last executing test programs: 14m6.049235916s ago: executing program 3 (id=941): syz_usb_connect$midi(0x0, 0x2a, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x10, 0x2466, 0x8010, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x18, 0x1, 0x1, 0x4d, 0x20, 0x1, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x3, 0x0, 0x4, [@midi_in_jack={0x6, 0x24, 0x2, 0x3, 0x7, 0x8}]}}}}}]}}, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) 14m3.821662781s ago: executing program 3 (id=950): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYRES32=0x0, @ANYBLOB="070d000001a0010014000300776c616e3100000000100000000000000a00010001"], 0x40}}, 0x0) 14m3.58537802s ago: executing program 3 (id=953): r0 = socket$pptp(0x18, 0x1, 0x2) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, 0x0) 14m3.341979119s ago: executing program 3 (id=956): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000240)={0x2, &(0x7f0000000280)=[{0x20, 0x0, 0x8, 0xfffff00c}, {0x40}]}, 0x10) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000280)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e23, 0x3, @loopback, 0x6}, 0x1c) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000080), 0x4) 14m2.974973012s ago: executing program 3 (id=958): epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000008}) socket$inet(0x2, 0x4000000000000001, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xf}, 0x1c) listen(r1, 0x3) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000140)={0x2, 0x4e22, @loopback}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000001000000280001801400040000000000000000000000ffffac1414aa06"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x4000000) 14m2.523940241s ago: executing program 3 (id=959): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x55}]}}]}, 0x38}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 13m47.383200343s ago: executing program 32 (id=959): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_fq={{0x7}, {0xc, 0x2, [@TCA_FQ_FLOW_MAX_RATE={0x8, 0x7, 0x55}]}}]}, 0x38}}, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) setsockopt$packet_int(r3, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) sendto$packet(r3, &(0x7f00000002c0)="05031600d3fc140000004788031c09102c28", 0xfd1e, 0x4, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @multicast}, 0x14) 11m51.407680001s ago: executing program 0 (id=1267): symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000000)='./file0\x00') socket$inet_icmp_raw(0x2, 0x3, 0x1) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x4000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x100000c, 0x11, r3, 0x100000000) inotify_init() r4 = userfaultfd(0x80001) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) ioctl$TIOCSPTLCK(r5, 0x40045431, &(0x7f0000000000)) ioctl$TIOCGPTPEER(r5, 0x5441, 0x9) ioctl$TCSETAW(r5, 0x5407, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000040)='./file0/file0/..\x00', 0x0, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpuset.effective_cpus\x00', 0x275a, 0x0) fcntl$lock(r6, 0x25, &(0x7f00000000c0)) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) fcntl$lock(r6, 0x26, &(0x7f0000000000)={0x1, 0x0, 0x0, 0x9b}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 11m49.287423914s ago: executing program 0 (id=1270): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = io_uring_setup(0x57e, &(0x7f0000000300)={0x0, 0x375, 0x10, 0x0, 0x2c4}) close(r2) r3 = socket$inet6(0xa, 0x5, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r4, 0x1, &(0x7f0000000040)={{}, {0x0, 0x3938700}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) listen(r3, 0x2) readv(r2, &(0x7f0000001700)=[{&(0x7f00000004c0)=""/4096, 0x1000}], 0x1) connect$unix(r0, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000b00)=[{{&(0x7f0000000480)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f00000005c0), 0x0, &(0x7f0000000800)=ANY=[@ANYBLOB="100000000000000001000000010000001c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000018000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYBLOB="1c00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000001c00000000000000010000000200e3ff", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000028000000000000000100000001000000", @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r0, @ANYRES32=r0, @ANYBLOB=' \x00\x00\x00\x00\x00\x00\x00', @ANYRES32=r0, @ANYRES32=r0, @ANYRES32=r1, @ANYRES32=r1, @ANYBLOB="1c000000000000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00'], 0xf0, 0x4040}}], 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) ioctl$VIDIOC_LOG_STATUS(0xffffffffffffffff, 0x5646, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, 0x0, 0x0, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4000000040202, 0x0) socket$isdn(0x22, 0x2, 0x3) r6 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x1, 0x5, 0x17a}, &(0x7f0000000240)=0x0, &(0x7f0000000000)=0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r5, 0xc000000, 0x0, 0x0, 0x1e}) io_uring_enter(r6, 0x847ba, 0x20000000, 0xe, 0x0, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f00000001c0), 0xffffffffffffffff) 11m46.324305708s ago: executing program 0 (id=1276): r0 = socket$inet6_udplite(0xa, 0x2, 0x88) bind$inet6(r0, 0x0, 0x0) munmap(&(0x7f0000002000/0x1000)=nil, 0x1000) r1 = socket(0x1e, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0xa, 0x1, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r6, 0x4018620d, &(0x7f0000000180)={0x73622a85, 0x2301, 0x400000000000001}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, 0x0) sched_getaffinity(r2, 0x8, &(0x7f0000002500)) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) connect$tipc(r1, &(0x7f0000000000)=@name={0x1e, 0x2, 0x0, {{0x1, 0x1}}}, 0x10) 11m44.246302815s ago: executing program 0 (id=1279): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'michael_mic-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000040)="4dc07f947163300c", 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$inet(r1, &(0x7f0000000dc0)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000840)="ebaa390353adfe745a6b84ace462d835220eec80bc0f8a6262a68a7e451132e86ab526d310ab35f58b653dd9de", 0x2d}, {&(0x7f0000000740)="6697d38c88397ed4010aaa48e281a9da43164fea7fdc", 0x16}, {&(0x7f0000000900)="d189326a37cc47b03f2ab03151", 0xd}, {&(0x7f0000000a00)="7efa6c1ae4ceab562c45f294e18b20d37e341f6faa401922cf74d239a66afe427d2092bd3ec411de37aa3e7440acb30930668718303a67747472b7a0a3ef90e9aebfbfdd3bb697", 0x47}, {&(0x7f0000000a80)="af4022dc75738e395a5e1e66ed24f1f8f5589a1594d4345dce002de35ca9f050402a712160ea5d1126abc790a5e3d7bfeb7ac10434a24ac41b0eedd83ec66809cf94dcb4b8cdcacde453390bf143658050a8496457a64cf5ac9b11758c84ec6eaf1e0a39b8f9d4b6d2246ba3df1d1b675d9455ae36c1ec175d85", 0x7a}, {&(0x7f0000000b00)="409cf72076425d9e64f82b4b5cdef3b0b1c8a5d033410a03311f705c98574cdbda", 0x21}], 0x6}}, {{0x0, 0x0, &(0x7f0000000d40)=[{&(0x7f0000000cc0)="a3f55a47b329bd8c4349f5c8c57d210895a9cd19208524b4d3a298ae6598dd", 0x1f}], 0x1}}], 0x3, 0x44008090) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000400)={0x0}, 0x1, 0x0, 0x0, 0x4011}, 0x40004) 11m43.432822929s ago: executing program 0 (id=1281): add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f00000001c0), 0x101000, 0x0) ioctl$SG_GET_COMMAND_Q(r2, 0x2270, &(0x7f00000003c0)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000280)={0x0, 0x4}, 0x8) syz_emit_ethernet(0x2e, &(0x7f00000016c0)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x6, 0x4, 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @remote, {[@timestamp={0x44, 0x4}]}}, @echo}}}}, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYRESDEC=r1], &(0x7f0000003ff6)='syzkaller\x00', 0x2, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r4, 0x1, 0x34, &(0x7f0000000040)=r3, 0x4) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f0000000140)=ANY=[@ANYBLOB="b7000000ecffffff0c0000000000000095000000000000005e0c83dfb64a3eb1cdfa541cd3957aa8a96b9fa4591c1eb556e38defc504b011face5a06294c2115a9ad943bac350e8d7961537181f79ead9176dc7c3ed2d450"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) dup2(r5, r3) r6 = fsopen(&(0x7f0000000140)='vfat\x00', 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r1, 0xc020662a, &(0x7f0000000200)={0x5, 0xc142, 0x7, 0x90000000, 0x1, 0x0, [{0x7fffffff, 0x2, 0x3, '\x00', 0x200}]}) fsconfig$FSCONFIG_SET_STRING(r6, 0x1, 0x0, &(0x7f0000001140)='\xe0^@&&}\'\x00', 0x0) 11m35.824664398s ago: executing program 0 (id=1300): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r4, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) 11m20.69699386s ago: executing program 33 (id=1300): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r4, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) 3m53.813320322s ago: executing program 4 (id=2260): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x61, 0x8e}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ioctl$sock_inet_SIOCSIFNETMASK(0xffffffffffffffff, 0x891c, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0x16, &(0x7f0000000000)=0x4, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, 0x0, 0x0, 0x2, 0x0) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x12, 0x4, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000080000000000000009000000731105000000000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, @fallback=0xa, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x2, 0x4000000, 0xffffffff}, 0x10) socket(0x10, 0x2, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=ANY=[@ANYBLOB="28010000100007000000000000000000ff020000000000000000000000000001e00000020000000000000000000000004e200000000000000000000002000000", @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc000000000000000000edff0000000000000000000000000000000000000000020000000000000000000000000000000000001000000000ffffffffffffffff00000000000000000000000000000000000000000000000000002000000000000700000000000000000000000000000000000400fdffffffe80a000000000000000000000a000200340000000000000014000e"], 0x128}}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, 0x0, 0x4000080) 3m52.015623608s ago: executing program 4 (id=2263): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x202, 0x0) write$sequencer(r2, &(0x7f0000000000)=[@t={0x81, 0x5, 0x0, 0x1, @generic=0xf}], 0x8) r3 = epoll_create1(0x0) r4 = dup3(r1, r2, 0x80000) ioctl$DRM_IOCTL_ADD_MAP(r4, 0xc0286415, &(0x7f0000000200)={&(0x7f0000ffe000/0x1000)=nil, 0xa5, 0x2, 0x10}) r5 = epoll_create1(0x0) r6 = dup3(r1, r5, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r6, &(0x7f00000001c0)={0x2007}) syz_usb_connect$cdc_ncm(0x5, 0x98, &(0x7f0000000100)=ANY=[@ANYBLOB="12010102020000082505a1a4400001020301090286000201df40010904000001020d00000524060001052400240060240f01fcffffffba00b4000906241abcf806152412ff00"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) sendmmsg$inet(r1, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r8) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x14, r9, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x48050}, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x17, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20000000}, {{0x18, 0x1, 0x1, 0x0, r10}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x48010000}, {0x85, 0x0, 0x0, 0x86}}, {}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3fd}, {0x85, 0x0, 0x0, 0xc2}}], {{}, {}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x2, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4b564d02, 0xec000000}]}) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f0000000240)={0xc, 0x6, 0x10}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xf}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0) 3m48.187434442s ago: executing program 4 (id=2269): openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000001500)=[{{0x0, 0x0, &(0x7f0000000300)=[{0x0}, {0x0}, {&(0x7f00000005c0)="f2", 0x1}], 0x3}}, {{&(0x7f0000000600)=@can, 0x80, &(0x7f0000000680)=[{&(0x7f0000000980)="d542f6300b61ca7913e7cd7b4036afcfddb3c77fc63db30ef223f1cc4fcdcbb56655be4873ea15e1a9d348fadc935180e702560acae65d42d95f6ddcae59879a1ce7e78eb197a0c8231a504b2614ac6dfd9a5760fe75ba4204694d382eb51806597cde99cedde3f0edd8bd3fce154f83e47f422d0e5bf427c23771a122bd0369cec32bbe791bfc2c0fce202d51df0862c31baa7b80bab6d64c1d5826a7f4c1982e3693e7a0677f2ad388ce872b890394a3ecfd1cec45ba7966945271fc033565d4a9bb17a41aacf550c4510ba99a24b48eab32e5d7549de9bae7954e0f750b55f706de3d5001638a1260dd8d2ad735d9ec409711851badf7e170fc50", 0xfc}, {&(0x7f0000000780)="92bdcafd7ac9e21583ea71b9eb5feeb69b7eeb919260393d59069611e6d460fd38481da64e5ad543477ed7b768b1a06c0a5d60edf6c5610c123e3572a7c3bd74b7bd876c6f1c54709ef06cb9187fa5ddecc04cdc8fd3e74782c0aa0579531662e6d5fcdddc53becdd0b8a59c3a97fe428e75e7707525647bd822", 0x7a}, {&(0x7f0000000580)}], 0x3, &(0x7f0000000b40)=[@timestamping={{0x14, 0x1, 0x25, 0x2d}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0xc}}], 0x60}}, {{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000bc0)="e7bc2f4799fe560c31cf5a20a1b22fb77ce7f19e605b6a8d2645af02e63f9a9d7ba31907ccc0f4aa71ec0762b3a8e3332fe3603b4624ac6a578ccd9a27b381a8dad12b3e3de940a99238945935184cd93dd174b70ecb9c3c99d2df9dd0cbef6a9e230f7dd8367384f034a7a011388990e94cd43e9f80ec3358dc596926960604b9f051", 0x83}, {&(0x7f0000000c80)="6c3e28dcd5c7eb9bc39a4bbc398357f3ad842b38a95863911bbd6e6afd9641d356257181e43b6e60349f69ec5f529734f76708a6c5eccb57005c1a513d8030d12c", 0x41}, {&(0x7f0000000d00)="dc6e94ac2db166801ffce85f6f44f2cb071c6b5113bc6bbf2f503d468253693a01102fcb8157c6e8a2b5620efa5d22400147cce896821150f95c0c69fa587a1f99fcb28cfeb09f45cb836f0ff891be10bb209dc04adc202ef866f27b74faa5ad3a2e5d40ebd6785c4e4a97ac13238c746d1109d12af5446c4e84591f121a494251e43bed18f6269bdd2e56f9c211dd7145f664286911b8bb3acf76a1b5ece94183a6c8cc47f2e1dd4e91dc10be8732e92e8620fa060fb15016c2dc9b6da18325e778660d499aec6215b0f9f679fa76d22cdd4ae3776203e2054240594f1c9b77ad77cf3f5631012fa0788c5b17f98cc34720b0", 0xf3}, {&(0x7f0000000fc0)="c6eae69212ba50dd664af774c32d34273a3baad9692140de74d9294c555a8c2e0d53acea79b788b5eb1a12ada17eda2b2fb96c439ce16e6266afda6613fd7c90be9a9dfcd1b099fe6b023b725241a6e1048c700e7a939bd3a38f1101213b81c252dd8c44b7e647940438343d0d082507d218a952e6d77ec0918968c74f220c981a3797fb6cadfd6723a75c5c4da33e830ecf602c55bc60831ddd694f15728f4d1eacad82a03540713f52f9485138574e5b6aec693c2c613e442d5306c2ef1c8ad8dda8d005f3f3bacb5991d1c18db228185e4d2fcca72d87d81df01c142428158ad7ba84dd6c65d24a8d094308", 0xed}, {&(0x7f00000010c0)="978d1129fddf5e2f1be8be48f935ef4f71893a57f79be3e44522d3987ccee23f4e717d8c8e14573937040fb658a24f1c9e0c7f98a24fa1209a6ea754e1244234c715713d120b6929614443fd6b4223bc04c3a8c9241ccbb6a8b0bb19fe4eedae48642a74e97588dc36bf06a4c1fb17b47b39240a6a8e9b5daa97e63d777e665841a349c52022252eafc1c129e154ab390624dd7fb8ac1e44c203140d6aab524f61cd8642ee0f380ebb21dc9267a8fbefa6eec89ff97e7800f44f89b17d43206217941c34067892c05465382550a1da2519", 0xd1}, {&(0x7f0000000800)="b56380b7487ff3b0cd079ed795bdeeb3ad75fe878a", 0x15}, {&(0x7f00000011c0)}, {&(0x7f0000001200)="43979d4537ac96f6e22b12acd1fdd3ffc7ef440e65e2e70d511a408f743d4ce7516f4364a00a041dc7b1ffe56ebc713b158ea1aab13ce3db53ab8af3f76ffaa86df636018175c4a8ea922a193ad08ca30d5031b27a4a87bff93dc12a98b6e4f25b5550d98a5bf3e040a8902083eea93bdbde6da91df3a730dd2b8215e9840f04dd0ab667500fe952fa1b8845c2cee50f8322175049c4a994def6599287fb0f8d61029188945e", 0xa6}, {&(0x7f0000001300)}], 0x9, &(0x7f00000014c0)}}], 0x3, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0xeeee8000, 0x4, 0x3, 0xf1, 0x5, 0xfa, 0xd4, 0x6, 0x0, 0x4, 0x7, 0x4f}, {0x5000, 0x2, 0xd, 0x9, 0x8, 0x3, 0xb, 0xb, 0x5, 0xf, 0x3, 0xc0}, {0xffff1000, 0x9000, 0xb, 0x1, 0x2, 0x7, 0x4, 0x4, 0x81, 0x0, 0x6, 0x5}, {0xeeee8000, 0x2000, 0x8, 0xf8, 0x3, 0x46, 0x2, 0xd, 0x6, 0xf3, 0x8, 0x1}, {0x100000, 0x4000, 0x9, 0x9, 0x3, 0x9, 0xd, 0x6, 0x5, 0x9, 0xc, 0x4b}, {0x6000, 0x0, 0x4, 0x4, 0x3, 0x7d, 0x1, 0xff, 0x4, 0x90, 0x1, 0xfc}, {0x8000000, 0x4000, 0x0, 0x9d, 0x3, 0x0, 0x0, 0xb, 0x5, 0x7, 0x9, 0xf8}, {0xf7f63004, 0x8000000, 0xf, 0x5, 0x7, 0x3, 0xa, 0x9, 0x54, 0x1, 0x2, 0x7}, {0xdddd1000, 0x5}, {0x4, 0x9}, 0x40030000, 0x0, 0x80a0000, 0x300, 0x1, 0xa901, 0xe6e70c00, [0x3, 0x401, 0x7, 0xc5]}) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 3m46.889241519s ago: executing program 1 (id=2271): socket$kcm(0x11, 0x3, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet(0x2, 0x8ace0a3f86283e7d, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000000c0), 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000740)=ANY=[@ANYRESOCT=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000780)={0x73622a85, 0x10e, 0x3}) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f0000000100)={0xac, 0x0, &(0x7f0000000ac0)=[@transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x60, 0x0, &(0x7f0000000580)={@ptr={0x70742a85, 0x1, &(0x7f0000000500)=""/106, 0x6a, 0x1, 0x35}, @fd, @fda={0x66646185, 0x5, 0x2, 0x3}}, 0x0}}, @clear_death={0x400c630f, 0x1}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x31, 0x0, 0x0, 0x68, 0x18, &(0x7f0000000800)={@fda={0x66646185, 0x3, 0x0, 0x24}, @fda={0x66646185, 0x8, 0x0, 0x6}, @ptr={0x70742a85, 0x0, 0x0, 0x0, 0x1, 0x2e}}, &(0x7f0000000400)={0x0, 0x20, 0x40}}}, @free_buffer], 0x0, 0x0, 0x0}) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x10, 0x0, @vifc_lcl_addr=@multicast2, @remote}, 0x10) 3m44.558939713s ago: executing program 1 (id=2273): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) geteuid() r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r4, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5", 0x0, 0xcc, 0xffffffff}, 0x3c) r5 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)) lsetxattr$trusted_overlay_upper(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280), 0x0, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@enum, @struct={0x0, 0x0, 0x0, 0x4, 0x1, 0xffff}]}}, 0x0, 0x32}, 0x28) timer_settime(0x0, 0x0, 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) pipe(&(0x7f0000000080)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='2', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) getpid() 3m43.081508863s ago: executing program 4 (id=2275): openat$sequencer(0xffffff9c, 0x0, 0x2000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x14) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)={0x44, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}]}, 0x44}}, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)={0x38, 0x1403, 0x1, 0x70bd2d, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r3, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000280)={&(0x7f00000001c0)={0x24, 0x4, 0x8, 0x201, 0x0, 0x0, {0xa, 0x0, 0x7}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x11}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0x8}]}, 0x24}}, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x40000) syz_emit_ethernet(0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x66) setsockopt$inet_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0xd5) sendmsg$IPSET_CMD_LIST(r6, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4}, 0x800) 3m42.959152056s ago: executing program 1 (id=2276): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x0) write$binfmt_script(r0, 0x0, 0x0) creat(&(0x7f0000000580)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r2, 0xffffffffffffffff, 0x200000000000000) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x3, 0x5) r3 = socket$netlink(0x10, 0x3, 0x0) syz_usb_connect$uac1(0x3, 0xdc, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902ca0003010070000904000000010100000a24010800000201020d24060000030800000000000000240803960c03112d9cd2ce0c240208000103000000ff000924060506020100000924030003030005490c", @ANYRES8=r3, @ANYRES16=r1], 0x0) 3m41.817159748s ago: executing program 4 (id=2277): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x202, 0x0) write$sequencer(r2, &(0x7f0000000000)=[@t={0x81, 0x5, 0x0, 0x1, @generic=0xf}], 0x8) r3 = epoll_create1(0x0) r4 = dup3(r1, r2, 0x80000) ioctl$DRM_IOCTL_ADD_MAP(r4, 0xc0286415, &(0x7f0000000200)={&(0x7f0000ffe000/0x1000)=nil, 0xa5, 0x2, 0x10}) r5 = epoll_create1(0x0) r6 = dup3(r1, r5, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r6, &(0x7f00000001c0)={0x2007}) syz_usb_connect$cdc_ncm(0x5, 0x98, &(0x7f0000000100)=ANY=[@ANYBLOB="12010102020000082505a1a4400001020301090286000201df40010904000001020d00000524060001052400240060240f01fcffffffba00b4000906241abcf806152412ff00"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) sendmmsg$inet(r1, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r8) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x14, r9, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x48050}, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) r10 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x17, &(0x7f0000000480)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x20000000}, {{0x18, 0x1, 0x1, 0x0, r10}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x48010000}, {0x85, 0x0, 0x0, 0x86}}, {}, [@printk={@llx, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x3fd}, {0x85, 0x0, 0x0, 0xc2}}], {{}, {}, {0x85, 0x0, 0x0, 0x2a}}}, &(0x7f0000000080)='GPL\x00', 0x2, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4b564d02, 0xec000000}]}) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f0000000240)={0xc, 0x6, 0x10}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r11, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xf}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0) 3m41.342291782s ago: executing program 1 (id=2281): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000107000000000000000026", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsopen(&(0x7f0000000000)='cgroup2\x00', 0x1) io_uring_setup(0x868, &(0x7f0000000080)={0x0, 0x8000ffc, 0x1001, 0x2, 0x8004}) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18020000fc0500000000000000000000850000004100000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_setup(0x258d, &(0x7f0000000640)={0x0, 0x4008272, 0x1, 0x3, 0x284}) socket$packet(0x11, 0x3, 0x300) socket$nl_route(0x10, 0x3, 0x0) socket$inet(0x2, 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x5, &(0x7f00000000c0), 0x106, 0x6}}, 0x20) r2 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0x235}], 0x20000000000001a5, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x4, &(0x7f0000000300), 0x2, 0x4}}, 0x20) writev(r2, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 3m39.890258843s ago: executing program 1 (id=2283): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) geteuid() socket$igmp(0x2, 0x3, 0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@enum, @struct={0x0, 0x0, 0x0, 0x4, 0x1, 0xffff}]}}, 0x0, 0x32}, 0x28) timer_settime(0x0, 0x0, 0x0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 3m38.30855694s ago: executing program 1 (id=2284): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x6, 0x40800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000600)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40080) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x35, 0x0, 0x1}, {0x20}]}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x400102, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'tunl0\x00'}) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000280)=0x8) vmsplice(r0, 0x0, 0x0, 0x2) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000005500e501000000000000000007000000", @ANYRES32, @ANYBLOB="200001", @ANYRES32, @ANYBLOB], 0x38}}, 0x20044050) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b700000000c300ffc3000000000000009500000000000000a9171809f8dcf159569d5475991f7de1a0d0c119cfcf6b98741c23fb7f8d3002ec85db75af955427e91496087a51a0a78f269a9e216a0d0177c4fe3552396a180330807a5b6e8c79aa92038c78d1f16c1323f0e0c8d45c641a21757847cb22230e4321cc3581e40c62c4defee8cffe359cfeef7f58fffdb48647d28ae810f6d22d20271e9e88e94aa6982bf48356652b08e2fbd404e41e0058aae0478fbe542b648421d1b4486a542a7d478fbe6b5e000000293853f9c68e235184b7ad5b6c4fe70ec8320500db0db7fda3da6171a05509ffecef2cb9802d4f36c9a1ce46d3b355fec188ccfc2f0fc89e164561fb06ee9a0153981a47b5de9edd3536d5534f9a699f73b2c9341d2d05043748ce1f4577ed76cdf5b3c697089daa4abda69a8c0c992404610a6be9e103c972459065dec0488e85a6a0418fc87dd8019ef7bb4ef4fa6ee08d81797570578f2e8198e687012f25a69a90e7515e35f8abbddfa96c3f0485f01f0e9e144a2bd31c1b594c50de7c9efd826f1e19b7bd89ca4052b1985287bd13957a48467e0eeddf564d175bf4340885b63976df609806c3"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r5 = socket$kcm(0x10, 0x3, 0x10) clock_nanosleep(0x2, 0xfffffdfc, 0x0, 0x0) r6 = gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x7, 0x4, @tid=r6}, &(0x7f0000044000)) timer_settime(0x0, 0xffffffffffffffff, &(0x7f0000000080)={{0x77359400}, {0x0, 0x9}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="1400000016000b43d27a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) 3m37.700469233s ago: executing program 4 (id=2286): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) geteuid() bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@enum, @struct={0x0, 0x0, 0x0, 0x4, 0x1, 0xffff}]}}, 0x0, 0x32}, 0x28) timer_settime(0x0, 0x0, 0x0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 3m22.380146117s ago: executing program 34 (id=2284): r0 = syz_open_dev$video4linux(&(0x7f0000000000), 0x6, 0x40800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000600)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x40080) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x2, &(0x7f0000000000)=[{0x35, 0x0, 0x1}, {0x20}]}) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x400102, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'tunl0\x00'}) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000280)=0x8) vmsplice(r0, 0x0, 0x0, 0x2) setsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="380000005500e501000000000000000007000000", @ANYRES32, @ANYBLOB="200001", @ANYRES32, @ANYBLOB], 0x38}}, 0x20044050) bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x1, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="b700000000c300ffc3000000000000009500000000000000a9171809f8dcf159569d5475991f7de1a0d0c119cfcf6b98741c23fb7f8d3002ec85db75af955427e91496087a51a0a78f269a9e216a0d0177c4fe3552396a180330807a5b6e8c79aa92038c78d1f16c1323f0e0c8d45c641a21757847cb22230e4321cc3581e40c62c4defee8cffe359cfeef7f58fffdb48647d28ae810f6d22d20271e9e88e94aa6982bf48356652b08e2fbd404e41e0058aae0478fbe542b648421d1b4486a542a7d478fbe6b5e000000293853f9c68e235184b7ad5b6c4fe70ec8320500db0db7fda3da6171a05509ffecef2cb9802d4f36c9a1ce46d3b355fec188ccfc2f0fc89e164561fb06ee9a0153981a47b5de9edd3536d5534f9a699f73b2c9341d2d05043748ce1f4577ed76cdf5b3c697089daa4abda69a8c0c992404610a6be9e103c972459065dec0488e85a6a0418fc87dd8019ef7bb4ef4fa6ee08d81797570578f2e8198e687012f25a69a90e7515e35f8abbddfa96c3f0485f01f0e9e144a2bd31c1b594c50de7c9efd826f1e19b7bd89ca4052b1985287bd13957a48467e0eeddf564d175bf4340885b63976df609806c3"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8}, 0x94) r5 = socket$kcm(0x10, 0x3, 0x10) clock_nanosleep(0x2, 0xfffffdfc, 0x0, 0x0) r6 = gettid() timer_create(0x2, &(0x7f0000000040)={0x0, 0x7, 0x4, @tid=r6}, &(0x7f0000044000)) timer_settime(0x0, 0xffffffffffffffff, &(0x7f0000000080)={{0x77359400}, {0x0, 0x9}}, 0x0) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$kcm(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000180)="1400000016000b43d27a80648c2594f90924fc60", 0x14}], 0x1, 0x0, 0x0, 0x600}, 0x0) 3m22.241851228s ago: executing program 35 (id=2286): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) geteuid() bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000480)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x2, [@enum, @struct={0x0, 0x0, 0x0, 0x4, 0x1, 0xffff}]}}, 0x0, 0x32}, 0x28) timer_settime(0x0, 0x0, 0x0, 0x0) r4 = socket(0x40000000015, 0x5, 0x0) sendto$inet(r4, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) close_range(r0, 0xffffffffffffffff, 0x0) 2m7.828844178s ago: executing program 8 (id=2434): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x3000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/drop_packet\x00', 0x2, 0x0) sendfile(r4, 0xffffffffffffffff, 0x0, 0x106f) r5 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r5, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x0, 0x4}) ioctl$DVB_DEMUX_DMX_REMOVE_PID(r5, 0x40026f34, &(0x7f0000000040)=0x1) ioctl$DVB_DEMUX_DMX_ADD_PID(r5, 0x40026f33, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2m0.839302437s ago: executing program 8 (id=2448): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000000c0)=[@nested_load_code={0x12e, 0x5b, {0x2, "b9800000c00f3235008000000f30420f01f836410f23b4410f01c9431026c4a17e121dfe870000460f013bc4c33d426e071d66ba2000b87d1d8e71ef2e2666410f6f12"}}], 0x5b}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, 0x0, 0x0}, 0x94) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_usb_connect(0x2, 0x48, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0xc4, 0xd, 0x8d, 0x8, 0x5ac, 0x22b, 0x8e39, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x3, 0x9, 0x30, 0x2, "", [{{0x9, 0x4, 0x9b, 0xf, 0x4, 0x3, 0xc, 0x2, 0x6, [], [{{0x9, 0x5, 0x4, 0x10, 0x200, 0x8, 0x3, 0x2}}, {{0x9, 0x5, 0x87, 0x3, 0x400, 0x3, 0x6, 0xe}}, {{0x9, 0x5, 0x1, 0x3, 0x8, 0x7, 0x1, 0x2}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0x63, 0xd2}}]}}]}}]}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x3}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000007c0)=[@wr_crn={0x46, 0x20, {0x4, 0x6}}, @wr_drn={0x6e, 0x20, {0x0, 0x5}}, @rdmsr={0x32, 0x18, {0x181}}, @code={0xa, 0x53, {"67735a2e0f019ee0000000650f01cfab66ba420066b89b1566ef4d0fc79ee388ef1966450f38803266baf80cb8947a2c89ef66bafc0ced40e80018000043d07c7800"}}, @out_dx={0xaa, 0x28, {0x5b77, 0x5, 0x8}}, @cpuid={0x14, 0x18, {0x10001, 0x9}}, @rdmsr={0x32, 0x18, {0xb7d}}, @rdmsr={0x32, 0x18, {0x2f0}}, @out_dx={0xaa, 0x28, {0xe6cb, 0x3, 0x80000000004}}, @code={0xa, 0x46, {"26640f35360f060f2084b9f70b00000f32420fc75d00c461fc298f0a630000c462c3f521c40299ac66410f01c9b8010000000f01d9"}}, @rdmsr={0x32, 0x18, {0x966}}, @rdmsr={0x32, 0x18, {0x4000009e}}, @nested_create_vm={0x12d, 0x18, 0x1}, @in_dx={0x82, 0x20, {0xbde0, 0x7}}], 0x1f1}) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f00000002c0)={0xbe, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m57.569027258s ago: executing program 8 (id=2456): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x48080, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) readv(r0, &(0x7f00000001c0)=[{&(0x7f0000001400)=""/227, 0x1c}], 0x4) socket$kcm(0x2, 0xa, 0x2) 1m53.963111498s ago: executing program 8 (id=2464): syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000000c0)=[@nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0xa3, 0xfffffffffffffff7, 0x40, 0xfffffffffffffffb}}, @nested_load_code={0x12e, 0x5b, {0x2, "b9800000c00f3235008000000f30420f01f836410f23b4410f01c9431026c4a17e121dfe870000460f013bc4c33d426e071d66ba2000b87d1d8e71ef2e2666410f6f12"}}], 0x93}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, 0x0}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$UFFDIO_UNREGISTER(0xffffffffffffffff, 0x8010aa01, &(0x7f0000000000)={&(0x7f0000ffa000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_usb_connect(0x2, 0x48, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0xc4, 0xd, 0x8d, 0x8, 0x5ac, 0x22b, 0x8e39, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x36, 0x1, 0x3, 0x9, 0x30, 0x2, "", [{{0x9, 0x4, 0x9b, 0xf, 0x4, 0x3, 0xc, 0x2, 0x6, [], [{{0x9, 0x5, 0x4, 0x10, 0x200, 0x8, 0x3, 0x2}}, {{0x9, 0x5, 0x87, 0x3, 0x400, 0x3, 0x6, 0xe}}, {{0x9, 0x5, 0x1, 0x3, 0x8, 0x7, 0x1, 0x2}}, {{0x9, 0x5, 0xe, 0x10, 0x8, 0x63, 0xd2}}]}}]}}]}}, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f00000000c0)={0x3}) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f00000007c0)=[@wr_crn={0x46, 0x20, {0x4, 0x6}}, @wr_drn={0x6e, 0x20, {0x0, 0x5}}, @rdmsr={0x32, 0x18, {0x181}}, @code={0xa, 0x53, {"67735a2e0f019ee0000000650f01cfab66ba420066b89b1566ef4d0fc79ee388ef1966450f38803266baf80cb8947a2c89ef66bafc0ced40e80018000043d07c7800"}}, @out_dx={0xaa, 0x28, {0x5b77, 0x5, 0x8}}, @cpuid={0x14, 0x18, {0x10001, 0x9}}, @rdmsr={0x32, 0x18, {0xb7d}}, @rdmsr={0x32, 0x18, {0x2f0}}, @out_dx={0xaa, 0x28, {0xe6cb, 0x3, 0x80000000004}}, @code={0xa, 0x46, {"26640f35360f060f2084b9f70b00000f32420fc75d00c461fc298f0a630000c462c3f521c40299ac66410f01c9b8010000000f01d9"}}, @rdmsr={0x32, 0x18, {0x966}}, @rdmsr={0x32, 0x18, {0x4000009e}}, @nested_create_vm={0x12d, 0x18, 0x1}, @in_dx={0x82, 0x20, {0xbde0, 0x7}}], 0x1f1}) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f00000002c0)={0xbe, 0x0, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1m52.271950131s ago: executing program 8 (id=2465): mbind(&(0x7f0000ff8000/0x8000)=nil, 0x8000, 0x8002, 0x0, 0x8, 0x4000000) r0 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000100)={@local}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r6 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r6, 0xffff) fcntl$addseals(r6, 0x409, 0x7) r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000000)={r6, 0x0, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, &(0x7f00000001c0)=0x1) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r1, 0x7b2, &(0x7f0000000140)={&(0x7f0000000300)=[0x4, 0x6, 0x1, 0x9, 0x5, 0x401, 0x200, 0x4, 0x0, 0xcb0d, 0x770f, 0xff, 0x4, 0x81, 0x2, 0x5, 0x1d, 0x0, 0x78, 0xb, 0x5, 0x6, 0x8, 0x9, 0x69, 0x5, 0xfffffff4, 0x7fff, 0x8, 0xe00, 0x0, 0x3, 0x10000, 0x7f, 0x0, 0xfffffff4, 0x15a0, 0xffffff7f, 0x8, 0x5d, 0x800, 0xf94, 0xff, 0x8, 0x2, 0xfffffff9, 0xe, 0xffffbb46, 0x7, 0x4, 0x1, 0x4, 0x5, 0x1000, 0x6, 0x3, 0x1, 0x8, 0x80, 0xc, 0x7, 0x8, 0x2, 0x1, 0x3, 0x1800000, 0x3, 0x5, 0x400, 0x5, 0x9, 0x1, 0x8, 0x2, 0x1000, 0x9, 0x3, 0x6d, 0xfffffffc, 0x1ff, 0xffffffc0, 0x0, 0x5, 0x8, 0x2008, 0x2, 0xf0, 0x5, 0x7, 0x6, 0x4469, 0xb, 0xfffffb4c, 0x80000001, 0xe5f6, 0x0, 0x4, 0xd4, 0xffffffff, 0x200000, 0x9, 0x2, 0x4, 0x5, 0x2, 0x3, 0x8f, 0x7, 0x6, 0x5, 0x4, 0x6d03, 0x8001, 0x9, 0x3, 0x0, 0x8e7a, 0x2, 0x8, 0xfffffff1, 0x5, 0x1000000, 0xfff3, 0x4, 0x1, 0x80000000, 0x3ff, 0x81, 0x100, 0x8, 0xfffffffb, 0x4, 0xfffffffc, 0x1, 0x7, 0x6, 0x3e, 0x43, 0xffff6a70, 0xc, 0xa092, 0x8, 0x877, 0x1, 0x3, 0x800, 0x5, 0x0, 0x8001, 0x48c, 0x7, 0x2, 0x13, 0x3, 0x3, 0x9, 0x0, 0x70000000, 0x2, 0x8, 0x2, 0x1b1c, 0x8, 0xb5, 0x8, 0x401, 0xfff, 0x5, 0x1, 0xa008, 0x9, 0x8, 0xe4, 0x898, 0x7, 0x81, 0x0, 0x1ff, 0x5, 0x80000000, 0x1, 0x8, 0x1, 0x8, 0x4251, 0x6, 0x4, 0x6, 0x4008, 0x200, 0x5, 0x73f7, 0x6, 0x8001, 0x80, 0xd5, 0x6, 0x800000, 0x40, 0xfffffe03, 0x2, 0x80000001, 0x7f, 0xfffffffa, 0xff, 0x4, 0x4b031fcb, 0x7, 0xf3, 0x40, 0xffffffff, 0x1, 0x0, 0x3, 0x6, 0x0, 0x5, 0x6, 0x3, 0x9, 0xfd, 0xd, 0x1000, 0x94, 0xd4f, 0x3, 0xfffffeff, 0xba7, 0x400, 0x4, 0x0, 0x80000001, 0x7, 0x10001, 0xfff, 0x9, 0x2, 0x9, 0x1, 0xfffffff9, 0x6, 0x62, 0x668, 0xffff, 0x0, 0x7, 0x6, 0x0, 0x49, 0x2, 0x5f4, 0x3fd, 0xfffffffe, 0x4, 0x6, 0x9, 0x0, 0x5, 0x4, 0x6, 0x3, 0x1ff, 0xc3f6, 0x7, 0xd8b8, 0xfffffffe, 0xff, 0x8000, 0x7, 0x100, 0x43, 0x2, 0xc7b, 0xe2a0, 0x5, 0x6, 0x81, 0x6, 0x0, 0x3, 0x75c, 0x1, 0x10000, 0x3f, 0x24f7, 0x5, 0x9, 0xd8c, 0x7ffffffd, 0x7, 0xfffff6d2, 0x0, 0x0, 0x3, 0x9, 0x800, 0x5, 0x9, 0x80000000, 0x1, 0x9dcb, 0x8, 0x4, 0x8001, 0x9, 0x7, 0x6, 0x7, 0x81, 0x7ff, 0x0, 0x7, 0x1c00000, 0x5, 0x10, 0x2, 0x1, 0x4, 0xac, 0x8001, 0xb2, 0x4, 0x84f4, 0xf, 0x0, 0x6, 0x6, 0x3ef, 0x7, 0x101, 0x3, 0x4, 0xa, 0x7f, 0x5, 0x2, 0x7ff, 0xffff094f, 0xb, 0x80, 0x6, 0xfffffffd, 0x63, 0xd, 0x7, 0x9, 0x200, 0x9, 0x7, 0x8, 0xa, 0x10001, 0x8, 0xa21, 0x2, 0x9, 0x7, 0xe207, 0xa4, 0x4, 0x5, 0x7, 0x9, 0x0, 0x0, 0x9, 0x1, 0xd, 0x1, 0xf, 0x1, 0x26d1, 0x9, 0x8b000, 0x6, 0x6, 0x5, 0x80000000, 0xfffffffb, 0x8, 0x7, 0xfffffff9, 0x7, 0x4, 0x2, 0x0, 0x80, 0xffff6c99, 0x5, 0x6bed988b, 0x7f, 0x6, 0xffffff7f, 0x7, 0x7, 0x8, 0x4, 0x10000, 0x6, 0x9, 0x40, 0x0, 0x5, 0x0, 0x2, 0x3, 0x10000, 0x8, 0x9, 0x53fa, 0x0, 0x53, 0x9465, 0x9, 0x3, 0x4, 0x36c9, 0x3ff, 0x3, 0x4, 0x8, 0x68, 0x2, 0x81, 0x8, 0xcd94, 0x75e, 0x1000, 0x9, 0x6, 0x0, 0xfffffff7, 0xe, 0x6, 0x3, 0x7, 0x0, 0x6, 0x80000001, 0x731, 0x6, 0x4, 0x8, 0x3, 0x9, 0x80000001, 0x1, 0xfff, 0x4, 0x6, 0x4, 0x4, 0x2, 0x9, 0x6f9, 0x3, 0x8, 0x475e0e15, 0x80000000, 0x5, 0x4, 0xf3e, 0x9, 0x5, 0x0, 0x3, 0xad64, 0xfffffff9, 0x2, 0x3, 0x10000, 0x4, 0xff, 0x400, 0x7f, 0x7f, 0x7, 0x800, 0x40, 0x7, 0x6, 0x8, 0x1a, 0x0, 0x1000, 0xff, 0x10001, 0x8, 0x2, 0xffff, 0x8, 0x100, 0x100, 0x9, 0x9, 0x37, 0x28, 0xfffffff9, 0x7fffffff, 0x4, 0x83b9, 0xb, 0x2, 0x85f2, 0xd7f, 0x7, 0x3ff, 0x1000000, 0x2387c5a4, 0x3, 0x8, 0xbc4e, 0xffff, 0x1, 0x2, 0x408, 0x5, 0x0, 0x5, 0x6, 0x2, 0x6, 0x0, 0x51, 0x5, 0x3, 0x2, 0xfaf0, 0x4a46, 0x4, 0x10001, 0x9, 0x4921bb4d, 0x5c, 0x6, 0x3, 0x7, 0x7fff, 0x80, 0x3, 0x29dc2fdf, 0x200, 0x1, 0x9, 0xd2c, 0x8, 0x3, 0x3, 0x66f, 0x5, 0x4bb6, 0x258d, 0x101, 0x10000, 0x662f, 0x401, 0x5, 0x4, 0x4, 0xd3f6, 0x4, 0x3, 0x4, 0x1, 0xc, 0xbf2, 0xff, 0x7, 0x8002, 0x9, 0x3ff, 0x80000000, 0x9, 0x9, 0x9, 0xf01a, 0x2, 0x1, 0x9, 0x100, 0x0, 0xffffffff, 0x80000001, 0x3, 0x3, 0x6, 0x240000, 0x0, 0x1, 0xfffffffa, 0x45, 0x0, 0x0, 0x8, 0x5, 0x0, 0x3, 0x8a8, 0xa, 0x9, 0x0, 0x7, 0x9, 0x583, 0x8, 0x8, 0x1, 0x10002, 0x9, 0xffffff81, 0x6, 0x400, 0x227, 0x6, 0x8, 0xc442, 0x0, 0x3, 0x3ff, 0x5, 0x82a, 0x4, 0x72d2, 0x7, 0x5, 0x7, 0x4, 0x8, 0x8, 0xea1, 0x0, 0x566, 0x0, 0xfffffffe, 0x7, 0x737, 0x4, 0x6, 0x2, 0x1000, 0x4, 0x8, 0xff, 0x9, 0x7, 0x5, 0x3, 0x9, 0xbcea, 0x7, 0x8000, 0x0, 0x1, 0x1, 0x3, 0x7fff, 0x8, 0x3, 0x4, 0x9, 0x101, 0x1, 0x8, 0x1, 0x6, 0x6, 0x9, 0x7f800, 0x9, 0xd8a8, 0x3, 0x9, 0xfffffffb, 0x8, 0xd0f, 0x7, 0x8, 0x4, 0x1, 0x7, 0x7, 0x8e, 0x5, 0x0, 0x7, 0xfffffffe, 0x81, 0xad3, 0x4, 0x80000001, 0x7, 0x8, 0x80, 0x8, 0x3ff, 0x6, 0xce1, 0x8, 0x80000001, 0xe, 0x1, 0x400002, 0x8000, 0x4, 0x3, 0xb, 0x2, 0x2, 0x6, 0x1, 0xe30, 0x3ff, 0xa7a, 0x8, 0x8, 0x9, 0x2, 0x401, 0x9, 0x9659, 0x400, 0xa83, 0x6, 0xfffffffe, 0x5082, 0x5, 0x6e82, 0xffff, 0x9, 0x7ff, 0x200800, 0xfffffffb, 0xfffffffb, 0x2, 0xd, 0x1, 0xffffff46, 0x7, 0x8000, 0x5d, 0x70d, 0x7fff, 0x3, 0x4, 0x6, 0x7, 0xa6a0, 0x7, 0x9, 0x1, 0xe8b0c95b, 0x9, 0x3, 0x8a2, 0x4, 0x6, 0x2, 0x3, 0x0, 0x7, 0x3, 0x4, 0x4, 0x5, 0xfffffff9, 0xbffeffff, 0xc, 0xfffffff7, 0x1ff, 0x8, 0x7ffc, 0x9, 0x3, 0xfffffff8, 0x1, 0x434, 0x8, 0x3ab, 0x8, 0x6, 0x0, 0x7, 0x4389, 0x7, 0x800, 0x400, 0x4, 0x0, 0x3, 0x5, 0xc94, 0x9, 0x4, 0x0, 0x4, 0x2, 0x401, 0x6, 0x401, 0x8, 0x1, 0xb, 0xe664, 0x0, 0xc, 0x96, 0x7, 0x101, 0xd, 0x2, 0x6, 0xdc, 0xf, 0x1000, 0x8, 0x7, 0x0, 0x0, 0x10001, 0x9, 0x7, 0x0, 0x40000fff, 0xf9, 0xc8, 0x2400, 0x1, 0x400, 0x9, 0x0, 0x8, 0x8, 0x7, 0x5, 0xfffffffb, 0x6b59b47c, 0x2, 0x4, 0xd64, 0x8, 0xc, 0x0, 0x7, 0x0, 0x9, 0x4, 0x80, 0x3, 0x6, 0x10, 0xc, 0x7, 0x8, 0x8, 0x8000, 0x6, 0x979, 0x385, 0xa0, 0x5, 0x8, 0x3d72e35e, 0xfffffff7, 0x9, 0x80000001, 0x8, 0x1a7, 0x7, 0x8, 0x0, 0x3, 0xe83, 0x3, 0x1, 0x3, 0x0, 0x2, 0x9973, 0x3, 0x4, 0x40, 0x40, 0x4, 0x5, 0x412, 0x4, 0x2, 0x5, 0xb4, 0x1ff, 0xc77c0000, 0xffff2c2c, 0x9, 0x8000, 0x47, 0x9, 0xffffff97, 0xffff, 0x3, 0xffffffc0, 0x10001, 0x2, 0xfffffe01, 0x7fff, 0x78, 0x8, 0x0, 0xf, 0x40, 0x8, 0xed, 0x3, 0x9, 0x8, 0x0, 0x1, 0x1, 0x7, 0x800, 0xb, 0x5, 0x5, 0x9, 0x2, 0xd, 0x2, 0x6, 0x101, 0x4, 0x6, 0xa6d2, 0xd, 0x8000, 0x2, 0x9, 0x2, 0x0, 0x0, 0x3ff, 0x7, 0xffffff00, 0x7, 0x7, 0x40, 0x3, 0x101, 0x20000000, 0xdc000000, 0x2, 0xfffffffb, 0x401, 0x6, 0x1, 0x9, 0x4, 0xffffffa2, 0x5, 0x5, 0x9015, 0x6, 0x5, 0x5, 0x14b, 0x0, 0x336, 0xcf, 0xd, 0x5, 0xbbe7, 0xa8eb, 0xd0, 0xb, 0x800, 0x2b18, 0x3ec3, 0x0, 0x9, 0x5, 0x1, 0x8, 0x200, 0x2, 0x0, 0x5, 0xff, 0xc, 0x8, 0x2, 0x2, 0x7, 0x8, 0x10, 0xb46, 0x8, 0x1, 0x5dc60e00, 0x4, 0x9, 0x8, 0xd2, 0x9, 0xffff4a7a, 0x88f, 0xbd, 0x4, 0x6, 0x5, 0x8, 0x9, 0xffffffff, 0xda, 0xe, 0x8001000, 0x7b, 0x9, 0x10001, 0x6, 0x136, 0x36, 0x3a12, 0x9, 0x8, 0x4, 0x8], 0x1, 0x400, 0x3ff}) close_range(r0, 0xffffffffffffffff, 0x0) 1m51.052368314s ago: executing program 8 (id=2466): fcntl$lock(0xffffffffffffffff, 0x25, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20044080) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) 1m35.406058183s ago: executing program 36 (id=2466): fcntl$lock(0xffffffffffffffff, 0x25, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20044080) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) socket$nl_netfilter(0x10, 0x3, 0xc) 30.00716136s ago: executing program 9 (id=2595): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getrlimit(0xc, &(0x7f0000000300)) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r3 = syz_open_dev$tty1(0xc, 0x4, 0x2) write(r3, &(0x7f00000008c0)="bae2bf808214ff98d8d00b4e4aa5b63a86342a471feaedd023fe0d23081a02d33e4a469ab9d700b98dbc637a1ab17ee404dfa6c5d5a144ee59221d4b94680ba508343a208a525cff39a2733191ec729e1ed6ee89970d901cdde9274de2a14d16d4b60efff4a823051100a4766a36baa70307cd088fcc9e7146a60c52282f525d113a20c411358bfa0b288791cc9dba6ba75a160cb7beda4a2a7f1a2fa5c565ff344c6b7550c85aeec24195055e0cb2b5ed37875be4e627ef1027ef44c76edb024b67d2dd316c9025880d70300e9ac5abae459e1de4d6868facadaf5c07042ba04768b47d542ef67510bc6a31e1c671cd366d1060843996078b8bceab4299a1fd7ff0318b010dfc8a95b9163505bdde7f92bccfb94a227d620c7fbf355564d75dadaeb40bfa148575d175ba6b276dd1f08de275305c679ed2ca319a0d0ea310eee868429deb863319197812d62a2961765536e8b81edabf419b3ee6c60e17b9c61353366cb3e11572e94b996053feb7854704a86cd638976f8373557ca455e43463252bff8f4835f05ac57cc3e29031d648a942c4f83823378367ff5ff6157e59ccb6b7236eeca6a5f962d3f79b677fa1d2b8baa374f5aab9ecabd7f024941d73db13ba01090a7544d51c2e1ffc35d383b355c359568623715caadca70f1125419af0a5ec9832a5885c29ac40b3fe2f9f173934bb57eef3c9ab71d1b747554fb403d22cd39f98d2ac6df121c75ea827d1790db6fc7c21f601f75bc9b7d5facd83cf77e4b666e3257fb81ac213d2afccd3cc5e2bab7db075d051cd5c9f860f421e672e6d3c2ffce5f51b45e24a1dcf27de17e47ad0d34fa1ead3fc3892593f29f94f26413603c490f9c7d0682de6f9048ae911615975cee4e8b1349133192bfe71130368238688b67b74631a1a524699d28d86427694f753daf88e009c4d34ed310fea1c7356e5abc256595589f704a69b36b6dd05060f3abd79af70d2eb438b85b3d35d300eabaf51bdf479e07ff1338eba821f0c2a395cd355103df33032c1cd8edcdc5425f4418f18b7c1e85fceeb6f41fbaed2573052cf087659520618fe64ec82ae8484b2ddb50a41762fc3f90b3ceb8b2d10bac688e2d35d35e93639ab72384bebe7690c467f0f678bd75c9aa67bc96d94c98ced73d22c6776c918fe50143b80dc80d97326858cbbff3d66f7dc788b788ef275c5037081e9f025e3becca7cf496f7cddd0da37a4ea323d5037bfbcb61edf8b5980269c788605be92bd56b2399e1d5c6dfb43b65d6c9fb9a1ea1c8c548833c48a255b81ac0f7029be6234823bcf232efdc8116d530b652bc6aeab4367f7a33b4d152646003c2064a0b1cabaef6c2391e71c822409130fc4d0a3c9d2895b3f3468a51b33c512711e36632597b3e582af545f29b698d2d41f8362080977d0a0d48d492cc4f61816b7fedd27b826f81e1cbffed54c31dc6ef4b986bad01da626237a2e6bca61e2329bc4e06de64fa68d371a2f0b5dfe017d321e09bd5fc8fba5416e8d7ea329ec0f9be877dc406b6f592dfb3176cffcd9a82ac7479e674d6f3c346fcd3cd2f65e724693b5ace04bb74c2e8a47717162a3b14fcd0b9045b48545ec9dd4d2d1926da207371dbb8e339bd5456f7e00dfb73a9ad86e5e902311644a9a0ce2cb9483b90c25c8e30984bac1c462c06f1b76c68f5a8ef8e6414c67b6a0f77e9eb2e56a8b9ebe6af0a8fa69a92ea6ffde0eee16696a065da53bb4cb51c5985fcb0434589b4628efcf14ddd5f17ec6bd1f219096e02dc364d036b21df65c16a7a83a2145996f2154719317f49444f6ba380b821e4ca10ebba5795d6f04fe252cfabc4ffba1ae5938450b6da37ad734cf298029bfdac3b28cf86f27696fb2b7707702606e3bf5ae65e0d74b3ba450cb36af1c975aead56e69d4e61d3b1941b15d4e017f46552caf43c5ac8beafcf4c0e64c8247136d8e36409ef2986b79c806f4122a44cf988ce789797ec8919f6daff8e353e2391e45f4a2dd9984fbc8646132e2502d462d04b2d7be73cca3ede4240e3368585083f7721da55c95fc49b43a28c3e09c5fb7b43e4dc48d1095d7327ec859d657cf9cc8eef62aac5f1948358727267b87741c27fcc4b3577552e8ad3393a28261a1f754e8130c5b696509b608eb18a0cea00709ec2698527182412559deb8158e2caac436d000b4fb0f98cf920be07f0cbf3eb042bf865f68ca9295e541ae1ec6620b657ffd021794c9e2af3fdaeb5d453c30f8f915b28f230deb1f0717992d9b33425b79106de94e1cdb79dd14627413af70a2d34c908d0c165a3601b0339a335bb44ae635fe96c932111f6eef5216e32a46085216ad85423ef9b0e335ff7028464ccaaaf146d846c436e1db3c77877dce48b92d6b7e1d04f455f66093a9b24c07ef58cbfa7626c03cdf2153f14b055eb6c3c98a28ca85a74c48773f829a35433f11078249dd0a4295dbc3cf539a2b68c472a3000bb1b8e0faee8ea405270532c20ef4955b54d768d99d83ba165f37061bad1d1dcb1d90162b2a6c7678068e665dfa9501d367e4ba272238a3f8919d7f19cb692f2679fb1ea43d3fcf7119ce967529450de7fb3a2bb9902bf5b146e37661a934554f12dfec8647a96c5efc7bf3256af35cc94b64ad1a6902c6b052bb7334a364b0eaa485dee260d1", 0x763) socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r5, {0x0, 0xfff3}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x4c840) sendmsg$nl_route_sched(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x48, 0x2c, 0xf3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r5, {0xb}, {0x0, 0xfff3}, {0xd, 0x300}}, [@filter_kind_options=@f_flow={{0x9}, {0x18, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0xc1f5}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_ACT={0x4}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20041090}, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0), 0x0, 0x0, &(0x7f0000000280)={0x0, 0x989680}, 0x0) 21.023108527s ago: executing program 9 (id=2612): socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8041, 0x0, 0x5441, 0x0, 0xfffffe0000000001, 0x9, 0xf7ffffff}, 0x0) fsopen(&(0x7f0000000040)='cgroup\x00', 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @local, @multicast1, @random="8528d5915819", @dev={0xac, 0x14, 0x14, 0x3c}}}}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000580)={0x48, 0x2, r3, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r2, 0x3b8c, &(0x7f0000000780)={0x30, r4, 0x0, 0x0, 0x0, 0x84, 0xa9, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) socket$alg(0x26, 0x5, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='status\x00') r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000040) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$netlink(0x10, 0x3, 0x4) r10 = socket$unix(0x1, 0x1, 0x0) bind$unix(r10, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) write(r9, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb00000000000000", 0x24) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x884) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, 0x0, 0x0) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r11, 0xffffffffffffffff, 0x0) 15.548850632s ago: executing program 7 (id=2624): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008b}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xb, 0x4, 0x0, &(0x7f0000000c40)='GPL\x00', 0x3, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf51c}, 0x94) socket$inet6(0xa, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r0 = io_uring_setup(0x1d48, &(0x7f0000000340)={0x0, 0xb140, 0x1000, 0x6, 0x196}) socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x48) r2 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0x0, 0x0, 0x4004) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000680)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0xc, &(0x7f00000005c0)=ANY=[@ANYRES8=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) r6 = socket$rxrpc(0x21, 0x2, 0x2) close_range(r0, r6, 0x0) sched_setaffinity(0x0, 0xfffffffffffffd7a, &(0x7f0000000580)=0x8000000002) 15.194005187s ago: executing program 9 (id=2625): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4805}, 0x20000050) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a40000000160a03020000000000000000020000000900020073797a30000000000900010073797a300000000014000380080001400000000008000240000000001400"], 0x68}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0) r2 = syz_io_uring_setup(0x49a, &(0x7f0000000140)={0x0, 0x59b0, 0x3180, 0x3, 0x2c0}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_WRITE={0x17, 0x48, 0x4007, @fd_index=0x3, 0x22, 0x0, 0x0, 0x6, 0x1}) io_uring_enter(r2, 0x627, 0x4c1, 0x63, 0x0, 0x20) 14.059368949s ago: executing program 7 (id=2627): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e04003100002200000109022400010000000009040000010300000009"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) futex_waitv(&(0x7f0000001740)=[{0xc, &(0x7f0000001380)=0xffffffffffffffff, 