) ioctl$SNDCTL_DSP_RESET(r10, 0x5000, 0x0) 9m10.078547713s ago: executing program 3 (id=3781): bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000040), &(0x7f00000000c0)}, 0x20) r1 = socket$nl_rdma(0x10, 0x3, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000300)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x60, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r5}, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_FASTOPEN_KEY(0xffffffffffffffff, 0x6, 0x21, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x10) socket$netlink(0x10, 0x3, 0x8000000004) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) r7 = dup(r6) ioctl$TIOCL_SETSEL(r7, 0x541c, &(0x7f0000001900)={0x2, {0xc, 0x9fe, 0x0, 0x101, 0xfff, 0xf}}) ioctl$SNDCTL_DSP_SETTRIGGER(r7, 0x40045010, &(0x7f0000000000)=0x6) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, &(0x7f0000000280)) openat$nullb(0xffffffffffffff9c, 0x0, 0x169802, 0x0) add_key$user(0x0, &(0x7f0000000440), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r1, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)=ANY=[], 0x28}}, 0x0) ioctl$VT_RESIZE(r7, 0x5609, &(0x7f0000000040)={0x2, 0x2, 0xfffd}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18580000030000000000000000000000003603000500000085200000020000001860000003000000000000000000000018120000", @ANYRES64=r0, @ANYBLOB="0000000000000000b703000000000000850000ec0c000000b700000000130000"], &(0x7f0000000080)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=@newtaction={0x70, 0x30, 0x1, 0x0, 0x0, {}, [{0x5c, 0x1, [@m_tunnel_key={0x58, 0x1, 0x0, 0x0, {{0xf}, {0x28, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0xb, @empty=0x4000300}, @TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{}, 0x1}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x70}}, 0x0) 9m8.880877667s ago: executing program 3 (id=3783): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) (async) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x44, 0x800000, 0x8, 0x7, 0x2}) (async) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000080)={0x19}) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) (async) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket$inet6_dccp(0xa, 0x6, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000400)={'batadv0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x48095}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r4}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x44}}, 0x4004000) (async) r8 = socket$inet(0x2, 0x2, 0x1) bind$inet(r8, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) (async) r9 = socket$inet(0x2, 0x2, 0x1) setsockopt$sock_int(r8, 0x1, 0x2, &(0x7f00000000c0), 0x4) (async) bind$inet(r9, &(0x7f0000000000)={0x2, 0x6e24, @empty}, 0x10) (async) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000200)={0x15, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r1, 0x3ba0, &(0x7f00000001c0)={0x48, 0x5, r10, 0x0, 0xffffffffffffffff, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x7, r11}) (async) write$bt_hci(r0, &(0x7f0000000080)=ANY=[], 0x6) 9m8.480419098s ago: executing program 3 (id=3784): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) r3 = socket$phonet(0x23, 0x2, 0x1) recvmmsg(r3, 0x0, 0x0, 0x40, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r5 = socket$inet(0x2, 0x3, 0x2) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000009c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="160000000000000004000000ffff000000000000", @ANYRES32=0x1, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00p ', @ANYRES32, @ANYBLOB='\x00'/21], 0x48) unshare(0x2060400) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/24], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1b, 0xb, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000100000000018010000786c6c2500000000002020207b1af8ff00000000bfa100"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f00000003c0)={{&(0x7f0000ffb000/0x4000)=nil, 0x4000}, 0x2}) sendmmsg$inet(r5, &(0x7f00000016c0)=[{{&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, 0x0, 0x0, &(0x7f00000015c0)=[@ip_retopts={{0x1c, 0x0, 0x7, {[@cipso={0x86, 0xa, 0x3, [{0x0, 0x2}, {0x0, 0x2}]}]}}}], 0x20}}], 0x1, 0x0) 9m7.118978168s ago: executing program 3 (id=3786): r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x20000000000000, 0x0) ioctl$EVIOCGRAB(r0, 0x40044590, &(0x7f0000000080)) ioctl$EVIOCGABS20(r0, 0x40044591, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fe0500000000000000000000950000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r4 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, &(0x7f0000000180)) syz_genetlink_get_family_id$netlbl_unlabel(0x0, 0xffffffffffffffff) 9m2.867914598s ago: executing program 3 (id=3790): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@newtaction={0x18, 0x31, 0x1, 0x0, 0x0, {0x0, 0x0, 0x11}, [{0x4}]}, 0x18}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e22, @multicast1}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040), 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x0, 0x20}, 0xc) sendmmsg$inet6(r1, &(0x7f0000003f00)=[{{0x0, 0xf, &(0x7f0000000300)=[{&(0x7f0000000140)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, 0x0, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000d80)=@nat={'nat\x00', 0x62, 0x5, 0x528, 0xa8, 0x150, 0xffffffff, 0x490, 0x398, 0x490, 0x490, 0xffffffff, 0x490, 0x490, 0x5, 0x0, {[{{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'rose0\x00', 'virt_wifi0\x00', {}, {}, 0xf1bca4f3d3c1eb74}, 0x0, 0x70, 0xa8, 0x0, {0x22e}}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x0, @loopback, @empty, @port, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @remote, @empty, @icmp_id=0x65, @icmp_id}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'tunl0\x00', 'ipvlan0\x00'}, 0x0, 0x210, 0x248, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'veth0_to_batadv\x00', {0x1, 0x3, 0x46, 0x71e, 0x6f, 0xfffffffc, 0x4, 0x20, 0x8}, {0x9}}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @remote, @multicast2, @gre_key}}}}, {{@ip={@remote, @dev={0xac, 0x14, 0x14, 0x22}, 0xff000000, 0x0, 'veth1_to_batadv\x00', 'pim6reg\x00'}, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "febc"}}, @common=@inet=@socket2={{0x28}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x16, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @port=0x4e21, @port=0x4e21}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x588) socket$l2tp6(0xa, 0x2, 0x73) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000004000000000000000000850000002300000095"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ptrace$ARCH_SHSTK_LOCK(0x1e, r3, 0x1, 0x5003) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000380)='sched_switch\x00', r7}, 0x10) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r3, &(0x7f00000001c0), 0x4003) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r8, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x615, 0x1, 0x4, 0xa, 0x9}, 0x9c) 8m46.902426589s ago: executing program 51 (id=3790): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000540)=@newtaction={0x18, 0x31, 0x1, 0x0, 0x0, {0x0, 0x0, 0x11}, [{0x4}]}, 0x18}}, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000340)=[@in={0x2, 0x4e22, @multicast1}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000040), 0x4) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000180)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x989, 0x0, 0x10}, 0x9c) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r1, 0x84, 0x72, &(0x7f0000000000)={0x0, 0x0, 0x20}, 0xc) sendmmsg$inet6(r1, &(0x7f0000003f00)=[{{0x0, 0xf, &(0x7f0000000300)=[{&(0x7f0000000140)="a2", 0x1a058}], 0x1}}], 0x1, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, 0x0, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000d80)=@nat={'nat\x00', 0x62, 0x5, 0x528, 0xa8, 0x150, 0xffffffff, 0x490, 0x398, 0x490, 0x490, 0xffffffff, 0x490, 0x490, 0x5, 0x0, {[{{@ip={@local, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'rose0\x00', 'virt_wifi0\x00', {}, {}, 0xf1bca4f3d3c1eb74}, 0x0, 0x70, 0xa8, 0x0, {0x22e}}, @SNAT0={0x38, 'SNAT\x00', 0x0, {0x1, {0x0, @loopback, @empty, @port, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @remote, @empty, @icmp_id=0x65, @icmp_id}}}}, {{@ip={@broadcast, @multicast1, 0x0, 0x0, 'tunl0\x00', 'ipvlan0\x00'}, 0x0, 0x210, 0x248, 0x0, {}, [@common=@inet=@hashlimit2={{0x150}, {'veth0_to_batadv\x00', {0x1, 0x3, 0x46, 0x71e, 0x6f, 0xfffffffc, 0x4, 0x20, 0x8}, {0x9}}}, @common=@osf={{0x50}, {'syz0\x00'}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @remote, @multicast2, @gre_key}}}}, {{@ip={@remote, @dev={0xac, 0x14, 0x14, 0x22}, 0xff000000, 0x0, 'veth1_to_batadv\x00', 'pim6reg\x00'}, 0x0, 0xc0, 0xf8, 0x0, {}, [@common=@icmp={{0x28}, {0x4, "febc"}}, @common=@inet=@socket2={{0x28}}]}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x16, @initdev={0xac, 0x1e, 0x1, 0x0}, @multicast2, @port=0x4e21, @port=0x4e21}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x588) socket$l2tp6(0xa, 0x2, 0x73) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000004000000000000000000850000002300000095"], &(0x7f0000000180)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) ptrace$ARCH_SHSTK_LOCK(0x1e, r3, 0x1, 0x5003) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000380)='sched_switch\x00', r7}, 0x10) ptrace$ARCH_GET_MAX_TAG_BITS(0x1e, r3, &(0x7f00000001c0), 0x4003) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000840)={r8, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x2, 0x2, 0x615, 0x1, 0x4, 0xa, 0x9}, 0x9c) 4m31.094230674s ago: executing program 8 (id=4531): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000380)='./file1\x00', 0x8a) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc9\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\xa4(V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J]\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93i|\xc0\x00\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\xb5\x13^\x13\xcb\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$NL80211_CMD_DISCONNECT(r5, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="200028bd7000ffdbdf253000000008000300", @ANYRES32=r6, @ANYBLOB], 0x68}, 0x1, 0x0, 0x0, 0x810}, 0x2000c804) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) socket(0x10, 0x80000, 0x1) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, 0x0, 0x118) write$UHID_CREATE2(r7, &(0x7f00000001c0)=ANY=[], 0x118) 4m30.48655023s ago: executing program 8 (id=4535): r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0300000004000000040000000a000000000000", @ANYRES32=0x1, @ANYBLOB="3af44182166e82cc71e13db5100000000000000083a3c787a3311af3d0dcccf1f223e7305ec553998512d5157e24a6d7f78a0577afe3ed8b84a02370c8d988a891024717ff7d02f53bede5a78befc3ff0ca93db8f905abc4551fbe8c6a6748a007ba07a42d16f4338ccc5ae3a599442c28184c024cca071f6e9806c02ed4954327846be5", @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x48) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r4}, 0x10) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/address_bits', 0x0, 0x0) pread64(r5, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@bloom_filter={0x1e, 0x6, 0x8, 0x2, 0x20, r0, 0x726e, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x2, 0x8, @void, @value, @void, @value}, 0x48) read$alg(0xffffffffffffffff, &(0x7f00000001c0)=""/68, 0x44) r6 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000000)={'veth0_vlan\x00', &(0x7f0000000040)=@ethtool_ts_info={0x26}}) 4m28.928123981s ago: executing program 8 (id=4538): madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) bind$inet(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) ioctl$SNDCTL_DSP_SUBDIVIDE(0xffffffffffffffff, 0xc0045009, &(0x7f0000000040)=0xffff) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) keyctl$chown(0x4, 0x0, 0x0, 0x0) r2 = socket$netlink(0x10, 0x3, 0x4) write(r2, &(0x7f0000000040)="2700000015000707030e0000120f0a0011000100f5fe009d2fb112ff000000008a151f75080039", 0x27) 4m28.079538697s ago: executing program 8 (id=4539): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000080)={[{@dyn}]}) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0}, 0x30) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_io_uring_setup(0x6de4, 0x0, &(0x7f00000000c0), &(0x7f0000000140)) io_uring_enter(r4, 0x0, 0xe38e, 0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r4, 0x10, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x12}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) 4m26.698813922s ago: executing program 8 (id=4542): r0 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r0, 0x114, 0xa, &(0x7f0000000080)=ANY=[], 0x4) r1 = socket(0x1, 0x2, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$nl_xfrm(0x10, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) socket$key(0xf, 0x3, 0x2) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fe050000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='sched_switch\x00', r3, 0x0, 0x3}, 0x18) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000000), 0xfffffecc) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) mount$9p_fd(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000300), 0x0, &(0x7f0000000340)=ANY=[@ANYRESHEX, @ANYBLOB=',wfdno=', @ANYRESHEX, @ANYBLOB="2c76657273696f6e3d39703230300000752c636163680f69e0d63d47504c00"]) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x1) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) 4m25.317826662s ago: executing program 8 (id=4549): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000080)={0x250, r1, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x98, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x75, 0x3, "dacb500c5739b51ef47796d2477190bf7f45142585a24ef3037224bdfa11e5089050ae66a6031815c1832ff983f89bc029d85ed84d94d0141c9fd7dc638dc72d5a5eb38a7636dfad7adbc9ce2a2e9ff5f70f3130afa08477574220da5e23c8666616776afef14a4043b966b3bea4745f31"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_MEDIA={0xb0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x516e3a6e}]}]}, @TIPC_NLA_BEARER={0xf0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xdca}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @empty}}, {0x14, 0x2, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x44}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @remote, 0x475f}}, {0x14, 0x2, @in={0x2, 0x4e23, @loopback}}}}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x20004040}, 0x8004) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_clone(0xc1000000, &(0x7f0000000380)="45a51fc307b91277ca5907cdc61494b7539ff1ffae", 0x15, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)) sched_setscheduler(r2, 0x0, &(0x7f0000000480)=0x10) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000004c0)="3b7a7165d71da9b029202e664fe23d1c1dd46e1b13c07368be18e3b614206a730da5077d41e018f7fd108a011f74bff729e556b38bde355c4492f56a0120d4f8d10dcdb4185fe24b", 0x0, 0x48) r3 = syz_open_dev$vcsu(&(0x7f0000000540), 0x0, 0x54c42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b00)={0xffffffffffffffff, 0xe0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000840)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000880)=[0x0], &(0x7f00000008c0)=[0x0], 0x0, 0x33, &(0x7f0000000900)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000940), &(0x7f0000000980), 0x8, 0x3e, 0x8, 0x8, &(0x7f00000009c0)}}, 0x10) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000b40)='.pending_reads\x00', 0x40000, 0x60) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000c00)={0x0, 0x8, 0x8}, 0xc) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c40)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000d40)={{0x1, 0xffffffffffffffff}, &(0x7f0000000cc0), &(0x7f0000000d00)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e00)={0x18, 0x12, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}]}, &(0x7f0000000700)='GPL\x00', 0xfffffff9, 0xfa, &(0x7f0000000740)=""/250, 0x0, 0x8, '\x00', r5, 0x0, r6, 0x8, &(0x7f0000000b80)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000bc0)={0x4, 0x4, 0x0, 0x2}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000d80)=[r7, r8, r9], &(0x7f0000000dc0)=[{0x4, 0x3, 0xb, 0x6}], 0x10, 0xfffeffff, @void, @value}, 0x94) listen(r6, 0xfffffffc) syz_io_uring_setup(0x44b9, &(0x7f0000000ec0)={0x0, 0x83d, 0x4, 0x2, 0xe, 0x0, r6}, &(0x7f0000000f40)=0x0, &(0x7f0000000f80)) r11 = mmap$IORING_OFF_SQES(&(0x7f0000ff9000/0x6000)=nil, 0x6000, 0x1000000, 0x13, r3, 0x10000000) syz_io_uring_submit(r10, r11, &(0x7f0000001000)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x3, &(0x7f0000000fc0), 0x1, 0x1}) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000001040)=0x2, 0x4) ioctl$TCSETS(r3, 0x5402, &(0x7f0000001080)={0x45a29dab, 0x5, 0x3, 0x3, 0x11, "9dd9db3123d0e2b7aa87063a2f793c36e5b5c3"}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f00000010c0)={0x0, 0xfe, "4f05f5c4e4bd236cad1e9e3ed8d6f364bbf7ee7425eab08dfdfd019c617d6e61185fd2e20e8fd82c4553524989642d2aca5cc9dc6176125d34d89f4370c7ac4aad131861c876a9450f3eb40f42f855885e8b82fac1e22fe073c540b9c71dc62fee7d0bc49a4284a24d659742709490799d9f9968f6b6ab7ec448a873ac6decbd1eeeb9c82f2b2c03f06d901c0c7ed7fb172b501fb558dd3ecaa9a2e5edb92a4f03bac83be02b10eb8deb29441051c6eb4f128f3e17ad5001b66b041d6446180dfa68f487bf28e9b8ebfb9f6f10f7628545edd24041c28ef0e9b5268ada5cc950005ebfdb4c12945217779aea0b33b996118b83c8ad0a87d999be6b9e3711"}, &(0x7f0000001200)=0x106) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000001240)={r12, 0x3}, 0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000001280)={r12, 0x8}, &(0x7f00000012c0)=0x8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000001300)={r13, 0x6}, 0x8) unshare(0x40000600) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nfc(&(0x7f0000001380), 0xffffffffffffffff) sendmsg$NFC_CMD_DISABLE_SE(r14, &(0x7f00000014c0)={&(0x7f0000001340), 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x24, r15, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) 4m9.742569261s ago: executing program 52 (id=4549): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MON_SET(r0, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000300)={&(0x7f0000000080)={0x250, r1, 0x100, 0x70bd2a, 0x25dfdbfd, {}, [@TIPC_NLA_NODE={0x98, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x75, 0x3, "dacb500c5739b51ef47796d2477190bf7f45142585a24ef3037224bdfa11e5089050ae66a6031815c1832ff983f89bc029d85ed84d94d0141c9fd7dc638dc72d5a5eb38a7636dfad7adbc9ce2a2e9ff5f70f3130afa08477574220da5e23c8666616776afef14a4043b966b3bea4745f31"}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x9}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_MON={0x4}, @TIPC_NLA_MEDIA={0xb0, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x401}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1b}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1ff}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9f}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x516e3a6e}]}]}, @TIPC_NLA_BEARER={0xf0, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_PROP={0x54, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_BEARER_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xdca}, @TIPC_NLA_PROP_MTU={0x8}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz2\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e23, @empty}}, {0x14, 0x2, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x44}}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @remote, 0x475f}}, {0x14, 0x2, @in={0x2, 0x4e23, @loopback}}}}]}]}, 0x250}, 0x1, 0x0, 0x0, 0x20004040}, 0x8004) syz_open_dev$tty20(0xc, 0x4, 0x0) r2 = syz_clone(0xc1000000, &(0x7f0000000380)="45a51fc307b91277ca5907cdc61494b7539ff1ffae", 0x15, &(0x7f00000003c0), &(0x7f0000000400), &(0x7f0000000440)) sched_setscheduler(r2, 0x0, &(0x7f0000000480)=0x10) syz_memcpy_off$KVM_EXIT_HYPERCALL(0x0, 0x20, &(0x7f00000004c0)="3b7a7165d71da9b029202e664fe23d1c1dd46e1b13c07368be18e3b614206a730da5077d41e018f7fd108a011f74bff729e556b38bde355c4492f56a0120d4f8d10dcdb4185fe24b", 0x0, 0x48) r3 = syz_open_dev$vcsu(&(0x7f0000000540), 0x0, 0x54c42) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000600)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000b00)={0xffffffffffffffff, 0xe0, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000840)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, &(0x7f0000000880)=[0x0], &(0x7f00000008c0)=[0x0], 0x0, 0x33, &(0x7f0000000900)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000940), &(0x7f0000000980), 0x8, 0x3e, 0x8, 0x8, &(0x7f00000009c0)}}, 0x10) r6 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000b40)='.pending_reads\x00', 0x40000, 0x60) r7 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000c00)={0x0, 0x8, 0x8}, 0xc) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000c40)={0x1b, 0x0, 0x0, 0xfffffffc, 0x0, 0x1, 0x9, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000d40)={{0x1, 0xffffffffffffffff}, &(0x7f0000000cc0), &(0x7f0000000d00)}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000e00)={0x18, 0x12, &(0x7f0000000640)=@framed={{0x18, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x5}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}}, @cb_func={0x18, 0x8, 0x4, 0x0, 0x6}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r4}}]}, &(0x7f0000000700)='GPL\x00', 0xfffffff9, 0xfa, &(0x7f0000000740)=""/250, 0x0, 0x8, '\x00', r5, 0x0, r6, 0x8, &(0x7f0000000b80)={0x0, 0x2}, 0x8, 0x10, &(0x7f0000000bc0)={0x4, 0x4, 0x0, 0x2}, 0x10, 0x0, 0x0, 0x1, &(0x7f0000000d80)=[r7, r8, r9], &(0x7f0000000dc0)=[{0x4, 0x3, 0xb, 0x6}], 0x10, 0xfffeffff, @void, @value}, 0x94) listen(r6, 0xfffffffc) syz_io_uring_setup(0x44b9, &(0x7f0000000ec0)={0x0, 0x83d, 0x4, 0x2, 0xe, 0x0, r6}, &(0x7f0000000f40)=0x0, &(0x7f0000000f80)) r11 = mmap$IORING_OFF_SQES(&(0x7f0000ff9000/0x6000)=nil, 0x6000, 0x1000000, 0x13, r3, 0x10000000) syz_io_uring_submit(r10, r11, &(0x7f0000001000)=@IORING_OP_TIMEOUT={0xb, 0x3, 0x0, 0x0, 0x3, &(0x7f0000000fc0), 0x1, 0x1}) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, &(0x7f0000001040)=0x2, 0x4) ioctl$TCSETS(r3, 0x5402, &(0x7f0000001080)={0x45a29dab, 0x5, 0x3, 0x3, 0x11, "9dd9db3123d0e2b7aa87063a2f793c36e5b5c3"}) getsockopt$inet_sctp_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f00000010c0)={0x0, 0xfe, "4f05f5c4e4bd236cad1e9e3ed8d6f364bbf7ee7425eab08dfdfd019c617d6e61185fd2e20e8fd82c4553524989642d2aca5cc9dc6176125d34d89f4370c7ac4aad131861c876a9450f3eb40f42f855885e8b82fac1e22fe073c540b9c71dc62fee7d0bc49a4284a24d659742709490799d9f9968f6b6ab7ec448a873ac6decbd1eeeb9c82f2b2c03f06d901c0c7ed7fb172b501fb558dd3ecaa9a2e5edb92a4f03bac83be02b10eb8deb29441051c6eb4f128f3e17ad5001b66b041d6446180dfa68f487bf28e9b8ebfb9f6f10f7628545edd24041c28ef0e9b5268ada5cc950005ebfdb4c12945217779aea0b33b996118b83c8ad0a87d999be6b9e3711"}, &(0x7f0000001200)=0x106) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f0000001240)={r12, 0x3}, 0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r3, 0x84, 0x76, &(0x7f0000001280)={r12, 0x8}, &(0x7f00000012c0)=0x8) io_uring_register$IORING_UNREGISTER_BUFFERS(0xffffffffffffffff, 0x1, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000001300)={r13, 0x6}, 0x8) unshare(0x40000600) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nfc(&(0x7f0000001380), 0xffffffffffffffff) sendmsg$NFC_CMD_DISABLE_SE(r14, &(0x7f00000014c0)={&(0x7f0000001340), 0xc, &(0x7f0000001480)={&(0x7f0000001440)={0x24, r15, 0x4, 0x70bd2b, 0x25dfdbfb, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_DEVICE_INDEX={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) 15.724261925s ago: executing program 0 (id=5396): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x16, &(0x7f0000000000)='/proc/0\x01\x00\x00\x19\xd9_,\xae\xf4t\x00AE\xf44'}, 0x30) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0x6de4, &(0x7f0000000180)={0x0, 0x95d3, 0x0, 0x2}, &(0x7f00000000c0), &(0x7f0000000140)) io_uring_enter(r2, 0x0, 0xe38e, 0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x12}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) 13.714731032s ago: executing program 0 (id=5403): r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x10, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000900)=0x0) sched_setscheduler(r3, 0x6, &(0x7f0000000940)=0xbb68) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d0301000000000095000000000000006916000000000000bf67000000000000350607000fff07206706000005000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d849f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0xffffffffffffffd2, 0x10, 0x0, 0x38, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r5 = msgget(0x0, 0x229) msgsnd(r5, &(0x7f00000000c0)={0x1, "ae42b21e7429ed0a16d400f280b8fda425744a99ec6a8151e3a5a35da677c758f09017382e5875c5dbe94b7e41357105764edcde58c276e4d04faa3e1f279d140ba043874cd2a785402d5bed0da15ac08192edafb77a5673cf2f0d75ba28b83fda3bc0aefb0fc14e8e942429466b4a7c7a42113d75482e8bf1d6e3c607d926c8ed831b2f4b5ce0ac09545797e8030bed1fe3114773c94ddb97a84e5265fccdcc44c3f34028fc778b1821b12ab5cdd6c39aa71d098e1a2ff95d30f37a3a0305cae3c8082225e0371368dced0537aaaa5a296d7a78e4115529fb9d65b1ab2027617dd6301b7073ba561a697df10b7c74e4dc9e7ba1cca2ae00d607362cc0b80c2066ca903d1f9a5f5262eb03eb96d870504b16752665e90d6ed7808c91823a064b688cf87254f2746f295ed36c8e41c7d30cb9c6ca4781603758148ef9a43226ddb021bf664321f3cd88ad48a464be534896c737aa7279f47ae6636f4bd276ac948e1985d33aec47457dd4165482f7634da41357cc0038c1db25b457dae5d197bf3e31892533dfca3a853aab9538643f905cfa462af11cb1f5099cb37ae38979a1818728df96e4b69086ad8dd842971509de353b4a8e2113449b993cfafd43782dedf9b56f5bf29682efd480c0d555dab2058176ba79e674c3231977843e294c41e3b4e03dfcfac72e17b359e788079cf74b274cb28f9e8597f088bfe004976f28cb9f4972477531670ae303dc1e89b479ff4b7bb43eb51c6d6a48e714888edd851bd9437b8b208068cc8e10dcdf22e7dceae489b550156312fa989bb8287a99c76ba90e0b0c4a6e215d1cc762140667d7bb2579debd96b78475354646912929018a48e5acd460830b4fe755f004d01bd209d9b2713dbc3d2aeb2031bdcc494f54debc4b852475fd9cc57132981056d60e0e1b0fe2e7a9c49a8a3079cabdd6794a30a08192fd99a2f123658ac11c3e4afa346f37df5aed5786bf93224700fbd7f0459fe4365a506fa2d8c0c3826648c0f370ff372ab88a7e8758d39b8899fc1ec83521b0c2175a927e187bb160874a166c24f4fc540749d55fd76605bee455d3e1ba3e6874af072a9eb9a2b275addb5a0ad0e9a8d78c776e8f98fd5e3edf24549742086da19476c88449574e1ebe32e806f29552278ce04a7c05323fbcfc078465b31bfffa290a6c7e7b788aa6349c5f7665e64adbaeba4a44299448871a2027cea14c6398791de919707821dc1e02797418ff6e4a95e2ce5b8bdb78d82a0a1c845e024c0664b22b6788be8dbffe931d5c0da486930785ad56b1546ad6ca3634872fce825204db774c48d2d4de89101e0f11674af40cf213885492b15c37c9d2d913b94371cca132d45ad6e8a43f64487b039c6be56e1b2b9556309aa853fe07ff24f9256a0a82c403c20469d3ecd88c7bc27b4ba1dec8509c1acbf695ea00eb98f44dd49238bdd95c0c643e4856f95fb217f589f696c34cc638f59dafb925084804855804ca22fa5e6418be3494bad65918b8c2e787083aec9dc1db8d480b74ccbad2d34f22530e622f5f19c7c398fed08c00ce8f98afa25d073a588f3ea4c42a15af599251e02254282c716711ce9a27191d00a24e958a5362578ca96afc88954e5c7bf96b164a9be99cb757fb12e70668e8b79c1cc8c425002376b53a985b88051cb093dd75a70b7278b67fdd320df0ada9ac3fe9bb5fec828e186607b212a857f7141f5490fd626faa82b52d539bdbb2c52b812d09cc1ef58b93b5ee8fb827374e22905a6cb7f10789c8aaff2a0c161b33dc0d14ce1c4f343bcf26a96623bc1b430e493a81ba7302a58c12d334fb20072b2c2f7f8f4399f02eac3f432de9a451fb2ce34605662586fb7703f7791979473bb0108e48a95232ffa05730b2820b7ac97bda421a8752674e2262d75e7798c1b726db98f8b2e6c8351dfd1d977ab90ef5757d97c34d5b00b9b0056a99af9513be87e509bf70bb52866a508b6666dc2f87bf9418161ad4aab1764bdc53027a2ba18307dab69250cd2858b35e7f779a2168e2e1a78947409d8acaab51990ec16f4ff85f4e28b9d1a0bb00d09f0500af3c1041265cd3d5cf64a36a376981262ba8c642aa0123eb893de783adc049d7faddfecc8f33597155dc834b92490bebc6cbbee2291608c36845726093e134b13be49d86e0e88b1b642109195837c775352466381b3b4e090f06b302c4dba50d0ed94b9cf8d1b2649e6fd9d3eba38ca8ec40bce09bfe729bbd5520a4ca02ff783d736ca6bb92534c6b579cd28d30bc2d4586c66a59a292b6a21e5de30c63c3f76be596495f987154bf4a077d73f67c4991af98eb0b40e48985509d69692b73e1b31b6cc25107031ed4d311bafe0a61c07f95f26f479d5203b796863ebe56501fbd4dfff0a65be918c2b0e6ef1c4c5c4f049aeff87b9049e64e7bf519095016c42470c8e14940717de2fd1122119f392d1acd3db28fbce7263826f14cd433f117758723c0adc04cbed425f53f7ec0a74f40e2959be957f87e71785338852aa494f0e37c51bf9fbd1335e1fbf13ec6ee245ee490dc6f9c47789df33a70210b4970cd2c39858cab39b079b989692f187681bfd404ccca029dd05a29028ec17a5cb3df3b634c3b08b663a2461ecba4f40e1593714f79ba89afa280a726c37cf3537949899510a5db5c06b847ab70b7405fe3fe9712c5c9eedc0b45edf747c1a0e0209a8ddb7c3211a70a0f81c8a160e244ec29eecb7d519ab15650d47468ebb18d6c3b4810ccb16124a56a06b8e9161dcee9e17474da889e0ecfe1f7cde30db3c7155ef9106d903edda5e6072bfb83a2ffabd8e2f8aeeb09b02cd0696861ad7705155da18cd2caa6d6bbd1e99c3c2827366c42160a2b9a63529d8bfc7e"}, 0x802, 0x800) bind$tipc(r1, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) sendmsg$tipc(r6, &(0x7f0000000540)={&(0x7f0000000200)=@name, 0x10, 0x0}, 0x0) r7 = socket$tipc(0x1e, 0x5, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000003c0)="9f", 0x1}], 0x1) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 11.323895671s ago: executing program 9 (id=5408): mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mkdir(&(0x7f0000000380)='./file1\x00', 0x8a) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) r1 = memfd_create(&(0x7f0000000880)='C\x13\xfc2\x95WD\xaa\xba^\x90\xfd\x8d\xc2\xb1[\x81\xda\xda\xd6\x8c\xc99\xec\x0e*||\xe4\xb3\xc4\xb6\v\xaa\x15\x86,\xac\x8d\x89cu\x10\xdc\x93\x9b\xb4\x93\xafE*:\xe4\xdd\xa5\xa75\xb8\x1e;7\xb7.V\xdcrw[\r\x98\x93j\x9c\xf6\xf8\x99\xefF_\xcd\xdf!b\xc5\xec\ntb\xff\b\xaaF?!\x9f\a\x1a\x03\f\xe94\x1deU\x06zS\xc9\xb4\xa7@\xa1\\B\xc2@\r_b\x9a\xeb\b\xa4(V\xd6/N\xc5\xc6f\xb1\x95Z\xe5w^\xd8\xe7J]\xf7\xae\xafuv\x84\x9eG\xd1\xe7\x9b\xf0_9\xc2\x9b\xfd\xc3\xf3\xe4\x95P\xf1m\xcf\xc2\xe1\xe6\xa6\x8c\x11\xfb\xb8S\x8b\x92\\\asW-Ee\x02\x00\x00\x00\xd0;Q\xc1~\x89\xec\xc8\x9b\x88\a\xf2\x93\x82(\x8b\x00\xd8\xb4T\x80\x95\x93i|\xc0\x00\x04\x00\x00\x00\x00\x00\x00v\xef\xee+\xab\x9c\x00^R\xb2n?i=\xbe\x16\x8a\xbf\xe3\xcdB\xed\xe14\xe8\xd0\xb7\xff\xfeQ\x1c\x85n8\x1b\xc1\b\x00\x00\x00\x00\x00\x00\x00\x17\x94\xdfW\x92z\xbe\xb2R)\xf1K\xd7\xaf\x99\xf6d\xe8\xec\xb7\xbd+T3\xa6\xa9\xfaY-1qs\x82\xefn*\x96\xc9\x1e\xf4\xd1\x02Dt\xc0\x19\xf7\x89\x96.D [F\xeeYW\x95\x13\xc7;\xb5\x13^\x13\xcb\xf0C\x9c\xabf\x1daCS2\x02\xb0\xef\xc7\x8c\x9e\xed\a\n0x0}) sendmsg$NL80211_CMD_DISCONNECT(r5, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16, @ANYBLOB="200028bd7000ffdbdf253000000008000300", @ANYRES32=r6, @ANYBLOB="0c0099000000000042000000060036000f000000060036002e00000006003600420000000600360002000000060036002c000000060036002400000006003600260000000600360014000000"], 0x68}, 0x1, 0x0, 0x0, 0x810}, 0x2000c804) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)={'bridge_slave_0\x00'}) socket(0x10, 0x80000, 0x1) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r8, 0x0, 0x118) write$UHID_CREATE2(r7, &(0x7f00000001c0)=ANY=[], 0x118) 10.194233692s ago: executing program 9 (id=5412): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x80000000003, 0x101301) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x56a, 0x84, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000380)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000070000000700c82783196230b5b0f9126ab2077334c3edb62864200ec0aa64d70635fd55a2c60aeda23200000000000000dee98d87d7e4d26f59ea69d60ca0eefe54fef5ed9191cfcf0fbc2158dd60e32e33b3ba6efc018b7e30076093dbb64d2b4155e13ee9ed367b7ce9ad6e876354e6bdffa5a2b2b4134740398ce665d5e567d42401f1cc75"], 0x0, 0x0, 0x0, 0x0}, 0x0) ioctl$USBDEVFS_FREE_STREAMS(r0, 0x802c550a, &(0x7f0000000080)=ANY=[@ANYRESOCT=r0]) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) ioctl$USBDEVFS_REAPURBNDELAY(r0, 0x4008550c, 0x0) 7.773728672s ago: executing program 5 (id=5418): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x20, 0x4, &(0x7f0000001ac0)=ANY=[@ANYBLOB="1800000000000000000000000400000091100600000000009500"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000000)={0x2c, r1, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_LINKINFO_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20009005}, 0x4000080) 7.754929013s ago: executing program 0 (id=5419): syz_usb_connect$hid(0x0, 0x6c, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000000000040b827ed0100000000"], 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000194ed710d51dd16976fd8f1a44c302c13384010203010902120001000000000904f70000114afe0021b7d38d1e92b1f2c1d2466c3f4ab6b3a318f3324567ca5ca25c31c70ac619fe4adb5755b63f580239250cc5114fba756911a4dc9a98dbd1f3776da2649bf1efb6eb69291b85f3d84a2d8a906652f8a88ef18de789f93d7825d4254203bb723fd26ccbe5c0b48a27b8ad4af53e92d6a1589e4f68b7ae4e14445a00e8e65bcb7721d2271ac796eb02bd1b94b4dc286e6b5a770c864ad122f3648b154ddb84997766ffc4bfd117c9af6c8267152719ce848929e6882b3daca945364bdf36"], 0x0) ioperm(0x200, 0x10, 0x100000004) socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000005f40), 0x0, 0x24000880) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x1ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) keyctl$dh_compute(0x17, &(0x7f0000000000), 0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)={'sm3\x00'}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000003d0007010000000000000000027c0000040000000c000180060006008035"], 0x24}}, 0x0) 6.995154338s ago: executing program 5 (id=5420): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x28000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001140)={'batadv_slave_0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6, &(0x7f0000001240)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0xbf, 0x8, 0x8, &(0x7f0000001300)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001500)={'ip6tnl0\x00', &(0x7f0000001480)={'ip6gre0\x00', 0x0, 0x2, 0x7, 0x0, 0xbd, 0x1b, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @remote, 0x8, 0x40, 0x4, 0x101}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001540)={'wg0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r7, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYBLOB="84000000", @ANYBLOB="37040000000000000000010000006800088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392208000100", @ANYRES32=r8], 0x84}}, 0x0) 5.47757308s ago: executing program 5 (id=5424): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000), 0x1c3a04, 0x0) read(r0, &(0x7f00000019c0)=""/4093, 0xffd) socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000240)={0x2, "d2c40184521de22900ef000400000000001624a89e0000000000000000000200", 0xffffffffffffffff}) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000002c0)={0x3, "421ae3753785259249154c944122ad063ff47d3bd7a8a45d6bb4c78a3ab4c981", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000000c0)={"fd0d1af889b4ea07001900005e99e47ac49e4906eddf9edd00004000000029e9", r5, 0xffffffffffffffff}) poll(&(0x7f0000000080)=[{r5}, {r6}], 0x2, 0x0) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f0000000180)=0x8) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) sendto$packet(r1, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x4000010, 0xffffffffffffffff, 0x8000000) 5.338626564s ago: executing program 5 (id=5425): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7a, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) setsockopt$sock_int(r0, 0x1, 0x8, 0x0, 0x0) sendmsg$inet(r0, &(0x7f0000000b40)={0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000000)="14fafa37bf25f04bda99eefbf2930f3151214ef6fdee25bdb2d1873ce347c7b623dd3140cfb20100a1bf9f1dc2375e3c49a4e7ffab4ed7181100", 0x3a}, {&(0x7f0000000240)="16a6fca1943502d7ac24a672321690c0215b73b201e67576ef51abd7cb2bcd21ebc41893e255eea9bba2639084f4dec0", 0x30}], 0x2}, 0x24000090) sendto$inet(r0, &(0x7f00000012c0)="09268a927f1f6588b967481241ba7860fcfaf65ac618ded8974895abeaf4b4834ff922b3f1e0b02bd67aa03059bcecc7a95425a3a07e758044ab4ea6f7ae55d88fecf90b1a7511bf746bec66ba", 0x20c8, 0x11, 0x0, 0x27) 4.668999596s ago: executing program 9 (id=5427): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) r0 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xdef0, 0x8000000000000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) read(r0, &(0x7f0000000640)=""/222, 0xde) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000500)=0x4) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) socket$inet6(0xa, 0x3, 0x8000000003c) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r5 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r5, 0xc06864a1, &(0x7f0000000380)={0x0, 0x28, r6, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r5, 0xc06864ce, &(0x7f0000000440)={r7, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x0, 0x0, 0x0, 0x400]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000540), 0x4000, 0x0) mount$9p_fd(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000740)=ANY=[@ANYBLOB="7472616e733d7e642c7266646e6f3d172182ae62ad9b9577d2936774243e4967fd81675ce76ff0b77676b23380dfc08b0ebdbe7b8e90780f815dcbc3d0c5c5ed72316bd1f57671e017ee64452a2d9f01cffff732ab11593da91f32950f641515aec47803b7f940bfa8528d6104bc99ab2c12e8d410483422f3ceba1fd902d2c07c52e23b0d72888062a1011e1fdf7d19e2fc602f15e2ffb07ed893ca50f249bfc251a6", @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYBLOB=',appraise_type=imasig,smackfshat=/dev/dri/card#\x00,fsmagic=0']) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r4, 0xc00c642d, &(0x7f0000000080)={r8, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r5, 0xc06864ce, &(0x7f0000000200)={r7}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r5, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r9}) 4.562081986s ago: executing program 5 (id=5428): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000001080)=@newspdinfo={0x1c, 0x24, 0x2478a943661bf01f, 0x0, 0x0, 0x0, [@XFRMA_SPD_IPV6_HTHRESH={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 4.508496702s ago: executing program 0 (id=5429): r0 = socket$tipc(0x1e, 0x2, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x10, 0x0, 0x0) ioctl$sock_SIOCGPGRP(r1, 0x8904, &(0x7f0000000900)=0x0) sched_setscheduler(r3, 0x6, &(0x7f0000000940)=0xbb68) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = syz_open_dev$MSR(&(0x7f0000000380), 0x0, 0x0) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000000e00)=ANY=[@ANYBLOB="61154c000000000061138c0000000000bfa000000000000007000000080000002d0301000000000095000000000000006916000000000000bf67000000000000350607000fff07206706000005000000160302000ee60060bf350000000000000f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dc725f431bcab0ef59b8f0e431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932b3a6aa0100000000000000b93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4ffcae1a8a793a7795a9214a92f66e9cc54db6c7205a6b068fff496d2da7d632bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db88aa3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4ff139604faf0a4da65396174b4563d54b52f06c870edf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2b517dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc3086936d7637e07c4a2a3bc87b0da23c00d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61dc18402cde8bf777b2eaa45c940aabc86b94f8cbde4d470667bee722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154baa8e51489a614e69722bac30000000000000000000000000000a006b178438e930b2494db1bf624a70a19a45b8b71869afb13cb2ac1d2f3ec0d93a3e4fd0ad076c7d849f218aa6ba8ec5e58b7c64dc8616127087901dc65418a4b25bfa7ae8b5ad9642815f319230425e8bd89c6983d816d97d81a739917eecd26f9a3aecaf0acdaf6cffab38eae3b10b122b4bf521a46bf01a0c136f745113b589459fbe1666087a7c554a55e2b42ab7e405a77f405a348a64e356b7fb61e48ea9c87bf13f97052c51fdd49f3dbccf9874cf61807ae4b1665ccdd026d4580a068395e8cb851eeadb1da6d1009513ca73a685c66fb15f27eb74a7a4eb5966e3ef4be3ca8ba81b2d17d797265390ce616c3d7b566fe956fb93c6a43f4dc6bfc194daeb7b998d550773bc14aca"], &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x4}, 0xffffffffffffffd2, 0x10, 0x0, 0x38, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r5 = msgget(0x0, 0x229) msgsnd(r5, &(0x7f00000000c0)={0x1, "ae42b21e7429ed0a16d400f280b8fda425744a99ec6a8151e3a5a35da677c758f09017382e5875c5dbe94b7e41357105764edcde58c276e4d04faa3e1f279d140ba043874cd2a785402d5bed0da15ac08192edafb77a5673cf2f0d75ba28b83fda3bc0aefb0fc14e8e942429466b4a7c7a42113d75482e8bf1d6e3c607d926c8ed831b2f4b5ce0ac09545797e8030bed1fe3114773c94ddb97a84e5265fccdcc44c3f34028fc778b1821b12ab5cdd6c39aa71d098e1a2ff95d30f37a3a0305cae3c8082225e0371368dced0537aaaa5a296d7a78e4115529fb9d65b1ab2027617dd6301b7073ba561a697df10b7c74e4dc9e7ba1cca2ae00d607362cc0b80c2066ca903d1f9a5f5262eb03eb96d870504b16752665e90d6ed7808c91823a064b688cf87254f2746f295ed36c8e41c7d30cb9c6ca4781603758148ef9a43226ddb021bf664321f3cd88ad48a464be534896c737aa7279f47ae6636f4bd276ac948e1985d33aec47457dd4165482f7634da41357cc0038c1db25b457dae5d197bf3e31892533dfca3a853aab9538643f905cfa462af11cb1f5099cb37ae38979a1818728df96e4b69086ad8dd842971509de353b4a8e2113449b993cfafd43782dedf9b56f5bf29682efd480c0d555dab2058176ba79e674c3231977843e294c41e3b4e03dfcfac72e17b359e788079cf74b274cb28f9e8597f088bfe004976f28cb9f4972477531670ae303dc1e89b479ff4b7bb43eb51c6d6a48e714888edd851bd9437b8b208068cc8e10dcdf22e7dceae489b550156312fa989bb8287a99c76ba90e0b0c4a6e215d1cc762140667d7bb2579debd96b78475354646912929018a48e5acd460830b4fe755f004d01bd209d9b2713dbc3d2aeb2031bdcc494f54debc4b852475fd9cc57132981056d60e0e1b0fe2e7a9c49a8a3079cabdd6794a30a08192fd99a2f123658ac11c3e4afa346f37df5aed5786bf93224700fbd7f0459fe4365a506fa2d8c0c3826648c0f370ff372ab88a7e8758d39b8899fc1ec83521b0c2175a927e187bb160874a166c24f4fc540749d55fd76605bee455d3e1ba3e6874af072a9eb9a2b275addb5a0ad0e9a8d78c776e8f98fd5e3edf24549742086da19476c88449574e1ebe32e806f29552278ce04a7c05323fbcfc078465b31bfffa290a6c7e7b788aa6349c5f7665e64adbaeba4a44299448871a2027cea14c6398791de919707821dc1e02797418ff6e4a95e2ce5b8bdb78d82a0a1c845e024c0664b22b6788be8dbffe931d5c0da486930785ad56b1546ad6ca3634872fce825204db774c48d2d4de89101e0f11674af40cf213885492b15c37c9d2d913b94371cca132d45ad6e8a43f64487b039c6be56e1b2b9556309aa853fe07ff24f9256a0a82c403c20469d3ecd88c7bc27b4ba1dec8509c1acbf695ea00eb98f44dd49238bdd95c0c643e4856f95fb217f589f696c34cc638f59dafb925084804855804ca22fa5e6418be3494bad65918b8c2e787083aec9dc1db8d480b74ccbad2d34f22530e622f5f19c7c398fed08c00ce8f98afa25d073a588f3ea4c42a15af599251e02254282c716711ce9a27191d00a24e958a5362578ca96afc88954e5c7bf96b164a9be99cb757fb12e70668e8b79c1cc8c425002376b53a985b88051cb093dd75a70b7278b67fdd320df0ada9ac3fe9bb5fec828e186607b212a857f7141f5490fd626faa82b52d539bdbb2c52b812d09cc1ef58b93b5ee8fb827374e22905a6cb7f10789c8aaff2a0c161b33dc0d14ce1c4f343bcf26a96623bc1b430e493a81ba7302a58c12d334fb20072b2c2f7f8f4399f02eac3f432de9a451fb2ce34605662586fb7703f7791979473bb0108e48a95232ffa05730b2820b7ac97bda421a8752674e2262d75e7798c1b726db98f8b2e6c8351dfd1d977ab90ef5757d97c34d5b00b9b0056a99af9513be87e509bf70bb52866a508b6666dc2f87bf9418161ad4aab1764bdc53027a2ba18307dab69250cd2858b35e7f779a2168e2e1a78947409d8acaab51990ec16f4ff85f4e28b9d1a0bb00d09f0500af3c1041265cd3d5cf64a36a376981262ba8c642aa0123eb893de783adc049d7faddfecc8f33597155dc834b92490bebc6cbbee2291608c36845726093e134b13be49d86e0e88b1b642109195837c775352466381b3b4e090f06b302c4dba50d0ed94b9cf8d1b2649e6fd9d3eba38ca8ec40bce09bfe729bbd5520a4ca02ff783d736ca6bb92534c6b579cd28d30bc2d4586c66a59a292b6a21e5de30c63c3f76be596495f987154bf4a077d73f67c4991af98eb0b40e48985509d69692b73e1b31b6cc25107031ed4d311bafe0a61c07f95f26f479d5203b796863ebe56501fbd4dfff0a65be918c2b0e6ef1c4c5c4f049aeff87b9049e64e7bf519095016c42470c8e14940717de2fd1122119f392d1acd3db28fbce7263826f14cd433f117758723c0adc04cbed425f53f7ec0a74f40e2959be957f87e71785338852aa494f0e37c51bf9fbd1335e1fbf13ec6ee245ee490dc6f9c47789df33a70210b4970cd2c39858cab39b079b989692f187681bfd404ccca029dd05a29028ec17a5cb3df3b634c3b08b663a2461ecba4f40e1593714f79ba89afa280a726c37cf3537949899510a5db5c06b847ab70b7405fe3fe9712c5c9eedc0b45edf747c1a0e0209a8ddb7c3211a70a0f81c8a160e244ec29eecb7d519ab15650d47468ebb18d6c3b4810ccb16124a56a06b8e9161dcee9e17474da889e0ecfe1f7cde30db3c7155ef9106d903edda5e6072bfb83a2ffabd8e2f8aeeb09b02cd0696861ad7705155da18cd2caa6d6bbd1e99c3c2827366c42160a2b9a63529d8bfc7e"}, 0x802, 0x800) bind$tipc(r1, &(0x7f0000000100)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) bind$tipc(r0, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r6 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r0, 0x10f, 0x87, &(0x7f0000000000)={0x42, 0x0, 0x3}, 0x10) setsockopt$TIPC_GROUP_JOIN(r6, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) sendmsg$tipc(r6, &(0x7f0000000540)={&(0x7f0000000200)=@name, 0x10, 0x0}, 0x0) r7 = socket$tipc(0x1e, 0x5, 0x0) writev(r0, &(0x7f00000001c0)=[{&(0x7f00000003c0)="9f", 0x1}], 0x1) setsockopt$TIPC_GROUP_JOIN(r7, 0x10f, 0x87, &(0x7f0000000180)={0x42}, 0x10) setsockopt$TIPC_GROUP_LEAVE(r0, 0x10f, 0x88) 4.474164817s ago: executing program 6 (id=5430): ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, 0x0) r0 = socket$inet6(0xa, 0xa, 0xaba) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, r0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) getsockopt$inet_pktinfo(r1, 0x0, 0x7, 0xffffffffffffffff, 0x0) socket$inet6(0xa, 0x3, 0xff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) fcntl$dupfd(r3, 0x406, r1) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/slabinfo\x00', 0x0, 0x0) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$sock_linger(r7, 0x1, 0xd, &(0x7f0000000080)={0xfffffffd, 0x80000801}, 0x8) bind$bt_sco(r7, &(0x7f0000000400), 0x8) listen(r7, 0x0) close_range(r6, 0xffffffffffffffff, 0x0) socket$key(0xf, 0x3, 0x2) 3.061767435s ago: executing program 9 (id=5431): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000040)={0x0, 0xffffffffffffffff, 0x0, 0x16, &(0x7f0000000000)='/proc/0\x01\x00\x00\x19\xd9_,\xae\xf4t\x00AE\xf44'}, 0x30) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = syz_io_uring_setup(0x6de4, &(0x7f0000000180)={0x0, 0x95d3, 0x0, 0x2}, &(0x7f00000000c0), &(0x7f0000000140)) io_uring_enter(r2, 0x0, 0xe38e, 0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS_UPDATE(r2, 0x10, &(0x7f0000002d80)={0x0, 0x0, &(0x7f0000002cc0)=[{0x0}, {0x0}], 0x0, 0x2}, 0x20) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={0x60, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}, @IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x12}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}]}, 0x60}}, 0x0) 2.936255414s ago: executing program 6 (id=5433): syz_usb_connect$hid(0x0, 0x6c, 0x0, 0x0) ioperm(0x200, 0x10, 0x100000004) socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x1ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x24}}, 0x0) 2.812466672s ago: executing program 2 (id=5434): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x28000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001140)={'batadv_slave_0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6, &(0x7f0000001240)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0xbf, 0x8, 0x8, &(0x7f0000001300)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001500)={'ip6tnl0\x00', &(0x7f0000001480)={'ip6gre0\x00', 0x0, 0x2, 0x7, 0x0, 0xbd, 0x1b, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @remote, 0x8, 0x40, 0x4, 