last executing test programs: 10m12.361256761s ago: executing program 4 (id=1842): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$netlink(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000c00)={0x6, 0x3, &(0x7f00000002c0)=ANY=[@ANYBLOB="180000000000000000358d265a7abcfce22b06cdfab4b1e7b952d97607000000b9b6e2b50ec507779f1a663691a46d1a4653b91a14c646f8b49e8b040e8a90c2025da3dd0c50e701b5f3886a7daf646141ae1a72fd31ece8dfeff13bffaad9bcd2e5b9f29f0fd60d15c494576784276fa1df2b716a6b9eaf64f22bc6b245966dc056fe7baf01b1d268f2a1c6dda0c2a925de41f3519b5a3aa525a8b3ded59622e7a90939c4efd8de9e60efa44cbb63990ebc4f7f20ee13a2294a017beded5094a61ebf2bd0d270854987"], &(0x7f0000000bc0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f00000000c0)={0xffffffffffffffff, &(0x7f0000000300), &(0x7f0000000000)=""/10, 0x2}, 0x20) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000240), 0x103182, 0x0) socket(0x1, 0x1, 0x0) ioctl$SIOCGETSGCNT(0xffffffffffffffff, 0x89a0, &(0x7f0000000200)={@rand_addr=0x64010100, @empty}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x121403, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40081271, &(0x7f0000000980)=0x4000) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000040)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x74, 0x6, 0xa, 0x401, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x48, 0x4, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_MATCH_NAME={0x9, 0x1, 'time\x00'}, @NFTA_MATCH_INFO={0x1c, 0x3, "07682c020b7b37f27f5101007f51010049f4e34e86f469eb"}, @NFTA_MATCH_REV={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x9c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='cramfs\x00', 0x800, 0x0) 10m9.686375964s ago: executing program 4 (id=1848): ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(0xffffffffffffffff, 0xc04c5349, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000040)={0xa, 0x3, 0x0, @loopback}, 0x1c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fcntl$getflags(r2, 0x1) r3 = openat$pfkey(0xffffffffffffff9c, &(0x7f00000000c0), 0x204200, 0x0) getsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000440)={0x0, @in6={{0xa, 0x4e24, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1}}, 0xff80, 0x6}, &(0x7f0000000200)=0x90) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r3, 0x84, 0x17, &(0x7f0000000500)=ANY=[@ANYRES32=r4, @ANYBLOB="958c15009101ba31831fe35fe1567dbd0900000000000000c2825af93afeed6e22fbc24cad7feff328968dd224959a951befb1af49ac00"/65], 0x1d) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000080)={0x0, 0x1, 0x0, &(0x7f00000009c0)=""/251, 0x0, 0x4000}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x7fff, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x20000000, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x70, 0x0, 0xf2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x36, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x6d1, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe02e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x6, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x413f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x4000000, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0xd, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x22, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe12a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa32, 0x0, 0x0, 0xfffffffc, 0x789], 0x1, 0x400}) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000180)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046d9c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f00000000c0), 0x0, 0x401, 0x4, 0x17) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x5, 0x7, 0xe51, 0x1, 0x5479, 0x103d, 0x6, 0x0, 0x32a, 0xfffffffffffffffe, 0xffffffff, 0x1, 0x40000000009, 0x5, 0x6a], 0x2000, 0x808d6}) write$rfkill(0xffffffffffffffff, &(0x7f0000000000)={0x3, 0x2, 0x0, 0x0, 0x1}, 0x8) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, &(0x7f00000013c0)={0xffffffffffffffff, 0xa, {0x0, 0x0, 0x0, 0x5, 0x8000, 0x0, 0x4, 0x1f, 0x10, "339f020bbe82b398000000000000000000000d0ec0c1b4e9b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "143939c787a16c1ca43f80026d1a8554fe581b59dee430e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d200", "24431a1e77a68e17000000040008000000000000000000e5e900", [0x83]}}) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = creat(&(0x7f0000000100)='./bus\x00', 0x0) fallocate(r8, 0x0, 0x0, 0x1000f4) r9 = open(&(0x7f0000000080)='./bus\x00', 0x147842, 0x49) preadv2(r9, &(0x7f0000000040)=[{&(0x7f0000001200)=""/4096, 0xfffffdef}], 0x1, 0x0, 0x0, 0x0) 10m8.205191107s ago: executing program 4 (id=1853): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000680)={{r0, 0xffffffffffffffff}, &(0x7f0000000580), &(0x7f00000005c0)='%-5lx \x00'}, 0x20) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000540)={r1, r0}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x16, 0x4, &(0x7f00000000c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x9e}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getpid() sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00'}, 0x10) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x1, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x1f00, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:ip,mark\x00'}]}, 0x4c}}, 0x4020080) 10m6.139061182s ago: executing program 4 (id=1862): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x402, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f00006dbffc), 0x4) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) bind$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0x54, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000240)={0xa, 0x101, 0xf, 0xf, 0x7, 0x800, 0x1, 0x3f}) 10m6.134629528s ago: executing program 4 (id=1863): socket$inet6_tcp(0xa, 0x1, 0x0) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x8042, 0x0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4040090}, 0x2400c8c1) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x83) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000000)) link(&(0x7f00000001c0)='./file1\x00', &(0x7f0000000240)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/59, 0x304000, 0x800, 0x0, 0x3}, 0x20) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) 10m3.786780977s ago: executing program 4 (id=1866): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) select(0x28, 0x0, &(0x7f0000000080)={0x3}, &(0x7f00000000c0), 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000004e00)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/135, 0x87}, {&(0x7f0000000600)=""/142, 0x8e}, {&(0x7f00000006c0)=""/194, 0xc2}, {&(0x7f0000000800)=""/188, 0xbc}, {&(0x7f00000008c0)=""/190, 0xbe}, {&(0x7f0000000980)=""/136, 0x88}, {&(0x7f0000000a40)=""/211, 0xd3}], 0x7, &(0x7f0000000180)=""/17, 0x11}, 0x7}, {{&(0x7f0000000b40)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000240)=""/14, 0xe}, {&(0x7f0000000bc0)=""/90, 0x5a}, {&(0x7f0000000c40)=""/210, 0xd2}, {&(0x7f0000000d40)=""/245, 0xf5}], 0x4, &(0x7f0000000e80)}, 0x7}, {{&(0x7f0000000ec0)=@alg, 0x80, &(0x7f00000013c0)=[{&(0x7f0000000f40)=""/247, 0xf7}, {&(0x7f0000001040)=""/68, 0x44}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f00000010c0)=""/118, 0x76}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000001140)=""/111, 0x6f}, {&(0x7f00000011c0)=""/195, 0xc3}, {&(0x7f00000012c0)=""/211, 0xd3}], 0x8, &(0x7f0000002980)=""/128, 0x80}, 0x1}, {{&(0x7f00000014c0)=@x25, 0x80, &(0x7f0000002840)=[{&(0x7f0000001540)=""/18, 0x12}, {&(0x7f0000001580)=""/187, 0xbb}, {&(0x7f0000001640)=""/204, 0xcc}, {&(0x7f0000002780)=""/171, 0xab}], 0x4}, 0x3}, {{&(0x7f0000002880)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000003d00)=[{&(0x7f0000003a00)=""/205, 0xcd}, {&(0x7f0000003b00)=""/255, 0xff}, {&(0x7f0000003c00)=""/209, 0xd1}, {&(0x7f0000002900)=""/10, 0xa}, {&(0x7f0000002940)=""/6, 0x6}], 0x5, &(0x7f0000002980)}, 0x7}, {{&(0x7f0000003d80)=@un=@abs, 0x80, &(0x7f0000003f40)=[{&(0x7f0000003e00)=""/165, 0xa5}, {&(0x7f0000003ec0)=""/2, 0x2}, {&(0x7f0000003f00)=""/44, 0x2c}, {&(0x7f0000004000)=""/215, 0xd7}], 0x4, &(0x7f0000003f80)=""/11, 0xb}, 0x5}, {{&(0x7f0000004100)=@in6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f0000004340)=[{&(0x7f0000004180)=""/190, 0xbe}, {&(0x7f0000004240)=""/217, 0xd9}], 0x2, &(0x7f0000004380)=""/82, 0x52}, 0xe520}, {{&(0x7f0000004400)=@alg, 0x80, &(0x7f00000044c0)=[{&(0x7f0000000e80)=""/44, 0x2c}], 0x1, &(0x7f0000004500)=""/58, 0x3a}, 0x7d}, {{&(0x7f0000004540)=@hci, 0x80, &(0x7f0000004700)=[{&(0x7f00000045c0)=""/90, 0x5a}, {&(0x7f0000005140)=""/163, 0xa3}], 0x2, &(0x7f0000004740)=""/253, 0xfd}, 0x9}, {{&(0x7f0000004840)=@caif=@rfm, 0x80, &(0x7f0000004d80)=[{&(0x7f00000048c0)=""/156, 0x9c}, {&(0x7f0000004980)=""/19, 0x13}, {&(0x7f00000049c0)=""/253, 0xfd}, {&(0x7f0000004ac0)=""/145, 0x91}, {&(0x7f0000004b80)=""/115, 0x73}, {&(0x7f0000004c00)=""/221, 0xdd}, {&(0x7f0000004d00)=""/122, 0x7a}], 0x7}, 0xb}], 0xa, 0x40000042, 0x0) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid_for_children\x00') ioctl$TUNGETVNETHDRSZ(r3, 0x8004b707, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x1}) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000140)={'veth0_virt_wifi\x00', 0x3}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000300)={'rose0\x00', 0x4000}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc1105518, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r5) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) io_submit(0x0, 0x3, &(0x7f00000001c0)=[&(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, 0x0, r3, &(0x7f0000005080)="648a2dba253cfc14fc7d0ae513bbd8023de6864191164453fb5db39b0e40b0da6a00098081b82270c79412ce6ad909393dcef36f7ee1134091e304741815abc9eda89de662131246ee48fd301ce07139f8d4a750c62e9b349af35b1897bdbd78be2c4f9d22f656ad9c4d3757f117658a31d0d3733dbcd4c3db4c11fe8d13c24c40345ad6b5a61c986108871f2729a828415db34c54990e23aa3c5b224a922ef30fedd8ceffc5e3d9", 0xa8}, 0x0, 0x0]) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r6, @ANYRES32, @ANYBLOB='&'], 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x6, 0x7a, 0x0, 0x0) epoll_create1(0x0) 9m48.663938223s ago: executing program 32 (id=1866): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) select(0x28, 0x0, &(0x7f0000000080)={0x3}, &(0x7f00000000c0), 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f0000004e00)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000540)=""/135, 0x87}, {&(0x7f0000000600)=""/142, 0x8e}, {&(0x7f00000006c0)=""/194, 0xc2}, {&(0x7f0000000800)=""/188, 0xbc}, {&(0x7f00000008c0)=""/190, 0xbe}, {&(0x7f0000000980)=""/136, 0x88}, {&(0x7f0000000a40)=""/211, 0xd3}], 0x7, &(0x7f0000000180)=""/17, 0x11}, 0x7}, {{&(0x7f0000000b40)=@ieee802154={0x24, @long}, 0x80, &(0x7f0000000e40)=[{&(0x7f0000000240)=""/14, 0xe}, {&(0x7f0000000bc0)=""/90, 0x5a}, {&(0x7f0000000c40)=""/210, 0xd2}, {&(0x7f0000000d40)=""/245, 0xf5}], 0x4, &(0x7f0000000e80)}, 0x7}, {{&(0x7f0000000ec0)=@alg, 0x80, &(0x7f00000013c0)=[{&(0x7f0000000f40)=""/247, 0xf7}, {&(0x7f0000001040)=""/68, 0x44}, {&(0x7f0000001780)=""/4096, 