0x6}], 0x1, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x3ab2c1) syz_open_dev$dri(0x0, 0x1, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x2982, 0x0) close(r3) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) setpriority(0x2, 0x0, 0x7fffff7ffffffffb) r4 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$rds(r4, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20040800}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'pim6reg1\x00', {0x2, 0x4e20, @local}}) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x26) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$radio(0x0, 0x1, 0x2) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000580)=[@text64={0x40, &(0x7f00000009c0)="b8010000000f01d90f20e035010000000f22e064440f01c9410f79153e000000f3f243df76c1360f01c3f3460f0f63510c0f09420f01c50f005198", 0x3b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {'\x00', "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) 13.221909067s ago: executing program 2 (id=2630): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xf}}}, 0x54}}, 0x10) 12.921791391s ago: executing program 5 (id=2632): bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={0xffffffffffffffff, &(0x7f0000000140), &(0x7f0000000080)=@udp6}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={0xffffffffffffffff, &(0x7f0000000200), 0x0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000c40)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="ef16", 0x0}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e", 0xc2}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 12.849243005s ago: executing program 2 (id=2633): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7c1c, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x20}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0xac800000}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) 12.791035922s ago: executing program 5 (id=2634): fcntl$lock(0xffffffffffffffff, 0x25, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="580000000206030000000000000000000300000705000100070000000900020073797a31000000000c00078008001240000000050500050002000000050004000100000011000300686173683a69702c706f7274"], 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x20044080) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="50000000090601020000000000000000020000840900020073797a31000000000500010007000000280007800c00018008000140fffffff70500070088000000060004404e22000006000540"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x90) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000000706010800000000000000000a00e2040500010007"], 0x1c}, 0x1, 0x0, 0x0, 0x20000005}, 0x80) 11.727359402s ago: executing program 9 (id=2635): socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8041, 0x0, 0x5441, 0x0, 0xfffffe0000000001, 0x9, 0xf7ffffff}, 0x0) fsopen(&(0x7f0000000040)='cgroup\x00', 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) syz_emit_ethernet(0x2a, &(0x7f0000000100)={@broadcast, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1c}, @void, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x2, @local, @multicast1, @random="8528d5915819", @dev={0xac, 0x14, 0x14, 0x3c}}}}}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000580)={0x48, 0x2, r3, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r2, 0x3b8c, &(0x7f0000000780)={0x30, r4, 0x0, 0x0, 0x0, 0x84, 0xa9, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) socket$alg(0x26, 0x5, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='status\x00') r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000040) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) r9 = socket$netlink(0x10, 0x3, 0x4) r10 = socket$unix(0x1, 0x1, 0x0) bind$unix(r10, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) write(r9, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb00000000000000", 0x24) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r5, 0x0, 0x884) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, 0x0, 0x0) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r11, 0xffffffffffffffff, 0x0) 10.678879982s ago: executing program 5 (id=2637): socket(0x2, 0xa, 0x300) r0 = socket(0x2c, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r1, &(0x7f0000000140), &(0x7f0000000080)=@udp6=r0}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYBLOB='\x00'/19, @ANYRES32], 0x50) r2 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000700), 0x0}, 0x50) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085", 0xcb}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r5, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r6, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 10.429750324s ago: executing program 2 (id=2638): socket$netlink(0x10, 0x3, 0xc) socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00"/12], 0x48) socket$key(0xf, 0x3, 0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 10.188921204s ago: executing program 5 (id=2639): openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x8480, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_buf(r0, 0x0, 0x8008000000010, &(0x7f0000005e40), 0x0) r1 = socket(0x15, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) getsockopt(r1, 0x200000000114, 0x2721, 0x0, &(0x7f0000000040)) 9.832001421s ago: executing program 2 (id=2640): socket(0x2, 0xa, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000140), &(0x7f0000000080)=@udp6}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r0, &(0x7f0000000200), 0x0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="ef16", 0x0}, 0x50) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f", 0xcd}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 9.556544347s ago: executing program 2 (id=2642): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) r1 = gettid() rt_sigprocmask(0x0, &(0x7f0000000100)={[0x4]}, 0x0, 0x8) r2 = syz_open_procfs(0x0, &(0x7f0000000380)='net/wireless\x00') lseek(r2, 0x8, 0x0) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, 0x0) rt_sigtimedwait(0x0, 0x0, 0x0, 0x0) ptrace$ARCH_SHSTK_LOCK(0x1e, r1, 0x2, 0x5003) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) prlimit64(r1, 0x0, &(0x7f0000000300)={0x37a06b55, 0x8}, &(0x7f0000000340)) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeeb, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r6 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0x2}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8, '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\b\x00'}}}]}, 0x48}}, 0x0) 7.205425253s ago: executing program 6 (id=2646): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r4, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5", 0x0, 0xcc, 0xffffffff}, 0x3c) gettid() r5 = socket(0x40000000015, 0x5, 0x0) bind$inet(r5, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) pipe(&(0x7f0000000080)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='2', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 5.950696027s ago: executing program 6 (id=2647): socket$netlink(0x10, 0x3, 0xc) socket$igmp(0x2, 0x3, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x50) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x48) socket$key(0xf, 0x3, 0x2) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r0, @ANYBLOB="08000100", @ANYRES32=r1], 0x90}}, 0x0) 5.74511543s ago: executing program 9 (id=2648): r0 = socket(0x400000000010, 0x3, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x202, 0x0) write$sequencer(r2, &(0x7f0000000000)=[@t={0x81, 0x5, 0x0, 0x1, @generic=0xf}], 0x8) r3 = epoll_create1(0x0) r4 = dup3(r1, r2, 0x80000) ioctl$DRM_IOCTL_ADD_MAP(r4, 0xc0286415, &(0x7f0000000200)={&(0x7f0000ffe000/0x1000)=nil, 0xa5, 0x2, 0x10}) r5 = epoll_create1(0x0) r6 = dup3(r1, r5, 0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r6, &(0x7f00000001c0)={0x2007}) syz_usb_connect$cdc_ncm(0x5, 0x98, &(0x7f0000000100)=ANY=[@ANYBLOB="12010102020000082505a1a4400001020301090286000201df40010904000001020d00000524060001052400240060240f01fcffffffba00b4000906241abcf806152412ff00"], &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0}) sendmmsg$inet(r1, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000080), r8) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x14, r9, 0x7}, 0x14}, 0x1, 0x0, 0x0, 0x48050}, 0x0) mmap(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000200)=ANY=[], 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x0, 0x0, &(0x7f0000000080)='GPL\x00', 0x2, 0x1001, &(0x7f0000001cc0)=""/4097, 0x41100, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0x4b564d02, 0xec000000}]}) ioctl$KVM_X86_SETUP_MCE(r6, 0x4008ae9c, &(0x7f0000000240)={0xc, 0x6, 0x10}) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x58, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0xf}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0) 5.498523023s ago: executing program 6 (id=2649): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000800)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x0) openat$dsp1(0xffffff9c, &(0x7f0000000180), 0x0, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0x10, 0x4}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x4, 0xffffff00, 0x20000000, 0xc31, 0x7}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}, @TCA_RATE={0x6, 0x5, {0xda, 0xc}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) 3.981814794s ago: executing program 7 (id=2650): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat(0xffffffffffffff9c, &(0x7f0000000540)='mnt\x00', 0x0, 0x0) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80800) splice(0xffffffffffffffff, 0x0, r0, 0x0, 0x7c1c, 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$uinput(0xffffffffffffff9c, &(0x7f00000003c0), 0x802, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x20}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) 3.533076205s ago: executing program 6 (id=2651): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000002c00)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$video4linux(&(0x7f0000000040), 0x7fff, 0x48b03) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) clock_gettime(0x0, 0x0) r1 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r1, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x6080, 0x0) add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000140)="1f", 0x1, 0xfffffffffffffffe) add_key$user(0x0, &(0x7f00000005c0), &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x1}, &(0x7f00000009c0)="3e12d23d346cfdeb1716f738374bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43eba0b67b516be14a8b51a75bfd611b2d7ae6a21d056c2c5116a416a76b1a03dc55ea62d43c809e0ed6e56163fdab317afd5c34d614367e4425bb9a97e38b8beb84ef6d549eed5aaa86dbe646fc95b4b88e17fb55ae6f1221bcf13ecff7a597f452bed6b6fb4c812df9be8e35d8d15086609c033a5d2a42d5dcb0d103098fa302c5b1d48f913f8b22a30a47d9ae02000000e2b855845f39806305f56d918cc5b4023fdbe9cae4147c84583ec9dd110f31ba5ae65e31f00e641832d29ed658b91f349b801b8b0d2de59d006ce210a0351b6bbd06c77c9aa67b5d7287fc1bfa1d0bf035ccdd4b20d7f95b5c77afde046b146ce8b395126fceb6cca68972ac02bc7d9b0aa6453cbca85e30a02db8f48b9eb10526d00f4e90971d6c844fb8b2fb70ec826465726fb78cc47db98cf04ba351e13fcd9ab1c4c2a18f2fb931951347528d02aa982f43adc7275cf628880d83ec1ec3f1f408d21a04e388b2460a6f33071ba190c3538bcc29d16bb0119570263af15bd2ae5f09c5d3177c3bf98da9b7", 0x1c1, 0xfffffffffffffffe) socket(0x1d, 0x2, 0x6) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x2982, 0x0) close(r2) syz_80211_join_ibss(&(0x7f0000000200)='wlan0\x00', 0x0, 0x0, 0x1) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f00000001c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x20000080) shmget$private(0x0, 0x4000, 0x54001800, &(0x7f0000000000/0x4000)=nil) 922.389557ms ago: executing program 7 (id=2652): socket(0x2, 0xa, 0x300) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="110000000400000004000000ff"], 0x17) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000140), &(0x7f0000000080)=@udp6}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000340)={r0, &(0x7f0000000200), 0x0}, 0x20) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'team_slave_0\x00', @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}) sendmsg$MPTCP_PM_CMD_GET_ADDR(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x410cd}, 0x400c084) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000080000", @ANYRES32=0x0, @ANYRES32], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xf, &(0x7f0000000540)=ANY=[], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f0000000700)="ef16", 0x0}, 0x50) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f", 0xcd}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r4, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r5, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 636.924287ms ago: executing program 5 (id=2653): socket(0x80000000000000a, 0x2, 0x0) socket$packet(0x11, 0x3, 0x300) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) epoll_create(0x6) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x120002) socket$packet(0x11, 0x2, 0x300) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffffff, 0x1, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000280)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000780)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r1}, &(0x7f0000000840), &(0x7f0000000880)=r2}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000040)={r2, r4, 0x25, 0x2, @val=@netfilter={0x3, 0x1, 0x0, 0x1}}, 0x20) syz_emit_ethernet(0xd6, &(0x7f0000000300)={@local, @multicast, @val={@void, {0x8100, 0x0, 0x1, 0x4}}, {@ipv6={0x86dd, @udp={0xa, 0x6, "fa20fb", 0x9c, 0x11, 0x0, @local, @local, {[], {0x4e1d, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x4, "08744845e02104431ad54d214a692f70998e39e2e092b7a629caad2671b0f478", "4b87d5455d736b7920997cd606850cf7dba04158a941a98f8c74c54e903d5be35c06c65ee8ab0354fc5c409451c999f3", "9219fdaabe9ee6f7e93f8e72ab42b7f10edee7e9f774040d99abf45b", {"c82926411ff99a160100000000000096", "5b8b7b770e1eaf5eeb1abc0ed34d494e"}}}}}}}}, 0x0) 592.4749ms ago: executing program 6 (id=2654): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)={{0x14}, [@NFT_MSG_NEWRULE={0x2c, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xf}}}, 0x54}}, 0x10) 570.813272ms ago: executing program 7 (id=2655): setsockopt$inet_opts(0xffffffffffffffff, 0x0, 0x4, &(0x7f0000000000)="8907040400", 0x5) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f00000000c0)='ip6_vti0\x00', 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000f40)=[{{&(0x7f0000000040)={0x2, 0x0, @broadcast}, 0x10, 0x0}}], 0x68000, 0xe000) 530.475134ms ago: executing program 9 (id=2656): r0 = io_uring_setup(0x937, &(0x7f00000002c0)={0x0, 0x32b6, 0x80, 0x0, 0x35d}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, 0x0, 0x0) syz_open_procfs(0x0, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000000)=0x10000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000100)={@local}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r6 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) ftruncate(r6, 0xffff) fcntl$addseals(r6, 0x409, 0x7) r7 = ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000000)={r6, 0x0, 0x0, 0x8000}) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, &(0x7f00000001c0)=0x1) ioctl$DMA_BUF_IOCTL_SYNC(r7, 0x40086200, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r1, 0x7b2, &(0x7f0000000140)={&(0x7f0000000300)=[0x4, 0x6, 0x1, 0x9, 0x5, 0x401, 0x200, 0x4, 0x0, 0xcb0d, 0x770f, 0xff, 0x4, 0x81, 0x2, 0x5, 0x1d, 0x0, 0x78, 0xb, 0x5, 0x6, 0x8, 0x9, 0x69, 0x5, 0xfffffff4, 0x7fff, 0x8, 0xe00, 0x0, 0x3, 0x10000, 0x7f, 0x0, 0xfffffff4, 0x15a0, 0xffffff7f, 0x8, 0x5d, 0x800, 0xf94, 0xff, 0x8, 0x2, 0xfffffff9, 0xe, 0xffffbb46, 0x7, 0x4, 0x1, 0x4, 0x5, 0x1000, 0x6, 0x3, 0x1, 0x8, 0x80, 0xc, 0x7, 0x8, 0x2, 0x1, 0x3, 0x1800000, 0x3, 0x5, 0x400, 0x5, 0x9, 0x1, 0x8, 0x2, 0x1000, 0x9, 0x3, 0x6d, 0xfffffffc, 0x1ff, 0xffffffc0, 0x0, 0x5, 0x8, 0x2008, 0x2, 0xf0, 0x5, 0x7, 0x6, 0x4469, 0xb, 0xfffffb4c, 0x80000001, 0xe5f6, 0x0, 0x4, 0xd4, 0xffffffff, 0x200000, 0x9, 0x2, 0x4, 0x5, 0x2, 0x3, 0x8f, 0x7, 0x6, 0x5, 0x4, 0x6d03, 0x8001, 0x9, 0x3, 0x0, 0x8e7a, 0x2, 0x8, 0xfffffff1, 0x5, 0x1000000, 0xfff3, 0x4, 0x1, 0x80000000, 0x3ff, 0x81, 0x100, 0x8, 0xfffffffb, 0x4, 0xfffffffc, 0x1, 0x7, 0x6, 0x3e, 0x43, 0xffff6a70, 0xc, 0xa092, 0x8, 0x877, 0x1, 0x3, 0x800, 0x5, 0x0, 0x8001, 0x48c, 0x7, 0x2, 0x13, 0x3, 0x3, 0x9, 0x0, 0x70000000, 0x2, 0x8, 0x2, 0x1b1c, 0x8, 0xb5, 0x8, 0x401, 0xfff, 0x5, 0x1, 0xa008, 0x9, 0x8, 0xe4, 0x898, 0x7, 0x81, 0x0, 0x1ff, 0x5, 0x80000000, 0x1, 0x8, 0x1, 0x8, 0x4251, 0x6, 0x4, 0x6, 0x4008, 0x200, 0x5, 0x73f7, 0x6, 0x8001, 0x80, 0xd5, 0x6, 0x800000, 0x40, 0xfffffe03, 0x2, 0x80000001, 0x7f, 0xfffffffa, 0xff, 0x4, 0x4b031fcb, 0x7, 0xf3, 0x40, 0xffffffff, 0x1, 0x0, 0x3, 0x6, 0x0, 0x5, 0x6, 0x3, 0x9, 0xfd, 0xd, 0x1000, 0x94, 0xd4f, 0x3, 0xfffffeff, 0xba7, 0x400, 0x4, 0x0, 0x80000001, 0x7, 0x10001, 0xfff, 0x9, 0x2, 0x9, 0x1, 0xfffffff9, 0x6, 0x62, 0x668, 0xffff, 0x0, 0x7, 0x6, 0x0, 0x49, 0x2, 0x5f4, 0x3fd, 0xfffffffe, 0x4, 0x6, 0x9, 0x0, 0x5, 0x4, 0x6, 0x3, 0x1ff, 0xc3f6, 0x7, 0xd8b8, 0xfffffffe, 0xff, 0x8000, 0x7, 0x100, 0x43, 0x2, 0xc7b, 0xe2a0, 0x5, 0x6, 0x81, 0x6, 0x0, 0x3, 0x75c, 0x1, 0x10000, 0x3f, 0x24f7, 0x5, 0x9, 0xd8c, 0x7ffffffd, 0x7, 0xfffff6d2, 0x0, 0x0, 0x3, 0x9, 0x800, 0x5, 0x9, 0x80000000, 0x1, 0x9dcb, 0x8, 0x4, 0x8001, 0x9, 0x7, 0x6, 0x7, 0x81, 0x7ff, 0x0, 0x7, 0x1c00000, 0x5, 0x10, 0x2, 0x1, 0x4, 0xac, 0x8001, 0xb2, 0x4, 0x84f4, 0xf, 0x0, 0x6, 0x6, 0x3ef, 0x7, 0x101, 0x3, 0x4, 0xa, 0x7f, 0x5, 0x2, 0x7ff, 0xffff094f, 0xb, 0x80, 0x6, 0xfffffffd, 0x63, 0xd, 0x7, 0x9, 0x200, 0x9, 0x7, 0x8, 0xa, 0x10001, 0x8, 0xa21, 0x2, 0x9, 0x7, 0xe207, 0xa4, 0x4, 0x5, 0x7, 0x9, 0x0, 0x0, 0x9, 0x1, 0xd, 0x1, 0xf, 0x1, 0x26d1, 0x9, 0x8b000, 0x6, 0x6, 0x5, 0x80000000, 0xfffffffb, 0x8, 0x7, 0xfffffff9, 0x7, 0x4, 0x2, 0x0, 0x80, 0xffff6c99, 0x5, 0x6bed988b, 0x7f, 0x6, 0xffffff7f, 0x7, 0x7, 0x8, 0x4, 0x10000, 0x6, 0x9, 0x40, 0x0, 0x5, 0x0, 0x2, 0x3, 0x10000, 0x8, 0x9, 0x53fa, 0x0, 0x53, 0x9465, 0x9, 0x3, 0x4, 0x36c9, 0x3ff, 0x3, 0x4, 0x8, 0x68, 0x2, 0x81, 0x8, 0xcd94, 0x75e, 0x1000, 0x9, 0x6, 0x0, 0xfffffff7, 0xe, 0x6, 0x3, 0x7, 0x0, 0x6, 0x80000001, 0x731, 0x6, 0x4, 0x8, 0x3, 0x9, 0x80000001, 0x1, 0xfff, 0x4, 0x6, 0x4, 0x4, 0x2, 0x9, 0x6f9, 0x3, 0x8, 0x475e0e15, 0x80000000, 0x5, 0x4, 0xf3e, 0x9, 0x5, 0x0, 0x3, 0xad64, 0xfffffff9, 0x2, 0x3, 0x10000, 0x4, 0xff, 0x400, 0x7f, 0x7f, 0x7, 0x800, 0x40, 0x7, 0x6, 0x8, 0x1a, 0x0, 0x1000, 0xff, 0x10001, 0x8, 0x2, 0xffff, 0x8, 0x100, 0x100, 0x9, 0x9, 0x37, 0x28, 0xfffffff9, 0x7fffffff, 0x4, 0x83b9, 0xb, 0x2, 0x85f2, 0xd7f, 0x7, 0x3ff, 0x1000000, 0x2387c5a4, 0x3, 0x8, 0xbc4e, 0xffff, 0x1, 0x2, 0x408, 0x5, 0x0, 0x5, 0x6, 0x2, 0x6, 0x0, 0x51, 0x5, 0x3, 0x2, 0xfaf0, 0x4a46, 0x4, 0x10001, 0x9, 0x4921bb4d, 0x5c, 0x6, 0x3, 0x7, 0x7fff, 0x80, 0x3, 0x29dc2fdf, 0x200, 0x1, 0x9, 0xd2c, 0x8, 0x3, 0x3, 0x66f, 0x5, 0x4bb6, 0x258d, 0x101, 0x10000, 0x662f, 0x401, 0x5, 0x4, 0x4, 0xd3f6, 0x4, 0x3, 0x4, 0x1, 0xc, 0xbf2, 0xff, 0x7, 0x8002, 0x9, 0x3ff, 0x80000000, 0x9, 0x9, 0x9, 0xf01a, 0x2, 0x1, 0x9, 0x100, 0x0, 0xffffffff, 0x80000001, 0x3, 0x3, 0x6, 0x240000, 0x0, 0x1, 0xfffffffa, 0x45, 0x0, 0x0, 0x8, 0x5, 0x0, 0x3, 0x8a8, 0xa, 0x9, 0x0, 0x7, 0x9, 0x583, 0x8, 0x8, 0x1, 0x10002, 0x9, 0xffffff81, 0x6, 0x400, 0x227, 0x6, 0x8, 0xc442, 0x0, 0x3, 0x3ff, 0x5, 0x82a, 0x4, 0x72d2, 0x7, 0x5, 0x7, 0x4, 0x8, 0x8, 0xea1, 0x0, 0x566, 0x0, 0xfffffffe, 0x7, 0x737, 0x4, 0x6, 0x2, 0x1000, 0x4, 0x8, 0xff, 0x9, 0x7, 0x5, 0x3, 0x9, 0xbcea, 0x7, 0x8000, 0x0, 0x1, 0x1, 0x3, 0x7fff, 0x8, 0x3, 0x4, 0x9, 0x101, 0x1, 0x8, 0x1, 0x6, 0x6, 0x9, 0x7f800, 0x9, 0xd8a8, 0x3, 0x9, 0xfffffffb, 0x8, 0xd0f, 0x7, 0x8, 0x4, 0x1, 0x7, 0x7, 0x8e, 0x5, 0x0, 0x7, 0xfffffffe, 0x81, 0xad3, 0x4, 0x80000001, 0x7, 0x8, 0x80, 0x8, 0x3ff, 0x6, 0xce1, 0x8, 0x80000001, 0xe, 0x1, 0x400002, 0x8000, 0x4, 0x3, 0xb, 0x2, 0x2, 0x6, 0x1, 0xe30, 0x3ff, 0xa7a, 0x8, 0x8, 0x9, 0x2, 0x401, 0x9, 0x9659, 0x400, 0xa83, 0x6, 0xfffffffe, 0x5082, 0x5, 0x6e82, 0xffff, 0x9, 0x7ff, 0x200800, 0xfffffffb, 0xfffffffb, 0x2, 0xd, 0x1, 0xffffff46, 0x7, 0x8000, 0x5d, 0x70d, 0x7fff, 0x3, 0x4, 0x6, 0x7, 0xa6a0, 0x7, 0x9, 0x1, 0xe8b0c95b, 0x9, 0x3, 0x8a2, 0x4, 0x6, 0x2, 0x3, 0x0, 0x7, 0x3, 0x4, 0x4, 0x5, 0xfffffff9, 0xbffeffff, 0xc, 0xfffffff7, 0x1ff, 0x8, 0x7ffc, 0x9, 0x3, 0xfffffff8, 0x1, 0x434, 0x8, 0x3ab, 0x8, 0x6, 0x0, 0x7, 0x4389, 0x7, 0x800, 0x400, 0x4, 0x0, 0x3, 0x5, 0xc94, 0x9, 0x4, 0x0, 0x4, 0x2, 0x401, 0x6, 0x401, 0x8, 0x1, 0xb, 0xe664, 0x0, 0xc, 0x96, 0x7, 0x101, 0xd, 0x2, 0x6, 0xdc, 0xf, 0x1000, 0x8, 0x7, 0x0, 0x0, 0x10001, 0x9, 0x7, 0x0, 0x40000fff, 0xf9, 0xc8, 0x2400, 0x1, 0x400, 0x9, 0x0, 0x8, 0x8, 0x7, 0x5, 0xfffffffb, 0x6b59b47c, 0x2, 0x4, 0xd64, 0x8, 0xc, 0x0, 0x7, 0x0, 0x9, 0x4, 0x80, 0x3, 0x6, 0x10, 0xc, 0x7, 0x8, 0x8, 0x8000, 0x6, 0x979, 0x385, 0xa0, 0x5, 0x8, 0x3d72e35e, 0xfffffff7, 0x9, 0x80000001, 0x8, 0x1a7, 0x7, 0x8, 0x0, 0x3, 0xe83, 0x3, 0x1, 0x3, 0x0, 0x2, 0x9973, 0x3, 0x4, 0x40, 0x40, 0x4, 0x5, 0x412, 0x4, 0x2, 0x5, 0xb4, 0x1ff, 0xc77c0000, 0xffff2c2c, 0x9, 0x8000, 0x47, 0x9, 0xffffff97, 0xffff, 0x3, 0xffffffc0, 0x10001, 0x2, 0xfffffe01, 0x7fff, 0x78, 0x8, 0x0, 0xf, 0x40, 0x8, 0xed, 0x3, 0x9, 0x8, 0x0, 0x1, 0x1, 0x7, 0x800, 0xb, 0x5, 0x5, 0x9, 0x2, 0xd, 0x2, 0x6, 0x101, 0x4, 0x6, 0xa6d2, 0xd, 0x8000, 0x2, 0x9, 0x2, 0x0, 0x0, 0x3ff, 0x7, 0xffffff00, 0x7, 0x7, 0x40, 0x3, 0x101, 0x20000000, 0xdc000000, 0x2, 0xfffffffb, 0x401, 0x6, 0x1, 0x9, 0x4, 0xffffffa2, 0x5, 0x5, 0x9015, 0x6, 0x5, 0x5, 0x14b, 0x0, 0x336, 0xcf, 0xd, 0x5, 0xbbe7, 0xa8eb, 0xd0, 0xb, 0x800, 0x2b18, 0x3ec3, 0x0, 0x9, 0x5, 0x1, 0x8, 0x200, 0x2, 0x0, 0x5, 0xff, 0xc, 0x8, 0x2, 0x2, 0x7, 0x8, 0x10, 0xb46, 0x8, 0x1, 0x5dc60e00, 0x4, 0x9, 0x8, 0xd2, 0x9, 0xffff4a7a, 0x88f, 0xbd, 0x4, 0x6, 0x5, 0x8, 0x9, 0xffffffff, 0xda, 0xe, 0x8001000, 0x7b, 0x9, 0x10001, 0x6, 0x136, 0x36, 0x3a12, 0x9, 0x8, 0x4, 0x8], 0x1, 0x400, 0x3ff}) close_range(r0, 0xffffffffffffffff, 0x0) 432.438808ms ago: executing program 6 (id=2657): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x11, 0x13, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x33, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC(r4, 0x0, 0xcc, &(0x7f0000000140)={@multicast2, @multicast1, 0x0, "aaa517d60f2811d48c8a2cc60c4380bc23b510d442ff13482864280a9c0f4eb5", 0x0, 0xcc, 0xffffffff}, 0x3c) gettid() r5 = socket(0x40000000015, 0x5, 0x0) bind$inet(r5, &(0x7f00008a5ff0)={0x2, 0x0, @loopback}, 0x10) sendto$inet(r5, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2, 0x0, @loopback}, 0x10) pipe(&(0x7f0000000080)) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000040)='fd', &(0x7f00000000c0)='2', 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 337.029831ms ago: executing program 7 (id=2658): bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800002, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) write$UHID_INPUT(r3, &(0x7f0000000000)={0xc, {"a2e3ad2107c752f91b25380987f70e06d038e7ff7fc6e5539b3264078b089b3b083468060890e0878f0e1ac6e70a9b3365959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31350d095d0636cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4040d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7dafbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e19c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa75a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d86fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a00508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f375257fa0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f228c783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f5f71d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810930500ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab974c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff25e20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc660db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d154d8a5ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c79a9a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21e5ec68cb068ea88067d905ea917bb03eefdaebdeabf2c0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) 