0x101}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001540)={'wg0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYRES16=r7, @ANYBLOB="37040000000000000000010000006800088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392208000100", @ANYRES32=r9], 0x84}}, 0x0) 2.399837862s ago: executing program 2 (id=5435): r0 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000000), 0x1c3a04, 0x0) read(r0, &(0x7f00000019c0)=""/4093, 0xffd) socket$packet(0x11, 0x2, 0x300) r1 = socket$packet(0x11, 0x3, 0x300) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000240)={0x2, "d2c40184521de22900ef000400000000001624a89e0000000000000000000200", 0xffffffffffffffff}) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f00000002c0)={0x3, "421ae3753785259249154c944122ad063ff47d3bd7a8a45d6bb4c78a3ab4c981", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f00000000c0)={"fd0d1af889b4ea07001900005e99e47ac49e4906eddf9edd00004000000029e9", r5, 0xffffffffffffffff}) poll(&(0x7f0000000080)=[{r5}, {r6}], 0x2, 0x0) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f0000000180)=0x8) setsockopt$packet_int(r1, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) sendto$packet(r1, &(0x7f00000002c0)="05031400d3fc140000004788031c09102c28", 0xfce0, 0x4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) mmap$IORING_OFF_CQ_RING(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x1, 0x4000010, 0xffffffffffffffff, 0x8000000) 2.275735s ago: executing program 2 (id=5436): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat2(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x62a41, 0x8}, 0x18) r2 = fcntl$dupfd(r1, 0x406, r0) getsockopt$SO_COOKIE(r0, 0x1, 0x39, &(0x7f0000000040), &(0x7f00000000c0)=0x8) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x6) r3 = getpid() sched_setscheduler(r3, 0x5, &(0x7f0000000400)=0x4) mmap(&(0x7f0000291000/0x2000)=nil, 0x2000, 0xb635773f07ebbeee, 0x80010, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) socketpair$unix(0x1, 0x2, 0x0, 0x0) bind$tipc(r2, &(0x7f0000000100)=@id={0x1e, 0x3, 0x1, {0x4e22, 0x4}}, 0x10) prctl$PR_SET_SECUREBITS(0x1c, 0x30) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f00000001c0)) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x50) r5 = add_key(&(0x7f0000000100)='rxrpc_s\x00', &(0x7f0000000180)={'syz', 0x3}, &(0x7f0000000240)="f0961e245c1349e19a9f0525bb2f34c31d56da64983e5e9b308170a442834ec927568395fcfdddfec043f0b5b52bca95bb3d309729425f6eb9b4b59c98599aca15541a1c0530afc12890f408d9ebe4957c8863ca911fb3e19147b1667565fc0fab1e096e77b5791aa842bad9795d6a81afa32141267e76fe169f9a48aaa53cc4e2f1b2744a246dcc4b7583293fadb67c90170675", 0x94, 0xfffffffffffffffe) keyctl$get_security(0x11, r5, &(0x7f0000000300)=""/118, 0x76) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) ioctl$IOCTL_STATUS_ACCEL_DEV(0xffffffffffffffff, 0x40046103, &(0x7f00000000c0)={0x1, 0xfffffff8, 0x8, 0x7, 0x7, 0x9, 0x3, 0x4, 0x74, 0x4, 0xaf, "cb79016b26c50c758d667e5a9a0f852026b79638c0c0bb720cf13a46eac9add9"}) r6 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r6, 0x40045532, &(0x7f0000000040)) prctl$PR_SET_SECUREBITS(0x8, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 2.134123237s ago: executing program 6 (id=5437): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000100)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) mount$tmpfs(0x0, &(0x7f0000000240)='./file0\x00', &(0x7f0000000280), 0x0, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x1, 0x8, &(0x7f0000000780)=ANY=[@ANYBLOB="7a0af8ff75257000bfa100000000000007010000f8ffffffb702000005000000bf130000000000008500000006000000b700000000000000950000ff00000000b25952850a84a70002b2ab3d6ffaa6ead0169191d54f8196217fc563e2fc91f6da4dad4fdc2eb1b5986fc44bc25fb591cf77b9dfb379a3f611dbc2a364916f098dab10b1a297cf528666d1ddd73f30f2382f6cda4bfdd45be583823c0f092248a57d48621f3c1c65ee19ee875daf45006a4c4ea5e15b2f9618d547244a22000000000800db583620ce7243d1aebdb638d91dbef6619358399aa9c2acd068c03efefd8bc77edf2d34b12cd48a1b20fb7dd843267e0331759f4ec6b5b0af58e604f494eff289026d5045ef08000000000000007718a09f4886afc26abba34635d0e8b598a51bc742135a6e1d33fe226c944bc76be40d435aa8b5202db761014b1b999a12df6bee431a6681000000263b6233e1c0fe30e384c3cb07b74a72291a1a2b523dd81b6651b1ee48e999bb004823ebcd8c65743f31f84b263ab9b3426692d01ad194f302d7a658e9e54687d3c56d7bedb6b2f25ddb8c640bb321a402058c9221b6870814cf4ee23ddb79fff5eb156e0a000000000000f2bd1d4a178d86d6935eb8b75bc4eb680d10e8b6a54c6c8674caf63ff76622939a20d4aadf85db40179c2cf83ee07e30a279d8f9f3bc282deb43a03409f8e6972f3f720d045923702cede0f3e91411f3f1b16f065624f280a7dcce8db910f93c49b9e0b6dd7356aa79d5fabb5c0d0da6d719d7e0efb2bb713d18242cd5df6ca53307a4cdd91be4587f90e317c8de5e5c3933fd5d5bf38f6b9fc39fc829dcfe4af8ac5fbb7314a7a433e0182767d1786eda2b20"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x2000d00, 0xe, 0x55, &(0x7f0000000140)="a06ad876d56a0064d082778c3938", &(0x7f0000000380)=""/85, 0x0, 0x4000000}, 0x28) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x89101a, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0/file0/file0\x00', 0x0, 0x80700a, 0x0) umount2(&(0x7f0000000300)='./file0/../file0\x00', 0x2) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="44010000100001000000000000000000ff02000000000000000000cc61ee2400000000010000000000000000000000000000000100"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000000100000000000000000000000000000000010000000000000000000000000000000000000000000000fdffffffffffffff000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000048000200656362286369706865725f6e756c6c29000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c000800aaff0800007f0000"], 0x144}}, 0x4008080) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="000000009002010014001a80100002800c00018008001d008600000008001b95829c6300"], 0x3c}}, 0x0) 2.024308559s ago: executing program 2 (id=5438): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000000040)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) r0 = socket$inet6(0xa, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xdef0, 0x8000000000000000}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) read(r0, &(0x7f0000000640)=""/222, 0xde) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r4}, 0x10) socket$inet6(0xa, 0x3, 0x8000000003c) syz_open_dev$dri(&(0x7f0000000080), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r6, 0xc06864a1, &(0x7f0000000380)={0x0, 0x28, r7, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, &(0x7f0000000440)={r8, 0x0, 0x0, 0x0, 0x0, [0x0], [], [0x0, 0x0, 0x0, 0x400]}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000140)={0x3ff, 0x2, 0xb5}) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000540), 0x4000, 0x0) mount$9p_fd(0x0, &(0x7f0000000340)='./file0\x00', 0x0, 0x1, &(0x7f0000000740)=ANY=[@ANYBLOB="7472616e733d7e642c7266646e6f3d172182ae62ad9b9577d2936774243e4967fd81675ce76ff0b77676b23380dfc08b0ebdbe7b8e90780f815dcbc3d0c5c5ed72316bd1f57671e017ee64452a2d9f01cffff732ab11593da91f32950f641515aec47803b7f940bfa8528d6104bc99ab2c12e8d410483422f3ceba1fd902d2c07c52e23b0d72888062a1011e1fdf7d19e2fc602f15e2ffb07ed893ca50f249bfc251a6", @ANYRESHEX, @ANYBLOB=',wfdno=', @ANYBLOB=',appraise_type=imasig,smackfshat=/dev/dri/card#\x00,fsmagic=0']) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r5, 0xc00c642d, &(0x7f0000000080)={r9, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r6, 0xc06864ce, &(0x7f0000000200)={r8}) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r6, 0xc00c642e, &(0x7f0000000300)={0x0, 0x0, r10}) 1.829700181s ago: executing program 6 (id=5439): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x11, 0xc, &(0x7f00000004c0)=ANY=[@ANYBLOB="180000000000000000000000000001b518110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r1}, 0x10) r2 = mq_open(&(0x7f0000000680)='\r\x00elinu\xef\xe3elinux\x00\x96\xf6\x92\n#*\xac\x05|\xf8D\\\x9a\xe6[]L+\xf6\v\xe8\xf2\xd3\b\x15\n\xb8F!Q9o\x1f#\xbdt\r\xfb\"\x18%\xfdM\xaf_t\xd2\xdcJ\x10\a\xbab\x1a\xdf\xb1\xbdU\xd7jo\xe7\xac\x81\x10k\xce-\xf5@\xbb\x9d;\xe8\xf6\xffQ\x04\xaai\x92k\x1b;\xddM\xa2\xe1-\x0e\xd8\xde\x00\xff\x18\xdd\bL\xfb\xa2\x1e\xd8\xdfJ\xcc\xd7\x9b\xfa\xf0\x0f\x05\xf1\xc4 \xde@\x80q\xf7\x04\xf5\x85T\x1f\xc2S]*\xc9lw\xd3J\xc5\xe8\x02\xcb\xbbAHxr\xac\xb77F\xdf\x1c\xcb\xd4\xce\x88L\xf1\xf9[\x98\xd4+pTx\x95\xb5\x1b]x\x1a\x95\xe1c6\xe7`83\xb7n#\xe0\xc1_\xec\xba\xec\x87\x1b\xde\a\x8b\xc5\x86woo\xbc\x1c\xa3r\x82\xf3enq-\x90/\xed\xff\xad+\x03\x10\t\xda\xfd\xa2\xd0\xef4\n%\xf1\xd8\x99$\xfb(\x9b5\xcbF4?O\x1d\xd7\x01*\xc9\xd6L\x86 \x1b\xab9\x1b\x12k\xf9\xec\xd8\x16E\x11-\xfd\x10\x89\x8d\xccbP\x14\x89w\xef\x90\x1d\xc9\x02\xeb\x01V\xfbm\x86\x8a\xc1.m\xd0\xa2\xa4\xc9\a;(\n\xc0\"\x1f\xe4\x1d\x85\xb3\x95\xec\xbb\x9b\x01\x85\xffx\xf2\a\f=\xd1\xcf\xec\xb8!\v\x958\xbf\x15b-\x92\xd6\xb5\xbf\xe2\x92\xc2\xa3}\xd0;\xd1\x96\x86\x8a\x1b\xe1w\xf9\xb0\xd2\xab\xc9\x8a\x19\n\xc5o\x1e\x13/\xe4\x91\x7f\xa5\xf1\xddW\xdb\x98\xcd\x94\xfc\x90\xa0\x05*', 0x6e93ebbbcc0884f2, 0x15b, &(0x7f0000000040)={0x0, 0x1, 0x5}) mq_getsetattr(r2, &(0x7f0000000300)={0x800, 0x0, 0x1}, 0x0) mq_timedreceive(r2, &(0x7f0000000340)=""/195, 0xc3, 0xfffffffffffffffc, 0x0) mq_timedreceive(r2, &(0x7f0000000100)=""/92, 0x5c, 0x4, 0x0) 1.087844189s ago: executing program 2 (id=5440): unshare(0x20000400) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) (fail_nth: 1) 984.187004ms ago: executing program 0 (id=5441): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mount$bpf(0x0, &(0x7f0000000500)='./file0\x00', &(0x7f0000000540), 0x80, &(0x7f0000000800)={[], [{@smackfstransmute={'smackfstransmute', 0x3d, '^'}}]}) (fail_nth: 7) 912.518049ms ago: executing program 6 (id=5442): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r0 = socket$kcm(0x11, 0x3, 0x0) setsockopt$sock_attach_bpf(r0, 0x107, 0xf, &(0x7f0000000000), 0x4) sendmsg$kcm(r0, &(0x7f00000000c0)={&(0x7f0000000100)=@hci={0x1f, 0x0, 0x5}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000040)="27031c00590214000000002f1eafbcf706e105000000894f000f1102ee1680ca82973d2bd4b8bf4a8291a14b8a34f90186cee844000000080000000019b0fb0bba", 0x41}, {&(0x7f0000000440)="63f805d7649496db72959832930469edc7b7d050139bf7ada32bc9e37eed1153ecb716cdb8981cd819af0b33254465cc904b7b31789d65c0e0d3333ce2ef36205dd154e363bcadf8f2ea93f45503c6d9fd8dfe5a638cfeb9f79c930a4d18260e5a08ffd35ed8371cff78119319b2b62c7cd9378c73ae90c801681f55ef26cb0000000000000000", 0x87}, {&(0x7f0000000540)="fe112162c63e6da8bc8432294ef18af53cc330a62a2c7035246635093ba4d30fcf19a90804f04a10939db8f4e13069cda6d167bf1b68c94d8d694d6ad1a4d51a715975560ad48770706eb1b88d021e1119f2eb75275cfe77f862368649be0f7aff5e7826729816e3d3e7986d9434f891c71ca6e4210c6757083cfd8e732048c504f28b6d309fc129ed8eb5a82e224eb648f90134d1d315977c6ea360a7fece4baa3dd7dcc970759f29df0e86469e954e2b050e87b203ca27a2a519b7555c3b73f2681d49442d9647ff5ea64110cc5020fdeafe53a7d8be70f3260816bc376bcdc5352771fa55d9733e27730ec7103520e8359c78edd21ee6c68feb3685a55722f5da09ffe8ba9f05081a8d214156376f99906245f2f390ad717979d98f0574f8c5b52dcc2fa494f461be6c2560ddbaafb80c5b4583cbe56d24f14ab78fd718947077ea736251c7b8eee267267534c84daa6f095e94bfb85986a03ddea362cc7e6682884e710727c1163cd4f336c13b844605b7a815fe39e43bd0d2e414410a82958455b8a6bd9194c631d66295675fed64c04107a595c421111a3af6e9fadab5c9", 0x1a1}, {&(0x7f0000000180)="6fe4dd9eeba8271dc700b581440284", 0xf}], 0x4}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000fe05000000000000000000009500"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) socket$l2tp6(0xa, 0x2, 0x73) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_MSRS(r4, 0xc048aeca, &(0x7f0000000200)) 389.088173ms ago: executing program 0 (id=5443): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/profiling', 0x22042, 0x0) write$binfmt_misc(r1, &(0x7f0000000000), 0xfffffecc) splice(r0, 0x0, r2, 0x0, 0xbfd1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000002c0)='./binderfs2/custom1\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000100)) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r5, &(0x7f0000000000)={0x1}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000140)={0x8, 0x0, &(0x7f0000000040)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f0000000640)={0x20, 0x0, &(0x7f0000000280)=[@request_death, @clear_death], 0x0, 0x0, 0x0}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) openat$ppp(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r6 = userfaultfd(0x801) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000000)='sys_enter\x00', r8}, 0x10) getresgid(0x0, 0x0, 0x0) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0xc}) socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0x2, &(0x7f0000000140)={0x80000000000009, 0xfffffffffffffffb}, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000780)={&(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x2000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x2000)=nil, 0x0}, 0x68) brk(0x20ff8000) openat$vimc1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r9 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r9, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) setsockopt$packet_fanout_data(r9, 0x107, 0x16, &(0x7f0000000100)={0x3, &(0x7f0000000180)=[{0x50}, {0x28, 0x0, 0x0, 0x8001}, {0x6}]}, 0x10) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x400, 0x0) 386.824169ms ago: executing program 9 (id=5444): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x6, &(0x7f0000000480)=ANY=[@ANYBLOB="18020000faffffff0000000000004000850000002c0000001800000004000000000000000700000095"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000500), 0x2, 0x0) write$UHID_SET_REPORT_REPLY(r1, &(0x7f0000000540)=ANY=[@ANYBLOB="0e00000004"], 0xf2) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x27, 0x8, 0x0, &(0x7f0000000140)="f3ed48cc460029fc", 0x0, 0x1400, 0xf2ffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 368.573899ms ago: executing program 2 (id=5445): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000a80)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="05000000894164b830c1d2e6ff0c27f500009991719f048d80d2eb551edea0f6a52b33e8c2e528ff46c0ab0bd365bd349f762515aa0fb070e4ad175aff4a40f798f78b76c6f2756fa8517e8df33c6b6f35ebd3fea9f4d4703506b4e9c810abbac598eb99ebf1d0b62952bb9d6de8c0cecaa8b008b379425a45eaa747df6748c864800b0b4f8faa0395b43120ccb265221417f5beed95ae9206dfdae195f69a4ad0ac7fd71195f2ab3a0eeffe7fac91f715c84907be6972e1046fcc0284074507aa8202bc7a16fd93ef405e4b73cb760affff3850c716a4bdc14e46ba81e549da0f3f68036dcf7f5bf4ef614b069ba0223c08aaacb1c6045cbc939d5b9b1044856d46649015840a22e590a753785239ed918d", @ANYRES32=r2, @ANYBLOB="0800050002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x40, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IE={0x11, 0x2a, [@random={0xdd, 0xb, 'abcdefghijk'}]}, @NL80211_ATTR_SCAN_SSIDS={0x10, 0x2d, 0x0, 0x1, [{0xa, 0x0, @default_ap_ssid}]}]}, 0x40}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), r0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'veth1_vlan\x00', 0x0}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f0000000480)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7, &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc0, &(0x7f0000000540)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000580), &(0x7f00000005c0), 0x8, 0x2f, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000840)={'ip6tnl0\x00', &(0x7f0000000680)={'syztnl2\x00', 0x0, 0x2f, 0x7f, 0x9, 0x9, 0x25, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @empty, 0x20, 0x18, 0xe1a, 0x8}}) getsockopt$inet_pktinfo(r6, 0x0, 0x8, &(0x7f0000000880)={0x0, @loopback, @multicast2}, &(0x7f00000008c0)=0xc) r12 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r12, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r14 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r14, &(0x7f00000007c0)={0x0, 0x4000, &(0x7f0000000780)={&(0x7f0000000800)=@newqdisc={0xac, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r13, {0x0, 0xfff2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x7c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x8, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400], [0x0, 0x8]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x18, 0x2, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x26f}]}]}]}}]}, 0xac}}, 0x0) sendmsg$ETHTOOL_MSG_DEBUG_GET(r0, &(0x7f0000000a40)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000a00)={&(0x7f0000000900)={0xcc, r7, 0x400, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'erspan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r11}]}, @HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvlan0\x00'}]}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}]}, 0xcc}, 0x1, 0x0, 0x0, 0x800}, 0x4000) waitid(0x1, 0x0, 0x0, 0x60000007, 0x0) r15 = add_key$keyring(0x0, &(0x7f0000000380)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$restrict_keyring(0xa, r15, &(0x7f0000000100)='asymmetric\x00', 0x0) request_key(&(0x7f0000000000)='id_legacy\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000100)='\\\\\x00', r15) 296.655168ms ago: executing program 5 (id=5446): pipe(&(0x7f00000001c0)={0xffffffffffffffff}) syz_open_dev$dri(&(0x7f0000000040), 0x1ff, 0x28000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000001140)={'batadv_slave_0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000001440)={r0, 0xe0, &(0x7f0000001340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe6, &(0x7f0000001240)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0xbf, 0x8, 0x8, &(0x7f0000001300)}}, 0x10) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000001500)={'ip6tnl0\x00', &(0x7f0000001480)={'ip6gre0\x00', 0x0, 0x2, 0x7, 0x0, 0xbd, 0x1b, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, @remote, 0x8, 0x40, 0x4, 0x101}}) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000200)={'batadv_slave_0\x00'}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000001540)={'wg0\x00'}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$ifreq_SIOCGIFINDEX_wireguard(r8, 0x8933, &(0x7f0000000340)={'wg0\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r6, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000003c0)=ANY=[@ANYRES16=r7, @ANYBLOB="37040000000000000000010000006800088030000080060005000000000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b39223400008004000980060005000080000024000100f44da367a88ee6564f020211456727082f5cebee8b1bf5eb7337341b459b392208000100", @ANYRES32=r9], 0x84}}, 0x0) 386.309µs ago: executing program 6 (id=5447): syz_usb_connect$hid(0x0, 0x6c, 0x0, 0x0) ioperm(0x200, 0x10, 0x100000004) socket$l2tp(0x2, 0x2, 0x73) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x1ff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x3) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x24}}, 0x0) 0s ago: executing program 9 (id=5448): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000280)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) process_madvise(0xffffffffffffffff, 0x0, 0x0, 0x19, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="050000000000fcdbdf252e00000008000300", @ANYRES32=r3, @ANYBLOB="0a00340002020202020200000800350007000000"], 0x30}}, 0x0) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r0, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_REGISTER_FRAME(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000002c0)={0x28, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_FRAME_MATCH={0x4}, @NL80211_ATTR_FRAME_TYPE={0x6}]}, 0x28}}, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_int(r8, 0x29, 0x24, &(0x7f0000000340)=0x8, 0x4) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r10 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r9, &(0x7f00000005c0)=ANY=[@ANYBLOB="020086dd0300000000001400000060ec970012302c00fe8000000000000000000000000000aaff0200000000000000000000000000013a"], 0xfdef) r11 = socket$nl_audit(0x10, 0x3, 0x9) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_cred(r12, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r13, 0x0) sendmsg$AUDIT_USER_AVC(r11, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)={0x10}, 0x10}}, 0x0) r14 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x101040) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000300), 0x4) ioctl$SNDRV_TIMER_IOCTL_SELECT(r14, 0x40345410, &(0x7f00000000c0)={{0x1, 0x3, 0x1, 0x3, 0x6}}) kernel console output (not intermixed with test programs): 718][ T29] kauditd_printk_skb: 47 callbacks suppressed [ 1906.118740][ T29] audit: type=1326 audit(1732812516.172:533): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=23038 comm="syz.5.4505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfae580809 code=0x7ffc0000 [ 1906.218032][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1906.243493][T10472] ldusb 9-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1906.273321][ T29] audit: type=1326 audit(1732812516.172:534): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=23038 comm="syz.5.4505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfae580809 code=0x7ffc0000 [ 1906.305683][T17420] usb 7-1: new low-speed USB device number 38 using dummy_hcd [ 1906.328924][T17420] usb 7-1: Invalid ep0 maxpacket: 64 [ 1906.457618][T23039] lo speed is unknown, defaulting to 1000 [ 1906.468098][T17420] usb 7-1: new low-speed USB device number 39 using dummy_hcd [ 1906.498174][ T29] audit: type=1326 audit(1732812516.182:535): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=23038 comm="syz.5.4505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=272 compat=0 ip=0x7fbfae580809 code=0x7ffc0000 [ 1906.532850][ T5894] usb 9-1: USB disconnect, device number 37 [ 1906.568666][T17420] usb 7-1: Invalid ep0 maxpacket: 64 [ 1906.596691][T17420] usb usb7-port1: unable to enumerate USB device [ 1906.631961][ T5894] ldusb 9-1:0.0: LD USB Device #0 now disconnected [ 1906.739595][ T29] audit: type=1326 audit(1732812516.852:536): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=23038 comm="syz.5.4505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfae580809 code=0x7ffc0000 [ 1906.797689][ T29] audit: type=1326 audit(1732812516.852:537): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=23038 comm="syz.5.4505" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fbfae580809 code=0x7ffc0000 [ 1906.859759][T23046] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1906.898269][T23046] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1907.258047][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1907.398101][T23051] tipc: Failed to remove unknown binding: 66,1,1/0:456586885/456586887 [ 1907.453515][T23051] netlink: 'syz.2.4508': attribute type 10 has an invalid length. [ 1907.937398][T23051] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1908.130056][T23059] netlink: 'syz.8.4511': attribute type 4 has an invalid length. [ 1908.308097][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1908.448273][ T5894] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1908.598703][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 1908.606937][ T5894] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1908.618566][ T5894] usb 3-1: config 0 has no interface number 0 [ 1908.624701][ T5894] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1908.649466][ T5894] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1908.671107][ T5894] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1908.692598][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1908.713499][ T5894] usb 3-1: config 0 descriptor?? [ 1909.068042][T23074] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4516'. [ 1909.166459][ T5894] usbhid 3-1:0.1: can't add hid device: -71 [ 1909.187409][ T5894] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 1909.211731][T23078] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1909.215481][ T5894] usb 3-1: USB disconnect, device number 21 [ 1909.242468][T23078] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1909.348050][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1910.378097][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1910.413541][T23103] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4523'. [ 1911.428071][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1912.154431][T23119] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4527'. [ 1912.458111][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1912.834138][T23130] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1912.889939][T23130] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1913.148182][T21696] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1913.498077][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1914.236570][ T5894] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1914.470388][ T5894] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1914.486871][ T5894] usb 7-1: config 0 has no interfaces? [ 1914.516062][ T5894] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1914.538199][T21696] usb 3-1: Using ep0 maxpacket: 32 [ 1914.548053][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1914.715222][ T5894] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1914.746261][ T5894] usb 7-1: config 0 descriptor?? [ 1914.754493][T21696] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 1914.913857][T21696] usb 3-1: config 0 has no interface number 0 [ 1914.920102][T21696] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1914.931077][T21696] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1914.941281][T21696] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1914.950585][T21696] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1914.966437][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1914.986790][T23137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1914.989567][T21696] usb 3-1: config 0 descriptor?? [ 1914.995575][T23137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1915.327565][T23137] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1915.352632][T10472] usb 7-1: USB disconnect, device number 40 [ 1915.578023][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1915.604223][T21696] usbhid 3-1:0.1: can't add hid device: -71 [ 1915.611468][T21696] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 1915.640442][T21696] usb 3-1: USB disconnect, device number 22 [ 1916.618054][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1917.209465][T23172] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4541'. [ 1917.658021][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1918.708114][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1919.419804][T23190] lo speed is unknown, defaulting to 1000 [ 1919.738087][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1920.778114][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1921.609623][T23196] lo speed is unknown, defaulting to 1000 [ 1921.818007][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1922.858087][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1923.898062][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1924.306214][T10472] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 1924.468274][T10472] usb 1-1: Using ep0 maxpacket: 32 [ 1924.479667][T10472] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1924.487719][T10472] usb 1-1: config 0 has no interface number 0 [ 1924.512046][T10472] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1924.564128][T23226] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4556'. [ 1924.875980][T10472] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1924.948053][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1925.093699][T10472] usb 1-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 1925.320089][T10472] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1925.405461][T10472] usb 1-1: config 0 descriptor?? [ 1925.431675][T10472] usb 1-1: can't set config #0, error -71 [ 1925.445507][T10472] usb 1-1: USB disconnect, device number 51 [ 1925.978086][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1927.028143][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1928.058130][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1929.098302][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1930.140656][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1931.178093][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1932.218077][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1933.258342][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1934.308025][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1934.321770][T10515] Bluetooth: hci1: ACL packet for unknown connection handle 200 [ 1934.872964][T23273] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4569'. [ 1935.339626][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1935.352890][ T55] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1935.425008][ T55] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1935.443112][ T55] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1935.570692][ T55] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1935.598719][ T55] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3 [ 1935.606056][ T55] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1935.785931][T23275] lo speed is unknown, defaulting to 1000 [ 1936.388000][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1937.079599][T23275] chnl_net:caif_netlink_parms(): no params data found [ 1937.418043][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1937.675421][T10515] Bluetooth: hci3: command tx timeout [ 1938.203996][T23275] bridge0: port 1(bridge_slave_0) entered blocking state [ 1938.211324][T23275] bridge0: port 1(bridge_slave_0) entered disabled state [ 1938.218816][T23275] bridge_slave_0: entered allmulticast mode [ 1938.225914][T23275] bridge_slave_0: entered promiscuous mode [ 1938.237445][T23275] bridge0: port 2(bridge_slave_1) entered blocking state [ 1938.246191][T23275] bridge0: port 2(bridge_slave_1) entered disabled state [ 1938.258185][T23275] bridge_slave_1: entered allmulticast mode [ 1938.276221][T23275] bridge_slave_1: entered promiscuous mode [ 1938.318660][T10472] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 1938.468203][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1938.775090][T10472] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1938.785099][T10472] usb 7-1: New USB device found, idVendor=0c45, idProduct=760b, bcdDevice= 0.00 [ 1938.794831][T10472] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1938.806195][T23275] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1939.262892][T10472] usb 7-1: config 0 descriptor?? [ 1939.274956][T23275] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1939.508025][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1939.644525][T23275] team0: Port device team_slave_0 added [ 1939.653401][T23275] team0: Port device team_slave_1 added [ 1940.538059][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1940.946100][T10515] Bluetooth: hci3: command tx timeout [ 1941.133498][T23319] netlink: 'syz.6.4575': attribute type 6 has an invalid length. [ 1941.350887][T23275] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1941.401221][T23275] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1941.454391][T23275] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1941.487746][T23275] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1941.505192][T23275] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1941.588361][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1941.727196][T23328] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4580'. [ 1941.821790][T23275] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1942.398884][T10472] usbhid 7-1:0.0: can't add hid device: -71 [ 1942.407014][T10472] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1942.416903][T10472] usb 7-1: USB disconnect, device number 41 [ 1942.453019][T23275] hsr_slave_0: entered promiscuous mode [ 1942.561660][T23275] hsr_slave_1: entered promiscuous mode [ 1942.590979][T23275] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 1942.615589][T23275] Cannot create hsr debugfs directory [ 1942.621201][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1943.118535][T10515] Bluetooth: hci3: command tx timeout [ 1943.658032][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1944.069794][T23275] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1944.182915][T23366] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 1944.189566][T23366] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1944.200456][T23366] vhci_hcd vhci_hcd.0: Device attached [ 1944.230649][T23275] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1944.287250][T23275] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1944.384659][T23275] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1944.708053][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1944.974095][T17420] vhci_hcd: vhci_device speed not set [ 1945.227150][T10515] Bluetooth: hci3: command tx timeout [ 1945.598287][T17420] usb 33-1: new full-speed USB device number 2 using vhci_hcd [ 1945.660439][T23275] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1945.668338][ T5894] usb 1-1: new low-speed USB device number 52 using dummy_hcd [ 1945.700239][T23275] 8021q: adding VLAN 0 to HW filter on device team0 [ 1945.738042][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1945.751973][T20489] bridge0: port 1(bridge_slave_0) entered blocking state [ 1945.759178][T20489] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1945.783642][T20489] bridge0: port 2(bridge_slave_1) entered blocking state [ 1945.790863][T20489] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1945.850226][ T5894] usb 1-1: config 0 has no interfaces? [ 1945.856050][ T5894] usb 1-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1945.882966][ T5894] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1945.909108][ T5894] usb 1-1: config 0 descriptor?? [ 1946.165168][T23275] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1946.214820][T23368] usb 33-1: recv xbuf, -104 [ 1946.218043][ T5894] usb 1-1: USB disconnect, device number 52 [ 1946.231358][ T2938] vhci_hcd: stop threads [ 1946.235694][ T2938] vhci_hcd: release socket [ 1946.241215][ T2938] vhci_hcd: disconnect device [ 1946.308432][T17420] vhci_hcd: vhci_device speed not set [ 1946.659549][T23275] veth0_vlan: entered promiscuous mode [ 1946.679886][T23275] veth1_vlan: entered promiscuous mode [ 1946.741444][T23275] veth0_macvtap: entered promiscuous mode [ 1946.751203][T23275] veth1_macvtap: entered promiscuous mode [ 1946.768461][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1946.779088][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1946.797244][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1946.836569][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1946.851809][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1946.862058][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1946.884154][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1946.906825][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1946.928121][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1946.968007][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1946.998199][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.018962][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1947.038636][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.048918][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1947.059644][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.082142][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1947.098869][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.109083][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 1947.119850][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.150421][T23275] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1947.198497][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.228166][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.258226][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.418427][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.429241][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.464849][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.493212][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.547961][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.578765][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.608925][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.638104][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.659291][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.680112][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.706381][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.734787][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.763484][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.783962][T23275] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 1947.807631][T23275] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 1947.824160][T23275] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1947.831565][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1948.153774][T23408] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1948.242302][T23275] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1948.251203][T23275] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1948.260050][T23275] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1948.268904][T23275] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1948.858097][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1949.078617][T16719] IPVS: starting estimator thread 0... [ 1949.298321][T23410] IPVS: using max 22 ests per chain, 52800 per kthread [ 1949.353636][ T6756] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1949.403082][ T6756] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1949.531367][ T6756] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1949.558334][ T6756] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1949.908379][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1950.938361][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1951.588125][T21696] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1951.808140][T21696] usb 10-1: Using ep0 maxpacket: 8 [ 1951.818667][T21696] usb 10-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 1951.852622][T21696] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1951.872230][T21696] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1951.978357][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1952.128184][T21696] usb 10-1: SerialNumber: syz [ 1952.392268][T23450] mac80211_hwsim hwsim56 wlan0: entered promiscuous mode [ 1952.441264][T23449] mac80211_hwsim hwsim56 wlan0: left promiscuous mode [ 1952.458783][T12292] usb 10-1: USB disconnect, device number 16 [ 1953.018048][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1953.034617][T23463] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 1953.910141][T10515] Bluetooth: hci0: unexpected event for opcode 0x040d [ 1953.919432][T23470] netlink: 'syz.0.4612': attribute type 26 has an invalid length. [ 1954.050456][T23477] xt_bpf: check failed: parse error [ 1954.058074][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1955.098071][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1955.361166][T23497] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1955.372054][T23497] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1955.866841][T23505] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4624'. [ 1956.148104][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1956.842638][T23511] do_dccp_setsockopt: sockopt(CHANGE_L/R) is deprecated: fix your app [ 1957.188009][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1957.358288][T16719] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 1957.520041][T16719] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1957.538139][T16719] usb 7-1: config 0 has no interfaces? [ 1957.549331][T16719] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1957.581353][T16719] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1957.606622][T16719] usb 7-1: config 0 descriptor?? [ 1957.831573][T23527] netlink: 'syz.2.4630': attribute type 1 has an invalid length. [ 1957.843119][T23527] netlink: 236 bytes leftover after parsing attributes in process `syz.2.4630'. [ 1957.843999][T23514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1957.868451][T23514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1958.013449][T23514] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1958.022827][T16719] usb 7-1: USB disconnect, device number 42 [ 1958.218018][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1959.246362][T23547] IPVS: length: 196 != 24 [ 1959.267997][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1960.199375][T23553] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1960.230385][T23556] kAFS: No cell specified [ 1960.242611][T23553] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1960.298007][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1961.337999][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1961.784482][T23571] netlink: 4 bytes leftover after parsing attributes in process `syz.0.4642'. [ 1962.378010][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1963.196401][T23582] FAULT_INJECTION: forcing a failure. [ 1963.196401][T23582] name failslab, interval 1, probability 0, space 0, times 0 [ 1963.222869][T23582] CPU: 0 UID: 0 PID: 23582 Comm: syz.0.4646 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 1963.233333][T23582] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 1963.243420][T23582] Call Trace: [ 1963.246733][T23582] [ 1963.249685][T23582] dump_stack_lvl+0x241/0x360 [ 1963.254404][T23582] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1963.259657][T23582] ? __pfx__printk+0x10/0x10 [ 1963.264309][T23582] ? __kmalloc_noprof+0xb5/0x4c0 [ 1963.269294][T23582] ? __pfx___might_resched+0x10/0x10 [ 1963.274623][T23582] should_fail_ex+0x3b0/0x4e0 [ 1963.279340][T23582] should_failslab+0xac/0x100 [ 1963.284052][T23582] __kmalloc_noprof+0xdd/0x4c0 [ 1963.288846][T23582] ? ovs_nla_copy_actions+0x79/0x3e0 [ 1963.294174][T23582] ovs_nla_copy_actions+0x79/0x3e0 [ 1963.299337][T23582] ? ovs_nla_get_identifier+0x11c/0x280 [ 1963.304975][T23582] ovs_flow_cmd_new+0x555/0xe00 [ 1963.309877][T23582] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 1963.315341][T23582] ? __nla_parse+0x40/0x60 [ 1963.319792][T23582] ? genl_family_rcv_msg_attrs_parse+0x1d1/0x290 [ 1963.326188][T23582] genl_rcv_msg+0xb14/0xec0 [ 1963.330766][T23582] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1963.335854][T23582] ? __pfx_lock_acquire+0x10/0x10 [ 1963.340910][T23582] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 1963.346324][T23582] ? __pfx___might_resched+0x10/0x10 [ 1963.351655][T23582] netlink_rcv_skb+0x1e3/0x430 [ 1963.356454][T23582] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1963.361520][T23582] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1963.366851][T23582] ? __netlink_deliver_tap+0x7aa/0x7f0 [ 1963.372368][T23582] genl_rcv+0x28/0x40 [ 1963.376392][T23582] netlink_unicast+0x7f6/0x990 [ 1963.381212][T23582] ? __pfx_netlink_unicast+0x10/0x10 [ 1963.386557][T23582] ? __virt_addr_valid+0x183/0x530 [ 1963.391714][T23582] ? __check_object_size+0x48e/0x900 [ 1963.397039][T23582] netlink_sendmsg+0x8e4/0xcb0 [ 1963.401852][T23582] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1963.407188][T23582] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1963.412519][T23582] __sock_sendmsg+0x221/0x270 [ 1963.417258][T23582] ____sys_sendmsg+0x52a/0x7e0 [ 1963.422101][T23582] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1963.427426][T23582] ? __fget_files+0x2a/0x410 [ 1963.432054][T23582] ? __fget_files+0x2a/0x410 [ 1963.436703][T23582] __sys_sendmsg+0x269/0x350 [ 1963.441331][T23582] ? __pfx_lock_release+0x10/0x10 [ 1963.446394][T23582] ? __pfx___sys_sendmsg+0x10/0x10 [ 1963.451556][T23582] ? __pfx_vfs_write+0x10/0x10 [ 1963.456391][T23582] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 1963.462756][T23582] ? do_syscall_64+0x100/0x230 [ 1963.467546][T23582] ? do_syscall_64+0xb6/0x230 [ 1963.472265][T23582] do_syscall_64+0xf3/0x230 [ 1963.476804][T23582] ? clear_bhb_loop+0x35/0x90 [ 1963.481515][T23582] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1963.487460][T23582] RIP: 0033:0x7f5e3a380809 [ 1963.491904][T23582] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1963.511553][T23582] RSP: 002b:00007f5e381f6058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1963.520002][T23582] RAX: ffffffffffffffda RBX: 00007f5e3a545fa0 RCX: 00007f5e3a380809 [ 1963.528003][T23582] RDX: 000000000000c000 RSI: 0000000020000000 RDI: 0000000000000003 [ 1963.535999][T23582] RBP: 00007f5e381f60a0 R08: 0000000000000000 R09: 0000000000000000 [ 1963.544002][T23582] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1963.552017][T23582] R13: 0000000000000000 R14: 00007f5e3a545fa0 R15: 00007ffc9d9d9fa8 [ 1963.560038][T23582] [ 1963.564066][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1963.571923][T23582] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1964.618016][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1965.089680][T23595] overlayfs: failed to resolve './file0': -2 [ 1965.180600][ T9] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1965.658001][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1966.168453][T21696] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 1966.219937][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1966.232019][ T9] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1966.247988][ T9] usb 3-1: New USB device found, idVendor=05ac, idProduct=027c, bcdDevice= 0.00 [ 1966.264713][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1966.294390][ T9] usb 3-1: config 0 descriptor?? [ 1966.666936][T21696] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1966.698012][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1966.721108][T21696] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1966.942802][T21696] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1967.450452][T21696] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1967.475052][ T9] usbhid 3-1:0.0: can't add hid device: -71 [ 1967.483088][ T9] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1967.500218][T21696] usb 10-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1967.514504][T21696] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1967.522796][T21696] usb 10-1: Product: syz [ 1967.527246][T21696] usb 10-1: Manufacturer: syz [ 1967.532190][T21696] usb 10-1: SerialNumber: syz [ 1967.558844][T21696] usb 10-1: config 0 descriptor?? [ 1967.576115][T21696] ums-isd200 10-1:0.0: USB Mass Storage device detected [ 1967.643026][ T9] usb 3-1: USB disconnect, device number 23 [ 1967.693493][T23618] kAFS: No cell specified [ 1967.738010][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1967.819126][ T5929] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 1967.827444][T21696] scsi host1: usb-storage 10-1:0.0 [ 1968.024998][ T5929] usb 1-1: Using ep0 maxpacket: 16 [ 1968.048714][ T5929] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1968.069347][T12339] usb 10-1: USB disconnect, device number 17 [ 1968.778009][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1968.951480][ T5929] usb 1-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 64 [ 1968.985002][ T5929] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 1969.010736][ T5929] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1969.020345][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1969.071610][ T5929] usb 1-1: SerialNumber: syz [ 1969.092611][T23613] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1969.129554][ T5929] cdc_acm 1-1:1.0: skipping garbage [ 1969.390529][ T5929] cdc_acm 1-1:1.0: ttyACM0: USB ACM device [ 1969.400347][ T5929] usb 1-1: USB disconnect, device number 53 [ 1969.828180][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1970.128391][T23639] netlink: 'syz.6.4662': attribute type 1 has an invalid length. [ 1970.329562][T23641] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1970.338728][T10472] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 1970.361132][T23641] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1970.633768][T10472] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1970.646264][T10472] usb 10-1: config 0 has no interfaces? [ 1970.652807][T10472] usb 10-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1970.817023][T10472] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1970.868135][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1970.981807][T10472] usb 10-1: config 0 descriptor?? [ 1971.626451][T23638] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1971.645805][T23638] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1971.814454][T23638] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1971.898003][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1972.948013][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1973.848202][T23684] kAFS: No cell specified [ 1973.987988][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1974.441663][T23687] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1974.472470][T23687] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1974.613916][T23692] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1974.759099][ T5929] usb 10-1: USB disconnect, device number 18 [ 1975.018022][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1976.068133][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1976.848672][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 1977.108173][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1977.348173][ T5929] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1977.508877][ T5929] usb 3-1: Using ep0 maxpacket: 16 [ 1977.525891][ T5929] usb 3-1: config 0 has an invalid interface number: 107 but max is 0 [ 1977.645480][ T5929] usb 3-1: config 0 has no interface number 0 [ 1977.680478][ T5929] usb 3-1: config 0 interface 107 altsetting 0 endpoint 0x88 has an invalid bInterval 0, changing to 7 [ 1977.713342][T23734] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1977.718857][ T5929] usb 3-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1977.723012][T23734] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1977.746966][ T5929] usb 3-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1977.818676][T23738] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4689'. [ 1978.138037][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1978.591896][ T5929] usb 3-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1978.600541][ T5929] usb 3-1: Product: syz [ 1978.604919][ T5929] usb 3-1: Manufacturer: syz [ 1978.609660][ T5929] usb 3-1: SerialNumber: syz [ 1978.616347][ T5929] usb 3-1: config 0 descriptor?? [ 1978.623769][ T5929] keyspan 3-1:0.107: Keyspan 4 port adapter converter detected [ 1978.632769][ T5929] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 81 [ 1978.641538][ T5929] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 1 [ 1978.652002][ T5929] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1978.662368][ T5929] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 2 [ 1978.671311][ T5929] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1978.684789][ T5929] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 4 [ 1978.693590][ T5929] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1978.711769][ T5929] keyspan 3-1:0.107: found no endpoint descriptor for endpoint 6 [ 1978.725760][ T5929] usb 3-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1978.754997][T23745] FAULT_INJECTION: forcing a failure. [ 1978.754997][T23745] name failslab, interval 1, probability 0, space 0, times 0 [ 1978.770468][T23745] CPU: 0 UID: 0 PID: 23745 Comm: syz.9.4694 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 1978.780940][T23745] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 1978.791021][T23745] Call Trace: [ 1978.794320][T23745] [ 1978.797275][T23745] dump_stack_lvl+0x241/0x360 [ 1978.801988][T23745] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1978.807191][T23745] ? __pfx__printk+0x10/0x10 [ 1978.811829][T23745] ? __kmalloc_noprof+0xb5/0x4c0 [ 1978.816812][T23745] ? __pfx___might_resched+0x10/0x10 [ 1978.822151][T23745] should_fail_ex+0x3b0/0x4e0 [ 1978.826875][T23745] should_failslab+0xac/0x100 [ 1978.831584][T23745] __kmalloc_noprof+0xdd/0x4c0 [ 1978.836379][T23745] ? ovs_nla_copy_actions+0x79/0x3e0 [ 1978.837557][T21696] usb 3-1: USB disconnect, device number 24 [ 1978.841769][T23745] ovs_nla_copy_actions+0x79/0x3e0 [ 1978.841803][T23745] ? ovs_nla_get_identifier+0x11c/0x280 [ 1978.841833][T23745] ovs_flow_cmd_new+0x555/0xe00 [ 1978.863237][T23745] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 1978.868663][T23745] ? __nla_parse+0x40/0x60 [ 1978.873107][T23745] ? genl_family_rcv_msg_attrs_parse+0x1d1/0x290 [ 1978.879469][T23745] genl_rcv_msg+0xb14/0xec0 [ 1978.884010][T23745] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1978.889066][T23745] ? __pfx_lock_acquire+0x10/0x10 [ 1978.894116][T23745] ? __pfx_ovs_flow_cmd_new+0x10/0x10 [ 1978.899514][T23745] ? __pfx___might_resched+0x10/0x10 [ 1978.904835][T23745] netlink_rcv_skb+0x1e3/0x430 [ 1978.909614][T23745] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1978.914668][T23745] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1978.919976][T23745] ? __netlink_deliver_tap+0x7aa/0x7f0 [ 1978.925464][T23745] genl_rcv+0x28/0x40 [ 1978.929463][T23745] netlink_unicast+0x7f6/0x990 [ 1978.934255][T23745] ? __pfx_netlink_unicast+0x10/0x10 [ 1978.939595][T23745] ? __virt_addr_valid+0x183/0x530 [ 1978.944987][T23745] ? __check_object_size+0x48e/0x900 [ 1978.950314][T23745] netlink_sendmsg+0x8e4/0xcb0 [ 1978.955119][T23745] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1978.960431][T23745] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1978.965729][T23745] __sock_sendmsg+0x221/0x270 [ 1978.970429][T23745] ____sys_sendmsg+0x52a/0x7e0 [ 1978.975214][T23745] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1978.980533][T23745] ? __fget_files+0x2a/0x410 [ 1978.985179][T23745] ? __fget_files+0x2a/0x410 [ 1978.989796][T23745] __sys_sendmsg+0x269/0x350 [ 1978.994446][T23745] ? __pfx_lock_release+0x10/0x10 [ 1978.999569][T23745] ? __pfx___sys_sendmsg+0x10/0x10 [ 1979.004701][T23745] ? __pfx_vfs_write+0x10/0x10 [ 1979.009505][T23745] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 1979.015848][T23745] ? do_syscall_64+0x100/0x230 [ 1979.020623][T23745] ? do_syscall_64+0xb6/0x230 [ 1979.025421][T23745] do_syscall_64+0xf3/0x230 [ 1979.029943][T23745] ? clear_bhb_loop+0x35/0x90 [ 1979.034729][T23745] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1979.040637][T23745] RIP: 0033:0x7f6092980809 [ 1979.045060][T23745] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1979.064776][T23745] RSP: 002b:00007f6093726058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1979.073210][T23745] RAX: ffffffffffffffda RBX: 00007f6092b45fa0 RCX: 00007f6092980809 [ 1979.081193][T23745] RDX: 000000000000c000 RSI: 0000000020000000 RDI: 0000000000000003 [ 1979.089169][T23745] RBP: 00007f60937260a0 R08: 0000000000000000 R09: 0000000000000000 [ 1979.097149][T23745] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1979.105165][T23745] R13: 0000000000000000 R14: 00007f6092b45fa0 R15: 00007ffe186c29f8 [ 1979.113155][T23745] [ 1979.116225][ C0] vkms_vblank_simulate: vblank timer overrun [ 1979.125643][T21696] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1979.139955][T21696] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1979.158060][T23745] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1979.177760][T21696] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1979.188019][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1979.975050][T21696] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1980.066504][T21696] keyspan 3-1:0.107: device disconnected [ 1980.218008][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1980.225818][T23766] lo speed is unknown, defaulting to 1000 [ 1981.265716][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1981.682833][T23781] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4703'. [ 1982.297998][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1983.313123][T23788] 9pnet_fd: Insufficient options for proto=fd [ 1983.338072][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1984.387981][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1984.484303][T23817] tipc: Started in network mode [ 1984.495316][T23817] tipc: Node identity ffffffff, cluster identity 4711 [ 1984.508431][T23817] tipc: Node number set to 4294967295 [ 1984.922006][T23837] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4722'. [ 1985.356627][T23855] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1985.419008][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1985.434876][T23855] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1985.528846][T23864] netlink: 176 bytes leftover after parsing attributes in process `syz.5.4734'. [ 1986.436922][T23908] netlink: 'syz.0.4751': attribute type 26 has an invalid length. [ 1986.438108][ T5929] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1986.448405][T23908] netlink: 24 bytes leftover after parsing attributes in process `syz.0.4751'. [ 1986.461869][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1986.521244][T23910] netlink: 'syz.6.4752': attribute type 16 has an invalid length. [ 1986.540146][T23910] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4752'. [ 1986.565102][T23910] netlink: 'syz.6.4752': attribute type 16 has an invalid length. [ 1986.582905][T23910] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4752'. [ 1986.599547][T23912] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1986.606835][T23912] IPv6: NLM_F_CREATE should be set when creating new route [ 1986.614713][ T5929] usb 3-1: Using ep0 maxpacket: 8 [ 1986.638739][ T5929] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1986.688103][ T5929] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1986.715096][ T5929] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1986.741225][ T5929] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1986.781277][ T5929] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1986.812851][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1986.814935][T23919] loop2: detected capacity change from 0 to 7 [ 1986.853540][T23919] Dev loop2: unable to read RDB block 7 [ 1986.883714][T23919] loop2: unable to read partition table [ 1986.905170][T23919] loop2: partition table beyond EOD, truncated [ 1986.917491][T23919] loop_reread_partitions: partition scan of loop2 (ţ被xü—źŃŕ– ) failed (rc=-5) [ 1987.045990][ T5929] usb 3-1: GET_CAPABILITIES returned 0 [ 1987.065187][ T5929] usbtmc 3-1:16.0: can't read capabilities [ 1987.252135][ T5929] usb 3-1: USB disconnect, device number 25 [ 1987.497998][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1987.629277][T23945] netlink: 20 bytes leftover after parsing attributes in process `syz.9.4767'. [ 1988.012494][T23945] vlan2: entered promiscuous mode [ 1988.303307][T23970] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4778'. [ 1988.504305][T23974] bond0: (slave syz_tun): Releasing backup interface [ 1988.538021][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1988.804650][ T5929] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 1988.969253][ T5929] usb 1-1: Using ep0 maxpacket: 8 [ 1989.012806][ T5929] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1989.157443][ T5929] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1989.403443][ T5929] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1989.448525][ T5929] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1989.508799][ T5929] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1989.563082][ T5929] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1989.578058][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1989.597520][ T5929] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1989.791997][T24007] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 1989.885813][ T5929] usb 1-1: usb_control_msg returned -32 [ 1989.892696][ T5929] usbtmc 1-1:16.0: can't read capabilities [ 1990.317214][T24031] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1990.338079][T24031] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 1990.618012][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1991.658245][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1991.888868][T24050] 9pnet: Unknown protocol version 9p200 [ 1992.226304][ T9] usb 1-1: USB disconnect, device number 54 [ 1992.697996][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1993.588033][T24097] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4825'. [ 1993.738001][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1994.788126][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1995.828001][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1996.606714][T24147] netlink: 8 bytes leftover after parsing attributes in process `syz.0.4839'. [ 1996.867983][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1997.907992][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1998.408017][T17420] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 1998.589855][T17420] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1998.624095][T17420] usb 1-1: config 0 has no interfaces? [ 1998.639117][T17420] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1998.663775][T17420] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1998.699290][T17420] usb 1-1: config 0 descriptor?? [ 1998.938182][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 1998.954467][T24161] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1998.968219][T24161] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1999.056420][T24179] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 1999.441543][T17420] usb 1-1: USB disconnect, device number 55 [ 1999.978114][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2001.018047][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2001.548313][ T9] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 2001.821151][ T9] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2001.836556][ T9] usb 7-1: config 0 has no interfaces? [ 2001.847647][ T9] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 2001.861047][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2002.058058][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2002.097271][ T9] usb 7-1: config 0 descriptor?? [ 2002.326752][T24213] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2002.347707][T24213] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2003.108110][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2003.202403][T24228] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 2003.441160][T17420] usb 7-1: USB disconnect, device number 43 [ 2004.147996][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2005.177991][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2005.494596][T24258] x_tables: duplicate underflow at hook 1 [ 2005.513053][T24258] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2006.217985][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2006.708209][ T5929] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 2006.981897][ T5929] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2006.994036][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 2007.018454][ T5929] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 2007.037978][ T5929] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2007.067513][ T5929] usb 3-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2007.096366][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2007.267987][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2007.340951][ T5929] usb 3-1: config 0 descriptor?? [ 2007.400295][T24279] 9pnet: Unknown protocol version 9p200 [ 2007.668219][T21696] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 2007.804432][ T5929] plantronics 0003:047F:FFFF.0020: ignoring exceeding usage max [ 2007.842360][ T5929] plantronics 0003:047F:FFFF.0020: No inputs registered, leaving [ 2007.853017][T21696] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2007.863620][T21696] usb 1-1: config 0 has no interfaces? [ 2007.870240][T21696] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 2007.882023][T21696] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2007.890491][ T5929] plantronics 0003:047F:FFFF.0020: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.2-1/input0 [ 2007.915551][T21696] usb 1-1: config 0 descriptor?? [ 2008.159468][T24283] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2008.178691][T24283] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2008.298003][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2008.436189][T24292] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 2008.952131][T17420] usb 1-1: USB disconnect, device number 56 [ 2009.337997][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2010.377996][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2011.418304][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2011.800242][T22950] usb 3-1: USB disconnect, device number 26 [ 2012.457986][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2013.275973][T24356] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2013.307999][T24356] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2013.398654][T17420] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 2013.497960][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2013.549549][T17420] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2013.568214][T17420] usb 7-1: config 0 has no interfaces? [ 2013.582899][T17420] usb 7-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 2013.799019][T17420] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2013.826411][T17420] usb 7-1: config 0 descriptor?? [ 2014.061982][T24354] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2014.089377][T24354] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2014.219201][T24354] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 2014.228801][T17420] usb 7-1: USB disconnect, device number 44 [ 2014.538000][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2015.577988][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2015.886696][T24391] overlayfs: failed to resolve './file0': -2 [ 2016.617977][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2017.668004][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2018.162469][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 2018.698049][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2019.738054][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2020.778006][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2021.828023][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2022.857985][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2023.819116][ C0] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 2023.898029][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2024.937996][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2025.987990][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2027.017987][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2027.428106][ T5894] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 2027.591517][ T5894] usb 3-1: Using ep0 maxpacket: 32 [ 2027.643179][ T5894] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 2027.720236][ T5894] usb 3-1: config 0 has no interface number 0 [ 2027.977096][T24530] 9pnet: Unknown protocol version 9p200 [ 2028.068048][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2028.207509][ T5894] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2028.218805][ T5894] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2028.228685][ T5894] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 2028.237804][ T5894] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2028.256205][ T5894] usb 3-1: config 0 descriptor?? [ 2029.091817][ T5894] usbhid 3-1:0.1: can't add hid device: -71 [ 2029.097982][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2029.119379][ T5894] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 2029.544330][ T5894] usb 3-1: USB disconnect, device number 27 [ 2030.137971][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2031.187978][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2032.218101][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2033.267975][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2034.298015][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2035.338005][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2036.378147][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2037.407762][T24623] 9pnet: Unknown protocol version 9p200 [ 2037.417994][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2038.467980][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2039.008800][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 2039.507976][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2040.280652][T24644] vlan2: entered promiscuous mode [ 2040.285825][T24644] vlan2: entered allmulticast mode [ 2040.538112][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2041.578016][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2041.717533][T24655] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2041.778928][T24655] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2042.617965][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2043.657991][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2043.688041][ T5894] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 2043.840069][ T5894] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2043.860539][ T5894] usb 1-1: config 0 has no interfaces? [ 2043.876349][ T5894] usb 1-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 2043.902350][ T5894] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2044.005721][ T5894] usb 1-1: config 0 descriptor?? [ 2044.235238][T24677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2044.294750][T24677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2044.475358][T24694] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 2044.588005][T17420] usb 7-1: new full-speed USB device number 45 using dummy_hcd [ 2044.698014][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2044.698686][T24693] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2044.713851][T24693] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2044.724655][ T5894] usb 1-1: USB disconnect, device number 57 [ 2045.020876][T17420] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 2045.065049][T17420] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2045.712027][T24703] 9pnet: Unknown protocol version 9p200 [ 2045.738041][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2046.534445][T17420] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2046.542820][T17420] usb 7-1: Product: ࡠ[ 2046.547037][T17420] usb 7-1: Manufacturer: 畉升čśáˇ‹çśĄćĄęľ¶č‚ťé´ď’Żę±ď§«ç˛Źĺ±šä¸™áś˝ďľżëą„콆â€ëŁĽÍ”ꙶ耢ḷ뺽Ἵ蓙ꂯ芖藍ṇ늶掯逬퇭⡍á“ç‚° [ 2046.561761][T17420] usb 7-1: SerialNumber: 相䶗怦頸᧲⌌꣸畷躕쎛뮏ࢴ懦ᱸ졵랇窛쥪䟭Ԁď”⩆೜ď‰ďŽśĺ­»îźéżżě–ˇăť§î’¶éµŠď‡ťęŞăą–괟ᬖ墹ᚲꉇ嬽⊗籗창뺯耿哱䵣čąçšî‰µĺ®˘é“µăŽęľî¨Ľŕ±¨ďş‚茭ĺ«ä»†ŕ»żĺŁ™ă¦Šä”˘é†čˇ‚ę—„ [ 2046.777967][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2047.536888][T24691] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 2047.817973][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2048.163157][T17420] usb 7-1: can't set config #1, error -71 [ 2048.170765][T17420] usb 7-1: USB disconnect, device number 45 [ 2048.857980][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2049.897957][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2050.045183][T24726] overlayfs: failed to resolve './file0': -2 [ 2050.937964][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2051.977962][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2052.048210][T12292] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 2052.056184][ T5929] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 2052.354422][T12292] usb 10-1: config 0 has an invalid interface number: 117 but max is 0 [ 2052.362817][ T5929] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 2052.372526][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2052.383255][T12292] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2052.408141][T12292] usb 10-1: config 0 has no interface number 0 [ 2052.414436][T12292] usb 10-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 2052.424878][ T5929] usb 3-1: config 0 has no interface number 0 [ 2052.432709][ T5929] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 2052.443157][T12292] usb 10-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2052.449131][T24759] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2052.466095][ T5929] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2052.493303][T24759] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2052.682913][T12292] usb 10-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 2052.692310][T12292] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2052.701155][T12292] usb 10-1: Product: syz [ 2052.706392][T12292] usb 10-1: Manufacturer: syz [ 2052.711963][T12292] usb 10-1: SerialNumber: syz [ 2052.712350][ T5929] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 2052.726419][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2052.744435][ T5929] usb 3-1: Product: syz [ 2052.754481][T12292] usb 10-1: config 0 descriptor?? [ 2052.759671][ T5929] usb 3-1: Manufacturer: syz [ 2052.772477][ T5929] usb 3-1: SerialNumber: syz [ 2052.785814][ T5929] usb 3-1: config 0 descriptor?? [ 2052.984210][T12292] usbtouchscreen 10-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 2053.013067][ T5929] usbtouchscreen 3-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 2053.019004][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2053.064492][T12292] usb 10-1: USB disconnect, device number 19 [ 2053.079205][ T5929] usb 3-1: USB disconnect, device number 28 [ 2054.058037][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2054.838102][ T29] audit: type=1326 audit(1732812664.942:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2055.097983][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2055.126180][ T29] audit: type=1326 audit(1732812664.942:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2055.412298][ T29] audit: type=1326 audit(1732812664.942:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=68 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.137984][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2056.372073][ T29] audit: type=1326 audit(1732812664.942:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.437335][ T29] audit: type=1326 audit(1732812664.942:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.625004][ T29] audit: type=1326 audit(1732812664.942:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.665168][ T29] audit: type=1326 audit(1732812664.942:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.687295][ T29] audit: type=1326 audit(1732812664.942:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.710855][ T29] audit: type=1326 audit(1732812664.942:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=189 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.732641][ T29] audit: type=1326 audit(1732812664.942:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24779 comm="syz.9.5042" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x7ffc0000 [ 2056.998083][T22950] usb 10-1: new high-speed USB device number 20 using dummy_hcd [ 2057.177976][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2057.187335][T22950] usb 10-1: Using ep0 maxpacket: 16 [ 2057.209622][T22950] usb 10-1: config index 0 descriptor too short (expected 22, got 18) [ 2057.225357][T22950] usb 10-1: New USB device found, idVendor=09c0, idProduct=0401, bcdDevice= 0.00 [ 2057.245238][T22950] usb 10-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 2057.257698][T22950] usb 10-1: Product: syz [ 2057.262287][T22950] usb 10-1: SerialNumber: syz [ 2057.568010][ T5929] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 2057.644451][T22950] usb 10-1: config 0 descriptor?? [ 2057.908827][ T5929] usb 3-1: config 0 has an invalid interface number: 117 but max is 0 [ 2057.921192][ T5929] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2058.217981][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2058.484158][T22950] usb 10-1: USB disconnect, device number 20 [ 2058.619381][ T5929] usb 3-1: config 0 has no interface number 0 [ 2058.631766][ T5929] usb 3-1: config 0 interface 117 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 2058.652841][ T5929] usb 3-1: config 0 interface 117 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2058.713956][ T5929] usb 3-1: New USB device found, idVendor=0afa, idProduct=03e8, bcdDevice=99.d0 [ 2058.733621][ T5929] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2058.761841][ T5929] usb 3-1: Product: syz [ 2058.779079][ T5929] usb 3-1: Manufacturer: syz [ 2058.808865][ T5929] usb 3-1: SerialNumber: syz [ 2058.838621][ T5929] usb 3-1: config 0 descriptor?? [ 2059.257957][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2060.082823][ T5929] usbtouchscreen 3-1:0.117: probe with driver usbtouchscreen failed with error -71 [ 2060.297982][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2060.310718][ T5929] usb 3-1: USB disconnect, device number 29 [ 2060.495405][T24840] lo speed is unknown, defaulting to 1000 [ 2060.986435][T10515] Bluetooth: hci3: command 0x0406 tx timeout [ 2061.338078][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2062.239142][T24854] binder: 24852:24854 ioctl c0306201 200003c0 returned -14 [ 2062.305700][T24858] overlayfs: failed to resolve './file1': -2 [ 2062.346900][T24860] netlink: 32 bytes leftover after parsing attributes in process `syz.2.5069'. [ 2062.377966][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2063.417967][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2063.992128][T24816] Bluetooth: hci1: unexpected event for opcode 0x080e [ 2063.992740][T24883] FAULT_INJECTION: forcing a failure. [ 2063.992740][T24883] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2064.025243][T24883] CPU: 1 UID: 0 PID: 24883 Comm: syz.6.5076 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2064.035704][T24883] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2064.045791][T24883] Call Trace: [ 2064.049093][T24883] [ 2064.052054][T24883] dump_stack_lvl+0x241/0x360 [ 2064.056772][T24883] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2064.061999][T24883] ? __pfx__printk+0x10/0x10 [ 2064.066634][T24883] ? __pfx_lock_release+0x10/0x10 [ 2064.071696][T24883] should_fail_ex+0x3b0/0x4e0 [ 2064.076404][T24883] _copy_from_user+0x2f/0xc0 [ 2064.081036][T24883] __sys_bpf+0x1a4/0x810 [ 2064.085306][T24883] ? __pfx___sys_bpf+0x10/0x10 [ 2064.090114][T24883] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 2064.096128][T24883] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 2064.102487][T24883] ? do_syscall_64+0x100/0x230 [ 2064.107291][T24883] __x64_sys_bpf+0x7c/0x90 [ 2064.111743][T24883] do_syscall_64+0xf3/0x230 [ 2064.116279][T24883] ? clear_bhb_loop+0x35/0x90 [ 2064.121001][T24883] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2064.126919][T24883] RIP: 0033:0x7f3429b80809 [ 2064.131357][T24883] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2064.151020][T24883] RSP: 002b:00007f342a8c9058 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2064.159468][T24883] RAX: ffffffffffffffda RBX: 00007f3429d45fa0 RCX: 00007f3429b80809 [ 2064.167463][T24883] RDX: 0000000000000020 RSI: 0000000020000200 RDI: 0000000000000012 [ 2064.175459][T24883] RBP: 00007f342a8c90a0 R08: 0000000000000000 R09: 0000000000000000 [ 2064.183471][T24883] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2064.191478][T24883] R13: 0000000000000000 R14: 00007f3429d45fa0 R15: 00007ffcb81ee888 [ 2064.199500][T24883] [ 2064.288143][ T5929] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 2064.410110][T24891] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5078'. [ 2064.457988][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2064.474030][ T5929] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2064.484615][ T5929] usb 10-1: config 0 has no interfaces? [ 2064.490331][ T5929] usb 10-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 2064.517935][ T5929] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2064.541505][ T5929] usb 10-1: config 0 descriptor?? [ 2064.667954][ T5894] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 2064.811517][ T5894] usb 3-1: device descriptor read/64, error -71 [ 2065.042397][T24902] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5082'. [ 2065.498280][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2065.737420][T24900] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 2065.835255][ T5894] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 2066.008051][ T5894] usb 3-1: device descriptor read/64, error -71 [ 2066.075329][T17420] usb 10-1: USB disconnect, device number 21 [ 2066.256215][ T5894] usb usb3-port1: attempt power cycle [ 2066.537960][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2067.577966][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2068.466506][ T29] kauditd_printk_skb: 69 callbacks suppressed [ 2068.466526][ T29] audit: type=1326 audit(1732812678.572:617): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24923 comm="syz.6.5089" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f3429b80809 code=0x0 [ 2068.617957][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2069.657987][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2070.698002][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2071.148101][ T29] audit: type=1326 audit(1732812681.252:618): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=24972 comm="syz.2.5106" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x0 [ 2071.627830][ C1] TCP: request_sock_subflow_v4: Possible SYN flooding on port [::]:20002. Sending cookies. [ 2071.737971][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2071.921968][ T29] audit: type=1800 audit(1732812682.032:619): pid=24989 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.9.5112" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 2072.777967][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2073.157487][T25004] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5116'. [ 2073.218047][T25004] netlink: 108 bytes leftover after parsing attributes in process `syz.5.5116'. [ 2073.330714][T25014] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2073.339662][T25014] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2073.778070][ T5929] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 2073.818040][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2074.831037][T25035] FAULT_INJECTION: forcing a failure. [ 2074.831037][T25035] name failslab, interval 1, probability 0, space 0, times 0 [ 2074.858009][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2075.512381][T25035] CPU: 0 UID: 0 PID: 25035 Comm: syz.9.5125 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2075.514622][ T5929] usb 3-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 2075.522842][T25035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2075.522863][T25035] Call Trace: [ 2075.522874][T25035] [ 2075.522886][T25035] dump_stack_lvl+0x241/0x360 [ 2075.522919][T25035] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2075.522943][T25035] ? __pfx__printk+0x10/0x10 [ 2075.532319][ T5929] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2075.542025][T25035] ? __kmalloc_noprof+0xb5/0x4c0 [ 2075.542058][T25035] ? __pfx___might_resched+0x10/0x10 [ 2075.547762][ T5929] usb 3-1: config 0 descriptor?? [ 2075.548305][T25035] should_fail_ex+0x3b0/0x4e0 [ 2075.548337][T25035] should_failslab+0xac/0x100 [ 2075.595481][T25035] __kmalloc_noprof+0xdd/0x4c0 [ 2075.600288][T25035] ? offload_action_alloc+0x2f/0x2a0 [ 2075.605619][T25035] offload_action_alloc+0x2f/0x2a0 [ 2075.610785][T25035] tcf_action_offload_add_ex+0x37f/0x840 [ 2075.616468][T25035] ? __pfx_tcf_action_offload_add_ex+0x10/0x10 [ 2075.622692][T25035] ? tcf_action_fill_size+0x1e/0x2d0 [ 2075.628019][T25035] ? tcf_action_fill_size+0x269/0x2d0 [ 2075.633417][T25035] tcf_action_init+0x347/0xae0 [ 2075.638195][T25035] ? 0xffffffffa0003b40 [ 2075.642371][T25035] ? __pfx_tcf_action_init+0x10/0x10 [ 2075.647710][T25035] ? __pfx_stack_trace_save+0x10/0x10 [ 2075.653124][T25035] ? cap_capable+0x1b4/0x250 [ 2075.657718][T25035] ? __lock_acquire+0x1397/0x2100 [ 2075.662752][T25035] ? cap_capable+0x1b4/0x250 [ 2075.667348][T25035] ? safesetid_security_capable+0xb2/0x1d0 [ 2075.673165][T25035] tc_ctl_action+0x47d/0xcf0 [ 2075.677784][T25035] ? __pfx_tc_ctl_action+0x10/0x10 [ 2075.682970][T25035] ? __pfx_tc_ctl_action+0x10/0x10 [ 2075.688102][T25035] rtnetlink_rcv_msg+0x73f/0xcf0 [ 2075.693046][T25035] ? rtnetlink_rcv_msg+0x1a7/0xcf0 [ 2075.698168][T25035] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2075.703652][T25035] ? ref_tracker_free+0x643/0x7e0 [ 2075.708695][T25035] netlink_rcv_skb+0x1e3/0x430 [ 2075.713472][T25035] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 2075.718948][T25035] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 2075.724286][T25035] ? netlink_deliver_tap+0x2e/0x1b0 [ 2075.729506][T25035] netlink_unicast+0x7f6/0x990 [ 2075.734293][T25035] ? __pfx_netlink_unicast+0x10/0x10 [ 2075.739602][T25035] ? __virt_addr_valid+0x183/0x530 [ 2075.744735][T25035] ? __check_object_size+0x48e/0x900 [ 2075.750046][T25035] netlink_sendmsg+0x8e4/0xcb0 [ 2075.754833][T25035] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2075.760153][T25035] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2075.765454][T25035] __sock_sendmsg+0x221/0x270 [ 2075.770162][T25035] ____sys_sendmsg+0x52a/0x7e0 [ 2075.774941][T25035] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2075.780240][T25035] ? __fget_files+0x2a/0x410 [ 2075.784842][T25035] ? __fget_files+0x2a/0x410 [ 2075.789448][T25035] __sys_sendmsg+0x269/0x350 [ 2075.794048][T25035] ? __pfx_lock_release+0x10/0x10 [ 2075.799105][T25035] ? __pfx___sys_sendmsg+0x10/0x10 [ 2075.804236][T25035] ? __pfx_vfs_write+0x10/0x10 [ 2075.809055][T25035] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 2075.815393][T25035] ? do_syscall_64+0x100/0x230 [ 2075.820170][T25035] ? do_syscall_64+0xb6/0x230 [ 2075.824885][T25035] do_syscall_64+0xf3/0x230 [ 2075.829413][T25035] ? clear_bhb_loop+0x35/0x90 [ 2075.834112][T25035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2075.840013][T25035] RIP: 0033:0x7f6092980809 [ 2075.844438][T25035] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2075.864061][T25035] RSP: 002b:00007f6093726058 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2075.872504][T25035] RAX: ffffffffffffffda RBX: 00007f6092b45fa0 RCX: 00007f6092980809 [ 2075.880509][T25035] RDX: 0000000000000000 RSI: 00000000200037c0 RDI: 0000000000000009 [ 2075.888514][T25035] RBP: 00007f60937260a0 R08: 0000000000000000 R09: 0000000000000000 [ 2075.896508][T25035] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 2075.904491][T25035] R13: 0000000000000000 R14: 00007f6092b45fa0 R15: 00007ffe186c29f8 [ 2075.912493][T25035] [ 2075.915585][ C0] vkms_vblank_simulate: vblank timer overrun [ 2075.922864][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2076.757666][ T5929] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 2076.767996][ T5929] asix 3-1:0.0: probe with driver asix failed with error -71 [ 2076.788688][ T5929] usb 3-1: USB disconnect, device number 33 [ 2076.937956][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2077.009477][T25059] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2077.039728][T25059] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2077.978134][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2079.017958][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2079.507008][ T5929] usb 10-1: new full-speed USB device number 22 using dummy_hcd [ 2080.058017][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2081.023968][T25102] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2081.097960][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2082.138019][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2082.326262][ T5929] usb 10-1: device descriptor read/all, error -71 [ 2082.381876][T25114] overlayfs: failed to resolve './file0': -2 [ 2083.177969][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2084.217967][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2084.853897][T25138] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5154'. [ 2085.031300][T25151] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2085.077635][T25151] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2085.142923][T25154] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2085.177615][T25154] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2085.257987][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2086.298137][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2086.615784][T25172] kAFS: No cell specified [ 2087.337954][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2088.378283][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2089.199031][T25211] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2089.221997][T25211] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2089.417979][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2090.328699][ T29] audit: type=1326 audit(1732812700.422:620): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25220 comm="syz.9.5178" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f6092980809 code=0x0 [ 2090.349797][ C1] vkms_vblank_simulate: vblank timer overrun [ 2090.457943][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2091.497997][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2091.782915][T25252] kAFS: No cell specified [ 2092.000966][ T29] audit: type=1326 audit(1732812702.112:621): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25246 comm="syz.0.5185" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f5e3a380809 code=0x0 [ 2092.375095][T25255] 9pnet: Unknown protocol version 9p200 [ 2092.537950][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2093.577964][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2094.526072][T25271] input: syz1 as /devices/virtual/input/input50 [ 2094.617941][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2094.899388][T25274] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2094.945282][T25274] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2095.350662][T25281] netlink: 'syz.9.5193': attribute type 5 has an invalid length. [ 2095.657959][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2096.320279][T25301] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 2096.404234][T25301] netlink: 48 bytes leftover after parsing attributes in process `syz.0.5200'. [ 2096.697980][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2097.737989][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2098.777941][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2098.986483][T25315] kAFS: No cell specified [ 2099.658021][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 2099.817963][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2100.857942][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2101.398830][T25331] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2101.438184][T25331] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2101.897945][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2102.937960][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2103.977947][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2104.154712][T25348] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5205'. [ 2104.321205][T10472] usb 7-1: new high-speed USB device number 46 using dummy_hcd [ 2104.440949][T12339] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 2104.678033][T10472] usb 7-1: Using ep0 maxpacket: 16 [ 2104.788054][T12339] usb 1-1: Using ep0 maxpacket: 32 [ 2105.017939][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2105.516847][T12339] usb 1-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.8f [ 2105.526351][T12339] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2105.534758][T12339] usb 1-1: Product: syz [ 2105.539039][T12339] usb 1-1: Manufacturer: syz [ 2105.543661][T12339] usb 1-1: SerialNumber: syz [ 2105.571565][T10472] usb 7-1: device descriptor read/all, error -71 [ 2105.892321][T12339] usb 1-1: config 0 descriptor?? [ 2105.900505][T12339] radio-si470x 1-1:0.0: could not find interrupt in endpoint [ 2105.910488][T25367] netlink: 'syz.6.5217': attribute type 1 has an invalid length. [ 2105.911543][T12339] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -5 [ 2105.959413][T25367] 8021q: adding VLAN 0 to HW filter on device bond1 [ 2105.986238][T25372] x_tables: duplicate underflow at hook 4 [ 2106.028419][T25371] kAFS: No cell specified [ 2106.057605][T25370] bond1: (slave bridge1): making interface the new active one [ 2106.065343][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2106.170783][T25370] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 2106.340385][T25374] FAULT_INJECTION: forcing a failure. [ 2106.340385][T25374] name failslab, interval 1, probability 0, space 0, times 0 [ 2106.353104][T25374] CPU: 1 UID: 0 PID: 25374 Comm: syz.2.5218 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2106.363576][T25374] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2106.373753][T25374] Call Trace: [ 2106.377053][T25374] [ 2106.380003][T25374] dump_stack_lvl+0x241/0x360 [ 2106.384708][T25374] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2106.389932][T25374] ? __pfx__printk+0x10/0x10 [ 2106.394573][T25374] ? fs_reclaim_acquire+0x93/0x130 [ 2106.399721][T25374] ? __pfx___might_resched+0x10/0x10 [ 2106.405060][T25374] should_fail_ex+0x3b0/0x4e0 [ 2106.409762][T25374] should_failslab+0xac/0x100 [ 2106.414465][T25374] __kmalloc_noprof+0xdd/0x4c0 [ 2106.419256][T25374] ? tomoyo_encode+0x26f/0x540 [ 2106.424055][T25374] tomoyo_encode+0x26f/0x540 [ 2106.428671][T25374] tomoyo_mount_permission+0x53d/0xb80 [ 