0x1000}, {&(0x7f00000010c0)=""/118, 0x76}, {&(0x7f0000002a00)=""/4096, 0x1000}, {&(0x7f0000001140)=""/111, 0x6f}, {&(0x7f00000011c0)=""/195, 0xc3}, {&(0x7f00000012c0)=""/211, 0xd3}], 0x8, &(0x7f0000002980)=""/128, 0x80}, 0x1}, {{&(0x7f00000014c0)=@x25, 0x80, &(0x7f0000002840)=[{&(0x7f0000001540)=""/18, 0x12}, {&(0x7f0000001580)=""/187, 0xbb}, {&(0x7f0000001640)=""/204, 0xcc}, {&(0x7f0000002780)=""/171, 0xab}], 0x4}, 0x3}, {{&(0x7f0000002880)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000003d00)=[{&(0x7f0000003a00)=""/205, 0xcd}, {&(0x7f0000003b00)=""/255, 0xff}, {&(0x7f0000003c00)=""/209, 0xd1}, {&(0x7f0000002900)=""/10, 0xa}, {&(0x7f0000002940)=""/6, 0x6}], 0x5, &(0x7f0000002980)}, 0x7}, {{&(0x7f0000003d80)=@un=@abs, 0x80, &(0x7f0000003f40)=[{&(0x7f0000003e00)=""/165, 0xa5}, {&(0x7f0000003ec0)=""/2, 0x2}, {&(0x7f0000003f00)=""/44, 0x2c}, {&(0x7f0000004000)=""/215, 0xd7}], 0x4, &(0x7f0000003f80)=""/11, 0xb}, 0x5}, {{&(0x7f0000004100)=@in6={0xa, 0x0, 0x0, @empty}, 0x80, &(0x7f0000004340)=[{&(0x7f0000004180)=""/190, 0xbe}, {&(0x7f0000004240)=""/217, 0xd9}], 0x2, &(0x7f0000004380)=""/82, 0x52}, 0xe520}, {{&(0x7f0000004400)=@alg, 0x80, &(0x7f00000044c0)=[{&(0x7f0000000e80)=""/44, 0x2c}], 0x1, &(0x7f0000004500)=""/58, 0x3a}, 0x7d}, {{&(0x7f0000004540)=@hci, 0x80, &(0x7f0000004700)=[{&(0x7f00000045c0)=""/90, 0x5a}, {&(0x7f0000005140)=""/163, 0xa3}], 0x2, &(0x7f0000004740)=""/253, 0xfd}, 0x9}, {{&(0x7f0000004840)=@caif=@rfm, 0x80, &(0x7f0000004d80)=[{&(0x7f00000048c0)=""/156, 0x9c}, {&(0x7f0000004980)=""/19, 0x13}, {&(0x7f00000049c0)=""/253, 0xfd}, {&(0x7f0000004ac0)=""/145, 0x91}, {&(0x7f0000004b80)=""/115, 0x73}, {&(0x7f0000004c00)=""/221, 0xdd}, {&(0x7f0000004d00)=""/122, 0x7a}], 0x7}, 0xb}], 0xa, 0x40000042, 0x0) r3 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/pid_for_children\x00') ioctl$TUNGETVNETHDRSZ(r3, 0x8004b707, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f00000002c0)={'veth0_to_bridge\x00', 0x1}) ioctl$sock_SIOCADDDLCI(r0, 0x8980, &(0x7f0000000140)={'veth0_virt_wifi\x00', 0x3}) ioctl$sock_inet_SIOCSIFFLAGS(0xffffffffffffffff, 0x8914, &(0x7f0000000300)={'rose0\x00', 0x4000}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, &(0x7f0000000340)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x0, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r4, 0xc1105518, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r5) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x6080, 0x0) io_submit(0x0, 0x3, &(0x7f00000001c0)=[&(0x7f0000000200)={0x0, 0x0, 0x2, 0x0, 0x0, r3, &(0x7f0000005080)="648a2dba253cfc14fc7d0ae513bbd8023de6864191164453fb5db39b0e40b0da6a00098081b82270c79412ce6ad909393dcef36f7ee1134091e304741815abc9eda89de662131246ee48fd301ce07139f8d4a750c62e9b349af35b1897bdbd78be2c4f9d22f656ad9c4d3757f117658a31d0d3733dbcd4c3db4c11fe8d13c24c40345ad6b5a61c986108871f2729a828415db34c54990e23aa3c5b224a922ef30fedd8ceffc5e3d9", 0xa8}, 0x0, 0x0]) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f00000007c0)=ANY=[@ANYRES32=r6, @ANYRES32, @ANYBLOB='&'], 0x10) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x22fe0}], 0x1}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_connect(0x6, 0x7a, 0x0, 0x0) epoll_create1(0x0) 7m39.382138425s ago: executing program 1 (id=2335): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r0) sendmsg$NLBL_CIPSOV4_C_ADD(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000a40)=ANY=[@ANYBLOB="84010000", @ANYRES16=r1, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000042000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b8008000900000009"], 0x184}}, 0x0) 7m39.204881749s ago: executing program 1 (id=2337): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000340)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x1}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r4, 0x400448cc, &(0x7f0000000380)="2e257e7e00d90e38077bbd82a3e9bfc18b36247327a6a4e092bf761ff0abc195377bffc3277e66fa75bfb6f285b4412dd61476ed5c7e14c67aa32700eb8aa1f8b9590f482cdcb07ae63c02db4c6782bbaf484d97ca421bdf1b122d73dceb9c25191e294045d1173547637b181cdf6fbd4e40a90c6afef4e17443009d70b5718cf1135220") recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r6, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r7, 0xc4c85512, &(0x7f0000000240)={{0x6, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x0, [0x0, 0x0, 0x40000000000, 0xffffffffffffffff, 0xffffffefffffffff, 0x0, 0x4, 0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffeffbfffffff, 0x0, 0x0, 0x0, 0x3, 0x80000000, 0x3, 0x0, 0x0, 0x4, 0x0, 0x6, 0x0, 0x40, 0x0, 0xfffffffffffffffd, 0x100200000, 0xb, 0x6, 0x0, 0x0, 0x0, 0x9, 0x0, 0x10000, 0x1000, 0x0, 0x9, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0xffffffdfffffffff, 0x0, 0x3, 0x0, 0x7, 0x10000, 0x7785, 0x0, 0x4, 0x4, 0x8, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x80000002000, 0x0, 0x4, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x1000000000, 0x0, 0x80000000000000, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0xfffffffffffffffe, 0x1, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x2c5, 0x0, 0x100, 0x81, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x2, 0x100000000000, 0x0, 0x3, 0x2, 0x0, 0x7, 0xc0c0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0xffffffffffeffffc, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000000, 0x0, 0x80]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x10, 0x4, 0x8, 0x5}, 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000280)={{r8}, &(0x7f0000000080), &(0x7f0000000240)=r9}, 0x20) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fsopen(0x0, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) 7m38.215033143s ago: executing program 1 (id=2339): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x0, 0x0) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x1, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000700)='syzkaller\x00', 0xffff, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = getpgrp(r0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000000)='syz_tun\x00', 0x10) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000180)={0x0, 0x18, 0xfa00, {0x4, 0x0, 0x111, 0x4}}, 0x20) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in={{0x2, 0x4e21, @empty}}, 0x5, 0x3, 0xf20, 0x1, 0x94, 0xfffffffd, 0x5}, 0x9c) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000400)={0x0, 0x18, 0xfa00, {0x3, 0x0, 0x106, 0xb}}, 0x20) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r5, 0x84, 0x22, &(0x7f0000000440)={0x1, 0x204, 0xc684, 0x9}, 0x10) write$cgroup_pid(r5, 0x0, 0x0) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f00000002c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty}}, 0xffffec47, 0x9, 0xffff1896, 0x100, 0x25, 0x7fff}, 0x9c) process_vm_readv(r3, &(0x7f0000000680)=[{&(0x7f0000000300)=""/195, 0xc3}, {0x0}, {&(0x7f0000000040)=""/53, 0x35}, {&(0x7f0000000580)=""/106, 0x6a}, {&(0x7f0000000480)=""/7, 0x7}, {&(0x7f0000002080)=""/4096, 0x1000}, {&(0x7f0000000600)=""/86, 0x56}], 0x7, &(0x7f0000000bc0)=[{0x0}, {&(0x7f00000008c0)=""/205, 0xcd}, {0x0}, {&(0x7f0000000ac0)=""/96, 0x60}, {&(0x7f0000000800)=""/56, 0x38}], 0x5, 0x0) ioperm(0x0, 0x2, 0x7e) r6 = gettid() timer_create(0xb, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syslog(0x2, &(0x7f00000001c0)=""/229, 0xe5) 7m37.34520449s ago: executing program 1 (id=2343): socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000005c0)) r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x4d0}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000005580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) socket$netlink(0x10, 0x3, 0xc) close(r2) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000007"], 0x50) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='[', 0x1, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 7m37.165023925s ago: executing program 1 (id=2346): r0 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r2, 0x40086602, &(0x7f00000002c0)=0x20) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000008c0)='./file4\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./file7\x00', 0x0) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000001440)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r3 = socket$inet6_sctp(0xa, 0x801, 0x84) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r3, 0x84, 0x1e, 0x0, &(0x7f0000000040)) syz_usb_connect(0x2, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12014101481344202475ea69010203010902120001000010000904b8070096d1ca00"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000240)=ANY=[], 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000000)=0xffb) socketpair$unix(0x1, 0x3, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) execve(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sendmsg$NFNL_MSG_ACCT_NEW(0xffffffffffffffff, 0x0, 0x80) r5 = openat$mixer(0xffffffffffffff9c, &(0x7f0000000700), 0x101180, 0x0) ioctl$SOUND_MIXER_WRITE_VOLUME(r5, 0xc0040d07, &(0x7f0000000040)=0x121) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x3000001, 0x32, 0xffffffffffffffff, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r4, 0xc0045516, &(0x7f0000000540)=0x7b1) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000000080)={0x1, @pix_mp={0x4, 0x1, 0x32314752, 0x3, 0x7, [{0x95ef, 0x2}, {0x7ff, 0xb}, {0x4d5, 0x81}, {0x800, 0xfff}, {0x8, 0x8}, {0x3, 0x7}, {0xfd8, 0xfffff64c}, {0x3, 0x1000}], 0x2f, 0xc, 0x0, 0x2, 0x1}}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="1b00000019000100000000000000000102", @ANYRESHEX=r6, @ANYRES16=r6, @ANYRESOCT=r6], 0x2c}}, 0x0) syz_open_dev$mouse(&(0x7f0000000040), 0x8, 0x14e80) 7m34.097124241s ago: executing program 1 (id=2364): r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x4, &(0x7f0000006680)) set_tid_address(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000002180)={&(0x7f0000002100)={0x24, 0xd, 0x6, 0x401, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x404e800) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x4f27, 0x5, 0x6, 0x4, 0x4, 0xfffffbfd, 0x12, 0x4, 0xd, 0x6, 0x2, 0x1, 0x5, 0x4, 0x2, 0x101, 0x4, 0x9, 0x3, 0x352f, 0x99, 0xcaa7, 0x2, 0x5, 0x7, 0x2000e77, 0x7a, 0x8, 0xfffffffe, 0x0, 0x3862]}) 7m19.048892769s ago: executing program 33 (id=2364): r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x400, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x8, 0x4, &(0x7f0000006680)) set_tid_address(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r4, &(0x7f0000002200)={0x0, 0x0, &(0x7f0000002180)={&(0x7f0000002100)={0x24, 0xd, 0x6, 0x401, 0x0, 0x0, {0x0, 0x0, 0x1}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0x7}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040000}, 0x404e800) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcl816\x00', [0x4f27, 0x5, 0x6, 0x4, 0x4, 0xfffffbfd, 0x12, 0x4, 0xd, 0x6, 0x2, 0x1, 0x5, 0x4, 0x2, 0x101, 0x4, 0x9, 0x3, 0x352f, 0x99, 0xcaa7, 0x2, 0x5, 0x7, 0x2000e77, 0x7a, 0x8, 0xfffffffe, 0x0, 0x3862]}) 5m54.313336692s ago: executing program 3 (id=2715): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x24, 0x2, 0x3, 