298.937012ms ago: executing program 5 (id=2659): prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x5) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000002c0), 0x80, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r2, 0x3ba0, &(0x7f0000000300)={0x48, 0x2, r3}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f0000000180)={0x28, 0x2, r3, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x100000000}) 0s ago: executing program 2 (id=2660): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000101e04003100002200000109022400010000000009040000010300000009"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) futex_waitv(&(0x7f0000001740)=[{0xc, &(0x7f0000001380)=0xffffffffffffffff, 0x6}], 0x1, 0x0, 0x0, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video4linux(0x0, 0x9, 0x3ab2c1) syz_open_dev$dri(0x0, 0x1, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x2982, 0x0) close(r3) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) syz_80211_join_ibss(0x0, &(0x7f00000002c0)=@default_ap_ssid, 0x6, 0x1) setpriority(0x2, 0x0, 0x7fffff7ffffffffb) r4 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r4, &(0x7f0000000080)={&(0x7f0000000180)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}, 0x0) sendmsg$rds(r4, &(0x7f0000000680)={&(0x7f00000000c0)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x34}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x20040800}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$sock_inet_SIOCSIFADDR(r5, 0x8916, &(0x7f0000000080)={'pim6reg1\x00', {0x2, 0x4e20, @local}}) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x26) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_open_dev$radio(0x0, 0x1, 0x2) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000580)=[@text64={0x40, &(0x7f00000009c0)="b8010000000f01d90f20e035010000000f22e064440f01c9410f79153e000000f3f243df76c1360f01c3f3460f0f63510c0f09420f01c50f005198", 0x3b}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000005700)=@vmx={0x0, 0x0, 0x2080, {0x0, 0xf000}, {'\x00', "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a5f2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fe00"}}) kernel console output (not intermixed with test programs): sb: will pass the complete MPEG2 transport stream to the software demuxer. [ 995.993623][ T36] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 995.993686][ T36] usb 5-1: media controller created [ 996.075132][ T36] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 996.248612][ T36] DVB: Unable to find symbol dib7000p_attach() [ 996.248625][ T36] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 996.388762][ T36] rc_core: IR keymap rc-dib0700-rc5 not found [ 996.388787][ T36] Registered IR keymap rc-empty [ 996.389137][ T36] dvb-usb: could not initialize remote control. [ 996.389147][ T36] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 996.458747][ T36] usb 5-1: USB disconnect, device number 63 [ 996.573838][T11583] QAT: failed to copy from user cfg_data. [ 996.679076][ T36] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1000.291847][T11598] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1695'. [ 1000.725458][ T36] usb 3-1: USB disconnect, device number 30 [ 1002.207070][T11610] binder: 11608:11610 ioctl c0306201 0 returned -14 [ 1002.957327][ T37] audit: type=1326 audit(1774423111.949:274): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11618 comm="syz.1.1702" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x0 [ 1003.768558][ T5934] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1003.963098][ T5934] usb 2-1: Using ep0 maxpacket: 32 [ 1003.966003][ T5934] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1003.966032][ T5934] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1003.974398][ T5934] usb 2-1: config 0 descriptor?? [ 1004.219717][ T5934] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1004.253350][ T5934] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1004.258373][ T5934] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1004.258544][ T5934] usb 2-1: media controller created [ 1004.387554][ T5934] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1004.668911][ T5934] DVB: Unable to find symbol dib7000p_attach() [ 1004.668929][ T5934] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1004.891049][ T5934] rc_core: IR keymap rc-dib0700-rc5 not found [ 1004.891073][ T5934] Registered IR keymap rc-empty [ 1004.891414][ T5934] dvb-usb: could not initialize remote control. [ 1004.891424][ T5934] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1006.323561][ T36] usb 3-1: new high-speed USB device number 31 using dummy_hcd [ 1006.478655][ T36] usb 3-1: Using ep0 maxpacket: 16 [ 1006.482858][ T36] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1006.482946][ T36] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1006.484508][ T36] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1006.484536][ T36] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1006.484557][ T36] usb 3-1: Manufacturer: syz [ 1006.555052][ T36] usb 3-1: config 0 descriptor?? [ 1006.572007][ T36] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1006.994299][T11646] QAT: failed to copy from user cfg_data. [ 1008.523813][ T5934] usb 2-1: USB disconnect, device number 49 [ 1008.955409][ T5934] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1009.056318][T11664] syzkaller0: entered promiscuous mode [ 1009.056336][T11664] syzkaller0: entered allmulticast mode [ 1009.372820][T11668] binder: 11665:11668 ioctl c0306201 0 returned -14 [ 1010.587831][T11673] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1013.056490][ T5926] usb 3-1: USB disconnect, device number 31 [ 1013.665915][ T5926] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1013.841283][ T5926] usb 3-1: Using ep0 maxpacket: 32 [ 1013.859617][ T5926] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1013.859638][ T5926] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1013.862937][ T5926] usb 3-1: config 0 descriptor?? [ 1014.074707][ T5926] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1014.085649][ T5926] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1014.090899][ T5926] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1014.090954][ T5926] usb 3-1: media controller created [ 1014.152897][ T5926] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1014.394094][ T5926] DVB: Unable to find symbol dib7000p_attach() [ 1014.394108][ T5926] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1014.548538][ T5926] rc_core: IR keymap rc-dib0700-rc5 not found [ 1014.548562][ T5926] Registered IR keymap rc-empty [ 1014.548768][ T5926] dvb-usb: could not initialize remote control. [ 1014.548896][ T5926] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1020.271035][T11718] lo speed is unknown, defaulting to 1000 [ 1020.275932][T11718] lo speed is unknown, defaulting to 1000 [ 1020.345258][T11718] lo speed is unknown, defaulting to 1000 [ 1020.455001][T11718] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1020.713573][T11718] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 1020.834023][T11717] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1728'. [ 1020.834061][T11717] netlink: 20 bytes leftover after parsing attributes in process `syz.5.1728'. [ 1020.874642][T11718] lo speed is unknown, defaulting to 1000 [ 1020.877790][T11718] lo speed is unknown, defaulting to 1000 [ 1020.880951][T11718] lo speed is unknown, defaulting to 1000 [ 1020.883998][T11718] lo speed is unknown, defaulting to 1000 [ 1020.889564][T11718] lo speed is unknown, defaulting to 1000 [ 1020.891375][T11718] lo speed is unknown, defaulting to 1000 [ 1020.893122][T11718] lo speed is unknown, defaulting to 1000 [ 1021.128138][ T36] usb 3-1: USB disconnect, device number 32 [ 1021.199945][T11726] random: crng reseeded on system resumption [ 1021.282868][ T36] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1021.390641][T11731] netlink: 'syz.6.1729': attribute type 6 has an invalid length. [ 1021.393573][T11727] syzkaller0: entered promiscuous mode [ 1021.393598][T11727] syzkaller0: entered allmulticast mode [ 1021.607966][T11738] QAT: failed to copy from user cfg_data. [ 1021.672466][T11738] IPv6: sit1: Disabled Multicast RS [ 1029.156965][T11768] siw: device registration error -23 [ 1029.182867][T11768] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1742'. [ 1029.185040][T11768] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1742'. [ 1030.030165][ T31] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1030.178530][ T31] usb 6-1: Using ep0 maxpacket: 32 [ 1030.180296][ T31] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1030.180315][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1030.220872][ T31] usb 6-1: config 0 descriptor?? [ 1030.328577][ T5926] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 1030.426020][ T31] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1030.438640][ T31] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1030.439191][ T31] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1030.439227][ T31] usb 6-1: media controller created [ 1030.484744][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1030.502781][ T5926] usb 3-1: Using ep0 maxpacket: 16 [ 1030.511168][ T5926] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1030.511280][ T5926] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1030.515473][ T5926] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1030.515500][ T5926] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1030.515518][ T5926] usb 3-1: Manufacturer: syz [ 1030.531155][ T5926] usb 3-1: config 0 descriptor?? [ 1030.547460][ T5926] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1030.661145][ T31] DVB: Unable to find symbol dib7000p_attach() [ 1030.661158][ T31] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1030.800655][ T31] rc_core: IR keymap rc-dib0700-rc5 not found [ 1030.800680][ T31] Registered IR keymap rc-empty [ 1030.801030][ T31] dvb-usb: could not initialize remote control. [ 1030.801040][ T31] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1031.946450][T11784] random: crng reseeded on system resumption [ 1032.244958][ T31] usb 6-1: USB disconnect, device number 18 [ 1032.378271][T11788] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1032.502306][ T31] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1032.874737][T11792] syzkaller0: entered promiscuous mode [ 1032.874764][T11792] syzkaller0: entered allmulticast mode [ 1034.494408][T11806] netlink: 'syz.6.1751': attribute type 6 has an invalid length. [ 1034.497491][T11806] QAT: failed to copy from user cfg_data. [ 1035.825969][ T31] usb 3-1: USB disconnect, device number 33 [ 1036.332650][T11818] siw: device registration error -23 [ 1036.348149][T11818] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1754'. [ 1036.348292][T11818] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1754'. [ 1037.730677][ T5926] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1037.889829][ T5926] usb 5-1: Using ep0 maxpacket: 32 [ 1037.895300][ T5926] usb 5-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1037.895320][ T5926] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1037.947448][ T5926] usb 5-1: config 0 descriptor?? [ 1038.153972][ T5926] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1038.156817][ T5926] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1038.178831][ T5926] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1038.178891][ T5926] usb 5-1: media controller created [ 1038.247291][ T5926] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1038.399071][ T5926] DVB: Unable to find symbol dib7000p_attach() [ 1038.399085][ T5926] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1038.508541][ T5926] rc_core: IR keymap rc-dib0700-rc5 not found [ 1038.508565][ T5926] Registered IR keymap rc-empty [ 1038.508767][ T5926] dvb-usb: could not initialize remote control. [ 1038.508773][ T5926] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1038.977836][T11831] random: crng reseeded on system resumption [ 1043.282467][T11854] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1043.417256][T11837] syzkaller0: entered promiscuous mode [ 1043.417285][T11837] syzkaller0: entered allmulticast mode [ 1043.489434][ T5926] usb 5-1: USB disconnect, device number 64 [ 1044.514004][T11867] siw: device registration error -23 [ 1045.120721][ T5926] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1045.508664][T11874] random: crng reseeded on system resumption [ 1047.243954][T11883] netlink: 'syz.6.1770': attribute type 6 has an invalid length. [ 1047.278993][T11883] QAT: failed to copy from user cfg_data. [ 1050.018551][ T31] usb 6-1: new high-speed USB device number 19 using dummy_hcd [ 1050.435431][T11908] random: crng reseeded on system resumption [ 1050.497772][ T31] usb 6-1: Using ep0 maxpacket: 32 [ 1050.501095][ T31] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1050.501126][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1050.510630][ T31] usb 6-1: config 0 descriptor?? [ 1050.636022][T11911] siw: device registration error -23 [ 1051.134153][ T31] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1051.157809][ T31] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1051.168377][ T31] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1051.168606][ T31] usb 6-1: media controller created [ 1051.314151][ T31] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1051.552767][T11912] syzkaller0: entered promiscuous mode [ 1051.552787][T11912] syzkaller0: entered allmulticast mode [ 1051.795016][ T31] DVB: Unable to find symbol dib7000p_attach() [ 1051.795035][ T31] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1052.052293][T11925] netlink: 'syz.6.1784': attribute type 6 has an invalid length. [ 1052.055117][T11925] QAT: failed to copy from user cfg_data. [ 1052.077573][ T31] rc_core: IR keymap rc-dib0700-rc5 not found [ 1052.077597][ T31] Registered IR keymap rc-empty [ 1052.077974][ T31] dvb-usb: could not initialize remote control. [ 1052.077986][ T31] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1052.119629][ T31] usb 6-1: USB disconnect, device number 19 [ 1052.258103][ T31] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1055.197715][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1055.205418][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1057.929099][T11952] siw: device registration error -23 [ 1058.958949][T11954] random: crng reseeded on system resumption [ 1060.018537][ T36] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 1060.037313][T11967] syzkaller0: entered promiscuous mode [ 1060.037332][T11967] syzkaller0: entered allmulticast mode [ 1060.199071][ T36] usb 2-1: Using ep0 maxpacket: 32 [ 1060.208721][ T36] usb 2-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1060.208752][ T36] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.216834][ T36] usb 2-1: config 0 descriptor?? [ 1060.344418][T11983] QAT: failed to copy from user cfg_data. [ 1060.388874][T11982] netlink: 'syz.4.1800': attribute type 6 has an invalid length. [ 1060.444421][ T36] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1060.614767][ T36] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1060.615430][ T36] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1060.615466][ T36] usb 2-1: media controller created [ 1060.715991][ T36] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1061.163263][ T36] DVB: Unable to find symbol dib7000p_attach() [ 1061.163276][ T36] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1061.328551][ T36] rc_core: IR keymap rc-dib0700-rc5 not found [ 1061.328576][ T36] Registered IR keymap rc-empty [ 1061.328903][ T36] dvb-usb: could not initialize remote control. [ 1061.328914][ T36] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1061.333315][ T36] usb 2-1: USB disconnect, device number 50 [ 1062.688736][ T36] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1067.332041][T12023] binder: 12016:12023 ioctl c0306201 0 returned -14 [ 1070.068577][T10986] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 1071.228227][T10986] usb 3-1: Using ep0 maxpacket: 32 [ 1071.229975][T10986] usb 3-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1071.229994][T10986] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.268159][T10986] usb 3-1: config 0 descriptor?? [ 1071.487302][T10986] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1071.617736][T10986] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1071.632225][T10986] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1071.632291][T10986] usb 3-1: media controller created [ 1072.406292][T10986] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1072.724529][T10986] DVB: Unable to find symbol dib7000p_attach() [ 1072.724542][T10986] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1073.048684][T10986] rc_core: IR keymap rc-dib0700-rc5 not found [ 1073.048708][T10986] Registered IR keymap rc-empty [ 1073.049039][T10986] dvb-usb: could not initialize remote control. [ 1073.049049][T10986] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1073.096761][T10986] usb 3-1: USB disconnect, device number 34 [ 1073.181468][T10986] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1073.237082][T12064] netlink: 'syz.6.1820': attribute type 6 has an invalid length. [ 1073.240064][T12064] QAT: failed to copy from user cfg_data. [ 1074.041756][T12069] binder: 12066:12069 ioctl c0306201 0 returned -14 [ 1076.861315][T12088] siw: device registration error -23 [ 1087.252531][T12147] binder: 12140:12147 ioctl c0306201 0 returned -14 [ 1093.845110][T12197] binder: 12194:12197 ioctl c0306201 0 returned -14 [ 1095.371569][T12199] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1096.034334][T12206] pim6reg: entered allmulticast mode [ 1097.283506][T12222] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1864'. [ 1100.915978][T12229] random: crng reseeded on system resumption [ 1100.961401][T12222] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1101.347221][T12242] netlink: 'syz.2.1870': attribute type 4 has an invalid length. [ 1103.956555][T12263] binder: 12253:12263 ioctl c0306201 0 returned -14 [ 1106.668568][ T5926] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1106.777525][T12287] pim6reg: entered allmulticast mode [ 1106.829242][ T5926] usb 2-1: Using ep0 maxpacket: 8 [ 1107.628275][ T5926] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1107.628311][ T5926] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1107.647613][ T5926] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1107.647672][ T5926] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1107.647696][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1107.721380][ T5926] usbtmc 2-1:16.0: bulk endpoints not found [ 1108.381407][T12311] netlink: 'syz.2.1886': attribute type 4 has an invalid length. [ 1109.523801][T12315] binder: 12302:12315 ioctl c0306201 0 returned -14 [ 1113.108258][ T5934] usb 2-1: USB disconnect, device number 51 [ 1114.809637][T12353] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1115.966332][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.966411][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.860839][ T5934] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 1117.658535][ T5934] usb 3-1: device descriptor read/64, error -71 [ 1117.909046][ T5934] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 1118.068510][ T5934] usb 3-1: device descriptor read/64, error -71 [ 1118.179031][ T5934] usb usb3-port1: attempt power cycle [ 1118.558609][ T5934] usb 3-1: new high-speed USB device number 37 using dummy_hcd [ 1118.579802][ T5934] usb 3-1: device descriptor read/8, error -71 [ 1118.728552][ T5926] usb 2-1: new high-speed USB device number 52 using dummy_hcd [ 1118.879102][ T5934] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 1118.898490][ T5926] usb 2-1: Using ep0 maxpacket: 8 [ 1118.903122][ T5926] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1118.903143][ T5926] usb 2-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1118.903171][ T5926] usb 2-1: config 16 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1118.903197][ T5926] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1118.903250][ T5926] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1118.905768][ T5934] usb 3-1: device descriptor read/8, error -71 [ 1118.910065][ T5926] usbtmc 2-1:16.0: bulk endpoints not found [ 1119.008864][ T5934] usb usb3-port1: unable to enumerate USB device [ 1120.305258][T12387] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 1121.037913][T12402] netlink: 'syz.6.1914': attribute type 6 has an invalid length. [ 1121.048766][T12402] QAT: failed to copy from user cfg_data. [ 1121.828622][T12409] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1918'. [ 1121.828660][T12409] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1918'. [ 1122.185747][T12420] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1122.411148][ T6150] usb 2-1: USB disconnect, device number 52 [ 1123.134611][T12428] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1125.433539][T12450] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1127.125490][T12468] fuse: Unknown parameter 'grou00000000000000000000' [ 1127.168510][T10986] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 1127.638063][T10986] usb 3-1: Using ep0 maxpacket: 8 [ 1127.652779][T12474] netlink: 'syz.5.1939': attribute type 6 has an invalid length. [ 1127.654768][T12474] QAT: failed to copy from user cfg_data. [ 1127.684332][T10986] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1127.684364][T10986] usb 3-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1127.684416][T10986] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1127.684439][T10986] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1127.684462][T10986] usb 3-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1127.684507][T10986] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1127.684530][T10986] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1127.703069][T10986] usbtmc 3-1:16.0: bulk endpoints not found [ 1129.203065][T12500] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1130.008970][T10986] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1130.148566][T10986] usb 6-1: device descriptor read/64, error -71 [ 1130.408506][T10986] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1130.548558][T10986] usb 6-1: device descriptor read/64, error -71 [ 1130.561278][ T6150] usb 3-1: USB disconnect, device number 39 [ 1130.659916][T10986] usb usb6-port1: attempt power cycle [ 1130.829693][T12510] fuse: Unknown parameter 'grou00000000000000000000' [ 1131.366154][T12517] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1131.577763][T10986] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1131.637124][T10986] usb 6-1: device descriptor read/8, error -71 [ 1132.514150][T10986] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1132.529345][T10986] usb 6-1: device descriptor read/8, error -71 [ 1132.678541][T10986] usb usb6-port1: unable to enumerate USB device [ 1133.084340][T12525] netlink: 52 bytes leftover after parsing attributes in process `syz.2.1955'. [ 1133.168192][T12526] virtio-fs: tag <./cgroup> not found [ 1133.798034][T12535] ±ÿþ€: renamed from team_slave_1 (while UP) [ 1135.358529][T10986] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1135.673535][T10986] usb 5-1: Using ep0 maxpacket: 8 [ 1136.698553][T10986] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 1136.698586][T10986] usb 5-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 