2106.434169][T25374] ? tomoyo_mount_permission+0x298/0xb80 [ 2106.439830][T25374] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 2106.445863][T25374] ? hook_sb_mount+0x10b/0x420 [ 2106.450640][T25374] ? security_sb_mount+0x22/0x2f0 [ 2106.455695][T25374] security_sb_mount+0xe0/0x2f0 [ 2106.460576][T25374] path_mount+0xb9/0xfa0 [ 2106.464872][T25374] ? kmem_cache_free+0x195/0x410 [ 2106.469817][T25374] ? user_path_at+0x44/0x60 [ 2106.474337][T25374] __se_sys_mount+0x2d6/0x3c0 [ 2106.479018][T25374] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 2106.485012][T25374] ? __pfx___se_sys_mount+0x10/0x10 [ 2106.490227][T25374] ? do_syscall_64+0x100/0x230 [ 2106.494999][T25374] ? __x64_sys_mount+0x20/0xc0 [ 2106.499768][T25374] do_syscall_64+0xf3/0x230 [ 2106.504286][T25374] ? clear_bhb_loop+0x35/0x90 [ 2106.508981][T25374] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2106.514899][T25374] RIP: 0033:0x7f3d52580809 [ 2106.519313][T25374] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2106.538921][T25374] RSP: 002b:00007f3d503f6058 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 2106.547351][T25374] RAX: ffffffffffffffda RBX: 00007f3d52745fa0 RCX: 00007f3d52580809 [ 2106.555328][T25374] RDX: 0000000020000680 RSI: 0000000020000640 RDI: 0000000000000000 [ 2106.563301][T25374] RBP: 00007f3d503f60a0 R08: 0000000000000000 R09: 0000000000000000 [ 2106.571277][T25374] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2106.579254][T25374] R13: 0000000000000000 R14: 00007f3d52745fa0 R15: 00007ffdebdecac8 [ 2106.587241][T25374] [ 2106.611836][T12339] radio-raremono 1-1:0.0: Thanko's Raremono connected: (10C4:818A) [ 2106.698355][T25353] loop7: detected capacity change from 1 to 0 [ 2106.744558][T12339] radio-raremono 1-1:0.0: raremono_cmd_main failed (-71) [ 2106.763844][T12339] radio-raremono 1-1:0.0: V4L2 device registered as radio48 [ 2106.793704][T12339] usb 1-1: USB disconnect, device number 58 [ 2106.808454][T12339] radio-raremono 1-1:0.0: Thanko's Raremono disconnected [ 2107.097347][T25380] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2107.098006][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2107.106407][T25380] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2108.069003][T25384] fuse: Bad value for 'group_id' [ 2108.073995][T25384] fuse: Bad value for 'group_id' [ 2108.137950][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2108.412353][T25386] (syz.6.5221,25386,1):ocfs2_fill_super:990 ERROR: superblock probe failed! [ 2108.421535][T25386] (syz.6.5221,25386,1):ocfs2_fill_super:1178 ERROR: status = -22 [ 2108.678723][T25380] loop7: detected capacity change from 0 to 1 [ 2109.177968][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2110.217958][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2110.358381][ T29] audit: type=1326 audit(1732812720.472:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2110.434582][T25392] 9pnet_fd: Insufficient options for proto=fd [ 2110.444734][ T29] audit: type=1326 audit(1732812720.472:623): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2110.719716][ T29] audit: type=1326 audit(1732812720.492:624): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=323 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2110.815106][ T29] audit: type=1326 audit(1732812720.492:625): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2110.854300][ T29] audit: type=1326 audit(1732812720.492:626): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2110.876574][ T29] audit: type=1326 audit(1732812720.492:627): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2111.257937][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2111.621626][ T29] audit: type=1326 audit(1732812720.492:628): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2111.668497][ T29] audit: type=1326 audit(1732812720.492:629): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2111.717896][ T29] audit: type=1326 audit(1732812720.502:630): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=10 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2111.758052][ T29] audit: type=1326 audit(1732812720.502:631): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25401 comm="syz.2.5227" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3d52580809 code=0x7ffc0000 [ 2112.297947][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2113.139006][T25425] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5232'. [ 2113.337971][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2114.107979][T25425] bridge_slave_1: left allmulticast mode [ 2114.114892][T25425] bridge_slave_1: left promiscuous mode [ 2114.127477][T25425] bridge0: port 2(bridge_slave_1) entered disabled state [ 2114.377992][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2114.769404][T25425] bridge_slave_0: left allmulticast mode [ 2114.775287][T25425] bridge_slave_0: left promiscuous mode [ 2114.781255][T25425] bridge0: port 1(bridge_slave_0) entered disabled state [ 2114.806217][T25437] netlink: 'syz.2.5234': attribute type 10 has an invalid length. [ 2114.926380][T25448] kAFS: No cell specified [ 2114.943092][T25449] overlayfs: failed to resolve './file0': -2 [ 2115.228255][T25437] bridge0: port 2(bridge_slave_1) entered disabled state [ 2115.235588][T25437] bridge0: port 1(bridge_slave_0) entered disabled state [ 2115.260293][T25437] bridge0: port 2(bridge_slave_1) entered blocking state [ 2115.267536][T25437] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2115.274994][T25437] bridge0: port 1(bridge_slave_0) entered blocking state [ 2115.282168][T25437] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2115.399947][T25437] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 2115.418238][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2116.198299][T25461] IPv6: Can't replace route, no match found [ 2116.457946][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2117.278279][ T5929] usb 7-1: new full-speed USB device number 48 using dummy_hcd [ 2117.497949][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2117.516914][ T5929] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2117.564284][ T5929] usb 7-1: New USB device found, idVendor=d6ff, idProduct=00cf, bcdDevice=d8.b0 [ 2117.607233][ T5929] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2117.689200][ T5929] usb 7-1: config 0 descriptor?? [ 2117.700247][ T5929] usb 7-1: bad CDC descriptors [ 2117.908233][T25476] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5245'. [ 2118.537976][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2119.409900][T22950] usb 7-1: USB disconnect, device number 48 [ 2119.578316][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2120.617959][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2120.672329][T25486] netlink: 'syz.9.5248': attribute type 1 has an invalid length. [ 2120.770462][T25486] netlink: 'syz.9.5248': attribute type 3 has an invalid length. [ 2120.825416][T25486] netlink: 224 bytes leftover after parsing attributes in process `syz.9.5248'. [ 2120.953431][T25492] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2120.955358][T25494] netlink: 'syz.2.5250': attribute type 3 has an invalid length. [ 2120.990252][T25494] netlink: 'syz.2.5250': attribute type 3 has an invalid length. [ 2121.000538][T25492] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2121.079243][T25495] bond0: (slave bridge0): Releasing backup interface [ 2121.288238][T25495] bridge0: port 2(bridge_slave_1) entered disabled state [ 2121.295568][T25495] bridge0: port 1(bridge_slave_0) entered disabled state [ 2121.370125][T25495] bridge_slave_0: left allmulticast mode [ 2121.385876][T25495] bridge_slave_0: left promiscuous mode [ 2121.464010][T25495] bridge0: port 1(bridge_slave_0) entered disabled state [ 2121.657994][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2121.661903][T25509] 9pnet: Unknown protocol version 9p200 [ 2122.698069][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2123.136749][T25495] bridge_slave_1: left allmulticast mode [ 2123.168024][T25495] bridge_slave_1: left promiscuous mode [ 2123.186141][T25495] bridge0: port 2(bridge_slave_1) entered disabled state [ 2123.266327][T25495] bond0: (slave bond_slave_0): Releasing backup interface [ 2123.317772][T25495] bond0: (slave bond_slave_1): Releasing backup interface [ 2123.458992][T25495] team0: Port device team_slave_0 removed [ 2123.485453][T25495] team0: Port device team_slave_1 removed [ 2123.496875][T25495] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2123.508299][T25495] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2123.523127][T25495] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2123.543134][T25495] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2123.589026][T25495] bond0: (slave wlan1): Releasing backup interface [ 2123.737946][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2123.985165][T25530] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5260'. [ 2124.777944][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2125.817946][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2126.817182][T25548] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5261'. [ 2126.846845][T25547] binder: 25543:25547 ioctl c0306201 0 returned -14 [ 2126.857942][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2126.906048][T25549] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2126.928525][T25549] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2127.897964][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2128.937921][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2129.064622][T25576] 9pnet: Unknown protocol version 9p200 [ 2129.977944][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2130.610857][T25598] netlink: 'syz.2.5275': attribute type 30 has an invalid length. [ 2131.017938][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2132.058002][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2132.279083][T25607] tipc: Enabling of bearer rejected, failed to enable media [ 2133.098049][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2134.137926][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2134.150052][T25623] netlink: 8 bytes leftover after parsing attributes in process `syz.9.5279'. [ 2135.178007][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2135.610400][T25624] lo speed is unknown, defaulting to 1000 [ 2136.218077][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2137.258012][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2137.800601][T25660] netlink: 24 bytes leftover after parsing attributes in process `syz.2.5290'. [ 2137.840997][ T29] kauditd_printk_skb: 31 callbacks suppressed [ 2137.841016][ T29] audit: type=1326 audit(1732812747.952:663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.047146][ T29] audit: type=1326 audit(1732812747.952:664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.069715][ T29] audit: type=1326 audit(1732812747.952:665): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=13 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.091719][ T29] audit: type=1326 audit(1732812747.952:666): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.113258][ C0] vkms_vblank_simulate: vblank timer overrun [ 2138.185228][ T29] audit: type=1326 audit(1732812747.952:667): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.211080][ T29] audit: type=1326 audit(1732812747.962:668): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.232652][ C0] vkms_vblank_simulate: vblank timer overrun [ 2138.242154][ T29] audit: type=1326 audit(1732812747.962:669): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.263705][ C0] vkms_vblank_simulate: vblank timer overrun [ 2138.271594][ T29] audit: type=1326 audit(1732812747.962:670): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2138.297981][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2138.468240][ T29] audit: type=1326 audit(1732812747.962:671): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=285 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2139.015299][ T29] audit: type=1326 audit(1732812747.962:672): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=25661 comm="syz.6.5291" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3429b80809 code=0x7ffc0000 [ 2139.337943][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2140.327438][T25688] 9pnet: Unknown protocol version 9p200 [ 2140.377943][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2140.433699][T25690] FAULT_INJECTION: forcing a failure. [ 2140.433699][T25690] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2140.447121][T25690] CPU: 1 UID: 0 PID: 25690 Comm: syz.2.5297 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2140.457553][T25690] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2140.467622][T25690] Call Trace: [ 2140.470902][T25690] [ 2140.473834][T25690] dump_stack_lvl+0x241/0x360 [ 2140.478519][T25690] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2140.483734][T25690] ? __pfx__printk+0x10/0x10 [ 2140.488346][T25690] ? __pfx_lock_release+0x10/0x10 [ 2140.493399][T25690] ? __lock_acquire+0x1397/0x2100 [ 2140.498473][T25690] should_fail_ex+0x3b0/0x4e0 [ 2140.503185][T25690] _copy_from_user+0x2f/0xc0 [ 2140.507823][T25690] kstrtouint_from_user+0xc6/0x190 [ 2140.512956][T25690] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 2140.518696][T25690] ? __pfx_lock_acquire+0x10/0x10 [ 2140.523730][T25690] proc_fail_nth_write+0xaa/0x2d0 [ 2140.528758][T25690] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 2140.534658][T25690] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2140.540288][T25690] ? vfs_write+0x1ed/0xd30 [ 2140.544710][T25690] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 2140.550382][T25690] vfs_write+0x2a3/0xd30 [ 2140.554636][T25690] ? __pfx_vfs_write+0x10/0x10 [ 2140.559405][T25690] ? __fget_files+0x2a/0x410 [ 2140.563996][T25690] ? __fget_files+0x395/0x410 [ 2140.568668][T25690] ? __fget_files+0x2a/0x410 [ 2140.573259][T25690] ksys_write+0x18f/0x2b0 [ 2140.577608][T25690] ? __pfx_ksys_write+0x10/0x10 [ 2140.582462][T25690] ? do_syscall_64+0x100/0x230 [ 2140.587228][T25690] ? do_syscall_64+0xb6/0x230 [ 2140.591921][T25690] do_syscall_64+0xf3/0x230 [ 2140.596434][T25690] ? clear_bhb_loop+0x35/0x90 [ 2140.601200][T25690] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2140.607126][T25690] RIP: 0033:0x7f3d5257f2bf [ 2140.611545][T25690] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 8d 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 8e 02 00 48 [ 2140.631145][T25690] RSP: 002b:00007f3d503f6050 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 2140.639554][T25690] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f3d5257f2bf [ 2140.647517][T25690] RDX: 0000000000000001 RSI: 00007f3d503f60b0 RDI: 0000000000000003 [ 2140.655493][T25690] RBP: 00007f3d503f60a0 R08: 0000000000000000 R09: 0000000000000000 [ 2140.663465][T25690] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002 [ 2140.671440][T25690] R13: 0000000000000000 R14: 00007f3d52745fa0 R15: 00007ffdebdecac8 [ 2140.679424][T25690] [ 2141.417928][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2142.114440][T25698] erofs (device erofs): cannot find valid erofs superblock [ 2142.458059][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2142.770604][T25708] netlink: 28 bytes leftover after parsing attributes in process `syz.2.5304'. [ 2142.800106][T25713] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5305'. [ 2142.809904][T25708] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5304'. [ 2142.834098][T25708] netlink: 12 bytes leftover after parsing attributes in process `syz.2.5304'. [ 2143.497957][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2144.537996][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2144.663193][T25724] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5308'. [ 2144.846389][T25735] syz.5.5311 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 2145.151208][T25745] vivid-004: ================= START STATUS ================= [ 2145.173459][T25745] vivid-004: Radio HW Seek Mode: Bounded [ 2145.198939][T25745] vivid-004: Radio Programmable HW Seek: false [ 2145.248069][T25745] vivid-004: RDS Rx I/O Mode: Block I/O [ 2145.255660][T25745] vivid-004: Generate RBDS Instead of RDS: false [ 2145.262442][T25745] vivid-004: RDS Reception: true [ 2145.267672][T25745] vivid-004: RDS Program Type: 0 inactive [ 2145.274209][T25745] vivid-004: RDS PS Name: inactive [ 2145.577927][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2146.162274][T25745] vivid-004: RDS Radio Text: inactive [ 2146.167956][T25745] vivid-004: RDS Traffic Announcement: false inactive [ 2146.174736][T25745] vivid-004: RDS Traffic Program: false inactive [ 2146.182128][T25745] vivid-004: RDS Music: false inactive [ 2146.187611][T25745] vivid-004: ================== END STATUS ================== [ 2146.505602][T25753] vlan2: entered promiscuous mode [ 2146.521117][T25753] vlan2: entered allmulticast mode [ 2146.618072][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2146.640920][T25757] kAFS: No cell specified [ 2146.771661][T25760] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5319'. [ 2146.809855][T25760] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5319'. [ 2147.657994][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2148.697955][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2149.221767][T25784] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5324'. [ 2149.274671][T25791] FAULT_INJECTION: forcing a failure. [ 2149.274671][T25791] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2149.336585][T25791] CPU: 1 UID: 0 PID: 25791 Comm: syz.0.5327 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2149.347070][T25791] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2149.357149][T25791] Call Trace: [ 2149.360467][T25791] [ 2149.363417][T25791] dump_stack_lvl+0x241/0x360 [ 2149.368127][T25791] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2149.373357][T25791] ? __pfx__printk+0x10/0x10 [ 2149.377989][T25791] ? snprintf+0xda/0x120 [ 2149.382271][T25791] should_fail_ex+0x3b0/0x4e0 [ 2149.386967][T25791] _copy_to_user+0x31/0xb0 [ 2149.391405][T25791] simple_read_from_buffer+0xca/0x150 [ 2149.396812][T25791] proc_fail_nth_read+0x1e9/0x250 [ 2149.401876][T25791] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2149.407455][T25791] ? rw_verify_area+0x568/0x6f0 [ 2149.412336][T25791] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2149.417914][T25791] vfs_read+0x1fc/0xb70 [ 2149.422111][T25791] ? kmem_cache_free+0x195/0x410 [ 2149.427092][T25791] ? __pfx_vfs_read+0x10/0x10 [ 2149.431819][T25791] ? put_files_struct+0x23d/0x310 [ 2149.436878][T25791] ? __pfx_do_mq_notify+0x10/0x10 [ 2149.441944][T25791] ? __might_fault+0xc6/0x120 [ 2149.446672][T25791] ksys_read+0x18f/0x2b0 [ 2149.450945][T25791] ? __pfx_ksys_read+0x10/0x10 [ 2149.455756][T25791] ? do_syscall_64+0x100/0x230 [ 2149.460550][T25791] ? do_syscall_64+0xb6/0x230 [ 2149.465265][T25791] do_syscall_64+0xf3/0x230 [ 2149.469803][T25791] ? clear_bhb_loop+0x35/0x90 [ 2149.474516][T25791] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2149.480425][T25791] RIP: 0033:0x7f5e3a37f21c [ 2149.484848][T25791] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 8e 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 8e 02 00 48 [ 2149.504464][T25791] RSP: 002b:00007f5e381f6050 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2149.512890][T25791] RAX: ffffffffffffffda RBX: 00007f5e3a545fa0 RCX: 00007f5e3a37f21c [ 2149.520885][T25791] RDX: 000000000000000f RSI: 00007f5e381f60b0 RDI: 0000000000000004 [ 2149.528862][T25791] RBP: 00007f5e381f60a0 R08: 0000000000000000 R09: 0000000000000000 [ 2149.536836][T25791] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2149.544807][T25791] R13: 0000000000000000 R14: 00007f5e3a545fa0 R15: 00007ffc9d9d9fa8 [ 2149.552802][T25791] [ 2149.555894][T25769] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 2149.596792][T25797] overlay: ./file0 is not a directory [ 2149.644524][T25800] netlink: 24 bytes leftover after parsing attributes in process `syz.0.5331'. [ 2149.717945][T25769] usb 3-1: Using ep0 maxpacket: 16 [ 2149.724920][T25769] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2149.736301][T25769] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2149.746227][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2149.787793][T25769] usb 3-1: New USB device found, idVendor=056e, idProduct=00ff, bcdDevice= 0.00 [ 2149.797471][T25769] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2149.858770][T25769] usb 3-1: config 0 descriptor?? [ 2150.778031][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2150.788828][T25769] elecom 0003:056E:00FF.0021: hidraw0: USB HID v0.10 Device [HID 056e:00ff] on usb-dummy_hcd.2-1/input0 [ 2151.028876][T25769] usb 3-1: USB disconnect, device number 34 [ 2151.818063][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2152.413206][T25826] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5337'. [ 2152.858039][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2153.593568][T25848] xt_l2tp: v2 tid > 0xffff: 262144 [ 2153.686751][T25851] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 2153.715271][T25850] netlink: 24 bytes leftover after parsing attributes in process `syz.5.5346'. [ 2153.897981][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2154.937970][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2155.970797][T25873] netlink: 'syz.2.5352': attribute type 16 has an invalid length. [ 2155.977969][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2157.017947][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2157.742367][T25893] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5359'. [ 2158.058074][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2159.097964][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2160.137965][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2160.542131][ T1291] ieee802154 phy1 wpan1: encryption failed: -22 [ 2161.177993][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2161.580567][T25937] vlan2: entered promiscuous mode [ 2161.585750][T25937] vlan2: entered allmulticast mode [ 2161.635878][T25937] hsr_slave_1: entered allmulticast mode [ 2162.018123][ T5929] usb 7-1: new full-speed USB device number 49 using dummy_hcd [ 2162.037326][T25949] netlink: 12 bytes leftover after parsing attributes in process `syz.9.5377'. [ 2162.218028][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2163.076175][ T5929] usb 7-1: config index 0 descriptor too short (expected 6427, got 27) [ 2163.085771][ T5929] usb 7-1: config 0 has an invalid interface number: 21 but max is 0 [ 2163.127082][ T5929] usb 7-1: config 0 has no interface number 0 [ 2163.148569][ T5929] usb 7-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 2163.193459][ T5929] usb 7-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 2163.239795][ T5929] usb 7-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 2163.258248][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2163.299151][ T5929] usb 7-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 2163.328931][ T5929] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2163.349160][ T5929] usb 7-1: config 0 descriptor?? [ 2163.354880][T25937] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 2163.915768][T25969] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5372'. [ 