0x301, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x1e}}, @NFQA_CFG_QUEUE_MAXLEN={0x8, 0x3, 0x1, 0x0, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000c085}, 0x4000000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f0000000080), r1) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e27}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b703000000000020850000007200000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_EGRESS_PRIORITY_CMD(r3, 0x8982, &(0x7f00000002c0)) ioctl$TCSETSW2(r6, 0x80047456, 0x0) socket$inet(0x2, 0x3, 0x13) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$F2FS_IOC_MOVE_RANGE(r7, 0xc020f509, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f0000000240)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f0000000400)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r7, 0xc0502100, &(0x7f0000000740)) ioctl$SECCOMP_IOCTL_NOTIF_SEND(r7, 0xc0182101, &(0x7f00000001c0)={r8}) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80085504, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x3, 0x10, 0x42, 0xe3}]}) 5m53.235007393s ago: executing program 3 (id=2720): r0 = fsopen(&(0x7f0000000140)='cgroup2\x00', 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'xchacha20\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d0ff0f1d0dbd301e5a47b2f3caa73dcd2a6a370554375a", 0x20) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000b80)=""/4096, 0x1000}], 0x1}, 0x6}], 0x1, 0x40000021, 0x0) sendmsg$DEVLINK_CMD_SB_POOL_SET(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001d80)={0x90, 0x0, 0x200, 0x70bd27, 0x25dfdbff, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0xb, 0x5c56}, {0x6, 0x11, 0x7fa}, {0x8, 0x13, 0x81}, {0x5, 0x14, 0x1}}, {@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x7}, {0x6, 0x11, 0x800}, {0x8, 0x13, 0x4}, {0x5}}]}, 0x90}, 0x1, 0x0, 0x0, 0x20000000}, 0x4004800) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000b40), 0x2328}}, 0x0) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r3, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, r4, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r3, 0x3ba0, &(0x7f00000001c0)={0x48, 0x1, r4, 0x0, 0x7, 0x1}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000080)={0x28, 0x2, r4, 0x0, &(0x7f0000fff000/0x1000)=nil, 0x1000}) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x3000)=nil, 0x3000, 0xa) r5 = fsmount(r0, 0xfe2df11b4abc7a63, 0x0) setreuid(0x0, 0xee01) syz_clone3(&(0x7f0000000280)={0x201800000, 0x0, 0x0, 0x0, {0x1f}, 0x0, 0x0, 0x0, 0x0, 0x0, {r5}}, 0x58) 5m53.059031107s ago: executing program 3 (id=2722): r0 = userfaultfd(0x1) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x4d0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000c40)={0x0, 0x0, &(0x7f0000000c00)={&(0x7f0000005580)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x80) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r2 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) close(r1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1700000007"], 0x50) sendto$packet(0xffffffffffffffff, &(0x7f0000000000)='[', 0x1, 0x0, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r3, &(0x7f0000000000), 0xd) 5m53.04983959s ago: executing program 3 (id=2723): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000005c0)='sched_switch\x00'}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000080)={0x0, 0x8, 0x2, '5E'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000280)={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r2 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r2, 0x110, 0x4, &(0x7f00000001c0), 0x4) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000a40)=ANY=[@ANYBLOB="84010000", @ANYRES16=r4, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000042000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b8008000900000009"], 0x184}}, 0x0) 5m48.879298806s ago: executing program 3 (id=2735): prctl$PR_SET_PTRACER(0x59616d61, 0xffffffffffffffff) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000cc0)={0x2, @pix_mp={0x3, 0x1, 0x35303553, 0x7, 0x5, [{0x7, 0x61280e0f}, {0x3, 0xa}, {0xe, 0x1}, {0x1, 0x1000}, {0x9, 0x8001}, {0x5, 0xdd7}, {0x5, 0x1ff}, {0x2}], 0x9, 0x2, 0x4, 0x2, 0x7}}) socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x80, 0x0) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r0, 0xc004ae0a, &(0x7f00000002c0)={0x40000000000000a0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x2) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0x0, 0x0, 0x4004) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$inet(r1, 0x0, 0x0, 0x20004000) r2 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315ce7e0102030109026100010000000009040001"], 0x0) syz_usb_connect(0x2, 0x9a2, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) preadv(r3, &(0x7f0000000540)=[{&(0x7f0000000080)=""/166, 0xa6}], 0x1, 0x6, 0xc) (fail_nth: 4) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) 5m34.582942226s ago: executing program 5 (id=2784): ioctl$DRM_IOCTL_GET_CAP(0xffffffffffffffff, 0xc010640c, &(0x7f0000000040)={0x8}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f000001b700)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000540)='binfmt_misc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) fchdir(r2) r3 = open(&(0x7f0000000040)='./bus\x00', 0x143142, 0x80) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0d05605, &(0x7f0000000140)={0x1, @pix_mp={0x0, 0x0, 0x34324142, 0x0, 0x0, [{}, {}, {}, {0x5, 0x7fff}, {0x2}, {0x0, 0x2}]}}) write(0xffffffffffffffff, 0x0, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x40001) ftruncate(r3, 0x2007ffb) sendfile(r3, r3, 0x0, 0x1000000201005) r5 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r6 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) ioctl$VIDIOC_G_OUTPUT(r3, 0x8004562e, &(0x7f0000000480)) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000500)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000400)={&(0x7f0000000840)=ANY=[@ANYBLOB="240000000906010200000000000000000a00000008000940000004eb08000940000000063c02696dc549767b30e909ec406b53045e390c29859c63ce075f9bafe3e51c2f1ab7ba610ac1f001fea6a2bf"], 0x24}, 0x1, 0x0, 0x0, 0x4008090}, 0x8800) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r2, &(0x7f0000000440)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000280)={&(0x7f00000006c0)=ANY=[@ANYBLOB="6c000000000805000000000000000000030000030600024000f900003400048008000640fffffffd080009400000100008000340000000090800094000000004080001400000003308000740000000810900010073797a31000000000600024022f000000500030021000000b46f0a81fc2642ba6f62a336c57440000e5f2026e4817367694317b4272a66ae2809fd2deed90a2d3d1674413c7d69baed1cafc8fad20f477445b6aa0ee9e98cb8d364d1486aa1f1297bf8bfb695793a71ed194182031042e22735d8e71159defad5763e44d02672f2963c60c2663625854a823b6c439bee7e643dabd15d66de425aa976f0988c1ae9da1142ef43fa620413dbbabffd4aad8f1743c9257f7ec0fe2371ddf5cb92faef659bb8e17a0f9e42b3ccbc697aa0eb74a01a2ba8c30311e185636ce6cb85cfde799683389b0f3f6c2ca4b591d80d6a02349f9f20a14f48a7435e1842a035218180f356ec34"], 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x4000000) keyctl$dh_compute(0x17, &(0x7f0000000100)={r5, r6, r6}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha3-512-generic\x00'}}) syz_emit_ethernet(0x32, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800490000240000000000329078ac1414bbac141454f11182328907efe00000018606000000"], 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="80000000", @ANYBLOB, @ANYRES16=r5, @ANYBLOB="04001300060012000400000006001000fd0000000a0006000802110000000000440081"], 0x80}, 0x1, 0x0, 0x0, 0x200000d0}, 0x8050) 5m33.667932487s ago: executing program 5 (id=2786): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000080)=@req3={0x54c, 0x4, 0x3, 0x3, 0xc, 0x6, 0x7}, 0x1c) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x7079, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_READ_FIXED={0x4, 0x4, 0x2000, @fd_index=0xa, 0x9, 0x7, 0x10001, 0xe, 0x0, {0x2}}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000980)=0x14) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r9, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x43d, 0x70bd2b, 0x10000, {0x0, 0x0, 0x0, r9, {0xc, 0xffff}, {0x0, 0x4}, {0xfff3, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x8014}, 0x0) r10 = dup2(r0, r1) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000000480)={0x7, 0x0}, 0x8) r12 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000700)=@bpf_lsm={0x1d, 0x4, &(0x7f00000004c0)=ANY=[@ANYBLOB="181a0000", @ANYRES32=0x1, @ANYBLOB="000000000000000018660000090000100000000003000000"], &(0x7f0000000500)='GPL\x00', 0x39000000, 0xec, &(0x7f0000000540)=""/236, 0x100, 0x1, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000640)={0x0, 0xb, 0x4, 0x5}, 0x10, 0x0, 0x0, 0x5, 0x0, &(0x7f0000000680)=[{0x4, 0x3, 0xb, 0x8}, {0x3, 0x1, 0x7, 0x9}, {0x2, 0x5, 0xf, 0x4}, {0x0, 0x3, 0x3, 0x2}, {0x5, 0x2, 0x9, 0xc}], 0x10, 0x3}, 0x94) r13 = fsopen(&(0x7f0000000080)='bpf\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r13, 0x6, 0x0, 0x0, 0x0) r14 = fsmount(r13, 0x0, 0x0) symlinkat(&(0x7f0000000000)='.\x00', r14, &(0x7f0000000140)='./file0\x00') readlinkat(r14, &(0x7f00000001c0)='./file0/../file0\x00', &(0x7f00000002c0)=""/204, 0xcc) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xe, 0xa, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000300000000000000070000001356000000181200000c8399df260478c2e2686c12b20e75329402f8098b9a41a31e07844b6b2d1cd90d5282555275ece3fe27b39f49b614f12cd9d9b7f20338012fbe0b20f5ad31f844f5abee0cf8", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000000000000085200000030000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x7ff, 0xe7, &(0x7f0000000380)=""/231, 0x1e00, 0x20, '\x00', r9, @sk_skb=0x5, r10, 0x8, &(0x7f0000000240)={0x7, 0x4}, 0x8, 0x10, &(0x7f0000000300)={0x5, 0xf, 0xa92, 0x8}, 0x10, r11, r12, 0x0, &(0x7f00000007c0)=[r14], 0x0, 0x10, 0x1}, 0x94) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) 5m30.734066253s ago: executing program 5 (id=2794): r0 = socket$inet6(0xa, 0x2, 0x0) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000600)={0x6, 0x2, &(0x7f0000000280)=@raw=[@call={0x85, 0x0, 0x0, 0xa0}, @exit], &(0x7f0000000300)='GPL\x00', 0x81, 0xac, &(0x7f00000003c0)=""/172, 0x41100, 0x44, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000480)={0x9, 0x3}, 0x8, 0x10, &(0x7f00000004c0)={0x1, 0xf, 0x2, 0x401}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000500)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1], 0x0, 0x10, 0x2598}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000001800)={r1, 0x0, 0xa0, 0x7c, &(0x7f00000006c0)="026005fa45e913909e2c33b181084570eafd83a60381d5a048f0a3f4059d68ed64ec2d3390a8ceb0e16cefaf822a010d2688e014980f4d01e136d2b1e6137ddf2f78883a3ef4a2141063b60ed95bc3f16ebcfe3ea5e43fca48f603cc94506f13345acf628129a49c978e8921f10d1659e021be213cab178ddff702a04e919f224ad8392bae4b9d221cb3066661f49901c3cccd9afd47c358d318551ded83f575", &(0x7f0000000540)=""/124, 0x3, 0x0, 0x1000, 