1136.698641][T10986] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1136.698663][T10986] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1136.698687][T10986] usb 5-1: config 16 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1136.698734][T10986] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1136.698756][T10986] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1136.800644][T10986] usbtmc 5-1:16.0: bulk endpoints not found [ 1137.298515][ T6150] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 1137.468567][ T6150] usb 7-1: device descriptor read/64, error -71 [ 1137.708541][ T6150] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 1137.838527][ T6150] usb 7-1: device descriptor read/64, error -71 [ 1137.948977][ T6150] usb usb7-port1: attempt power cycle [ 1138.298581][ T6150] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 1138.333609][ T6150] usb 7-1: device descriptor read/8, error -71 [ 1138.858172][T10986] usb 5-1: USB disconnect, device number 65 [ 1139.049241][ T6150] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 1139.225622][ T6150] usb 7-1: device descriptor read/8, error -71 [ 1139.448751][ T6150] usb usb7-port1: unable to enumerate USB device [ 1140.567195][ T36] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 1141.708800][ T36] usb 3-1: Using ep0 maxpacket: 16 [ 1141.712155][ T36] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1141.712214][ T36] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1141.714987][ T36] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1141.715007][ T36] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1141.715019][ T36] usb 3-1: Manufacturer: syz [ 1141.722438][ T36] usb 3-1: config 0 descriptor?? [ 1141.729416][ T36] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1142.081662][T12603] netlink: 52 bytes leftover after parsing attributes in process `syz.4.1980'. [ 1142.156616][T12605] virtio-fs: tag <./cgroup> not found [ 1143.125100][T12615] fuse: Unknown parameter 'group_i00000000000000000000' [ 1145.126701][T10986] usb 3-1: USB disconnect, device number 40 [ 1145.783469][T12642] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1991'. [ 1145.783496][T12642] netlink: 28 bytes leftover after parsing attributes in process `syz.2.1991'. [ 1145.921439][T12642] ip6gretap0: entered promiscuous mode [ 1145.949256][T12642] syz_tun: entered promiscuous mode [ 1146.112811][T12644] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1990'. [ 1147.337483][ T6150] usb 3-1: new high-speed USB device number 41 using dummy_hcd [ 1147.728466][ T6150] usb 3-1: Using ep0 maxpacket: 8 [ 1147.755576][ T6150] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1147.803064][ T6150] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1147.803131][ T6150] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1147.803563][ T6150] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1148.147950][ T6150] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1148.147993][ T6150] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1148.148057][ T6150] usb 3-1: Product: syz [ 1148.148112][ T6150] usb 3-1: Manufacturer: syz [ 1148.148164][ T6150] usb 3-1: SerialNumber: syz [ 1149.611285][ T6150] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 1149.611347][ T6150] cdc_ncm 3-1:1.0: bind() failure [ 1149.707009][ T6150] usb 3-1: USB disconnect, device number 41 [ 1151.791748][T12681] netlink: 44 bytes leftover after parsing attributes in process `syz.2.1999'. [ 1151.872198][T12677] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1151.872375][T12678] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1999'. [ 1151.919220][T12677] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1999'. [ 1151.919288][T12677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1999'. [ 1151.923908][T12677] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1999'. [ 1151.923956][T12677] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1999'. [ 1152.613274][T12689] siw: device registration error -23 [ 1154.194286][T12700] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2005'. [ 1155.820875][T12706] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1156.813883][T12710] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1159.350622][T12748] syzkaller0: entered promiscuous mode [ 1159.350641][T12748] syzkaller0: entered allmulticast mode [ 1159.364649][T12748] tipc: Started in network mode [ 1159.364679][T12748] tipc: Node identity 8e378cd18a11, cluster identity 4711 [ 1159.364863][T12748] tipc: Enabled bearer , priority 0 [ 1159.560047][T12746] tipc: Resetting bearer [ 1160.873693][T12753] siw: device registration error -23 [ 1161.000188][T12746] tipc: Disabling bearer [ 1161.255942][ T6150] tipc: Node number set to 69635281 [ 1163.009462][T12774] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1163.010981][T12774] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2027'. [ 1163.018043][T12774] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2027'. [ 1163.018067][T12774] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2027'. [ 1163.019280][T12774] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2027'. [ 1163.019301][T12774] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2027'. [ 1163.905582][T12786] siw: device registration error -23 [ 1165.369186][T12803] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2039'. [ 1165.369225][T12803] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2039'. [ 1165.989563][T12803] syz_tun: entered promiscuous mode [ 1166.327353][T12803] syz_tun: left promiscuous mode [ 1170.518599][ T6150] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1170.668511][ T6150] usb 6-1: Using ep0 maxpacket: 32 [ 1170.671855][ T6150] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1170.671889][ T6150] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1170.675721][ T6150] usb 6-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1170.675739][ T6150] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1170.675750][ T6150] usb 6-1: Product: syz [ 1170.675767][ T6150] usb 6-1: Manufacturer: syz [ 1170.675775][ T6150] usb 6-1: SerialNumber: syz [ 1170.685184][ T6150] usb 6-1: config 0 descriptor?? [ 1170.762492][ T6150] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input39 [ 1170.791200][ T6150] usbtouchscreen 6-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1170.950987][T12827] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2047'. [ 1171.003488][ T6150] usbtouchscreen 6-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1171.041471][ T6150] usb 6-1: USB disconnect, device number 24 [ 1171.066456][T12826] syz.2.2046 (12826): drop_caches: 2 [ 1174.035334][T12878] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2058'. [ 1177.409237][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.409359][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.284783][T12916] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2069'. [ 1179.618764][T12929] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2071'. [ 1183.754163][T12965] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1185.013300][ T37] audit: type=1326 audit(1774423294.009:275): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1185.013360][ T37] audit: type=1326 audit(1774423294.009:276): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1185.013399][ T37] audit: type=1326 audit(1774423294.009:277): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1185.013443][ T37] audit: type=1326 audit(1774423294.009:278): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1185.013483][ T37] audit: type=1326 audit(1774423294.009:279): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1185.122365][T12971] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2084'. [ 1186.042037][ T37] audit: type=1326 audit(1774423295.019:280): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1186.042097][ T37] audit: type=1326 audit(1774423295.019:281): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1186.042153][ T37] audit: type=1326 audit(1774423295.019:282): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1186.042194][ T37] audit: type=1326 audit(1774423295.019:283): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1186.042238][ T37] audit: type=1326 audit(1774423295.019:284): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=12966 comm="syz.4.2083" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fe90792c799 code=0x7ffc0000 [ 1186.475322][T12975] netlink: 'syz.4.2083': attribute type 4 has an invalid length. [ 1186.598168][T12978] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2086'. [ 1186.617346][T12978] virtio-fs: tag <./cgroup> not found [ 1187.994473][T12982] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1191.667197][T13010] fuse: Bad value for 'fd' [ 1193.456600][T13026] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1193.894077][ T37] kauditd_printk_skb: 10 callbacks suppressed [ 1193.894091][ T37] audit: type=1326 audit(1774423302.889:295): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894131][ T37] audit: type=1326 audit(1774423302.889:296): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894156][ T37] audit: type=1326 audit(1774423302.889:297): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894179][ T37] audit: type=1326 audit(1774423302.889:298): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894204][ T37] audit: type=1326 audit(1774423302.889:299): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894228][ T37] audit: type=1326 audit(1774423302.889:300): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894252][ T37] audit: type=1326 audit(1774423302.889:301): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894275][ T37] audit: type=1326 audit(1774423302.889:302): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.894299][ T37] audit: type=1326 audit(1774423302.889:303): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1193.898446][ T37] audit: type=1326 audit(1774423302.889:304): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13027 comm="syz.1.2100" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f87eaaac799 code=0x7ffc0000 [ 1194.041287][T13029] netlink: 'syz.1.2100': attribute type 4 has an invalid length. [ 1199.378575][ T6150] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 1199.548822][ T6150] usb 6-1: Using ep0 maxpacket: 32 [ 1199.564993][ T6150] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1199.565029][ T6150] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1199.618828][ T6150] usb 6-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1199.618860][ T6150] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1199.618880][ T6150] usb 6-1: Product: syz [ 1199.618894][ T6150] usb 6-1: Manufacturer: syz [ 1199.618908][ T6150] usb 6-1: SerialNumber: syz [ 1199.669430][ T6150] usb 6-1: config 0 descriptor?? [ 1199.704713][ T6150] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input40 [ 1199.738999][ T6150] usbtouchscreen 6-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1200.197890][ T6150] usbtouchscreen 6-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1200.322508][T13062] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2107'. [ 1200.324541][ T6150] usb 6-1: USB disconnect, device number 25 [ 1200.797716][T13076] binder: 13070:13076 ioctl c0306201 0 returned -14 [ 1201.587251][T13077] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2110'. [ 1201.614279][T13077] virtio-fs: tag <./cgroup> not found [ 1202.079210][ T37] kauditd_printk_skb: 12 callbacks suppressed [ 1202.079229][ T37] audit: type=1326 audit(1774423311.079:317): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.079278][ T37] audit: type=1326 audit(1774423311.079:318): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.079775][ T37] audit: type=1326 audit(1774423311.079:319): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.079823][ T37] audit: type=1326 audit(1774423311.079:320): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.086817][ T37] audit: type=1326 audit(1774423311.079:321): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.086866][ T37] audit: type=1326 audit(1774423311.079:322): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.086909][ T37] audit: type=1326 audit(1774423311.079:323): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.086954][ T37] audit: type=1326 audit(1774423311.079:324): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.086997][ T37] audit: type=1326 audit(1774423311.079:325): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.087043][ T37] audit: type=1326 audit(1774423311.079:326): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13079 comm="syz.6.2112" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1202.138920][T13085] netlink: 'syz.6.2112': attribute type 4 has an invalid length. [ 1203.166489][T13100] ieee802154 phy0 wpan0: encryption failed: -22 [ 1206.938573][ T36] usb 3-1: new full-speed USB device number 42 using dummy_hcd [ 1207.166401][T13129] binder: 13116:13129 ioctl c0306201 0 returned -14 [ 1208.483609][T13120] kvm: MWAIT instruction emulated as NOP! [ 1208.519365][ T36] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1208.523309][ T36] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1208.523349][ T36] usb 3-1: can't read configurations, error -71 [ 1210.530796][ T37] kauditd_printk_skb: 11 callbacks suppressed [ 1210.530815][ T37] audit: type=1326 audit(1774423319.519:338): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.530865][ T37] audit: type=1326 audit(1774423319.519:339): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.530910][ T37] audit: type=1326 audit(1774423319.519:340): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.530953][ T37] audit: type=1326 audit(1774423319.519:341): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.531024][ T37] audit: type=1326 audit(1774423319.519:342): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.531070][ T37] audit: type=1326 audit(1774423319.519:343): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.531114][ T37] audit: type=1326 audit(1774423319.529:344): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.531157][ T37] audit: type=1326 audit(1774423319.529:345): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.531202][ T37] audit: type=1326 audit(1774423319.529:346): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.531245][ T37] audit: type=1326 audit(1774423319.529:347): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=13140 comm="syz.6.2126" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1210.600018][T13145] netlink: 'syz.6.2126': attribute type 4 has an invalid length. [ 1211.689521][T13156] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2129'. [ 1211.724158][T13156] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1211.855321][T13156] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1216.445198][T13193] binder: 13176:13193 ioctl c0306201 0 returned -14 [ 1216.582811][T13197] fuse: Unknown parameter '00000000000000000000' [ 1217.078644][ T808] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1217.248565][ T808] usb 6-1: Using ep0 maxpacket: 8 [ 1217.259012][ T808] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1217.264574][ T808] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1217.264598][ T808] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1217.264644][ T808] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1217.269617][ T808] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1217.269643][ T808] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1217.269662][ T808] usb 6-1: Product: syz [ 1217.269687][ T808] usb 6-1: Manufacturer: syz [ 1217.269700][ T808] usb 6-1: SerialNumber: syz [ 1218.095976][T13192] syz.1.2138 (13192): drop_caches: 2 [ 1218.256906][ T808] cdc_ncm 6-1:1.0: CDC Union missing and no IAD found [ 1218.256977][ T808] cdc_ncm 6-1:1.0: bind() failure [ 1218.368693][ T808] usb 6-1: USB disconnect, device number 26 [ 1218.648533][T10986] usb 2-1: new high-speed USB device number 53 using dummy_hcd [ 1218.818471][T10986] usb 2-1: Using ep0 maxpacket: 32 [ 1218.822753][T10986] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1218.822775][T10986] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1218.824726][T10986] usb 2-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1218.824743][T10986] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1218.824754][T10986] usb 2-1: Product: syz [ 1218.824763][T10986] usb 2-1: Manufacturer: syz [ 1218.824771][T10986] usb 2-1: SerialNumber: syz [ 1218.839756][T10986] usb 2-1: config 0 descriptor?? [ 1218.844831][T10986] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input41 [ 1218.932609][T10986] usbtouchscreen 2-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1219.094746][T10986] usbtouchscreen 2-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1220.469938][T13210] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2144'. [ 1220.472059][ T5934] usb 2-1: USB disconnect, device number 53 [ 1222.028675][T13238] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2150'. [ 1222.044309][T13238] virtio-fs: tag <./cgroup> not found [ 1223.517251][T13255] ieee802154 phy0 wpan0: encryption failed: -22 [ 1225.708919][ T808] usb 3-1: new high-speed USB device number 44 using dummy_hcd [ 1226.698530][ T808] usb 3-1: Using ep0 maxpacket: 16 [ 1226.700801][ T808] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1226.700817][ T808] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1226.703549][ T808] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1226.703567][ T808] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1226.703578][ T808] usb 3-1: Product: syz [ 1226.703586][ T808] usb 3-1: Manufacturer: syz [ 1226.703594][ T808] usb 3-1: SerialNumber: syz [ 1227.090646][ T808] usb 3-1: 0:2 : does not exist [ 1227.233477][T13276] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2161'. [ 1228.251648][ T808] usb 3-1: USB disconnect, device number 44 [ 1228.755520][T13211] udevd[13211]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1228.827171][T13282] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1231.258564][ T6150] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1231.763765][T13310] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2172'. [ 1232.199467][T13309] pimreg: entered allmulticast mode [ 1232.454201][ T6150] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1232.454225][ T6150] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1232.454253][ T6150] usb 5-1: New USB device found, idVendor=046d, idProduct=c539, bcdDevice= 0.00 [ 1232.454267][ T6150] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1232.799497][ T6150] usb 5-1: config 0 descriptor?? [ 1233.310441][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310481][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310509][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310536][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310563][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310589][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310615][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310641][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310667][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.310693][ T6150] logitech-djreceiver 0003:046D:C539.000F: unknown main item tag 0x0 [ 1233.388503][ T36] usb 2-1: new high-speed USB device number 54 using dummy_hcd [ 1233.610681][ T808] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 1233.722258][ T36] usb 2-1: Using ep0 maxpacket: 16 [ 1234.413387][ T36] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1234.413416][ T36] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1234.416597][ T36] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1234.416626][ T36] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1234.416647][ T36] usb 2-1: Product: syz [ 1234.416662][ T36] usb 2-1: Manufacturer: syz [ 1234.416676][ T36] usb 2-1: SerialNumber: syz [ 1234.508004][ T808] usb 7-1: Using ep0 maxpacket: 32 [ 1234.510671][ T808] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1234.510691][ T808] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1234.513151][ T808] usb 7-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1234.513168][ T808] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1234.513180][ T808] usb 7-1: Product: syz [ 1234.513188][ T808] usb 7-1: Manufacturer: syz [ 1234.513196][ T808] usb 7-1: SerialNumber: syz [ 1234.767239][ T808] usb 7-1: config 0 descriptor?? [ 1234.778573][ T5934] usb 5-1: USB disconnect, device number 66 [ 1234.829709][ T36] usb 2-1: 0:2 : does not exist [ 1234.912288][ T808] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input42 [ 1234.957555][ T808] usbtouchscreen 7-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1234.978166][ T36] usb 2-1: USB disconnect, device number 54 [ 1235.437310][ T808] usbtouchscreen 7-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1235.523814][T13329] udevd[13329]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1235.584634][T13319] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2175'. [ 1235.592510][ T5934] usb 7-1: USB disconnect, device number 14 [ 1235.876338][T13342] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2180'. [ 1235.876379][T13342] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2180'. [ 1235.975342][T13343] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1238.838473][T13353] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2184'. [ 1238.891132][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.891209][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1239.875432][ T808] IPVS: starting estimator thread 0... [ 1240.141631][T13364] IPVS: using max 7 ests per chain, 16800 per kthread [ 1244.362746][T13388] syzkaller1: entered promiscuous mode [ 1244.362786][T13388] syzkaller1: entered allmulticast mode [ 1245.327728][T13391] ceph: No mds server is up or the cluster is laggy [ 1246.510861][ T5926] IPVS: starting estimator thread 0... [ 1246.803780][T13415] IPVS: using max 13 ests per chain, 31200 per kthread [ 1246.809027][ T808] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1246.810034][ C1] raw-gadget.0 gadget.6: ignoring, device is not running [ 1247.898505][ T808] usb 7-1: device descriptor read/64, error -32 [ 1248.249694][ T808] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1249.278433][ T808] usb 7-1: Using ep0 maxpacket: 8 [ 1249.454436][ T808] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1250.722976][ T808] usb 7-1: unable to read config index 0 descriptor/all [ 1250.723032][ T808] usb 7-1: can't read configurations, error -71 [ 1250.723504][ T808] usb usb7-port1: attempt power cycle [ 1251.240845][T13437] pimreg: entered allmulticast mode [ 1253.738490][T10986] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1254.127801][T10986] usb 6-1: Using ep0 maxpacket: 8 [ 1254.142646][T10986] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1254.142665][T10986] usb 6-1: config 0 has no interfaces? [ 1254.144358][T10986] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1254.144374][T10986] usb 6-1: config 0 has no interfaces? [ 1254.148210][T10986] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1254.148234][T10986] usb 6-1: config 0 has no interfaces? [ 1254.545557][T10986] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1254.545577][T10986] usb 6-1: config 0 has no interfaces? [ 1254.545598][T10986] usb 6-1: New USB device found, idVendor=046d, idProduct=08b3, bcdDevice=6d.2a [ 1254.545616][T10986] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1254.557238][T10986] usb 6-1: config 0 descriptor?? [ 1254.875213][T13450] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2208'. [ 1255.668526][ T6150] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 1255.705056][T13474] netlink: 