2164.169479][T25970] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2164.266088][T25970] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2164.298082][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2164.462953][T25972] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2164.473982][T25969] hsr_slave_1 (unregistering): left allmulticast mode [ 2164.489254][T25972] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2164.554455][T25969] hsr_slave_1 (unregistering): left promiscuous mode [ 2164.750971][ T5929] usb 7-1: USB disconnect, device number 49 [ 2165.337997][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2166.050850][T25992] netlink: 12 bytes leftover after parsing attributes in process `syz.6.5388'. [ 2166.377958][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2167.177082][T26003] overlayfs: failed to resolve './file0': -2 [ 2167.417959][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2167.417983][ T5929] usb 7-1: new high-speed USB device number 50 using dummy_hcd [ 2167.606912][ T5929] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 2167.628357][ T5929] usb 7-1: config 0 has no interface number 0 [ 2167.634539][ T5929] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2167.677044][ T5929] usb 7-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2167.701265][ T5929] usb 7-1: New USB device found, idVendor=5543, idProduct=0522, bcdDevice= 0.00 [ 2167.718197][ T5929] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2167.745426][ T5929] usb 7-1: config 0 descriptor?? [ 2167.848045][ T9] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 2167.940945][T26014] kAFS: No cell specified [ 2168.008048][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 2168.019855][ T9] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 2168.038327][ T9] usb 3-1: config 0 has no interface number 0 [ 2168.044470][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2168.086260][ T9] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2168.116633][ T9] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 2168.148137][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2168.177350][ T9] usb 3-1: config 0 descriptor?? [ 2168.187487][ T5929] uclogic 0003:5543:0522.0022: No inputs registered, leaving [ 2168.221643][ T5929] uclogic 0003:5543:0522.0022: hidraw0: USB HID v0.00 Device [HID 5543:0522] on usb-dummy_hcd.6-1/input1 [ 2168.440541][T26004] (unnamed net_device) (uninitialized): option use_carrier: invalid value (4) [ 2168.454967][T21696] usb 7-1: USB disconnect, device number 50 [ 2168.457981][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2168.615488][ T9] usbhid 3-1:0.1: can't add hid device: -71 [ 2168.634621][ T9] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 2168.656067][ T9] usb 3-1: USB disconnect, device number 35 [ 2169.498064][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2169.932207][T26033] netlink: 8 bytes leftover after parsing attributes in process `syz.2.5401'. [ 2170.341890][T26041] netlink: 76 bytes leftover after parsing attributes in process `syz.6.5399'. [ 2170.537993][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2171.302153][T26039] netlink: 'syz.9.5404': attribute type 72 has an invalid length. [ 2171.577939][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2172.370295][T26056] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2172.379238][T26056] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2172.617995][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2173.426392][T26067] FAULT_INJECTION: forcing a failure. [ 2173.426392][T26067] name failslab, interval 1, probability 0, space 0, times 0 [ 2173.464775][T26067] CPU: 1 UID: 0 PID: 26067 Comm: syz.6.5410 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2173.475245][T26067] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2173.485312][T26067] Call Trace: [ 2173.488604][T26067] [ 2173.491544][T26067] dump_stack_lvl+0x241/0x360 [ 2173.496235][T26067] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2173.501451][T26067] ? __pfx__printk+0x10/0x10 [ 2173.506058][T26067] ? __kmalloc_noprof+0xb5/0x4c0 [ 2173.511002][T26067] ? __pfx___might_resched+0x10/0x10 [ 2173.516299][T26067] should_fail_ex+0x3b0/0x4e0 [ 2173.521017][T26067] should_failslab+0xac/0x100 [ 2173.525719][T26067] __kmalloc_noprof+0xdd/0x4c0 [ 2173.530490][T26067] ? io_alloc_async_data+0x7a/0x120 [ 2173.535703][T26067] io_alloc_async_data+0x7a/0x120 [ 2173.540735][T26067] io_msg_alloc_async+0x1b7/0x300 [ 2173.545786][T26067] io_connect_prep+0x1b6/0x300 [ 2173.550567][T26067] io_submit_sqes+0x94a/0x1d90 [ 2173.555360][T26067] __se_sys_io_uring_enter+0x2c8/0x3200 [ 2173.560925][T26067] ? __pfx_rcu_read_lock_any_held+0x10/0x10 [ 2173.566828][T26067] ? ksys_write+0x22a/0x2b0 [ 2173.571343][T26067] ? __pfx_lock_release+0x10/0x10 [ 2173.576377][T26067] ? vfs_write+0x730/0xd30 [ 2173.580829][T26067] ? __pfx___se_sys_io_uring_enter+0x10/0x10 [ 2173.586820][T26067] ? __mutex_unlock_slowpath+0x21e/0x790 [ 2173.592482][T26067] ? __pfx_vfs_write+0x10/0x10 [ 2173.597266][T26067] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 2173.603258][T26067] ? __fget_files+0x2a/0x410 [ 2173.607865][T26067] ? __fget_files+0x2a/0x410 [ 2173.612466][T26067] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 2173.618449][T26067] ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10 [ 2173.624778][T26067] ? do_syscall_64+0x100/0x230 [ 2173.629546][T26067] ? __x64_sys_io_uring_enter+0x21/0xf0 [ 2173.635106][T26067] do_syscall_64+0xf3/0x230 [ 2173.639623][T26067] ? clear_bhb_loop+0x35/0x90 [ 2173.644308][T26067] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2173.650205][T26067] RIP: 0033:0x7f3429b80809 [ 2173.654624][T26067] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2173.657995][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2173.674227][T26067] RSP: 002b:00007f342a8c9058 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 2173.689574][T26067] RAX: ffffffffffffffda RBX: 00007f3429d45fa0 RCX: 00007f3429b80809 [ 2173.697554][T26067] RDX: 0000000000000000 RSI: 000000000000291c RDI: 0000000000000004 [ 2173.705528][T26067] RBP: 00007f342a8c90a0 R08: 0000000000000000 R09: 0000000000000000 [ 2173.713498][T26067] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2173.721468][T26067] R13: 0000000000000000 R14: 00007f3429d45fa0 R15: 00007ffcb81ee888 [ 2173.729451][T26067] [ 2173.732564][ C1] vkms_vblank_simulate: vblank timer overrun [ 2174.078024][T21696] usb 10-1: new high-speed USB device number 24 using dummy_hcd [ 2174.085901][T12292] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 2174.258409][T21696] usb 10-1: Using ep0 maxpacket: 16 [ 2174.268053][T12292] usb 3-1: Using ep0 maxpacket: 32 [ 2174.309008][T21696] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2174.331626][T12292] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 2174.348655][T21696] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2174.368003][T12292] usb 3-1: config 0 has no interface number 0 [ 2174.374985][T12292] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2174.398506][T21696] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2174.582368][T12292] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2174.598013][T21696] usb 10-1: New USB device found, idVendor=056a, idProduct=0084, bcdDevice= 0.00 [ 2174.608633][T12292] usb 3-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.00 [ 2174.620034][T21696] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2174.697981][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2175.501342][T12292] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2175.532480][T21696] usb 10-1: config 0 descriptor?? [ 2175.539744][T12292] usb 3-1: config 0 descriptor?? [ 2175.652510][T26084] 9pnet_fd: Insufficient options for proto=fd [ 2175.738135][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2176.069970][T12292] usbhid 3-1:0.1: can't add hid device: -71 [ 2176.123403][T12292] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 2176.203170][T17420] usb 1-1: new high-speed USB device number 59 using dummy_hcd [ 2176.207230][T12292] usb 3-1: USB disconnect, device number 36 [ 2176.237398][T21696] wacom 0003:056A:0084.0023: hidraw0: USB HID v0.00 Device [HID 056a:0084] on usb-dummy_hcd.9-1/input0 [ 2176.598793][T17420] usb 1-1: no configurations [ 2176.607037][T17420] usb 1-1: can't read configurations, error -22 [ 2176.778311][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2176.785873][T17420] usb 1-1: new high-speed USB device number 60 using dummy_hcd [ 2177.066005][T17420] usb 1-1: no configurations [ 2177.072993][T17420] usb 1-1: can't read configurations, error -22 [ 2177.081735][T17420] usb usb1-port1: attempt power cycle [ 2177.818180][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2178.028020][T12292] usb 10-1: reset high-speed USB device number 24 using dummy_hcd [ 2178.050077][T26110] cgroup2: Unknown parameter 'g€tlb_accounting' [ 2178.055751][T26111] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 2178.084551][T26111] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 2178.117946][T17420] usb 1-1: new high-speed USB device number 61 using dummy_hcd [ 2178.139285][T17420] usb 1-1: no configurations [ 2178.143919][T17420] usb 1-1: can't read configurations, error -22 [ 2178.278092][T17420] usb 1-1: new high-speed USB device number 62 using dummy_hcd [ 2178.319335][T17420] usb 1-1: no configurations [ 2178.324016][T17420] usb 1-1: can't read configurations, error -22 [ 2178.362931][T17420] usb usb1-port1: unable to enumerate USB device [ 2178.868133][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2178.950841][T26122] netlink: 'syz.2.5426': attribute type 10 has an invalid length. [ 2179.128763][T26122] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 2179.898088][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2180.684419][T26145] kAFS: No cell specified [ 2180.742765][ T5929] usb 10-1: USB disconnect, device number 24 [ 2180.947949][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2181.977960][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2182.682651][T26170] FAULT_INJECTION: forcing a failure. [ 2182.682651][T26170] name failslab, interval 1, probability 0, space 0, times 0 [ 2182.692224][T26171] FAULT_INJECTION: forcing a failure. [ 2182.692224][T26171] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2182.717375][T26170] CPU: 0 UID: 0 PID: 26170 Comm: syz.0.5441 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2182.727826][T26170] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2182.737903][T26170] Call Trace: [ 2182.741194][T26170] [ 2182.744150][T26170] dump_stack_lvl+0x241/0x360 [ 2182.748862][T26170] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2182.754100][T26170] ? __pfx__printk+0x10/0x10 [ 2182.758740][T26170] ? fs_reclaim_acquire+0x93/0x130 [ 2182.763888][T26170] ? __pfx___might_resched+0x10/0x10 [ 2182.769206][T26170] should_fail_ex+0x3b0/0x4e0 [ 2182.773905][T26170] should_failslab+0xac/0x100 [ 2182.778604][T26170] __kmalloc_noprof+0xdd/0x4c0 [ 2182.783377][T26170] ? tomoyo_encode+0x26f/0x540 [ 2182.788165][T26170] tomoyo_encode+0x26f/0x540 [ 2182.792781][T26170] tomoyo_mount_permission+0x359/0xb80 [ 2182.798273][T26170] ? tomoyo_mount_permission+0x298/0xb80 [ 2182.803930][T26170] ? __pfx_tomoyo_mount_permission+0x10/0x10 [ 2182.809989][T26170] ? hook_sb_mount+0x10b/0x420 [ 2182.814806][T26170] ? security_sb_mount+0x22/0x2f0 [ 2182.819868][T26170] security_sb_mount+0xe0/0x2f0 [ 2182.824765][T26170] path_mount+0xb9/0xfa0 [ 2182.829031][T26170] ? kmem_cache_free+0x195/0x410 [ 2182.833998][T26170] ? user_path_at+0x44/0x60 [ 2182.838541][T26170] __se_sys_mount+0x2d6/0x3c0 [ 2182.843240][T26170] ? __pfx___se_sys_mount+0x10/0x10 [ 2182.848455][T26170] ? do_syscall_64+0x100/0x230 [ 2182.853226][T26170] ? __x64_sys_mount+0x20/0xc0 [ 2182.858001][T26170] do_syscall_64+0xf3/0x230 [ 2182.862538][T26170] ? clear_bhb_loop+0x35/0x90 [ 2182.867233][T26170] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2182.873143][T26170] RIP: 0033:0x7f5e3a380809 [ 2182.877567][T26170] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2182.897178][T26170] RSP: 002b:00007f5e381f6058 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 [ 2182.905617][T26170] RAX: ffffffffffffffda RBX: 00007f5e3a545fa0 RCX: 00007f5e3a380809 [ 2182.913614][T26170] RDX: 0000000020000540 RSI: 0000000020000500 RDI: 0000000000000000 [ 2182.921597][T26170] RBP: 00007f5e381f60a0 R08: 0000000020000800 R09: 0000000000000000 [ 2182.929595][T26170] R10: 0000000000000080 R11: 0000000000000246 R12: 0000000000000001 [ 2182.937580][T26170] R13: 0000000000000000 R14: 00007f5e3a545fa0 R15: 00007ffc9d9d9fa8 [ 2182.945579][T26170] [ 2182.958317][T26171] CPU: 1 UID: 0 PID: 26171 Comm: syz.2.5440 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2182.968786][T26171] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2182.978865][T26171] Call Trace: [ 2182.982169][T26171] [ 2182.985122][T26171] dump_stack_lvl+0x241/0x360 [ 2182.989836][T26171] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2182.995069][T26171] ? __pfx__printk+0x10/0x10 [ 2182.999707][T26171] ? __pfx_lock_release+0x10/0x10 [ 2183.004770][T26171] should_fail_ex+0x3b0/0x4e0 [ 2183.009482][T26171] _copy_from_user+0x2f/0xc0 [ 2183.014118][T26171] udp_lib_setsockopt+0x19e/0xc10 [ 2183.018407][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2183.019165][T26171] ? __pfx_udp_lib_setsockopt+0x10/0x10 [ 2183.031579][T26171] ? vfs_write+0x730/0xd30 [ 2183.036032][T26171] ? do_sys_openat2+0x17a/0x1d0 [ 2183.040907][T26171] udp_setsockopt+0x73/0xb0 [ 2183.045433][T26171] ? __pfx_udp_push_pending_frames+0x10/0x10 [ 2183.051441][T26171] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 2183.057394][T26171] do_sock_setsockopt+0x3af/0x720 [ 2183.062450][T26171] ? __pfx_do_sock_setsockopt+0x10/0x10 [ 2183.068040][T26171] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 2183.074059][T26171] __x64_sys_setsockopt+0x1ee/0x280 [ 2183.079297][T26171] do_syscall_64+0xf3/0x230 [ 2183.083829][T26171] ? clear_bhb_loop+0x35/0x90 [ 2183.088531][T26171] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2183.094448][T26171] RIP: 0033:0x7f3d52580809 [ 2183.098891][T26171] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2183.118528][T26171] RSP: 002b:00007f3d503f6058 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 2183.126976][T26171] RAX: ffffffffffffffda RBX: 00007f3d52745fa0 RCX: 00007f3d52580809 [ 2183.134974][T26171] RDX: 0000000000000064 RSI: 0000000000000011 RDI: 0000000000000003 [ 2183.142984][T26171] RBP: 00007f3d503f60a0 R08: 0000000000000004 R09: 0000000000000000 [ 2183.150984][T26171] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000001 [ 2183.158983][T26171] R13: 0000000000000000 R14: 00007f3d52745fa0 R15: 00007ffdebdecac8 [ 2183.167002][T26171] [ 2183.170118][ C1] vkms_vblank_simulate: vblank timer overrun [ 2183.544099][T26183] [ 2183.546475][T26183] ====================================================== [ 2183.553508][T26183] WARNING: possible circular locking dependency detected [ 2183.560546][T26183] 6.12.0-syzkaller-10553-gb86545e02e8c #0 Not tainted [ 2183.567317][T26183] ------------------------------------------------------ [ 2183.574343][T26183] syz.0.5443/26183 is trying to acquire lock: [ 2183.580418][T26183] ffff888029b17488 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x1ea/0x500 [ 2183.589775][T26183] [ 2183.589775][T26183] but task is already holding lock: [ 2183.597173][T26183] ffff88805c00dc68 (&pipe->mutex){+.+.}-{4:4}, at: iter_file_splice_write+0x330/0x1510 [ 2183.606911][T26183] [ 2183.606911][T26183] which lock already depends on the new lock. [ 2183.606911][T26183] [ 2183.617326][T26183] [ 2183.617326][T26183] the existing dependency chain (in reverse order) is: [ 2183.626333][T26183] [ 2183.626333][T26183] -> #3 (&pipe->mutex){+.+.}-{4:4}: [ 2183.633745][T26183] lock_acquire+0x1ed/0x550 [ 2183.638785][T26183] __mutex_lock+0x1ac/0xee0 [ 2183.643818][T26183] iter_file_splice_write+0x330/0x1510 [ 2183.649800][T26183] do_splice+0xd68/0x18e0 [ 2183.654659][T26183] __se_sys_splice+0x2e0/0x450 [ 2183.659971][T26183] do_syscall_64+0xf3/0x230 [ 2183.665018][T26183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2183.671434][T26183] [ 2183.671434][T26183] -> #2 (sb_writers#5){.+.+}-{0:0}: [ 2183.678840][T26183] lock_acquire+0x1ed/0x550 [ 2183.683863][T26183] sb_start_write+0x4d/0x1c0 [ 2183.688985][T26183] mnt_want_write+0x3f/0x90 [ 2183.694015][T26183] ovl_create_object+0x13a/0x3a0 [ 2183.699477][T26183] path_openat+0x1c03/0x3590 [ 2183.704590][T26183] do_filp_open+0x27f/0x4e0 [ 2183.709617][T26183] do_sys_openat2+0x13e/0x1d0 [ 2183.714815][T26183] __x64_sys_openat+0x247/0x2a0 [ 2183.720197][T26183] do_syscall_64+0xf3/0x230 [ 2183.725232][T26183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2183.731648][T26183] [ 2183.731648][T26183] -> #1 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}: [ 2183.740532][T26183] lock_acquire+0x1ed/0x550 [ 2183.745556][T26183] down_read+0xb1/0xa40 [ 2183.750232][T26183] lookup_slow+0x45/0x70 [ 2183.754996][T26183] walk_component+0x2e1/0x410 [ 2183.760208][T26183] path_lookupat+0x16f/0x450 [ 2183.765317][T26183] filename_lookup+0x2a3/0x670 [ 2183.770632][T26183] kern_path+0x35/0x50 [ 2183.775216][T26183] lookup_bdev+0xc5/0x290 [ 2183.780065][T26183] resume_store+0x1a0/0x710 [ 2183.785096][T26183] kernfs_fop_write_iter+0x3a0/0x500 [ 2183.790901][T26183] vfs_write+0xaeb/0xd30 [ 2183.795664][T26183] ksys_write+0x18f/0x2b0 [ 2183.800517][T26183] do_syscall_64+0xf3/0x230 [ 2183.805537][T26183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2183.811952][T26183] [ 2183.811952][T26183] -> #0 (&of->mutex){+.+.}-{4:4}: [ 2183.819167][T26183] validate_chain+0x18ef/0x5920 [ 2183.824541][T26183] __lock_acquire+0x1397/0x2100 [ 2183.829912][T26183] lock_acquire+0x1ed/0x550 [ 2183.834944][T26183] __mutex_lock+0x1ac/0xee0 [ 2183.839976][T26183] kernfs_fop_write_iter+0x1ea/0x500 [ 2183.845784][T26183] iter_file_splice_write+0xbfa/0x1510 [ 2183.851769][T26183] do_splice+0xd68/0x18e0 [ 2183.856611][T26183] __se_sys_splice+0x2e0/0x450 [ 2183.861889][T26183] do_syscall_64+0xf3/0x230 [ 2183.866905][T26183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2183.873329][T26183] [ 2183.873329][T26183] other info that might help us debug this: [ 2183.873329][T26183] [ 2183.883567][T26183] Chain exists of: [ 2183.883567][T26183] &of->mutex --> sb_writers#5 --> &pipe->mutex [ 2183.883567][T26183] [ 2183.895655][T26183] Possible unsafe locking scenario: [ 2183.895655][T26183] [ 2183.903119][T26183] CPU0 CPU1 [ 2183.908484][T26183] ---- ---- [ 2183.913840][T26183] lock(&pipe->mutex); [ 2183.917993][T26183] lock(sb_writers#5); [ 2183.924681][T26183] lock(&pipe->mutex); [ 2183.931359][T26183] lock(&of->mutex); [ 2183.935364][T26183] [ 2183.935364][T26183] *** DEADLOCK *** [ 2183.935364][T26183] [ 2183.943511][T26183] 2 locks held by syz.0.5443/26183: [ 2183.948706][T26183] #0: ffff888024016420 (sb_writers#8){.+.+}-{0:0}, at: do_splice+0xce4/0x18e0 [ 2183.957689][T26183] #1: ffff88805c00dc68 (&pipe->mutex){+.+.}-{4:4}, at: iter_file_splice_write+0x330/0x1510 [ 2183.967789][T26183] [ 2183.967789][T26183] stack backtrace: [ 2183.973675][T26183] CPU: 0 UID: 0 PID: 26183 Comm: syz.0.5443 Not tainted 6.12.0-syzkaller-10553-gb86545e02e8c #0 [ 2183.984120][T26183] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 [ 2183.994181][T26183] Call Trace: [ 2183.997519][T26183] [ 2184.000462][T26183] dump_stack_lvl+0x241/0x360 [ 2184.005150][T26183] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2184.010350][T26183] ? __pfx__printk+0x10/0x10 [ 2184.014963][T26183] print_circular_bug+0x13a/0x1b0 [ 2184.019995][T26183] check_noncircular+0x36a/0x4a0 [ 2184.024945][T26183] ? __pfx_check_noncircular+0x10/0x10 [ 2184.030412][T26183] ? lockdep_lock+0x123/0x2b0 [ 2184.035093][T26183] ? mark_lock+0x9a/0x360 [ 2184.039461][T26183] validate_chain+0x18ef/0x5920 [ 2184.044336][T26183] ? __pfx_validate_chain+0x10/0x10 [ 2184.049542][T26183] ? look_up_lock_class+0x77/0x170 [ 2184.054665][T26183] ? register_lock_class+0x102/0x980 [ 2184.059951][T26183] ? __pfx_validate_chain+0x10/0x10 [ 2184.065174][T26183] ? __pfx_register_lock_class+0x10/0x10 [ 2184.070802][T26183] ? lockdep_hardirqs_on_prepare+0x43d/0x780 [ 2184.076792][T26183] ? mark_lock+0x9a/0x360 [ 2184.081130][T26183] __lock_acquire+0x1397/0x2100 [ 2184.085990][T26183] lock_acquire+0x1ed/0x550 [ 2184.090492][T26183] ? kernfs_fop_write_iter+0x1ea/0x500 [ 2184.095955][T26183] ? __pfx_lock_acquire+0x10/0x10 [ 2184.100986][T26183] ? __pfx___might_resched+0x10/0x10 [ 2184.106283][T26183] ? __virt_addr_valid+0x183/0x530 [ 2184.111396][T26183] __mutex_lock+0x1ac/0xee0 [ 2184.115895][T26183] ? kernfs_fop_write_iter+0x1ea/0x500 [ 2184.121354][T26183] ? _copy_from_iter+0x960/0x1e70 [ 2184.126385][T26183] ? __virt_addr_valid+0x183/0x530 [ 2184.131498][T26183] ? kernfs_fop_write_iter+0x1ea/0x500 [ 2184.136956][T26183] ? __pfx___mutex_lock+0x10/0x10 [ 2184.141985][T26183] ? __pfx__copy_from_iter+0x10/0x10 [ 2184.147289][T26183] ? __virt_addr_valid+0x183/0x530 [ 2184.152404][T26183] ? __virt_addr_valid+0x183/0x530 [ 2184.157521][T26183] ? __virt_addr_valid+0x45f/0x530 [ 2184.162631][T26183] ? __check_object_size+0x48e/0x900 [ 2184.167915][T26183] kernfs_fop_write_iter+0x1ea/0x500 [ 2184.173208][T26183] iter_file_splice_write+0xbfa/0x1510 [ 2184.178674][T26183] ? __pfx_iter_file_splice_write+0x10/0x10 [ 2184.184571][T26183] ? rcu_read_lock_any_held+0xb7/0x160 [ 2184.190044][T26183] ? __pfx_iter_file_splice_write+0x10/0x10 [ 2184.195934][T26183] do_splice+0xd68/0x18e0 [ 2184.200263][T26183] ? __pfx_lock_release+0x10/0x10 [ 2184.205283][T26183] ? trie_lookup_elem+0x967/0xa70 [ 2184.210306][T26183] ? pipe_clear_nowait+0x196/0x220 [ 2184.215416][T26183] ? __pfx_do_splice+0x10/0x10 [ 2184.220187][T26183] ? __fget_files+0x2a/0x410 [ 2184.224789][T26183] __se_sys_splice+0x2e0/0x450 [ 2184.229558][T26183] ? __pfx___se_sys_splice+0x10/0x10 [ 2184.234838][T26183] ? trace_sys_enter+0xae/0x160 [ 2184.239687][T26183] ? rcu_is_watching+0x15/0xb0 [ 2184.244459][T26183] ? trace_sys_enter+0x3d/0x160 [ 2184.249322][T26183] ? __x64_sys_splice+0x21/0xf0 [ 2184.254198][T26183] do_syscall_64+0xf3/0x230 [ 2184.258696][T26183] ? clear_bhb_loop+0x35/0x90 [ 2184.263371][T26183] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2184.269292][T26183] RIP: 0033:0x7f5e3a380809 [ 2184.273713][T26183] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2184.293335][T26183] RSP: 002b:00007f5e381d5058 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 [ 2184.301753][T26183] RAX: ffffffffffffffda RBX: 00007f5e3a546080 RCX: 00007f5e3a380809 [ 2184.309721][T26183] RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003 [ 2184.317685][T26183] RBP: 00007f5e3a3f393e R08: 000000000000bfd1 R09: 0000000000000000 [ 2184.325651][T26183] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2184.333620][T26183] R13: 0000000000000001 R14: 00007f5e3a546080 R15: 00007ffc9d9d9fa8 [ 2184.341598][T26183] [ 2184.345262][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2185.428430][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2186.458151][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2187.508260][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2188.538160][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2189.578345][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2190.628231][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2191.668270][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 2192.698117][ C0] IPVS: nq: UDP 224.0.0.2:0 - no destination available