0x68, &(0x7f0000000780)="e10cf2cc18a43d653d9d59d1bbc2e3d87e052623e320b2bc01cb7552cff28bc71293106d915616d9d0bf32982ec038c57a7ac5f1f9ded74256cd416bcc0601fd25faa2d816a6b88cf039e934e8d0871ffcbe1db4756512acdb9b23dbdbc2a1c6e7b2aa6b97bf29e03701ed630f9e361b978d48c56a7e4903720ad9e88ad51869ac6b2d9720e89d318f5b7508dee3e456ca050d54bda1ba1aeb9afbc75148788f653518080fbd2e97ee69b4f503f61c496de20ea97f639752fdd177a717cf80a64cd854a858bad4ca0e4e29952000557bd337f454b6504975f492e8a74d7c7c9ff04998ecd59f3401cdcab54f4fbffe18b66105155ec9074137f191ef1b6b3da02e124ae3f76207477624e035d59e1d8ddb99cc8dd75d3f05a4ea43236aaa1172c5d78b66908b636de661025226092ab68cba610d63f676f2b804415c84ff5e82579da3c540e2dbfab00b1a4806a4b2cdb0027ff85239dc50271686057bab18d62cb4c55f47af66ecaf10abc2b9cd906be983fe35309bcca06995cd7c775b7ebf5558740f490bd4dfd3b000c359f270f4b2b6b6c0f3370b8f2f0277d3fcb0441354216f4ae3ab2e47aa9c976bc23b5a357089dcbda8121e34923452c885a12250fbefea531a69601bf801524c4760c0239a5176bc95bda602fd9ff6f745026c442a5662f661dcd929898da236a92fb24f50d65d15cb0517bd3c0bbf58635f22b42690bcc806cc860680dcd5d1b96362406dc262b9f62cbcd7aaf84e84d16c2ca6afcda7e3e6b77efd27e0955ab14aa2141214692b88db639d9995ad9f7443bc301cedaefb0f26c3438cb64b04b45718b4a04520983ab6a5585372bf5f02e32194d9a3cf979d909e1aed80e841c75f8496dc53d8a97ffa6b68b825637bb44494a2fffaf1908c46759c609c2dfc3daf21f8391b4a6ded214e2bac141bccca5bf096ef558fcc67abc3fbc8193660a384cf41d271d5e4aff65809e3ce78732d630142e81bf4747dd2f3553580986166bbbdbadd44b454d2636dd325d2e9dd2160c96d8fc7e996a433ee365d73a8d5db2a58364938ab1f971cf6c4c48554f47f22be188569df6cd3fa9d0626f000c34e80a99096353a3c2c9e1f83d7f784eda1390aae19c16abb73cbf6cb25d38d6e8526e800dea4225d33302c738f0f88e3d62ee9925dab003fcabcdc31684ee4fc5e725b739222030dc41668fa351ea56770f1f846c6ea2817fb42fe1b7c33a794fd1f71fc2ea630a6f5dc95430431a453ecd9d14a6e68b96834e36751caba778a84dffb205c6107558702392ea1a1f8b2fb9b327996dde18a4fc91bfe36c65d21707d28a1986e4de10643fceb114f1eb20bbc5afcf597d01c9316e3081a8e903240bdcfeac6e751250f49735ceb02fd0fbde47b13125153fe60a6424083259643d092557c234588ddceb0c21e38d546a485203dac57b9838ecbc564a1605cf0162fd9582ea26126887ff12e2f3a78b8866571d0a47f808854a68db918842a44cb4d615da4008f7e00781acdf46a1ccbd370f16a1357409a83390c5ab60032463212897d3969bac0cc44e179183c27a7475c802782034eeb0ada4a1ce8d70af05ecbd232650929a41f43b819a814cab779012ac620cad589175d74d9bd249a8b569d8feee45ed8934244988000e67759eccd4110180e0b5c167c4b46c5e4eda5ad0a1350d2beb7761b41f5226f71f6265f05911202446706eb71a45ee96bf990e61190533750cd415016fe7f9b2d7e0a4577d560cfe5b877dd6c85e6d3f818ff3abededdb42f5cbf411faed1ef559ff2619ec02844d1b312ef8892ab8b376f35ea2855610f1d2d9d328523cf476fd9cf1d7a301c414a97d5a45b724763b0d2da1e42222bade933d55bb81360dfeb6e07662c16cfec6ce926233466502a6712f1a6fdc928b44b025f31a030d11e3b5526c555d0a202a2482793c6e2e8a0093debf6c70511bdb73e8b17a9f9cef3e05bf89198d5804b2774e418ea3a833f7ca2393c9fe92ba4c4ec32bd478ae769ccad7d628486224b905f175dfe21c9e84fcb73b75f28b4a23a1218212de4467be48954169e025a16bde7cf715e40109fa2188b247e768e40a8750dfbc807e8621b104c7dc0e3dac29f093675337e504955a5088e2572f6bd30ec0dffdfa5b38874f1cbfad6f058739210e70f0b3bad08b6b2c062dec761c1b31e941933857dbcda552141a6835257a7ee4a3049682be9d6000b10db4a1be2289bbce5eececf3266ade19803bd363eff3d323502fb54e40581b2d7f88193f332f4c7f4d3f6848800aeb776c73b76806dce912af604d1317b2c6b569eadff4464c9d1a685f5122219c2c3506797aa903e409331a46312521e242745f3f57a81dba5755d32b72eed5b4775aa2e0afd82e45f706ccaa141e89c13e090ec01c08b06502b5c3f78390610f712d03886abb8f1251df26c49cd1d85d4e81fe8d16864406207122978e8256a5a928c4e44975815318d6b6fa2c40cfca666e90daec8399a324c7b0eb47f37c0ae92d5d0368a05c88d02894a266b97751a9ed50e26c3162a082c28042daa1efedc11c5f4f0c9a629b90a06bd916ee9b66b3b32d2f9bba224e83e602fc8035967e04582e63b19009ba078296bd5a1c84b65e8a076e072659bbe7e51e4d4eaa983f7e2509821c664a644e450877e82bcf73698dfcc284a94ad0a01164ec54b400a4b49e686bbee49db3a6e2c19cc59c2f5f3e00573934594c4139b4b440542fdc1258a545cc3e1e66b01c8a9c382e296004ded737356be48854490109d9bc07c3dc2d835618e0463d42de4f23e27184343fbeedad6494462f67c3dc6ec3a3dad797e6680f4691c90d8247af14dacb764c7a39731767ae95c4548efd5f6570b91ba7a09eb702ff95898b1904b9cd89ccf023466f1fe84d9c518e1af2f6e90a15020ca303dd7693d80fef9798a6815cc4c3789008f3c8331711b37b5d20ea6f489fa03e8fb15acbb5aac5b5e71df801158fe706f6bf5dcf94aeda89f58ce1e5d15b91660be90cf54047582cd8a8c91dca15b445ac118fae37a823b5d18d5043b5c1118773f631e80f282f73b4a7e79af2141165b2530a29e17e4981f5cfae8ffbf70d68be4c3a9d144d1f6499d4699e9487f73fd82d5efb613db32f69ba0480ae244b7c4b4aee9d72c17166f87146fcc3ba9a91877e360d3682ca6d469e7504a3105074c567280da82a389aee229ff8d5bd1a0c35a756feaf7354e82aca97c9a13ab3d4dc63b73fccebbb5b5b976373fa8a49a0af6ec30bbffa9c40dcfc3d5dfadc615049f78aa3dcaeb35d41b793bad272508e9180e40ce7de3050ca302513a36a7c9164fd4d3dc46a3a9a32474d3b2f03060ecf5a9dde5558df8d66d265eb8d20690463fa17fe2c1d7f032e97e3ab5d33058eb6fe553e57f0ca1abd1b737afdb7d6c094fb2e1a00c348d421ba943eef1c74d4b49381ec0a5dac0586b1381d31702869841614aa339b75dc18a329bb04a25587602c4350f6d0350482d7131426d3f62c495a49c545c58bf827d1a22040218dd9790ddf97d8436192cbe4d60b0d786f28f9f32d2aaaea29bd2ed3640133f25e60dbfe9b7159e963fd5f3e76cfc4f815bf4201d575556f9fef8462f8b129b6099b1c01cfabc81134cc5525437b47d6a7dd06c85f1938f2d8db64cf7dc1922a9b5efdae9bd0d344728fcc156b7e827a58b89de822bd0a7a25df75a50b9b601d93efa8dc9be2f218f937e997c80646c6a3a4b5d25a3367e071d437245c32dbb066d8244c47a45faa38720a07a1f8ad69d6096c3d822d4e478862c14e68384e6657efc46d3e353bc43e95f50c19dcde8f4b04860f6f4796c00393237ec24d9d18771f18d1e5a9490e256b58fa98fb16a61861707d1193985f0d0dad5bf4ed29eb19a23dc908717d798b6d75782557f161b901cfbae5decff7c7264ab38fd81f1ede218c042d0e98f46c2f8cdd635008316b1cad068bbfce695e0dd1c8cd1b47bc27edeca10d36a3188ef9a988e3a6e5753244e60aaf426d49883d3dac121735d2683f4b3cd585ac03501f79e9c410e1e2af50b615bc340b0bef50a25c0e312bac769e6fe4d6c2306f5240aa0d6eacd623f27043601c68cebd7444cf5d0bb2809077530388ee0a3df4215ed07482470f4d00b0cfbef0144302f77a299dc2847afdf8778a504a7a0b7e985292e6620ba2bb07cced119b02af765e60ed423748efe49e1a6f23edc4a0765d7a65896a4f6e062cdb0930d001b6c80144033c95f63e1c34cf5fd5bb79846279ba2920c6f2a500bbbe9d6be30934b64dad2819b7046476366da551a6f02c6c0d5de772c0b1483778624790ae509a1ec074d2a69878026dc8db38f0578280037dd0e4f4ecf3ef4dd861382676430c3f00a6cb4bb933c8734eab42c5a27785deec541203a72f9fa50b62326867706fc5b08ef2ddfaf80340537b4f4197062d6ef94e8f292bc329316bc8a0355a3c21c04ed6a392ce9862dfcf0e82131be489f379c97a12c84389386d7e1b52a2170d16df861e4e4624719a9c0e5f5b9fc368c582b38f850c44fec3b6866fbd0d44e4215e1df79e81d22946aaa0a988f49d2b98ae3808a5488e1f939953ecb96745a5224a84aeb1bc360fd4de512750d52fbbff3a0b5ba53533500425910ce1f2f9c11cc53b0881690558fcf0701bdba11edd735c32a941f69593af7acc7d04993db0300f30dca9c06dd9cf5691442d39e75ecf8a297f6b91bf2e1acf39485a83ffd18d011b2cd9d216def8e0163a30a7e3bc87ac862ee093ba9581750e5638a4627f5d05270791dbc63e7dd687765f770074dbf53d5c663e03397e5cf081daf1657f7b7ccb075c34738f511f4879ad7c0d44b0b9f86f9739b40d9524b5192155793e1220a7659c2a0e15f177b8bae0e84e2a6d36497fe25f380710fb42241b8f9acf4826351f8dc637f16552167b467f4db43671f82b664b67f62bb6fe10b5e1b34a9fdd7d850467d92e86e69ceccac39539c6711b093108cb8310859e1017652832a36953991e39b031588bbfe1475c0e78596f58217a9d0bc050b9dd81a6de40953be43984d08ad68a21c9e9e06ac949a41dba64ba36f93e63f69a6fc2243ef0bf50039d661551cfcb52da1f1ef3c408524b473a4be3cc77178aa78d821d49eca9fa24c4afe5f50820dbff1a5ffd28d0ce7caaeca9d843240db6e01e1814a0012f3550c7e3f4de3060f24985f0d95d8168ed4c51bfe44013b167c2577eeff0784c5567853428db02374c30677abb98eb581a6642bb1cbbc9b31153ba1122614813eaec29276aea62786a9c4a93bb11ad09c896a55e4b50ef695d3df24bd582a10df31d259ae9feae37c53a39012caa7bb6b46957805d57e1119c0501ff8ee1c0ac095c8f694f557a662f1ee4e9afdaddedb566f8e8a5632873e7eeeb6cfe9c302fd67766e6a34cc6526b0153568633f9d93363ecdecd6e9a6a1375a6a347a07e6bfe925926767d09034257c1b0a753faefe95b5f42ab58b1d3f0f3e70101fd951527765fbba4f92574180ab359233c276ff63cde06967b88b79b987c2ef93ae910ddad87966a361ce35448244b420c0ed0a96ed03375a40c4b203b91e084d93f0e7a08792b91fb2f1ca18dfc9826d3bd0fe8eb8675d7d36083ac5a96a02f1e18485d416dd486d2ea3789a8ca198822e6240928489f556e13d0c56b1e159510812876939df182bed04088a5a7afb7e2c761c7eb7cbcc4ae0c335c7a436a66a5d88de75bcee3ba6b7de28944cff2d7cd1c2de252cc71c8776c9b517132f0793aaa260", &(0x7f0000001780)="6aedd548dd5fe6a31ec3c4076a1de92cd320b42e20969221948498e89b6b0f8f146a68d2150b0527166ecea44dd19ab9a2f31f01998d067d925cf869e594cf46d7c5b8a1a6fa0e53e5d0075fe847fa7ca58b0c9863df59c6a2763c153442fb1be917cf5ba718578d", 0x4, 0x0, 0xfffffffa}, 0x50) (async, rerun: 64) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) (async, rerun: 64) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async, rerun: 64) r2 = socket$tipc(0x1e, 0x5, 0x0) (async, rerun: 64) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) (async) r3 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan1\x00', 0x0}) sendmsg$can_raw(r3, &(0x7f00000001c0)={&(0x7f0000000180)={0x1d, r4}, 0x43, &(0x7f0000000140)={&(0x7f0000000340)=@canfd={{0x4, 0x1, 0x1, 0x1}, 0xe, 0x3, 0x0, 0x0, "555390508bff2b9e63477a98784ca217bae7ae597ea6ea5b806fcd257ce7cb9e0346b0e1ec5064937df2a6f9dd768ae61274d13f2ddf486eaacfb6af356771b9"}, 0x10}, 0x2, 0x0, 0x0, 0x844}, 0x4000855) (async, rerun: 64) r5 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') (rerun: 64) preadv2(r5, 0x0, 0x0, 0x5, 0x101, 0x1) bind$tipc(r2, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x41}}, 0x10) (async) r6 = creat(&(0x7f0000000040)='./file0\x00', 0xaa) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r5, 0xc018937c, &(0x7f0000000100)={{0x1, 0x1, 0x18, r6, {0x4}}, './file0\x00'}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r7, 0x3ba0, &(0x7f0000000200)={0x48}) (async) ioctl$int_in(r2, 0x5421, &(0x7f00000000c0)=0x7fffffffffffffff) (async) listen(r2, 0xffefffff) (async, rerun: 64) r8 = socket$tipc(0x1e, 0x5, 0x0) (rerun: 64) sendmsg$tipc(r8, &(0x7f00000002c0)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x3, {{0x41, 0x3}, 0x10001}}, 0x10, 0x0}, 0x0) (async) accept4(r2, 0x0, 0x0, 0x0) 5m30.270073515s ago: executing program 5 (id=2796): r0 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) close(r0) r4 = syz_open_dev$dri(0x0, 0x1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_GET_STATS_FD_vm(r6, 0xaece) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x3, [], [0x800000], [0x0, 0x1001000], [0x4, 0x0, 0x7]}) 5m29.001631075s ago: executing program 3 (id=2746): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000640)={0x5}, 0x4) sendmsg$inet_sctp(r3, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0xc851) socket(0xa, 0x3, 0x3a) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f00000001c0)={0x1, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07c94089473e5288773c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d80e7ef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e7b2516d156e5a0934d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c29f84d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d52760566"}) ioctl$USBDEVFS_ALLOC_STREAMS(r4, 0x8008551c, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000200)={0xfffffffc, 0x0, 0x6, 0x0, 0xff, "db8f2d2b3b7596160c6981acf8805944823a7f"}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ppoll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x200}], 