1688 bytes leftover after parsing attributes in process `syz.2.2216'. [ 1256.327613][ T6150] usb 7-1: Using ep0 maxpacket: 16 [ 1256.512212][ T6150] usb 7-1: too many configurations: 14, using maximum allowed: 8 [ 1257.040042][ T6150] usb 7-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice= 6.ad [ 1257.040077][ T6150] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1257.040097][ T6150] usb 7-1: Product: syz [ 1257.040112][ T6150] usb 7-1: Manufacturer: syz [ 1257.040126][ T6150] usb 7-1: SerialNumber: syz [ 1257.087527][ T6150] usb 7-1: config 0 descriptor?? [ 1257.385943][ T6150] usb 6-1: USB disconnect, device number 27 [ 1257.394686][T13483] virtio-fs: tag <./cgroup> not found [ 1258.424750][ T36] usb 7-1: USB disconnect, device number 18 [ 1258.829587][T13491] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1259.079433][T13500] syzkaller1: entered promiscuous mode [ 1259.079496][T13500] syzkaller1: entered allmulticast mode [ 1259.437304][T13502] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.2222'. [ 1260.951283][T13515] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2226'. [ 1260.951310][T13515] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2226'. [ 1260.957694][T13515] syz_tun: entered promiscuous mode [ 1261.011178][T13515] syz_tun: left promiscuous mode [ 1262.008478][ T36] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 1262.160288][ T36] usb 7-1: Using ep0 maxpacket: 32 [ 1262.164040][ T36] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1262.164074][ T36] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1262.166686][ T36] usb 7-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1262.166707][ T36] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1262.166717][ T36] usb 7-1: Product: syz [ 1262.166726][ T36] usb 7-1: Manufacturer: syz [ 1262.166734][ T36] usb 7-1: SerialNumber: syz [ 1262.193001][ T36] usb 7-1: config 0 descriptor?? [ 1262.206218][ T36] input: syz syz as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/input/input43 [ 1262.470283][ T36] usbtouchscreen 7-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1262.624818][T13529] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1263.548140][T13527] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2228'. [ 1263.988621][ T36] usbtouchscreen 7-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1264.023194][ T36] usb 7-1: USB disconnect, device number 19 [ 1264.217317][ T5926] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1265.488613][ T5926] usb 6-1: Using ep0 maxpacket: 8 [ 1266.179542][T13550] netlink: 36 bytes leftover after parsing attributes in process `syz.2.2235'. [ 1266.228508][ T36] usb 2-1: new full-speed USB device number 55 using dummy_hcd [ 1266.392536][ T36] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1266.394632][ T36] usb 2-1: unable to read config index 0 descriptor/start: -71 [ 1266.394670][ T36] usb 2-1: can't read configurations, error -71 [ 1267.111250][T13557] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2238'. [ 1267.111524][T13557] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2238'. [ 1267.155719][T13557] ip6gretap0: entered promiscuous mode [ 1267.184499][T13557] syz_tun: entered promiscuous mode [ 1267.188288][T13557] debugfs: 'hsr1' already exists in 'hsr' [ 1267.206826][T13557] Cannot create hsr debugfs directory [ 1267.207473][T13557] hsr1: Slave A (ip6gretap0) is not up; please bring it up to get a fully working HSR network [ 1267.207488][T13557] hsr1: Slave B (syz_tun) is not up; please bring it up to get a fully working HSR network [ 1268.143014][T13566] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1268.698013][T13572] ieee802154 phy0 wpan0: encryption failed: -22 [ 1269.912527][T13576] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1270.648574][ T5926] usb 6-1: device descriptor read/all, error -110 [ 1270.830869][ T5926] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1270.958511][ T5926] usb 6-1: device descriptor read/64, error -32 [ 1271.162256][ T5926] usb usb6-port1: attempt power cycle [ 1271.988450][ T6150] usb 2-1: new high-speed USB device number 57 using dummy_hcd [ 1272.305652][T13596] netlink: 36 bytes leftover after parsing attributes in process `syz.6.2247'. [ 1272.322151][ T6150] usb 2-1: Using ep0 maxpacket: 32 [ 1272.343173][ T6150] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1272.351536][ T6150] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1272.378118][ T6150] usb 2-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1272.378152][ T6150] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1272.378172][ T6150] usb 2-1: Product: syz [ 1272.378186][ T6150] usb 2-1: Manufacturer: syz [ 1272.378201][ T6150] usb 2-1: SerialNumber: syz [ 1272.390579][ T6150] usb 2-1: config 0 descriptor?? [ 1272.420796][ T6150] input: syz syz as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input44 [ 1272.434780][ T6150] usbtouchscreen 2-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1272.733990][ T6150] usbtouchscreen 2-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1272.739216][T13590] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2246'. [ 1273.915644][ T6150] usb 2-1: USB disconnect, device number 57 [ 1275.436116][T13613] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2251'. [ 1275.436143][T13613] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2251'. [ 1275.444198][T13613] syz_tun: entered promiscuous mode [ 1275.488562][T13613] syz_tun: left promiscuous mode [ 1277.075115][T13621] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2253'. [ 1277.075248][T13621] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1279.009227][T13621] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1280.208687][T13643] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2260'. [ 1281.462992][ T5934] usb 2-1: new high-speed USB device number 58 using dummy_hcd [ 1281.728545][ T5934] usb 2-1: Using ep0 maxpacket: 16 [ 1281.735175][ T5934] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1281.735202][ T5934] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1281.735221][ T5934] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1281.738552][ T5934] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1281.738579][ T5934] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1281.738597][ T5934] usb 2-1: Product: syz [ 1281.738611][ T5934] usb 2-1: Manufacturer: syz [ 1281.738623][ T5934] usb 2-1: SerialNumber: syz [ 1281.968737][ T5934] usb 2-1: 0:2 : does not exist [ 1281.968834][ T5934] usb 2-1: unit 6 not found! [ 1282.114565][ T5934] usb 2-1: USB disconnect, device number 58 [ 1282.128566][ T6150] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1282.208477][ T9602] usb 3-1: new high-speed USB device number 45 using dummy_hcd [ 1282.378483][ T9602] usb 3-1: Using ep0 maxpacket: 32 [ 1282.380225][ T9602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1282.380246][ T9602] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1282.382108][ T9602] usb 3-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1282.382125][ T9602] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1282.382137][ T9602] usb 3-1: Product: syz [ 1282.382145][ T9602] usb 3-1: Manufacturer: syz [ 1282.382153][ T9602] usb 3-1: SerialNumber: syz [ 1282.385365][ T9602] usb 3-1: config 0 descriptor?? [ 1282.408467][ T6150] usb 5-1: Using ep0 maxpacket: 8 [ 1283.214320][ T6150] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1283.226418][ T6150] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1283.226447][ T6150] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1283.226509][ T6150] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1283.267897][T13658] udevd[13658]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1283.272571][ T9602] input: syz syz as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input45 [ 1283.303167][ T9602] usbtouchscreen 3-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1283.325551][ T6150] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1283.325572][ T6150] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1283.325585][ T6150] usb 5-1: Product: syz [ 1283.325593][ T6150] usb 5-1: Manufacturer: syz [ 1283.325601][ T6150] usb 5-1: SerialNumber: syz [ 1283.427620][T13655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2262'. [ 1283.462183][ T9602] usbtouchscreen 3-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1283.495255][ T9602] usb 3-1: USB disconnect, device number 45 [ 1284.154030][ T6150] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 1284.154084][ T6150] cdc_ncm 5-1:1.0: bind() failure [ 1284.953588][ T6150] usb 5-1: USB disconnect, device number 67 [ 1287.095500][T13688] ieee802154 phy0 wpan0: encryption failed: -22 [ 1291.088511][ T5926] usb 2-1: new high-speed USB device number 59 using dummy_hcd [ 1291.241102][T13710] siw: device registration error -23 [ 1291.488411][ T5926] usb 2-1: Using ep0 maxpacket: 16 [ 1291.492503][ T5926] usb 2-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 1291.492527][ T5926] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1291.492544][ T5926] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1291.495267][ T5926] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1291.495292][ T5926] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.495311][ T5926] usb 2-1: Product: syz [ 1291.495323][ T5926] usb 2-1: Manufacturer: syz [ 1291.495336][ T5926] usb 2-1: SerialNumber: syz [ 1291.727500][ T5926] usb 2-1: 0:2 : does not exist [ 1291.727601][ T5926] usb 2-1: unit 6 not found! [ 1291.977995][ T5926] usb 2-1: USB disconnect, device number 59 [ 1292.126936][T13658] udevd[13658]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1292.538507][ T6150] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1292.609751][ T808] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 1293.631994][ T808] usb 6-1: Using ep0 maxpacket: 32 [ 1293.632170][ T6150] usb 5-1: Using ep0 maxpacket: 8 [ 1293.655193][ T808] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1293.655227][ T808] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1293.683263][ T6150] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1293.693366][ T6150] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1293.693394][ T6150] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1293.693555][ T6150] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1293.693861][ T808] usb 6-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1293.693886][ T808] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1293.693904][ T808] usb 6-1: Product: syz [ 1293.693913][ T808] usb 6-1: Manufacturer: syz [ 1293.693921][ T808] usb 6-1: SerialNumber: syz [ 1293.787715][ T808] usb 6-1: config 0 descriptor?? [ 1293.794376][ T6150] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1293.794395][ T6150] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1293.794410][ T6150] usb 5-1: Product: syz [ 1293.794418][ T6150] usb 5-1: Manufacturer: syz [ 1293.794426][ T6150] usb 5-1: SerialNumber: syz [ 1293.865095][ T808] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input46 [ 1293.894209][ T808] usbtouchscreen 6-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1295.155020][T13734] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2278'. [ 1295.198496][ T808] usbtouchscreen 6-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1295.317417][ T6150] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 1295.317489][ T6150] cdc_ncm 5-1:1.0: bind() failure [ 1295.379882][ T808] usb 6-1: USB disconnect, device number 31 [ 1295.451355][ T6150] usb 5-1: USB disconnect, device number 68 [ 1299.308739][T13763] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1300.513081][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.513163][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.700346][T13767] fuse: Unknown parameter '0x0000000000000003' [ 1304.785139][T13785] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 1309.640252][T13807] workqueue: Failed to create a rescuer kthread for wq "ceph-completion": -EINTR [ 1313.032047][ T60] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1313.165677][ T60] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1313.382683][T13834] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1313.385153][T13834] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1313.416342][T13834] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1313.416758][T13834] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1313.465284][T13834] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1314.020601][T13840] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1314.067767][T13842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1314.076337][T13842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1314.077063][T13834] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1314.088830][T13842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1314.089554][T13842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1314.134251][T13842] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1314.158541][T13842] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1314.945250][T13833] lo speed is unknown, defaulting to 1000 [ 1315.923504][T13854] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1315.923718][T13854] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1316.144840][T13836] lo speed is unknown, defaulting to 1000 [ 1316.196599][T13854] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1316.272211][T13854] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1316.272471][T13854] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1316.385111][T13850] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1316.385510][T13850] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 1316.387833][T13854] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1316.489663][T13850] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1316.489682][T13850] Bluetooth: hci6: Error when powering off device on rfkill (-4) [ 1316.829011][ T5846] syz_tun (unregistering): left promiscuous mode [ 1317.206510][ T9602] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1318.058784][ T9602] usb 7-1: Using ep0 maxpacket: 8 [ 1318.063899][ T9602] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1318.082214][ T9602] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1318.082251][ T9602] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1318.082304][ T9602] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1318.100588][ T9602] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1318.100617][ T9602] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1318.100636][ T9602] usb 7-1: Product: syz [ 1318.100649][ T9602] usb 7-1: Manufacturer: syz [ 1318.100662][ T9602] usb 7-1: SerialNumber: syz [ 1318.370672][T13836] chnl_net:caif_netlink_parms(): no params data found [ 1318.406530][T13833] chnl_net:caif_netlink_parms(): no params data found [ 1318.527384][ T9602] cdc_ncm 7-1:1.0: CDC Union missing and no IAD found [ 1318.527439][ T9602] cdc_ncm 7-1:1.0: bind() failure [ 1318.582118][ T9602] usb 7-1: USB disconnect, device number 20 [ 1318.948433][ T31] usb 6-1: new full-speed USB device number 32 using dummy_hcd [ 1319.203363][ T31] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1319.208062][ T31] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 1319.208106][ T31] usb 6-1: can't read configurations, error -71 [ 1319.350010][T13836] bridge0: port 1(bridge_slave_0) entered blocking state [ 1319.350178][T13836] bridge0: port 1(bridge_slave_0) entered disabled state [ 1319.350313][T13836] bridge_slave_0: entered allmulticast mode [ 1319.351941][T13836] bridge_slave_0: entered promiscuous mode [ 1319.448805][T13836] bridge0: port 2(bridge_slave_1) entered blocking state [ 1319.448955][T13836] bridge0: port 2(bridge_slave_1) entered disabled state [ 1319.449280][T13836] bridge_slave_1: entered allmulticast mode [ 1319.450943][T13836] bridge_slave_1: entered promiscuous mode [ 1319.452289][T13833] bridge0: port 1(bridge_slave_0) entered blocking state [ 1319.452428][T13833] bridge0: port 1(bridge_slave_0) entered disabled state [ 1319.452632][T13833] bridge_slave_0: entered allmulticast mode [ 1319.456836][T13833] bridge_slave_0: entered promiscuous mode [ 1319.555739][T13833] bridge0: port 2(bridge_slave_1) entered blocking state [ 1319.555994][T13833] bridge0: port 2(bridge_slave_1) entered disabled state [ 1319.556225][T13833] bridge_slave_1: entered allmulticast mode [ 1319.598549][T13833] bridge_slave_1: entered promiscuous mode [ 1319.610084][T13836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1319.683385][T13836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1319.761708][T13833] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1319.973464][T13833] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1319.977843][T13836] team0: Port device team_slave_0 added [ 1320.004994][T13836] team0: Port device team_slave_1 added [ 1321.239228][T13906] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2321'. [ 1322.837660][T13833] team0: Port device team_slave_0 added [ 1322.860421][T13836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1322.860437][T13836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1322.860452][T13836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1322.864091][T13833] team0: Port device team_slave_1 added [ 1322.864614][T13836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1322.864623][T13836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1322.864638][T13836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1323.171233][T13833] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1323.171246][T13833] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1323.171262][T13833] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1324.267370][T13833] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1324.267389][T13833] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1324.267419][T13833] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1324.490202][T13836] hsr_slave_0: entered promiscuous mode [ 1324.491226][T13836] hsr_slave_1: entered promiscuous mode [ 1324.493955][T13836] debugfs: 'hsr0' already exists in 'hsr' [ 1324.493973][T13836] Cannot create hsr debugfs directory [ 1324.712445][T13833] hsr_slave_0: entered promiscuous mode [ 1324.714110][T13833] hsr_slave_1: entered promiscuous mode [ 1324.715217][T13833] debugfs: 'hsr0' already exists in 'hsr' [ 1324.715244][T13833] Cannot create hsr debugfs directory [ 1325.068470][ T36] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 1325.230711][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1325.237643][ T36] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 1325.237684][ T36] usb 6-1: can't read configurations, error -71 [ 1326.555325][T13953] kernel profiling enabled (shift: 63) [ 1326.555480][T13953] profiling shift: 63 too large [ 1327.029116][T13836] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1328.070361][T13836] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1328.134577][T13836] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1328.366068][T13836] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1328.764455][T13966] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2335'. [ 1329.638426][ T36] usb 3-1: new high-speed USB device number 46 using dummy_hcd [ 1329.808473][ T36] usb 3-1: Using ep0 maxpacket: 16 [ 1329.816078][ T36] usb 3-1: config 0 has no interfaces? [ 1329.835050][ T36] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1329.835082][ T36] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1329.835104][ T36] usb 3-1: Manufacturer: syz [ 1329.871850][T13959] lo speed is unknown, defaulting to 1000 [ 1329.877319][ T36] usb 3-1: config 0 descriptor?? [ 1330.096221][T13833] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1330.158493][ T36] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1330.162206][T13833] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1330.250029][T13833] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1330.301784][T13833] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1330.309021][ T36] usb 6-1: Using ep0 maxpacket: 8 [ 1330.311424][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1330.312727][ T36] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1330.312749][ T36] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1330.312794][ T36] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1330.346437][ T36] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1330.346560][ T36] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1330.346580][ T36] usb 6-1: Product: syz [ 1330.346593][ T36] usb 6-1: Manufacturer: syz [ 1330.346605][ T36] usb 6-1: SerialNumber: syz [ 1331.042604][T13836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1331.136294][T13836] 8021q: adding VLAN 0 to HW filter on device team0 [ 1331.196518][ T6841] bridge0: port 1(bridge_slave_0) entered blocking state [ 1331.197000][ T6841] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1331.247551][T13833] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1331.290950][T12879] bridge0: port 2(bridge_slave_1) entered blocking state [ 1331.291108][T12879] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1332.544168][T13833] 8021q: adding VLAN 0 to HW filter on device team0 [ 1332.695932][T12879] bridge0: port 1(bridge_slave_0) entered blocking state [ 1332.956547][T12879] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1333.011703][ T9602] usb 3-1: USB disconnect, device number 46 [ 1333.093232][ T36] cdc_ncm 6-1:1.0: CDC Union missing and no IAD found [ 1333.093286][ T36] cdc_ncm 6-1:1.0: bind() failure [ 1333.178579][ T36] usb 6-1: USB disconnect, device number 36 [ 1333.298422][ T6779] bridge0: port 2(bridge_slave_1) entered blocking state [ 1333.300148][ T6779] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1333.848764][ T36] usb 6-1: new full-speed USB device number 37 using dummy_hcd [ 1334.217006][T14019] Option ' ' to dns_resolver key: bad/missing value [ 1334.924174][ T36] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1334.926156][ T36] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 1334.926198][ T36] usb 6-1: can't read configurations, error -71 [ 1335.358170][T13836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1335.380412][T13833] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1341.173141][T14058] lo speed is unknown, defaulting to 1000 [ 1341.229248][ T36] usb 7-1: new high-speed USB device number 21 using dummy_hcd [ 1341.418481][ T36] usb 7-1: Using ep0 maxpacket: 16 [ 1341.425229][ T36] usb 7-1: config 0 has no interfaces? [ 1341.426785][ T36] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1341.426813][ T36] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1341.426834][ T36] usb 7-1: Manufacturer: syz [ 1341.432926][ T36] usb 7-1: config 0 descriptor?? [ 1341.678177][T13836] veth0_vlan: entered promiscuous mode [ 1341.910674][T14074] Option ' ' to dns_resolver key: bad/missing value [ 1342.724723][T13836] veth1_vlan: entered promiscuous mode [ 1343.142305][T13836] veth0_macvtap: entered promiscuous mode [ 1343.147390][T13833] veth0_vlan: entered promiscuous mode [ 1343.185334][T13836] veth1_macvtap: entered promiscuous mode [ 1343.209841][T13833] veth1_vlan: entered promiscuous mode [ 1343.242197][T13836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1343.260075][T13836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1343.276155][ T6299] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.277282][ T6299] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.288356][ T6299] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.302623][ T6299] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1343.332268][T13833] veth0_macvtap: entered promiscuous mode [ 1343.454300][T13833] veth1_macvtap: entered promiscuous mode [ 1343.788578][T10986] usb 6-1: new full-speed USB device number 39 using dummy_hcd [ 1343.870950][ T5934] usb 7-1: USB disconnect, device number 21 [ 1343.955469][T10986] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1343.961445][T10986] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 1343.961483][T10986] usb 6-1: can't read configurations, error -71 [ 1344.016404][T13833] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1344.231488][T13833] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1344.237557][ T5878] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1344.237578][ T5878] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1344.351175][T12879] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.364108][T12879] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.406700][T12879] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1344.411231][T12879] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1345.145567][ T1126] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1345.145591][ T1126] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1346.050642][T14107] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1348.517848][T12880] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1348.517864][T12880] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1348.708195][ T1126] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1348.708211][ T1126] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1348.971548][T14126] lo speed is unknown, defaulting to 1000 [ 1349.423399][T14131] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1350.355356][T14087] usb 3-1: new high-speed USB device number 47 using dummy_hcd [ 1350.508401][T14087] usb 3-1: Using ep0 maxpacket: 16 [ 1350.524000][T14087] usb 3-1: config 0 has no interfaces? [ 1350.532896][T14087] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1350.532927][T14087] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1350.532949][T14087] usb 3-1: Manufacturer: syz [ 1350.544173][T14087] usb 3-1: config 0 descriptor?? [ 1350.888620][ T5959] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1351.068498][ T5959] usb 6-1: Using ep0 maxpacket: 16 [ 1351.105925][ T5959] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1351.105981][ T5959] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1351.109954][ T5959] usb 6-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1351.109982][ T5959] usb 6-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1351.110055][ T5959] usb 6-1: Manufacturer: syz [ 1351.626231][ T5959] usb 6-1: config 0 descriptor?? [ 1352.057150][ T5959] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1352.098518][ T31] usb 3-1: USB disconnect, device number 47 [ 1352.184511][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60000000000 [ 1352.184646][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60100000000 [ 1352.201942][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60200000000 [ 1352.202077][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60300000000 [ 1352.202183][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60400000000 [ 1352.202288][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60500000000 [ 1352.202392][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60600000000 [ 1352.202496][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60700000000 [ 1352.202600][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60800000000 [ 1352.202704][T14141] kvm: kvm [14140]: vcpu0, guest rIP: 0x11c Unhandled WRMSR(0xc2) = 0x60900000000 [ 1354.097443][T13997] usb 3-1: new high-speed USB device number 48 using dummy_hcd [ 1354.425040][T14176] Option ' ' to dns_resolver key: bad/missing value [ 1354.613155][T13997] usb 3-1: Using ep0 maxpacket: 8 [ 1354.958145][T13997] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1355.181511][T13997] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1355.181530][T13997] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1355.181560][T13997] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1355.188058][T13997] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1355.188078][T13997] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1355.188089][T13997] usb 3-1: Product: syz [ 1355.188098][T13997] usb 3-1: Manufacturer: syz [ 1355.188106][T13997] usb 3-1: SerialNumber: syz [ 1355.529981][T13997] cdc_ncm 3-1:1.0: CDC Union missing and no IAD found [ 1355.530035][T13997] cdc_ncm 3-1:1.0: bind() failure [ 1355.568736][T13997] usb 3-1: USB disconnect, device number 48 [ 1355.988736][T13997] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 1356.284215][T13997] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1356.296909][T13997] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 1356.296952][T13997] usb 9-1: can't read configurations, error -71 [ 1357.209359][ T36] usb 6-1: USB disconnect, device number 41 [ 1357.607289][T14200] lo speed is unknown, defaulting to 1000 [ 1357.798563][ T36] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1357.897218][ T31] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1357.990116][ T36] usb 6-1: Using ep0 maxpacket: 16 [ 1357.993149][ T36] usb 6-1: config 0 has no interfaces? [ 1357.994626][ T36] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1357.994642][ T36] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1357.994653][ T36] usb 6-1: Manufacturer: syz [ 1358.037290][ T36] usb 6-1: config 0 descriptor?? [ 1358.048667][ T31] usb 7-1: Using ep0 maxpacket: 8 [ 1358.051628][ T31] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1358.053182][ T31] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1358.053208][ T31] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1358.053262][ T31] usb 7-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1358.055978][ T31] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1358.056015][ T31] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1358.056035][ T31] usb 7-1: Product: syz [ 1358.056050][ T31] usb 7-1: Manufacturer: syz [ 1358.056064][ T31] usb 7-1: SerialNumber: syz [ 1358.658080][ T31] cdc_ncm 7-1:1.0: CDC Union missing and no IAD found [ 1358.658114][ T31] cdc_ncm 7-1:1.0: bind() failure [ 1358.706529][ T31] usb 7-1: USB disconnect, device number 22 [ 1360.373136][ T36] usb 6-1: USB disconnect, device number 42 [ 1361.543094][T14222] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2388'. [ 1361.602264][T14222] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1361.840941][T14228] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2389'. [ 1361.857153][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.857413][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.878206][T14228] virtio-fs: tag <./cgroup> not found [ 1361.947921][T14222] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1363.318488][ T31] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1363.468422][ T31] usb 9-1: Using ep0 maxpacket: 16 [ 1363.471216][ T31] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1363.471274][ T31] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1363.473653][ T31] usb 9-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1363.473682][ T31] usb 9-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1363.473703][ T31] usb 9-1: Manufacturer: syz [ 1363.482278][ T31] usb 9-1: config 0 descriptor?? [ 1363.572893][ T31] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 1363.832862][T14247] netlink: 'syz.2.2394': attribute type 6 has an invalid length. [ 1363.837799][T14247] QAT: failed to copy from user cfg_data. [ 1363.854629][T14247] IPv6: sit1: Disabled Multicast RS [ 1367.988438][ T9602] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 1368.138825][ T9602] usb 8-1: Using ep0 maxpacket: 8 [ 1368.390102][ T9602] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 1368.390141][ T9602] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1368.390155][ T9602] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1368.390169][ T9602] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1368.390182][ T9602] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1368.390208][ T9602] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1368.390221][ T9602] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1368.967590][T14284] Option ' ' to dns_resolver key: bad/missing value [ 1369.627461][ T9602] usb 8-1: GET_CAPABILITIES returned 0 [ 1369.627531][ T9602] usbtmc 8-1:16.0: can't read capabilities [ 1369.732718][T11372] usb 9-1: USB disconnect, device number 4 [ 1371.828403][ T9602] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1372.029184][ T9602] usb 9-1: Using ep0 maxpacket: 32 [ 1372.032080][ T9602] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1372.032115][ T9602] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1372.037332][ T9602] usb 9-1: New USB device found, idVendor=14c8, idProduct=0003, bcdDevice= 5.6c [ 1372.037359][ T9602] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1372.037381][ T9602] usb 9-1: Product: syz [ 1372.037396][ T9602] usb 9-1: Manufacturer: syz [ 1372.037411][ T9602] usb 9-1: SerialNumber: syz [ 1372.119378][ T9602] usb 9-1: config 0 descriptor?? [ 1372.154548][ T9602] input: syz syz as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input47 [ 1372.180502][ T9602] usbtouchscreen 9-1:0.0: usbtouch_probe - usb_submit_urb failed with result: -90 [ 1372.284635][ T9602] usbtouchscreen 9-1:0.0: probe with driver usbtouchscreen failed with error -90 [ 1372.454379][T14305] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2407'. [ 1372.481820][ T9602] usb 9-1: USB disconnect, device number 5 [ 1372.962491][ T9602] usb 8-1: USB disconnect, device number 2 [ 1373.663362][T14316] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1375.298490][ T9602] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 1375.336464][T14335] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2416'. [ 1375.365018][T14335] virtio-fs: tag <./cgroup> not found [ 1376.368392][ T9602] usb 7-1: Using ep0 maxpacket: 16 [ 1376.381663][ T9602] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1376.381720][ T9602] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1376.388958][ T9602] usb 7-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1376.388988][ T9602] usb 7-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1376.389006][ T9602] usb 7-1: Manufacturer: syz [ 1376.400201][ T9602] usb 7-1: config 0 descriptor?? [ 1376.407647][ T9602] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1378.081584][ T5959] usb 3-1: new high-speed USB device number 49 using dummy_hcd [ 1378.248378][ T5959] usb 3-1: Using ep0 maxpacket: 8 [ 1378.254261][ T5959] usb 3-1: config index 0 descriptor too short (expected 301, got 45) [ 1378.254325][ T5959] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1378.254347][ T5959] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1378.254372][ T5959] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1378.254395][ T5959] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1378.254439][ T5959] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1378.254462][ T5959] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1378.512587][ T5959] usb 3-1: GET_CAPABILITIES returned 0 [ 1378.512640][ T5959] usbtmc 3-1:16.0: can't read capabilities [ 1381.574723][T14377] kernel profiling enabled (shift: 63) [ 1381.574778][T14377] profiling shift: 63 too large [ 1382.989678][T11372] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1383.568534][T11372] usb 9-1: Using ep0 maxpacket: 16 [ 1383.569674][T11372] usb 9-1: too many configurations: 14, using maximum allowed: 8 [ 1383.620417][T11372] usb 9-1: New USB device found, idVendor=0e41, idProduct=5057, bcdDevice= 6.ad [ 1383.620441][T11372] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1383.620453][T11372] usb 9-1: Product: syz [ 1383.620461][T11372] usb 9-1: Manufacturer: syz [ 1383.620469][T11372] usb 9-1: SerialNumber: syz [ 1383.840913][T11372] usb 9-1: config 0 descriptor?? [ 1384.651501][T11372] usb 7-1: USB disconnect, device number 23 [ 1384.716725][ T36] usb 3-1: USB disconnect, device number 49 [ 1385.201616][T14399] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.2432'. [ 1385.655908][ T31] usb 9-1: USB disconnect, device number 6 [ 1386.652009][T14413] kernel profiling enabled (shift: 63) [ 1386.652029][T14413] profiling shift: 63 too large [ 1388.728450][ T5959] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 1388.902858][ T5959] usb 7-1: Using ep0 maxpacket: 16 [ 1388.905584][ T5959] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1388.905641][ T5959] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1388.907226][ T5959] usb 7-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1388.907254][ T5959] usb 7-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1388.907275][ T5959] usb 7-1: Manufacturer: syz [ 1389.011218][ T5959] usb 7-1: config 0 descriptor?? [ 1389.051191][ T5959] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1389.288525][ T5959] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 1389.448496][ T5959] usb 6-1: Using ep0 maxpacket: 8 [ 1389.456736][ T5959] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 1389.456803][ T5959] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1389.456828][ T5959] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1389.456863][ T5959] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1389.456887][ T5959] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1389.456935][ T5959] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1389.456959][ T5959] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1390.497463][ T5959] usb 6-1: GET_CAPABILITIES returned 0 [ 1390.497521][ T5959] usbtmc 6-1:16.0: can't read capabilities [ 1392.942849][T11372] usb 6-1: USB disconnect, device number 43 [ 1393.008742][ T9602] usb 8-1: new full-speed USB device number 3 using dummy_hcd [ 1393.248420][ T31] usb 9-1: new full-speed USB device number 7 using dummy_hcd [ 1393.430924][T14471] kernel profiling enabled (shift: 63) [ 1393.430944][T14471] profiling shift: 63 too large [ 1394.237336][ T9602] usb 8-1: unable to get BOS descriptor or descriptor too short [ 1394.293023][ T9602] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 1394.293070][ T9602] usb 8-1: can't read configurations, error -71 [ 1394.370803][ T31] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1394.372820][ T31] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 1394.372859][ T31] usb 9-1: can't read configurations, error -71 [ 1394.686604][T10986] usb 7-1: USB disconnect, device number 24 [ 1396.237733][T14490] binder: 14485:14490 ioctl c0306201 0 returned -14 [ 1398.408422][ T36] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 1398.526023][T14512] kernel profiling enabled (shift: 63) [ 1398.526042][T14512] profiling shift: 63 too large [ 1399.428420][ T36] usb 7-1: Using ep0 maxpacket: 8 [ 1399.432906][ T36] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 1399.432971][ T36] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1399.432994][ T36] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1399.433020][ T36] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1399.433044][ T36] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1399.433090][ T36] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1399.433113][ T36] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1399.658384][T10986] usb 3-1: new high-speed USB device number 50 using dummy_hcd [ 1399.795444][ T36] usb 7-1: GET_CAPABILITIES returned 0 [ 1399.795498][ T36] usbtmc 7-1:16.0: can't read capabilities [ 1399.818634][T10986] usb 3-1: Using ep0 maxpacket: 16 [ 1399.822742][T10986] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1399.822798][T10986] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1399.824183][T10986] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1399.824201][T10986] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1399.824212][T10986] usb 3-1: Manufacturer: syz [ 1399.827549][T10986] usb 3-1: config 0 descriptor?? [ 1399.837646][T10986] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1400.459018][ T9602] usb 9-1: new full-speed USB device number 9 using dummy_hcd [ 1400.711330][ T9602] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1400.714300][ T9602] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 1400.714340][ T9602] usb 9-1: can't read configurations, error -71 [ 1404.228529][ T9602] usb 7-1: USB disconnect, device number 25 [ 1406.283094][T13997] usb 3-1: USB disconnect, device number 50 [ 1408.368389][ T5934] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 1408.547399][ T5934] usb 6-1: Using ep0 maxpacket: 8 [ 1408.558405][ T5934] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1408.560047][ T5934] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1408.560071][ T5934] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1408.560124][ T5934] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1408.564880][ T5934] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1408.564911][ T5934] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1408.564931][ T5934] usb 6-1: Product: syz [ 1408.564946][ T5934] usb 6-1: Manufacturer: syz [ 1408.564959][ T5934] usb 6-1: SerialNumber: syz [ 1408.647942][T14576] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1408.761478][ T5934] usb 6-1: can't set config #1, error -71 [ 1408.791274][ T5934] usb 6-1: USB disconnect, device number 44 [ 1409.022118][T14580] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2477'. [ 1409.022227][T14580] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2477'. [ 1409.095210][T14580] ip6gretap0: entered promiscuous mode [ 1409.098148][T14580] syz_tun: entered promiscuous mode [ 1409.113246][T14580] debugfs: 'hsr1' already exists in 'hsr' [ 1409.113277][T14580] Cannot create hsr debugfs directory [ 1409.113416][T14580] hsr1: Slave A (ip6gretap0) is not up; please bring it up to get a fully working HSR network [ 1409.113435][T14580] hsr1: Slave B (syz_tun) is not up; please bring it up to get a fully working HSR network [ 1411.980722][T14596] lo speed is unknown, defaulting to 1000 [ 1412.688513][ T36] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 1412.738370][T14087] usb 3-1: new high-speed USB device number 51 using dummy_hcd [ 1413.748370][ T36] usb 6-1: Using ep0 maxpacket: 16 [ 1413.778423][T14087] usb 3-1: Using ep0 maxpacket: 16 [ 1413.780586][T14087] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1413.780650][T14087] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1413.782074][T14087] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1413.782100][T14087] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1413.782119][T14087] usb 3-1: Manufacturer: syz [ 1413.896063][T14087] usb 3-1: config 0 descriptor?? [ 1413.921203][T14087] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1418.711155][T14629] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1418.761358][ T36] usb 6-1: device descriptor read/all, error -110 [ 1418.888369][ T36] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 1419.028966][ T36] usb 6-1: device descriptor read/64, error -32 [ 1419.141504][ T36] usb usb6-port1: attempt power cycle [ 1419.423554][T13842] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1419.445709][T13842] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1419.447373][T13842] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1419.449553][T13842] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1419.450316][T13842] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1419.518518][ T36] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 1419.539341][ T36] usb 6-1: device descriptor read/8, error -32 [ 1419.595672][T14633] lo speed is unknown, defaulting to 1000 [ 1419.778451][ T36] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 1419.800146][ T36] usb 6-1: device descriptor read/8, error -32 [ 1420.003419][ T36] usb usb6-port1: unable to enumerate USB device [ 1421.368497][ T37] kauditd_printk_skb: 10 callbacks suppressed [ 1421.368518][ T37] audit: type=1326 audit(1774423530.349:358): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368580][ T37] audit: type=1326 audit(1774423530.349:359): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368626][ T37] audit: type=1326 audit(1774423530.349:360): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368669][ T37] audit: type=1326 audit(1774423530.349:361): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368713][ T37] audit: type=1326 audit(1774423530.349:362): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368749][ T37] audit: type=1326 audit(1774423530.349:363): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368774][ T37] audit: type=1326 audit(1774423530.349:364): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368798][ T37] audit: type=1326 audit(1774423530.349:365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368939][ T37] audit: type=1326 audit(1774423530.349:366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.368979][ T37] audit: type=1326 audit(1774423530.349:367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14638 comm="syz.6.2493" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f21d1abc799 code=0x7ffc0000 [ 1421.419462][T14649] netlink: 'syz.6.2493': attribute type 4 has an invalid length. [ 1421.482384][T13842] Bluetooth: hci2: command tx timeout [ 1423.529306][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.529388][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.558801][T13842] Bluetooth: hci2: command tx timeout [ 1423.586182][T10986] usb 3-1: USB disconnect, device number 51 [ 1425.638533][T13842] Bluetooth: hci2: command tx timeout [ 1426.434143][ T5898] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1427.102682][ T5898] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1427.718371][T13842] Bluetooth: hci2: command tx timeout [ 1427.947684][ T5898] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1428.191412][T14633] chnl_net:caif_netlink_parms(): no params data found [ 1428.454424][T14694] hub 9-0:1.0: USB hub found [ 1428.471373][T14694] hub 9-0:1.0: 1 port detected [ 1429.594672][T14701] ieee802154 phy0 wpan0: encryption failed: -22 [ 1430.578632][T13997] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 1430.791245][T13997] usb 6-1: Using ep0 maxpacket: 16 [ 1430.933795][T13997] usb 6-1: config 0 has no interfaces? [ 1431.002348][T13997] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1431.002396][T13997] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1431.002453][T13997] usb 6-1: Manufacturer: syz [ 1431.128162][T13997] usb 6-1: config 0 descriptor?? [ 1431.241394][ T5898] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1431.690648][T14709] lo speed is unknown, defaulting to 1000 [ 1431.947526][T14633] bridge0: port 1(bridge_slave_0) entered blocking state [ 1431.964429][T14633] bridge0: port 1(bridge_slave_0) entered disabled state [ 1431.964694][T14633] bridge_slave_0: entered allmulticast mode [ 1431.989026][T14633] bridge_slave_0: entered promiscuous mode [ 1432.032150][T14633] bridge0: port 2(bridge_slave_1) entered blocking state [ 1432.032285][T14633] bridge0: port 2(bridge_slave_1) entered disabled state [ 1432.032688][T14633] bridge_slave_1: entered allmulticast mode [ 1432.053046][ T37] kauditd_printk_skb: 35 callbacks suppressed [ 1432.053133][ T37] audit: type=1326 audit(1774423541.039:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053320][ T37] audit: type=1326 audit(1774423541.039:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053413][ T37] audit: type=1326 audit(1774423541.039:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053469][ T37] audit: type=1326 audit(1774423541.039:406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053515][ T37] audit: type=1326 audit(1774423541.039:407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053562][ T37] audit: type=1326 audit(1774423541.039:408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053608][ T37] audit: type=1326 audit(1774423541.039:409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053654][ T37] audit: type=1326 audit(1774423541.039:410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053699][ T37] audit: type=1326 audit(1774423541.039:411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.053738][ T37] audit: type=1326 audit(1774423541.039:412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14725 comm="syz.7.2513" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f22d92fc799 code=0x7ffc0000 [ 1432.089014][T14633] bridge_slave_1: entered promiscuous mode [ 1432.129936][T14732] netlink: 'syz.7.2513': attribute type 4 has an invalid length. [ 1433.130862][T14633] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1433.165545][T14633] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1433.844937][T14633] team0: Port device team_slave_0 added [ 1433.883714][T14633] team0: Port device team_slave_1 added [ 1434.358770][ T5898] bridge_slave_1: left allmulticast mode [ 1434.358973][ T5898] bridge_slave_1: left promiscuous mode [ 1434.360047][ T5898] bridge0: port 2(bridge_slave_1) entered disabled state [ 1434.715067][ T5898] bridge_slave_0: left allmulticast mode [ 1434.715089][ T5898] bridge_slave_0: left promiscuous mode [ 1434.715263][ T5898] bridge0: port 1(bridge_slave_0) entered disabled state [ 1435.653678][T14760] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2518'. [ 1435.653705][T14760] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2518'. [ 1436.089770][ T5898] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1436.170803][ T5898] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1436.213436][ T5898] bond0 (unregistering): Released all slaves [ 1436.388463][T14760] ip6gretap0: entered promiscuous mode [ 1436.390494][T14760] syz_tun: entered promiscuous mode [ 1436.391771][T14760] debugfs: 'hsr1' already exists in 'hsr' [ 1436.391913][T14760] Cannot create hsr debugfs directory [ 1436.397752][T14633] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1436.397764][T14633] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1436.397780][T14633] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1436.557010][T14633] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1436.557029][T14633] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1436.557059][T14633] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1437.643681][T14633] hsr_slave_0: entered promiscuous mode [ 1437.645292][T14633] hsr_slave_1: entered promiscuous mode [ 1437.646463][T14633] debugfs: 'hsr0' already exists in 'hsr' [ 1437.646490][T14633] Cannot create hsr debugfs directory [ 1438.759427][T14087] usb 6-1: USB disconnect, device number 49 [ 1441.088995][ T37] kauditd_printk_skb: 38 callbacks suppressed [ 1441.089015][ T37] audit: type=1326 audit(1774423550.089:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.089145][ T37] audit: type=1326 audit(1774423550.089:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.149152][ T37] audit: type=1326 audit(1774423550.149:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.149208][ T37] audit: type=1326 audit(1774423550.149:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.169059][ T37] audit: type=1326 audit(1774423550.149:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.398500][ T37] audit: type=1326 audit(1774423550.389:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.398559][ T37] audit: type=1326 audit(1774423550.389:457): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.398586][ T37] audit: type=1326 audit(1774423550.389:458): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.398614][ T37] audit: type=1326 audit(1774423550.389:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.398637][ T37] audit: type=1326 audit(1774423550.389:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=14791 comm="syz.5.2526" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f77c25cc799 code=0x7ffc0000 [ 1441.478817][T14799] netlink: 'syz.5.2526': attribute type 4 has an invalid length. [ 1441.533103][T14802] ieee802154 phy0 wpan0: encryption failed: -22 [ 1442.169948][ T5898] hsr_slave_0: left promiscuous mode [ 1442.215222][ T5898] hsr_slave_1: left promiscuous mode [ 1442.216331][ T5898] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1442.216426][ T5898] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1442.281709][ T5898] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1442.281729][ T5898] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1442.420878][ T5898] veth1_macvtap: left promiscuous mode [ 1442.421250][ T5898] veth0_macvtap: left promiscuous mode [ 1442.423752][ T5898] veth1_vlan: left promiscuous mode [ 1442.424166][ T5898] veth0_vlan: left promiscuous mode [ 1444.509294][ T5898] team0 (unregistering): Port device team_slave_1 removed [ 1444.559797][ T5898] team0 (unregistering): Port device team_slave_0 removed [ 1448.499912][T14633] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1448.669077][T14633] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1448.749140][T14633] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1448.841698][T14633] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1450.950174][T14882] ieee802154 phy0 wpan0: encryption failed: -22 [ 1451.015147][T14633] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1451.077561][T14633] 8021q: adding VLAN 0 to HW filter on device team0 [ 1451.221526][ T5878] bridge0: port 1(bridge_slave_0) entered blocking state [ 1451.221756][ T5878] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1451.258922][ T5878] bridge0: port 2(bridge_slave_1) entered blocking state [ 1451.259169][ T5878] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1451.939123][T14893] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2544'. [ 1451.939161][T14893] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2544'. [ 1453.717533][T14633] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1455.818304][T14936] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2551'. [ 1455.839234][T14936] virtio-fs: tag <./cgroup> not found [ 1457.152916][T14633] veth0_vlan: entered promiscuous mode [ 1457.187898][T14633] veth1_vlan: entered promiscuous mode [ 1457.399255][T14633] veth0_macvtap: entered promiscuous mode [ 1457.419579][T14633] veth1_macvtap: entered promiscuous mode [ 1457.459968][T14633] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1457.512047][T14633] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1457.605761][ T5878] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1457.610271][ T5878] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1457.610506][ T5878] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1457.610544][ T5878] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1459.061498][ T6779] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1459.061522][ T6779] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1462.684711][T14967] binder: 14963:14967 ioctl c0306201 0 returned -14 [ 1463.378713][T12880] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1463.378737][T12880] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1465.278289][T15005] ieee802154 phy0 wpan0: encryption failed: -22 [ 1466.851309][T15017] binder: 15014:15017 ioctl c0306201 0 returned -14 [ 1468.586957][T15022] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 1476.578460][T13997] usb 3-1: new high-speed USB device number 52 using dummy_hcd [ 1476.791570][T15082] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 1477.528385][T13997] usb 3-1: Using ep0 maxpacket: 16 [ 1477.531383][T13997] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1477.531440][T13997] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1477.532990][T13997] usb 3-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1477.533018][T13997] usb 3-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1477.533039][T13997] usb 3-1: Manufacturer: syz [ 1477.712535][T13997] usb 3-1: config 0 descriptor?? [ 1477.740465][T13997] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1479.456540][T15104] workqueue: Failed to create a rescuer kthread for wq "ceph-watch-notify": -EINTR [ 1480.738483][T13997] usb 3-1: USB disconnect, device number 52 [ 1481.272466][T15126] pimreg: entered allmulticast mode [ 1481.296410][T15129] netlink: 'syz.9.2587': attribute type 2 has an invalid length. [ 1481.574083][T15129] ‚#{6c: entered promiscuous mode [ 1481.695209][T15129] netlink: 'syz.9.2587': attribute type 2 has an invalid length. [ 1481.695864][T15129] ‚#{6c: left promiscuous mode [ 1484.037409][T15147] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.163262][T15148] siw: device registration error -23 [ 1484.676953][ T1326] ieee802154 phy0 wpan0: encryption failed: -22 [ 1484.677026][ T1326] ieee802154 phy1 wpan1: encryption failed: -22 [ 1486.828662][T15143] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1486.828732][T15143] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1486.946550][T15143] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1487.062423][T15142] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1487.062450][T15142] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 1487.328342][ T5934] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 1487.508463][ T5934] usb 7-1: Using ep0 maxpacket: 16 [ 1487.510862][ T5934] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1487.510919][ T5934] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1487.512495][ T5934] usb 7-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1487.512523][ T5934] usb 7-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1487.512544][ T5934] usb 7-1: Manufacturer: syz [ 1487.521439][ T5934] usb 7-1: config 0 descriptor?? [ 1487.570323][ T5934] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1488.000794][T15187] pimreg: entered allmulticast mode [ 1492.662012][T15230] fuse: Unknown parameter 'user_i00000000000000000000' [ 1492.969278][T15238] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1493.110103][T15239] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2613'. [ 1494.144384][T14087] usb 7-1: USB disconnect, device number 26 [ 1494.500096][T15252] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1495.697921][T15258] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2619'. [ 1495.697948][T15258] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2619'. [ 1495.746282][T15258] syz_tun: entered promiscuous mode [ 1495.798609][T15258] syz_tun: left promiscuous mode [ 1499.968439][ T36] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 1500.118448][ T36] usb 8-1: Using ep0 maxpacket: 16 [ 1500.121248][ T36] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1500.121306][ T36] usb 8-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1500.122819][ T36] usb 8-1: New USB device found, idVendor=041e, idProduct=3100, bcdDevice= 0.00 [ 1500.122845][ T36] usb 8-1: New USB device strings: Mfr=34, Product=0, SerialNumber=0 [ 1500.122868][ T36] usb 8-1: Manufacturer: syz [ 1500.182446][ T36] usb 8-1: config 0 descriptor?? [ 1500.200795][ T36] usbhid 8-1:0.0: couldn't find an input interrupt endpoint [ 1502.069002][T15312] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2633'. [ 1503.056337][T15333] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1503.331960][T15338] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2638'. [ 1503.331999][T15338] netlink: 28 bytes leftover after parsing attributes in process `syz.2.2638'. [ 1507.797184][T15364] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2647'. [ 1507.797211][T15364] netlink: 28 bytes leftover after parsing attributes in process `syz.6.2647'. [ 1508.363265][ T36] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1508.443838][T14087] usb 8-1: USB disconnect, device number 5 [ 1508.550520][ T36] usb 10-1: Using ep0 maxpacket: 8 [ 1509.698833][ T36] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1509.725958][ T36] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1509.725988][ T36] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1509.726042][ T36] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1509.763581][ T36] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1509.763616][ T36] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1509.763638][ T36] usb 10-1: Product: syz [ 1509.763655][ T36] usb 10-1: Manufacturer: syz [ 1509.763670][ T36] usb 10-1: SerialNumber: syz [ 1510.309459][T15375] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2650'. [ 1512.857161][ T36] cdc_ncm 10-1:1.0: CDC Union missing and no IAD found [ 1512.857216][ T36] cdc_ncm 10-1:1.0: bind() failure [ 1512.878961][ T36] usb 10-1: USB disconnect, device number 2 [ 1513.856580][T15400] ================================================================== [ 1513.856600][T15400] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60 [ 1513.856641][T15400] Read of size 1 at addr ffff888052c35868 by task syz.9.2656/15400 [ 1513.856661][T15400] [ 1513.856673][T15400] CPU: 1 UID: 0 PID: 15400 Comm: syz.9.2656 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1513.856698][T15400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1513.856712][T15400] Call Trace: [ 1513.856721][T15400] [ 1513.856730][T15400] dump_stack_lvl+0xe8/0x150 [ 1513.856763][T15400] print_report+0xba/0x230 [ 1513.856792][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.856823][T15400] kasan_report+0x117/0x150 [ 1513.856846][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.856881][T15400] __kasan_check_byte+0x2a/0x40 [ 1513.856913][T15400] lock_acquire+0x79/0x2e0 [ 1513.856933][T15400] ? rcu_is_watching+0x15/0xb0 [ 1513.856958][T15400] _raw_spin_lock_irqsave+0x40/0x60 [ 1513.856989][T15400] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 1513.857016][T15400] rt_mutex_slowunlock+0xbf/0x8b0 [ 1513.857047][T15400] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1513.857076][T15400] ? __rcu_read_unlock+0x83/0xe0 [ 1513.857106][T15400] ? rt_spin_unlock+0x160/0x200 [ 1513.857135][T15400] dma_buf_fd+0x189/0x370 [ 1513.857163][T15400] udmabuf_create+0xf26/0xfe0 [ 1513.857195][T15400] ? __pfx_udmabuf_create+0x10/0x10 [ 1513.857225][T15400] udmabuf_ioctl+0x1f6/0x310 [ 1513.857245][T15400] ? __pfx_smack_file_ioctl+0x10/0x10 [ 1513.857276][T15400] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1513.857303][T15400] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1513.857325][T15400] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1513.857344][T15400] __se_sys_ioctl+0xff/0x170 [ 1513.857379][T15400] do_syscall_64+0x14d/0xf80 [ 1513.857398][T15400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.857429][T15400] ? clear_bhb_loop+0x40/0x90 [ 1513.857453][T15400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.857475][T15400] RIP: 0033:0x7fd3ed22c799 [ 1513.857494][T15400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1513.857513][T15400] RSP: 002b:00007fd3eb444028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1513.857538][T15400] RAX: ffffffffffffffda RBX: 00007fd3ed4a6180 RCX: 00007fd3ed22c799 [ 1513.857555][T15400] RDX: 0000200000000000 RSI: 0000000040187542 RDI: 0000000000000007 [ 1513.857570][T15400] RBP: 00007fd3ed2c2c99 R08: 0000000000000000 R09: 0000000000000000 [ 1513.857584][T15400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1513.857597][T15400] R13: 00007fd3ed4a6218 R14: 00007fd3ed4a6180 R15: 00007ffdd42d42c8 [ 1513.857622][T15400] [ 1513.857630][T15400] [ 1513.857635][T15400] Allocated by task 15400: [ 1513.857647][T15400] kasan_save_track+0x3e/0x80 [ 1513.857674][T15400] __kasan_kmalloc+0x93/0xb0 [ 1513.857703][T15400] __kmalloc_noprof+0x3e7/0x7b0 [ 1513.857732][T15400] dma_buf_export+0x3ba/0xb10 [ 1513.857755][T15400] udmabuf_create+0xee5/0xfe0 [ 1513.857772][T15400] udmabuf_ioctl+0x1f6/0x310 [ 1513.857788][T15400] __se_sys_ioctl+0xff/0x170 [ 1513.857817][T15400] do_syscall_64+0x14d/0xf80 [ 1513.857834][T15400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.857853][T15400] [ 1513.857858][T15400] Freed by task 15401: [ 1513.857867][T15400] kasan_save_track+0x3e/0x80 [ 1513.857894][T15400] kasan_save_free_info+0x46/0x50 [ 1513.857915][T15400] __kasan_slab_free+0x5c/0x80 [ 1513.857942][T15400] kfree+0x1c1/0x6c0 [ 1513.857967][T15400] __dentry_kill+0x211/0x5e0 [ 1513.857985][T15400] finish_dput+0xc9/0x480 [ 1513.858008][T15400] __fput+0x6a3/0xa90 [ 1513.858030][T15400] task_work_run+0x1d9/0x270 [ 1513.858052][T15400] exit_to_user_mode_loop+0xed/0x480 [ 1513.858081][T15400] do_syscall_64+0x32d/0xf80 [ 1513.858097][T15400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.858117][T15400] [ 1513.858121][T15400] The buggy address belongs to the object at ffff888052c35800 [ 1513.858121][T15400] which belongs to the cache kmalloc-1k of size 1024 [ 1513.858139][T15400] The buggy address is located 104 bytes inside of [ 1513.858139][T15400] freed 1024-byte region [ffff888052c35800, ffff888052c35c00) [ 1513.858161][T15400] [ 1513.858166][T15400] The buggy address belongs to the physical page: [ 1513.858178][T15400] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x52c30 [ 1513.858202][T15400] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1513.858218][T15400] flags: 0x80000000000040(head|node=0|zone=1) [ 1513.858235][T15400] page_type: f5(slab) [ 1513.858254][T15400] raw: 0080000000000040 ffff88813fe19dc0 dead000000000100 dead000000000122 [ 1513.858272][T15400] raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1513.858292][T15400] head: 0080000000000040 ffff88813fe19dc0 dead000000000100 dead000000000122 [ 1513.858310][T15400] head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 [ 1513.858329][T15400] head: 0080000000000003 ffffea00014b0c01 00000000ffffffff 00000000ffffffff [ 1513.858346][T15400] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 [ 1513.858356][T15400] page dumped because: kasan: bad access detected [ 1513.858435][T15400] page_owner tracks the page as allocated [ 1513.858443][T15400] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13833, tgid 13833 (syz-executor), ts 1319819761133, free_ts 1297592206027 [ 1513.858481][T15400] post_alloc_hook+0x231/0x280 [ 1513.858512][T15400] get_page_from_freelist+0x28bb/0x2950 [ 1513.858532][T15400] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1513.858554][T15400] allocate_slab+0x77/0x660 [ 1513.858576][T15400] refill_objects+0x334/0x3c0 [ 1513.858597][T15400] __pcs_replace_empty_main+0x35c/0x710 [ 1513.858622][T15400] __kmalloc_node_noprof+0x610/0x7f0 [ 1513.858651][T15400] qdisc_alloc+0x92/0x9f0 [ 1513.858675][T15400] qdisc_create_dflt+0x8e/0x510 [ 1513.858700][T15400] dev_activate+0x378/0x1150 [ 1513.858725][T15400] __dev_open+0x67a/0x830 [ 1513.858748][T15400] netif_open+0xaa/0x190 [ 1513.858771][T15400] dev_open+0x125/0x260 [ 1513.858798][T15400] bond_enslave+0x127b/0x3ca0 [ 1513.858816][T15400] do_set_master+0x533/0x6d0 [ 1513.858844][T15400] do_setlink+0x1018/0x4590 [ 1513.858872][T15400] page last free pid 13755 tgid 13754 stack trace: [ 1513.858884][T15400] __free_frozen_pages+0xfe3/0x1170 [ 1513.858912][T15400] __slab_free+0x24f/0x2a0 [ 1513.858927][T15400] qlist_free_all+0x97/0x100 [ 1513.858953][T15400] kasan_quarantine_reduce+0x148/0x160 [ 1513.858979][T15400] __kasan_slab_alloc+0x22/0x80 [ 1513.859007][T15400] kmem_cache_alloc_node_noprof+0x22a/0x6e0 [ 1513.859036][T15400] __alloc_skb+0x1d0/0x7d0 [ 1513.859063][T15400] alloc_skb_with_frags+0xca/0x890 [ 1513.859093][T15400] sock_alloc_send_pskb+0x884/0x9a0 [ 1513.859113][T15400] unix_dgram_sendmsg+0x460/0x18e0 [ 1513.859142][T15400] ____sys_sendmsg+0x94c/0x9c0 [ 1513.859160][T15400] ___sys_sendmsg+0x2a5/0x360 [ 1513.859178][T15400] __sys_sendmmsg+0x282/0x4e0 [ 1513.859197][T15400] __x64_sys_sendmmsg+0xa0/0xc0 [ 1513.859215][T15400] do_syscall_64+0x14d/0xf80 [ 1513.859232][T15400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.859251][T15400] [ 1513.859256][T15400] Memory state around the buggy address: [ 1513.859268][T15400] ffff888052c35700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1513.859282][T15400] ffff888052c35780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 1513.859296][T15400] >ffff888052c35800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1513.859306][T15400] ^ [ 1513.859319][T15400] ffff888052c35880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1513.859333][T15400] ffff888052c35900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1513.859344][T15400] ================================================================== [ 1513.859356][T15400] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1513.859372][T15400] CPU: 1 UID: 0 PID: 15400 Comm: syz.9.2656 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 1513.859396][T15400] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 1513.859417][T15400] Call Trace: [ 1513.859426][T15400] [ 1513.859434][T15400] vpanic+0x56c/0xa60 [ 1513.859468][T15400] ? __pfx_vpanic+0x10/0x10 [ 1513.859505][T15400] panic+0xc5/0xd0 [ 1513.859535][T15400] ? __pfx_panic+0x10/0x10 [ 1513.859567][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859600][T15400] ? rcu_is_watching+0x15/0xb0 [ 1513.859625][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859657][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859689][T15400] check_panic_on_warn+0x89/0xb0 [ 1513.859713][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859745][T15400] end_report+0x73/0x180 [ 1513.859765][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859796][T15400] kasan_report+0x128/0x150 [ 1513.859817][T15400] ? _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859853][T15400] __kasan_check_byte+0x2a/0x40 [ 1513.859885][T15400] lock_acquire+0x79/0x2e0 [ 1513.859905][T15400] ? rcu_is_watching+0x15/0xb0 [ 1513.859929][T15400] _raw_spin_lock_irqsave+0x40/0x60 [ 1513.859959][T15400] ? rt_mutex_slowunlock+0xbf/0x8b0 [ 1513.859986][T15400] rt_mutex_slowunlock+0xbf/0x8b0 [ 1513.860017][T15400] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 1513.860046][T15400] ? __rcu_read_unlock+0x83/0xe0 [ 1513.860076][T15400] ? rt_spin_unlock+0x160/0x200 [ 1513.860104][T15400] dma_buf_fd+0x189/0x370 [ 1513.860132][T15400] udmabuf_create+0xf26/0xfe0 [ 1513.860163][T15400] ? __pfx_udmabuf_create+0x10/0x10 [ 1513.860192][T15400] udmabuf_ioctl+0x1f6/0x310 [ 1513.860212][T15400] ? __pfx_smack_file_ioctl+0x10/0x10 [ 1513.860242][T15400] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1513.860270][T15400] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1513.860291][T15400] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 1513.860311][T15400] __se_sys_ioctl+0xff/0x170 [ 1513.860345][T15400] do_syscall_64+0x14d/0xf80 [ 1513.860364][T15400] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.860386][T15400] ? clear_bhb_loop+0x40/0x90 [ 1513.860418][T15400] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1513.860439][T15400] RIP: 0033:0x7fd3ed22c799 [ 1513.860458][T15400] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1513.860477][T15400] RSP: 002b:00007fd3eb444028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1513.860500][T15400] RAX: ffffffffffffffda RBX: 00007fd3ed4a6180 RCX: 00007fd3ed22c799 [ 1513.860516][T15400] RDX: 0000200000000000 RSI: 0000000040187542 RDI: 0000000000000007 [ 1513.860530][T15400] RBP: 00007fd3ed2c2c99 R08: 0000000000000000 R09: 0000000000000000 [ 1513.860544][T15400] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1513.860558][T15400] R13: 00007fd3ed4a6218 R14: 00007fd3ed4a6180 R15: 00007ffdd42d42c8 [ 1513.860582][T15400] [ 1513.860896][T15400] Kernel Offset: disabled