0x1, &(0x7f0000000280)={0x77359400}, &(0x7f0000000300)={[0x10000]}, 0x8) unshare(0x40020000) r6 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r6, 0xc25c4110, &(0x7f0000000080)={0x3000000, [[0x7fff, 0x2, 0x0, 0x0, 0x1, 0x10000], [0xfffffffc, 0x52cf, 0x0, 0xf51, 0x6, 0x4], [0x403, 0x2000c, 0x0, 0x0, 0x0, 0x6]], '\x00', [{0x5, 0x5}, {}, {}, {}, {0x2}, {0xfffffffe}, {0x0, 0xffffff01}, {0xfffffffe, 0x1}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], '\x00', 0x100}) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r7, 0x800448f0, &(0x7f0000000180)={0x0, 0x0, "a4cd91", 0x9}) 5m27.878928451s ago: executing program 5 (id=2802): r0 = socket$igmp(0x2, 0x3, 0x2) sendmsg$inet(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10, 0x0}, 0x0) 5m27.846923784s ago: executing program 5 (id=2803): pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4880) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x40010000, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000000080000000000000000010000000000000044000500ac1414aa00000000"], 0xfc}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20, 0xd, @empty}, 0x1c) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'macsec0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x7, 0xaaf9f76dab351c33}, {0xffff, 0xffff}, {0xc, 0xd}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x2c, 0x2, [@TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x880c}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0x4}, @TCA_FQ_RATE_ENABLE={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x6, 0x5}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000004c0)={'vlan0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004800) socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x800448f0, &(0x7f0000000300)) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000c091}, 0x28000811) writev(r0, &(0x7f0000000680)=[{&(0x7f0000000040)}, {&(0x7f0000000780)="cd0193ec7490037855c420610a2fed3fee4d99a0ecd77bc5b61944a2c2a0dc34041af62dcef4ef946ed0831f2f8b85246bcb96312cab45ebee5af58b1fd258593d451d81f98b936afae664bd126218819ffe29da9c797cd0031e9ff2f6889ab6325c7a8ee43fdd915d23a5945617afee2139f5a728c46c156838534697ad13d64f41b904098517e9", 0x88}, {&(0x7f0000000140)="65816891f9f33184be30f16d6839489a88a7151efe06e31f30fd9432f78c185dbcc2b5831e79fc3e579ea44090e0805a0230f6ef1475dfa0974d0eabd50f9e8ded10802dfd5a820423f90d6534cf2d0347ef03c8882a2fd56e2ebc0acd19f09f0302e2fab1bf295a56c0230cffd9e8b59cc59f4373d275187c962bc0e88b4ecb447796095ab7e372b04eeb974937901f2920a655d160da1b47c5192bcb362024c8d83d0713a8fc7feab3b09b8eb6", 0xae}, {&(0x7f00000006c0)="a0ca809915bec757f0b00fe1ce7c39cc0374b9bb394bd6a32cb16c059ee94fdd216113f048638aa15a3af5b13b7668bf826ae61f874ec2e2d1021b35db3e7bb5803079b417101d62285c383ac07b65edf3c9e3f845cb98a1718153e0938f7e7ff6020107bcf9989b03325a2157e111de1b0d404f8a8c415ca4e03360765c1a1764f5fafb00d9a8663e6a8369c1ca52dba810f75912ecdfd127ec1d9b82511a5a71ee7c6a4fab51c262f0d0340000000000000000", 0xb4}], 0x4) syz_usb_connect(0x3, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="5b050000061f6f20cd0ca5104ceb000000010902120001ea0000000904000000cd0c9b00"], 0x0) 5m13.893004789s ago: executing program 34 (id=2746): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @local}], 0x10) setsockopt$inet_sctp_SCTP_ADAPTATION_LAYER(r3, 0x84, 0x7, &(0x7f0000000640)={0x5}, 0x4) sendmsg$inet_sctp(r3, &(0x7f0000000700)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000380)='N', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0xc851) socket(0xa, 0x3, 0x3a) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = syz_open_dev$usbfs(&(0x7f0000000080), 0xf, 0x8041) ioctl$USBDEVFS_DISCONNECT_CLAIM(r4, 0x8108551b, &(0x7f00000001c0)={0x1, 0x2, "4cf90fba85c830e42a3ca4b10f01bbcb15f3806c4853e7c44a6974759d9f643905a56baa4195fb396d9bfa306999f1586e5d1ca49add100a36b751a7d9fe0b182ebf2c8a0e66f72c1c08260030752f07c94089473e5288773c85bacf3ccfac5bb9435fe036dcfccd7254bbd8bce90e2284d29e1f17d6652270fd0abcb8729f16ff602b438bd122a9e09984e2799d80e7ef7533d1a930ea4f4b57605ace45f5815450693650ae122d34aa0c5ca5e7b2516d156e5a0934d6c17c40d753426a3d8e15e726d0f2622e873e0cbe63751bb62c29f84d4cb0a21b92ad2e80f24a9b290a87ee6779022a0b7f5223e4e8c9f53f501ec8c439724078fdc076a51d52760566"}) ioctl$USBDEVFS_ALLOC_STREAMS(r4, 0x8008551c, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x482, 0x0) ioctl$TCSETS(r5, 0x5402, &(0x7f0000000200)={0xfffffffc, 0x0, 0x6, 0x0, 0xff, "db8f2d2b3b7596160c6981acf8805944823a7f"}) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, 0x0, 0x0) ppoll(&(0x7f0000000100)=[{0xffffffffffffffff, 0x200}], 0x1, &(0x7f0000000280)={0x77359400}, &(0x7f0000000300)={[0x10000]}, 0x8) unshare(0x40020000) r6 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r6, 0xc25c4110, &(0x7f0000000080)={0x3000000, [[0x7fff, 0x2, 0x0, 0x0, 0x1, 0x10000], [0xfffffffc, 0x52cf, 0x0, 0xf51, 0x6, 0x4], [0x403, 0x2000c, 0x0, 0x0, 0x0, 0x6]], '\x00', [{0x5, 0x5}, {}, {}, {}, {0x2}, {0xfffffffe}, {0x0, 0xffffff01}, {0xfffffffe, 0x1}, {}, {0x0, 0xffffffff}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x1}], '\x00', 0x100}) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r7, 0x800448f0, &(0x7f0000000180)={0x0, 0x0, "a4cd91", 0x9}) 5m12.526639741s ago: executing program 35 (id=2803): pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4880) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000580)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x40010000, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000002c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000020000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000000080000000000000000010000000000000044000500ac1414aa00000000"], 0xfc}, 0x1, 0x0, 0x0, 0x800}, 0x0) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e20, 0xd, @empty}, 0x1c) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r6 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000500)={'macsec0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x7, 0xaaf9f76dab351c33}, {0xffff, 0xffff}, {0xc, 0xd}}, [@qdisc_kind_options=@q_fq={{0x7}, {0x2c, 0x2, [@TCA_FQ_FLOW_REFILL_DELAY={0x8, 0x9, 0x880c}, @TCA_FQ_CE_THRESHOLD={0x8, 0xc, 0x9}, @TCA_FQ_LOW_RATE_THRESHOLD={0x8, 0xb, 0x4}, @TCA_FQ_RATE_ENABLE={0x8}, @TCA_FQ_FLOW_DEFAULT_RATE={0x8, 0x6, 0x5}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f00000004c0)={'vlan0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000006040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8848}, 0x20004800) socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_bt_hci(r8, 0x800448f0, &(0x7f0000000300)) fsopen(&(0x7f0000000280)='ceph\x00', 0x0) sendmsg$NL80211_CMD_START_AP(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000c091}, 0x28000811) writev(r0, &(0x7f0000000680)=[{&(0x7f0000000040)}, {&(0x7f0000000780)="cd0193ec7490037855c420610a2fed3fee4d99a0ecd77bc5b61944a2c2a0dc34041af62dcef4ef946ed0831f2f8b85246bcb96312cab45ebee5af58b1fd258593d451d81f98b936afae664bd126218819ffe29da9c797cd0031e9ff2f6889ab6325c7a8ee43fdd915d23a5945617afee2139f5a728c46c156838534697ad13d64f41b904098517e9", 0x88}, {&(0x7f0000000140)="65816891f9f33184be30f16d6839489a88a7151efe06e31f30fd9432f78c185dbcc2b5831e79fc3e579ea44090e0805a0230f6ef1475dfa0974d0eabd50f9e8ded10802dfd5a820423f90d6534cf2d0347ef03c8882a2fd56e2ebc0acd19f09f0302e2fab1bf295a56c0230cffd9e8b59cc59f4373d275187c962bc0e88b4ecb447796095ab7e372b04eeb974937901f2920a655d160da1b47c5192bcb362024c8d83d0713a8fc7feab3b09b8eb6", 0xae}, {&(0x7f00000006c0)="a0ca809915bec757f0b00fe1ce7c39cc0374b9bb394bd6a32cb16c059ee94fdd216113f048638aa15a3af5b13b7668bf826ae61f874ec2e2d1021b35db3e7bb5803079b417101d62285c383ac07b65edf3c9e3f845cb98a1718153e0938f7e7ff6020107bcf9989b03325a2157e111de1b0d404f8a8c415ca4e03360765c1a1764f5fafb00d9a8663e6a8369c1ca52dba810f75912ecdfd127ec1d9b82511a5a71ee7c6a4fab51c262f0d0340000000000000000", 0xb4}], 0x4) syz_usb_connect(0x3, 0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="5b050000061f6f20cd0ca5104ceb000000010902120001ea0000000904000000cd0c9b00"], 0x0) 2m19.352930862s ago: executing program 7 (id=3361): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x30d4, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000140)={{0x1, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)}, 0x20) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r3 = dup(r2) ioctl$BLKFLSBUF(r3, 0x1261, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'lo\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="680000001000030500000000fcdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="00000000008000004800128008000100687372003c000280060005000180000008000100", @ANYRES32=r5, @ANYBLOB="0500060001000000050007000000000005000300df00000008000200", @ANYRES64=r4], 0x68}}, 0x0) r6 = openat2(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000300)={0x80101, 0x80, 0x7}, 0x18) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0x8, &(0x7f00000026c0)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd1200000000000085000000d0000000b70000000000000095000000000000003fba6a7d36d9b18ed812a2e2c49e8020a6f4e0e4a9446ca2b5f1cc1a100a9af698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f010c5077da80fb982c1e9400c603146cea484a415b76966118b64f751a0f241b072e90080008002d75593a280000c93e64c227c95aa0b784625704f07a72c2918451ebdcf4cef7f9606056fe5c34665c0af9360a1f7a5e6b607130c89f18c0c1089d8b85880000c29c48b45ef4adf634be763288d01aa27ae8b09e13e79ab20b0b8ed8fb7a68af2ad0000000000000006f803c6468082089b302d7bff8f06f7f918d65eae391cb41336023cdcedb5e0125ebbccbddcf10cb2364149215108355ee570f8078be5cab389cd65e7133719acd97cfa107d40224edc5465a932b77e74e712a0d42bc6099ad23000000803a90bce6dc3a13871765df961c2ed3b1006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f40cab87b1586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9f081d6a08000000ea2b1a52496dfcaf99431412fd13f4cec49669e443dcb924cfe5f3185418d60532be9c4d2ec7c32f2095e63c8cdc28f74d043ef8dba2f23b01a9ae44cf945b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142bdda5e6c5d50b83bae616b5054d1e7c13b1355d6f4a8245eaa4997da9c77af40000000000000005f58351d599e9b61e8caab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a41326eea31ae4e0f75057df3c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57010000009700ce0b4b8bc22941330000000000000000000300000000000000000000000010008bc0d955f2a83366b99711e6e8861c46495ba585a4b2d02edc3e28dd279a896249ed85b9806f0b6c4a000000002b43dcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffff7f00000000df73be83bb7d5ad883ef07000000000000006da21b40216e14ba2d6af8656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff72943327d830689da6b53ffffffff631c7771429d1200000033ed846197fcff5e1c7c3d1d6e3a52872baef9753fffffffffffffe09fec2271fe010cd7bb2366fde4a59429738fcc917a57f94f6c453cea623cc5ee0c2a5ff870ce5dfd3467decb05cfd9fcd41df54cdbd9d10a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce978275d5bc8955778567bc79e13b78249788f11f708008b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab7929a57affe7d7fa29822aea68a660e717a04becff0f719107000000000000002d7e927123d8ecbbc55bf404571be54c72d978cf2804107f0238abccd32368e57040906df0042e19000000000000002c06f815312e086dd022c074eb8a322fb0bf47c0a8d154b405a07feaf3dd95f6ef44cd1fe582786105c7df8be4877084d4173731efe895efc71f665c4d75cf2458e35d2c9062ece84c99e061887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb2b5e518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad055e4af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457ac0eaaa99bf0bdc14ae358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df9b3fdf242b985bf16b99c9cc0ad1857036f1a985f369191ae954febb3df464bfe0f773ee9afe72f32a2befb89d3777399f5874c553a2ebe9061fe86e669642e09c0e5a3bb6d163118e4cbe024fd452277c3887d6116c6cc9d8046c216c1f8a9778cb26e22a2a998de5eaeadea10d3cfb41b92ecbb422a40da8daccf080842a486721737390cbf3a74cb2003efb9a101b51ab63e9600040000b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde6e4a4304e50c349f4f9ecee27defd83871c5191e10096e7e60fc3541a2c905a1a95e9571bf38aebd15172f94e3245c582909e2a3bce109b6000000000000000000d6d5210d7560eb92d6a97a27602b81f7636df1535bef1497f90100000000000000abf9010000007740890200d627e87306703be8672dc84eeadba6a41891c170d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288a0268893373750d10a3fc22dd704e4214de5946912d6c98cd1a9fbe1e7ef8c08acaf30235b920500d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69b93e9960ff5f74562adae283d9756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff85000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a31c72ad53bc19faa5401120000793ac48c1b539c75ab40743b00020000a1f68df75cf43f8ecc8d3726602111b40e761fd210a1920382f14d12ca3c3431ee97471c781d0d1280fb00818654a53b6df4b2c97cc1c98d85fda8f80fe908b65550b4412331d73062197655b7f0469250a5989cef0e10773920ed3ccee42d2c3eb80159da5c002511e6eb93842054cfce2ac306cb6e472db3fd67a49b6855a694a8d359add43907003223a47a7fae4f3748d5a432825bc40a03aaef1c8488d86dc211dd2a3ba71e0f45492ef1f8b65ccb3dcd251a61b152d02c29ca0a3328fa7753a5cddea1acaae55ae8263fb284b7a6ab2a8826c1b948207c498cf4824ab1ea3225a53072423b907c6682f8999e0311da5b8378bc841e1787e3a8128dda381a26cb2b365702ff8a27831375b2ddaa2f56e21169f7ca4fd9655ccd4a584acd244e965a0afedaff7c415ff682a4044b3381cc2df28278c9a6824c52048a7cfabda294925cc0956bffa8e950ff5e49f41ae600d830207bf728cd9807933c3c16d80bbea611a18becc2dc38ca0a6f5740f340b76edcd100fcffff007231dcef58c7b88b5aeedaf9626cb51ce1737c10ab37d4f98a934b0f900e0eb639878a1200629f5503cf679154d27681d7a3744cbcd42af59407c9c8e39c5271868917954e604352ba26171d004f1cb2976fab3fa19c7d3ef9678bff79f5155524f061378f94fb453786c3a6f78b10d383b49e31d1568bd43ee34ce6e6be235aa6207285665c2fba773671da41959f51610963b48930658e2d6125a26085001345b0473240b7e5e91811312c43663e76f711c6529ecdec75c7ea1cf0f8f8fff40247d59bbde2ebb8659197e0f37a71be1b12a182ed7de3acba28561a04b807f7a4647e2ea6d8fb92541d07c3d5e4ba077d3cad9f8ba1919592014c00c8eccb2ca5d48ba7b1c3fb185a4bb79700cf51f818b0c701c8de47d12281a67bdaf4b0c50bee9e8f5936250df2e15c1172e7ea6619f7db330700d1e9e42a035e6fd532f61fbfed9c4a7124a1e38eee50a6bbcd1d4e3f68c3f27dd9a70f1a7c6046237ddfb0b26e197322226367d998010458cd4df10af249ce717f6f45e5176e0ddae3054d7289d4e13ab0912703ee39ce264572b89194fdf7acecc35cf8309d4b680a08eed367dad855fce210f1a7c7222dd360eafb4bef7d58bf83362930af6e3f3f851abdc0003bdf9401b533019e90feb069189100007a82df8d9b5f44ebf9355e7b1b01c9470608d4f306d21004730396a4d6c6d46e1ffac97aa93c36123532a36186575266be4981c847160079421d0137801e553069f8d025c40f287378810defc7f2ed4e15f6af17b21153394f8bcfa6a23a77c8d61c9bbc127a57b8d631f36558d9093dee08bc53d97a8003363421738650a22c8fd87b13026799caf58e59951b125e7f161ca34e2c0dd65a23d01a3cb191e743de07247c7f993cf01166fa2ac1ba02f60550e63a7f50422e478c6b5d87f9bd0567a279a9d85a380db25c43bd0529ad783b9d64aaac1b793afb44b7126e17d2b7c0d6be650de7eeef3f3605af344015d03c3e7819145cb9fe1978c98bf9cf10773db59505ae33708c728844c872dfd2cb0b29008000000000000005ca18cb72f0944d0e4fea0a0abd0285bdaf1b000000c089d640c2facb0d1e6243873ac4b1e1068c45c715b68effb7d58d1f9e726dbf6bd910ca4ce0e075658ede42192cf393a50dcc197b03402fed75083628e5dd38213d353b9049e71f037064b05e73ec00c710f1ffc5737d397d555d1cf8859cc030ea8dc3c6a5b3b6fa1c81707479db1833d593a271253aa11efd936b74784f2fc286814848e92d8ee541bc179813297a0a4cc3c8f80c28701185bea091f32475e859479b734727afc110e1abcff460172fd1b42e3c0e2a4bf94a060069000010000087c7572a1e7596f89e5c3d5e70640c90815f77b7b13d0000000085a1e1e84900000000000000000000000000b422fc160a458ee5a91a2471e6e56fdabec6c73ce8983fc68f0b7cdcdde632e6f54a07620e8aa116ce9e84fc3cd5e8288a333dcebb233da9186796995ba69487d8f77d2f8800f02d690fc70a08b231cad1bdcf3740a95d4dd1cfe0f417f275493cf33b19ffff93dfdaf7eb00b8ad87cdf7c21bab5af8e2bac54ee5597e6508c1158124a538c36f9bb11fea7d8b8c7e954b1bc7811654a6636b33f271d0923e9ecd1b724b8feffadfc23c07000000f0785fb722f346d6a5dffe1884d4d0cd8f00000092c85ed44db68ab800001f00000000406e6ed9b219ad07125381087298e75965d1cc5932ddf9e66351b9332a34bee3e3d562c914c629933f0b8724cf680889ade72558d191d9890c69a718f9018586c5131c8dc8e0379bafda1a0fd2997ff115215ce23dca8db7236c1554cdaaadcce2f31834c1bd1908d8e1b361034db56be76acb7654a195bc3e98df3a5dffd5b0783883ef7da3433110e37f7c7cb7f3800de7f99abf910d6949e062747a9c87dcfcc716d6a9c0ec53b9cffe3cfd1df69a76f373d7f997edb9b80bdea1a99c2a6fbb25e035deadaadd7917ebfedd6304a19491769476208684e343f86b4d55a7dbbb07283cb1e35a138d24ebc5b4f8e35a82d3a7f84cb1e02a5a92b53567088be0b1ca023ccd518c0e0715b1c8760801a419ebd2e26440ff7493019bdb655cc88d72d6d7b6bca5a2e19b63ec52fce43d8c53a8031e64026e0d36b6401064c49a729f11ab377f7132c5232bb80195dd5d43d29646a9378eea0761b7ed9d2172e33ed87c7413c843b180cc00000000006bedf2ed716ca43a941119b96d82b26d9061de240d85ec2cfa462bd52104489bb7a7548d7cc53627031e909c69cb824233975a1ea645de63522407c3a240a37e946f30ebf075ea97846a0a8d2286f3f446b1b99ab83a12ddf8a1c06294eadc3eb3e339591afd5c00000000000000000000000000000000000000000000000000579dad8347a3d16976bb7483840b32db0158fb6c809349333325a7866ca5d3133e33ef1a183cefdb65a79fa71800988c8445029e024822dbcfcab49c3a0aec9bd43e6e14078b260700d849a2aa14c9b593f6dcb1de334c065ecfd65031606e55949c185bcda9fde4f9b46a76b8a24bbcd31b22373eb0473248150cd179405ee1af1183b0c0ce3483dc1d9bf732b0751b78fb211d6706b55960c6431afbc02b3c7e08086573939290bb9e590a3875f02a828b07f1dc7df9c8e5da22dfb9dacbf5529e4e994128d835f85465173ea7bbcc519a0c9798ce8b1b07567e3e07169c8c3e4da8bf725c050000000000000000000000000000000000000000004775abdf0c62728eb55a9e2849a1ce05bed60dfe4cc9fa43f9684297c02382c0a35829be7a86305792a9d2e80ca9e8fc50f31f6e0fa810303da03d8b74b42c1ebaf16bb343256405a3a07229a54de09a97b269cd29e8b2f0b0d46c51a6a93eec37f4bc6e29a8e19120ae050ab682662e9b2cc3263a4aba62b63ca9123a53c0f4bf3c4463b8144c89bf058a0af0ae9fc2b7cdfc4817703e267cddc193637d7fd97646090da37093657643daae3840c7f5c10f93524f7ae4791ec6e9d9722e5f670ccb358e051a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f00000001c0)={0x0, 0x0}, 0x8) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000480)={@cgroup=r7, r7, 0x2f, 0x2028, 0x4, @void, @void, @value=r8}, 0x20) r9 = openat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x10000, 0x14) fsmount(r9, 0x0, 0x0) r10 = creat(&(0x7f0000000440)='./file0\x00', 0x0) open_by_handle_at(r10, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000f800030000000400e5b7"], 0x830200) r11 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000480)=@generic={&(0x7f0000000400)='./file0\x00', 0x0, 0x8}, 0x18) r12 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f00000004c0)={0xffffffffffffffff, 0x0, 0x18}, 0xc) r13 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000500)={0x3, 0x4, 0x4, 0xa, 0x0, 0xffffffffffffffff, 0x101, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x3, 0x2}, 0x50) r14 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x80000) r15 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000580)={0x0, 0x7, 0x10}, 0xc) r16 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000600)=@o_path={&(0x7f00000005c0)='./file0\x00', 0x0, 0x4000}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1e, 0x18, &(0x7f0000000180)=@raw=[@tail_call={{0x18, 0x2, 0x1, 0x0, r1}}, @map_val={0x18, 0x5, 0x2, 0x0, r3}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xf, 0x0, 0x0, 0x0, 0x28a6d239}, @btf_id={0x18, 0x7, 0x3, 0x0, 0x4}, @exit, @btf_id={0x18, 0xb, 0x3, 0x0, 0x4}, @map_idx_val={0x18, 0x7, 0x6, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x8}}], &(0x7f0000000240)='GPL\x00', 0xffff, 0xa, &(0x7f0000000280)=""/10, 0x41100, 0x0, '\x00', r5, @sk_lookup=0x24, r6, 0x8, &(0x7f0000000380)={0x5, 0x4}, 0x8, 0x10, &(0x7f00000003c0)={0x1, 0xf, 0x8, 0xfffffffa}, 0x10, 0x0, r7, 0x6, &(0x7f0000000640)=[r9, r10, r11, r12, r13, r14, 0x1, r15, r16], &(0x7f0000000680)=[{0x5, 0x5, 0xf, 0x9}, {0x2, 0x1, 0x4, 0x3}, {0x3, 0x1, 0x7, 0x9}, {0x3, 0x1, 0x6}, {0x1, 0x1, 0x4, 0x2}, {0x0, 0x3, 0x9, 0x8}], 0x10, 0xe}, 0x94) syz_usb_control_io$hid(r0, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000440)={0x2c, 0x0, 0x0, 0x0, &(0x7f0000000340)={0x20, 0x1, 0x2, "6a9f"}, 0x0}) 2m16.276001721s ago: executing program 7 (id=3376): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x181942, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, &(0x7f0000001100)={0x77359400}, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f00000002c0)='./file1\x00') r3 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r4 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) symlinkat(&(0x7f00000000c0)='./file1\x00', r4, &(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r3, 0x40049366, 0x0) ptrace$ARCH_MAP_VDSO_32(0x1e, 0xffffffffffffffff, 0x5, 0x2002) statx(r0, 0x0, 0x6100, 0x800, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) 2m15.354431266s ago: executing program 7 (id=3379): r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) openat$cgroup_ro(r0, &(0x7f0000000580)='cpuacct.usage_all\x00', 0x275a, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) sendmmsg(r1, &(0x7f0000000ec0)=[{{&(0x7f00000002c0)=@l2tp={0x2, 0x0, @private=0xa010100}, 0x80, &(0x7f0000000340)=[{&(0x7f00000006c0)="cc5c84001214dbd9e5943aa8a315357330c56529d6b619a78687eea13ea02981afbb0fab70e8c3ab037cd82bd48f4947702a177974e7eff5f2ccdec909645f69e3dea5153157374459f6a21ba8609552d9ada54e81b0f19b55b77cf382ad229baa9decce1ea639a300f1fa65b945a0e29d36cb8ed3", 0x75}, {&(0x7f0000001400)="9af390e2aadb61017e08249a2485ad46a590a90910858e1ceefc66db2ed8f32bf6be0e2f94e7e4db6454393a128402ed26580c7c5ebc85db639da17c927c23dbde640ab030889e8b61f26d270bc73b21c9ac8ba542e6b4ad2cd147059128ba038e4b9ebb20537f437b23b46ec790720e1fb74cef3c677e9978662a84cf2fcf73c73a5e763358496737af6284226bad34fb9083f87d853ab78c816cf32c90bd5c40ff6446214552d29745d34e0c4bfa623d00e5cbb393972371503122a0f44135db5654ace67cddb85a12df91fcf994fc680afe5d34268b23447589ef3f5383d152bf6dd104984297180f896ec8b1ba50952c5ab76e144f5636692d7cf17922c9b447ed6d59553ec6085e07413034875c1ae0947280e1a6f0d5e7f23b32e56ead8590d3269fdcb624cc870968b2f100bf3bc3d2ab105a5f61456d4969181fbd207b6f4d6d9ca0a1920daabec06d0c5e276d18f2571e88373dd41af9080d72aa88b10f8900b48acb61a61007dd4dd0e9240af5382a26f68bd706a83d8df76a4a5d02b39d07f97c4f86dad9e14eb957cc4be52b027a462262589929e3d035188dd9f0561e3ba2de6bafe743d9ae397e9aa423644fba8b2d6425ac1cd78c76e52e04d3a29e74075625fb5e674bab02843991ce804e0d04961f2978f3749c5ad83f355ae5da936fd6e0178d2bd12aacbe0205aa9a15579fd61d738f8d36412e814ba500edaf28ea68b0e96fb1839acf8416d8f5df7fad3b663f68e2ee5784fd01c7021130a490e629b1348acf3479e0392ecabbeeb18ec421c26e76f6f5c480e7decc85a0583a56180f199d26090b10ee5057ec4c1e04be948a5960acda014d646cf91bfdfb9d327f8ab545f8b41e8dbab94f195b189a8642a6b95e0ceb36b640fbdfe21925cc110bd2ef2c3fe24f12f95771b60e2ffbc47e58b2237b5574cadc32aab0f0db3202e4adc44a0651ef97703957857cfb6022578c97802f486bd7f48129f0c120700d0b70e048618a9f1de9f34dbb1f92dadc86f09e6288eb1bdbd1f700cc2df781654dfd57d9da779607080d3bc6dede5818aa8d6c99fa1ffdbb6a1a43040fe1379cf2a8b4b862db428c29e388a6e6b863bc818c2139a0d4238f10baf22f498b6629181f997ac280547e92fe300d0f8dd8b6724df5aa14be73cd630b808a29bfb52707b8db7d0065bd753b3773f8df58c74ea56f4582caa2fa8532b8049fd9ba775afc5b92b767ed0b35d4c086d9af6f7b7ed96f5f9d3734e703fc683fe0ed82b7763c67734067759e27b60036a3b4c53526716c175d75a9fa6ed019d3e1047bcb9c6510665de23cc2802804a0c3a347faba392282df430e5e6141f9eb660f7cb0eaedb832a7880c953bc0188c1f28eb466799e2768886ef81096847f50159278b572b0cca7744d6a572a81ddd2bcea73da3c8a59680bcaaadaf95e1fe91e41a8036835975b072a9587c560e3da854c96c64011755d08fef5228bb2db62a445bc0b9e17dea88854cd6a7c8a288727d5690fc4941978dee5eda2dbdc85915e7a2fdae978adb217b3f6b31cf69b51b9f805f8b447a4868b442933fc0e03860a7084230ff8fdff70665717f9c0bade31f87f5de99643e800feceb0dfdd6d1b67d4056a52f0efa2ed2b1142132c6242d917b46d939aade6a362bf586058385d7fcef1b4e358a093d6781b9e9bf280520ff083a6026bf701237e38927ed21209dbf407a7944ef687b93619b181b9112477fa902f391a7163f93bec2d6369ffba644f4fd5139890fb66bd6017a61d9fd043154eb0ab0de3046cdb8a182a553cece0701a922518cf09cd1ab421ee8ec677a8d453cd8c21bdaa5f8dd804dfe80fffec8c4d778d5e260b65a2f0d3c1b09e9d6bd1f3746aa7fe07374a028a89fc96eb66affbcddfaa01a72058566e33af88e37f43fbba73c0423d54079fad54c136ec5fcd61d5134f833ab44f6cfbc2348871f190ac4c4bc20c97fcb29f4823a8e3bf76f85b10dfd33df0001646a7e0b2ee3e14455f6c8f225b80eed457e772cb2504ded46a24e911428decff4a130be797b6530c33ec1be7b0dd4df6206eca1c4c8dfda776336bcb876d80043195de773fbcf0d3abe53e9a38da0af7a6598815a71ffc937203f5a04e87eb532e579d66d42b06b791b6ebd50e7855f6645d29434bb0280fdf1511b163b12838f39ca864516711501bbe345d46b34ab2f0d8317d45376f73e302a90f5c362b18e1840668a9f27e90f2b715b4b6ae7a6dc387583110a42fd4977635275f7244a1912d0c67cf53d5da8a384839020d71db234fcc4388a735275763f01b2b4967e99f551e489bcc28f693a1e688ac8c39a971f8ae9d973cc7adac4a642a7a84ecca2d0bd24c300b94dff82fa4f95c1ce5fdb9128466443cb8442048e53cd46334d59774de0e2ceefcd4cd2e6c9da7cdc2162346111f7da236d72f33d509d73133951e1a3f84fa7e767cf56fc9bfb3986c5ec501634b92a780f63e0ee61e3d25f51c39b975ea587027a101059e9386f1eaaaab8ebfd5c453e9f86c851f9c78e4e06184f04fa9a54ba0bba5d18108c2973f50cb626eca6e3d5b2907b00d2ad4fff9546482815291bd220fa31c1d1a735562174644fe06131e31ce66064fa6a02d5bda756994f81163b97e854274183bbc4ddeb9bb823944afc3e07caf510732df2835fd11de82cb318b88f4d385adb57ac73ffe7f3d1e387848766e11000c94123f2a7d33a93d3b030ebb1206f26221a1ceef44a708693796ab80add7d9b6907c653c6becc21d49c380b3fea419276a387ad482fc3614fa7cac6ea9d07dffc85c1d3f01f57aa9816f32e3237b05d191c3f3d2ed31c313346176d18dc53307afc3aea306a5b44189b6fce062cd21319f1c0a5cf3bc84aaff275491d5fa26d12173e134bdb776478c27502dd4786cc079b6eb00d05f1c8c27a2e326ef11ad1866529b60e6a9e9ae776f01071e364a4604dfe79fbdfc9828628e50940398cc6b925ea8806ee3bbd22129c5d37551eb5e1ef613b027aebce0a83963888396f3e7c953e5416b522fd3a0660fefaea0fc97ca7d82191e2e8f23ca2aa56e8b9de2e1d3e093b8c3f4d7e700b7193b3d83c5b6bb1e7ff2a1c574c9d15ad79631573e41d46653601c510ec7cd0d6125c8e600ebb41247988c28305ac47eead817fecf4460c2221a399134d1d11363401090691a7bf1f58f27a09311d6591cef3d879570667e9e10eebf7df32ec9417f0132be9f1485b167b58b0bf88e31fb2d3957fa05a4d3f191c1d1caa189fc0c11c04287ceaee39a147aced6e3e9c2fe8f51a9823401ad4bf92b0fd4070aae1fe886b8c160a0d2a1507259e58c5608654f05f444877bf9ec215933d6f0a89a3f6199a23c535d8cf9541f2eb970261b12325884fe64330f67a8b07748522c58e5096a04afc67f08b4b0b3da2c9e010b8f079fabdbd187b3d1f69b9f8110e0ec3a488aa8b8563745f7e9fdc1faeaf542858f417d3a75d416e8f55c46cd962d9ac96ce8b56f7a0e22350d2b9e8a537780edddd519fd43baec4834aa6abb0b8c4007dfbb9dac74bf3802108966bf7d5a2999d16110ad0d2cab1c72c2d0ddce14e5043ee62fe9b722355dd2b7e728a589da59ef46dae95f1b89c22d5487a855bc1ee5f9d1427f643e2fa8748e07e6b51e365ab5e23e32401acc229c09f56868532ca611fa678b1", 0xa36}], 0x2}}, {{0x0, 0x0, &(0x7f0000000600)=[{0x0}, {&(0x7f00000008c0)="90b9f79fecbead0dcee5ce27047e4dad3fcdd2c10d8474464a37dea4c1ab2a961404f5aa544515c10a65e395edcfa65d27b9c9a2c71433375810d44ee5a60cdd5e9d889ffd646bcd2e07fc1f5b1e7e9a9cc4eaf0657737d680c69e7f6cf914552c221da50bd4de63c964d777358f4d575ac53237e270b2c2c31035dd521048e0957ef8788656a1a9bc19de515b0db6223a5e7942b70249d792d161d579be1e235754073af3013897a6252da9ae0bdf23d6aae67addb56a22d18037cf6a148bd9", 0xc0}], 0x2}}], 0x2, 0x11) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x101042, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r3, 0x1, &(0x7f00000002c0)=[&(0x7f0000000200)={0xffffff7f00000000, 0x0, 0xa0, 0x1, 0x0, r2, 0x0}]) r4 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000740)="ebe3a0e9796cfd1647e299f4e376fd11148280b372219d205e7bdc705df48badf4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884eb0958730480000000000001000000000000065836fe77c90c0a87c37555f7f433f74453635860abd1a2a241ac667459e488c7769c0c8b84d666ff14a6365cb39d1f6be6bf3b820eb0a68a1e0b707b87d34fb0805c096088b1563bfad26e4d7b57d7b357b78fbccd2794007d5e6c6963809cba5fdb62bdede5c361a3d871f2634546eaa8d095546b2429b3d143aaf02b64d8eb692072db8aad6dbc95c32f5853a97c83bd7ed07e52d40a798fcb036156fe79e90bf7f18dc26ea6ff55d1fef60aed2ac", 0x103}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000000010d804dd000000000000010902240001000000e9090400000103000000092105000001220500090581030002"], 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB='\x00\x00\b'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_ep_write(r5, 0x81, 0x3, &(0x7f0000000000)="10db5a") r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000540)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r7, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r8, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) 2m12.054783811s ago: executing program 7 (id=3391): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x181942, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) r0 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, &(0x7f0000001100)={0x77359400}, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) mount$fuse(0x0, 0x0, 0x0, 0x200000, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r3 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) symlinkat(&(0x7f00000000c0)='./file1\x00', r3, &(0x7f0000000100)='./file0\x00') statx(r0, 0x0, 0x6100, 0x800, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) 2m9.416334997s ago: executing program 7 (id=3395): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$F2FS_IOC_DEFRAGMENT(r1, 0xc010f508, &(0x7f0000000100)={0x2, 0x9}) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@setneightbl={0x12, 0x43, 0x1, 0x70bd2c, 0x25dfdbff, {0xa}, [@NDTA_NAME={0x5, 0x1, '\x00'}]}, 0x1c}}, 0x0) mount(&(0x7f0000000080)=@sg0, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000000)='ubifs\x00', 0x200000, 0x0) 2m9.290906709s ago: executing program 7 (id=3397): r0 = socket$inet_tcp(0x2, 0x1, 0x0) inotify_init1(0x800) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x46c}) r2 = syz_io_uring_setup(0x2839, &(0x7f0000000340)={0x0, 0x47c5, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x82000) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe8c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000000c0)={0x1, 0x8, 0x0, 'queue0\x00', 0x2}) write$sndseq(r5, &(0x7f00000001c0)=[{0x0, 0xe1, 0x0, 0x0, @time={0x0, 0x1}, {}, {0x1}, @result={0xffffffe0, 0xfffff001}}], 0x1c) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$sndseq(r6, &(0x7f00000003c0)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x5, 0x6, 0xe2, 0x7, @tick=0x6, {0x10, 0x31}, {0xff, 0x2}, @addr={0xf7, 0x6}}, {0xf8, 0x3, 0x3, 0x81, @time={0x9, 0xac}, {0x15}, {0x9, 0xc}, @raw32={[0xf92, 0xcd, 0x9]}}, {0x48, 0xc1, 0x2, 0x6, @time={0x80000000, 0x21}, {0x5, 0xf8}, {0xe, 0x2a}, @raw8={"a7ada0cd33c336402af7e379"}}, {0x8, 0x0, 0x6, 0x5, @time={0x1, 0x9}, {0x3, 0x1}, {0x81, 0x29}, @raw8={"a1efc3639154fe15eb151211"}}], 0x8c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xe, 0x0, @fd_index, 0xfffffffffffffffa, 0x0, 0x0, 0x8, 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x2a8, 0x98, 0x2a8, 0x130, 0x1f0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0xa}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x5}}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r10, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f0000000000), 0x0, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 1m53.771712966s ago: executing program 36 (id=3397): r0 = socket$inet_tcp(0x2, 0x1, 0x0) inotify_init1(0x800) r1 = userfaultfd(0x80001) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000000)={0xaa, 0x46c}) r2 = syz_io_uring_setup(0x2839, &(0x7f0000000340)={0x0, 0x47c5, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x82000) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe8c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r5, 0xc08c5332, &(0x7f00000000c0)={0x1, 0x8, 0x0, 'queue0\x00', 0x2}) write$sndseq(r5, &(0x7f00000001c0)=[{0x0, 0xe1, 0x0, 0x0, @time={0x0, 0x1}, {}, {0x1}, @result={0xffffffe0, 0xfffff001}}], 0x1c) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$sndseq(r6, &(0x7f00000003c0)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}, {0x5, 0x6, 0xe2, 0x7, @tick=0x6, {0x10, 0x31}, {0xff, 0x2}, @addr={0xf7, 0x6}}, {0xf8, 0x3, 0x3, 0x81, @time={0x9, 0xac}, {0x15}, {0x9, 0xc}, @raw32={[0xf92, 0xcd, 0x9]}}, {0x48, 0xc1, 0x2, 0x6, @time={0x80000000, 0x21}, {0x5, 0xf8}, {0xe, 0x2a}, @raw8={"a7ada0cd33c336402af7e379"}}, {0x8, 0x0, 0x6, 0x5, @time={0x1, 0x9}, {0x3, 0x1}, {0x81, 0x29}, @raw8={"a1efc3639154fe15eb151211"}}], 0x8c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xe, 0x0, @fd_index, 0xfffffffffffffffa, 0x0, 0x0, 0x8, 0x1}) io_uring_enter(r2, 0x847ba, 0x0, 0xe, 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000001640)=@mangle={'mangle\x00', 0x44, 0x6, 0x408, 0x2a8, 0x98, 0x2a8, 0x130, 0x1f0, 0x370, 0x370, 0x370, 0x370, 0x370, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11, 0x0, 0x69}, 0x0, 0x70, 0x98}, @unspec=@CHECKSUM={0x28}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@ttl={{0x28}, {0x2, 0xa}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @empty, 0x0, 0x0, 'syzkaller0\x00', 'dvmrp1\x00', {}, {}, 0x6}, 0x0, 0x70, 0xb8}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x3, {0x5}}}}, {{@ip={@broadcast, @dev={0xac, 0x14, 0x14, 0x18}, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x98, 0xc8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0xc}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x468) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) connect$unix(r10, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f0000000000), 0x0, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 12.718551873s ago: executing program 2 (id=3808): r0 = socket$inet(0x2, 0x801, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e23, @multicast2}, 0x10) sendto$inet(r0, 0x0, 0xe803, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x3c}}, 0x10) sendmmsg$inet(r0, &(0x7f0000000a80)=[{{0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000200)='\\', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000700), 0x62, 0x0, 0x0, 0x40020000}}], 0x2, 0x4000000) 12.623060016s ago: executing program 2 (id=3809): socket$inet_sctp(0x2, 0x1, 0x84) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000040050bb41900000000000109022400010000300009040000014dc6f24a092100020001030002000000"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000380)={0x2c, &(0x7f0000000180)=ANY=[@ANYBLOB="20030600ba1fa3017c33d96c"], 0x0, 0x0, 0x0, 0x0}, 0x0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000000)='.\x00', 0x400017e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000013c0)=[{{&(0x7f0000000b00)=@xdp, 0x80, &(0x7f0000001440)=[{&(0x7f0000000a00)=""/39, 0x27}, {&(0x7f0000000b80)=""/31, 0x1f}, {&(0x7f0000000d80)=""/47, 0x2f}, {&(0x7f0000000dc0)=""/61, 0x3d}, {&(0x7f0000001500)=""/255, 0xff}, {&(0x7f0000001400)=""/46, 0x2e}, {&(0x7f0000000f40)=""/218, 0xda}, {&(0x7f0000001040)=""/231, 0xe7}, {&(0x7f0000001140)=""/113, 0x71}, {&(0x7f00000011c0)=""/108, 0x6c}], 0xa, &(0x7f0000001300)=""/140, 0x8c}, 0x1}], 0x1, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x3010, 0x0, 0x206}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0xfffffff0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) syz_io_uring_setup(0x497, 0x0, 0x0, &(0x7f0000000600)) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x44200, 0x0) mq_open(&(0x7f00000000c0)='${$\x00', 0x840, 0x0, 0x0) r7 = syz_io_uring_setup(0x9e, &(0x7f0000000640)={0x0, 0xec25, 0x0, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_enter(r7, 0x847ba, 0x0, 0xe, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x32, 0x2000, @fd_index=0xa, 0x4, &(0x7f0000000cc0)=[{&(0x7f00000003c0)=""/120, 0x78}, {&(0x7f0000000440)=""/222, 0xde}, {&(0x7f0000000540)=""/69, 0x45}, {&(0x7f0000000700)=""/225, 0xe1}, {&(0x7f0000000800)=""/115, 0x73}, {&(0x7f0000000880)=""/164, 0xa4}, {&(0x7f0000000bc0)=""/205, 0xcd}, {&(0x7f0000000240)}, {&(0x7f0000000a40)=""/139, 0x8b}, {&(0x7f0000000940)=""/167, 0xa7}], 0xa, 0x1a}) io_uring_enter(r7, 0x47ba, 0xec8a, 0x53, 0x0, 0x0) read$FUSE(r1, &(0x7f0000001fc0)={0x2020}, 0x2020) 8.786816341s ago: executing program 2 (id=3826): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)=ANY=[@ANYBLOB="2000000010000104000000000000000000480000", @ANYRES32=r1, @ANYBLOB="ad1e"], 0x20}}, 0x0) socket$rds(0x15, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[], 0x50) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8b06, &(0x7f0000000000)={'wlan1\x00', @random="060000000010"}) r3 = socket$kcm(0x10, 0x2, 0x0) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) sendmsg$kcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="2e00000010008188e6b62aa73772cc9f1ba1f848480000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) 8.363172914s ago: executing program 9 (id=3831): pipe(&(0x7f0000000500)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000001c0)='sched_switch\x00', r1, 0x0, 0x3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r2, 0x84, 0x19, &(0x7f0000001500), 0x8) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) ioctl$COMEDI_BUFINFO(0xffffffffffffffff, 0xc02c640e, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount(0x0, 0x0, 0x0, 0x0, 0x0) ioctl$VHOST_VDPA_GET_VRING_GROUP(0xffffffffffffffff, 0xc008af7b, &(0x7f0000000180)={0x1, 0x4}) semctl$IPC_SET(0xffffffffffffffff, 0x0, 0x1, 0x0) socket(0x2c, 0x4, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) r6 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPUT_VSCREENINFO(r6, 0x4601, &(0x7f0000000040)={0x191, 0x78, 0xa0, 0x3f, 0x32, 0x1c0, 0x0, 0x0, {}, {}, {}, {}, 0x0, 0x40, 0x0, 0x0, 0x0, 0x6, 0x1, 0x1, 0x0, 0xfffffffd, 0x0, 0x8, 0x4, 0x0, 0x2, 0xa}) r7 = fsopen(&(0x7f0000000080)='jffs2\x00', 0x0) fsconfig$FSCONFIG_SET_FD(r7, 0x5, &(0x7f00000005c0)='fd', 0x0, r0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) syz_usb_connect(0x4, 0x10b, &(0x7f0000000000)=ANY=[@ANYRESDEC=r7], 0x0) syz_open_dev$sndpcmp(&(0x7f0000002000), 0x5d5d, 0x0) 8.335933774s ago: executing program 2 (id=3832): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "5d9bc136c963254c661fb620148b6f72ca6ae2a44829bfa79ec13499f8ec9077d85d879711d98bb1687ad36dfe5f14a7b0ce15c1e6be0e7ecabfdfde0dfa00b1"}, 0x48, 0xffffffffffffffff) pipe2$watch_queue(&(0x7f0000000200), 0x80) creat(&(0x7f0000010280)='./file0\x00', 0x182) r1 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000480)=@upd={0xe0, 0x12, 0x1, 0x70bd2c, 0x25dfdbfb, {{'ccm(des3_ede)\x00'}, '\x00', '\x00', 0x400, 0x2400}}, 0xe0}, 0x1, 0x0, 0x0, 0x4804}, 0x2890) 8.172929925s ago: executing program 2 (id=3833): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x972, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) socket$kcm(0x10, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000002100)=[{{&(0x7f00000002c0)=@can, 0x80, 0x0, 0x0, &(0x7f0000001a40)=""/135, 0x87}, 0x8b6}, {{0x0, 0x0, &(0x7f00000003c0)=[{0x0}, {0x0}, {&(0x7f0000001d00)=""/253, 0xfd}], 0x3}, 0xfe64}, {{&(0x7f0000001e80)=@phonet, 0x80, &(0x7f0000000440)=[{&(0x7f0000001f00)=""/225, 0xe1}], 0x1, &(0x7f0000002000)=""/235, 0xeb}, 0x1}], 0x3, 0x40000000, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r2, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000080)={0x50, 0x0, r3, {0x7, 0x29, 0x9, 0xffffffff9080edc4, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x101800, 0x18) syz_fuse_handle_req(r2, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x0, 0x800000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r2, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)={0x10, 0x0, 0xfffffffffffffff9}, 0x0, 0x0, 0x0}) getdents(r4, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0008000001, 0xfa11, 0xffffffff}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) syz_open_dev$video(&(0x7f0000000140), 0xd, 0x0) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000000040)={0x0, 0xfff, 0x4, {0x9, @pix_mp={0x12, 0x5be7, 0xb5315258, 0x6, 0xb, [{0x80000004, 0x7}, {0x7ff, 0x5}, {0x10000001, 0x9}, {0x63d, 0x7fd}, {0x1, 0xb}, {0x7, 0x489aa92e}, {0x5}, {0xff, 0x7}], 0x1, 0xc, 0x2, 0x0, 0x3}}, 0xfffffffd}) r5 = io_uring_setup(0x24b9, &(0x7f0000000000)={0x0, 0x9aa5, 0x400, 0x1, 0x58}) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r5, 0x13, &(0x7f0000000400)=[0xe758, 0x8], 0x2) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) write$P9_RGETLOCK(r6, &(0x7f0000001b80)=ANY=[], 0x200002e6) fcntl$setpipe(r7, 0x407, 0x100000) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 6.348819245s ago: executing program 0 (id=3838): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x400}, 0xc) socket$kcm(0x10, 0x2, 0x0) r1 = openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2d41, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x11, 0x0, 0x0, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x33, 0x0, 0x40f00, 0x26, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$VT_RESIZEX(0xffffffffffffffff, 0x560a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x7) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffffffffffffffff, 0x4}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) socket$nl_route(0x10, 0x3, 0x0) inotify_rm_watch(0xffffffffffffffff, 0x0) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00'}) sendmsg$nl_route_sched(r7, 0x0, 0x0) r8 = open(&(0x7f0000000040)='./bus\x00', 0x200542, 0x42) mknodat$loop(r8, 0x0, 0x8000, 0x1) ioctl$SNAPSHOT_PLATFORM_SUPPORT(r1, 0x330f, 0x4) 5.33315203s ago: executing program 6 (id=3839): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c"], 0x0) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6(0xa, 0x80000, 0x80003) connect$unix(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000a40)=ANY=[@ANYBLOB="84010000", @ANYRES16=r2, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b800800090000000000080009000000000008000a000042000008000a000000000008000a000000000008000900000000000800097c86b722735035dc0067f6b13308000a000000000008000a000000000008000900975b9b5e04000b801c000b8008000900000009"], 0x184}}, 0x0) 5.201829126s ago: executing program 9 (id=3840): r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi1\x00', 0x401, 0x0) socket$alg(0x26, 0x5, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) syz_open_procfs(0xffffffffffffffff, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) socket$kcm(0x23, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000700)=@mangle={'mangle\x00', 0x1f, 0x6, 0x418, 0xa0, 0xa0, 0x1d8, 0xa0, 0x138, 0x270, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x3, 0x7, @multicast1, 0x4e22}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xe, 0x4, 0x2}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x36}, @loopback, 0x1fffffffe, 0xff, 'pimreg1\x00', 'dummy0\x00', {0xff}, {}, 0x2, 0x1, 0x40}, 0x0, 0x70, 0x70}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x4, @remote, 0x4e21}}}, {{@ip={@remote, @multicast1, 0xff, 0x0, 'virt_wifi0\x00', 'team_slave_0\x00', {0xff}, {0xff}, 0x6c, 0x2, 0x59}, 0x0, 0x70, 0x98}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x1, 0x3, 0x2}, {0x3, 0x0, 0x4}}}}, {{@ip={@local, @remote, 0xffffff00, 0xff, 'gretap0\x00', 'batadv0\x00', {}, {}, 0x84, 0x1, 0x5}, 0x0, 0xa0, 0x110, 0x0, {}, [@common=@ah={{0x30}, {[0x3, 0x5112], 0x1}}]}, @common=@unspec=@NFLOG={0x70, 'NFLOG\x00', 0x0, {0x1, 0x0, 0x46c5, 0x0, 0x0, "2b4e84400af0c61fe4b77d62d90d10d33fce7dc71425d4209d84f086ee827a4b064c417320a5f57e2dcc64d51dd574bd8c47cabfe9f21364d0c1a47f3240e300"}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f00000000c0)={'pcm3724\x00', [0x6, 0x0, 0x800, 0x5, 0x1000, 0xcc7, 0x200006, 0x4, 0xa, 0x6, 0x2, 0x9, 0xf, 0x1, 0x6, 0x100, 0x7, 0x1a449, 0x406, 0x40000003, 0x89, 0xcae3, 0xfffffff6, 0x20001e58, 0xb, 0xe69, 0x3d, 0x4, 0x9, 0x3, 0x8]}) 5.119266477s ago: executing program 9 (id=3841): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast2}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001600)=ANY=[@ANYBLOB="0100000000002000000000ff00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r2 = dup(0xffffffffffffffff) read$FUSE(r2, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x4020400) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x4020400) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x48) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x14, 0x6000, @fd, 0x0, 0x20000003, 0x8020, 0x0, 0x1, {0x2}}) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) 4.726573738s ago: executing program 2 (id=3843): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, 0x0, 0x8d) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r6, 0x29, 0x37, &(0x7f00000002c0)=@routing={0x6, 0x0, 0x1, 0x7f}, 0x8) connect$inet6(r6, &(0x7f0000000000)={0xa, 0x0, 0x0, @local, 0x5}, 0x1c) sendmmsg$inet6(r6, &(0x7f0000007e40)=[{{&(0x7f0000000340)={0xa, 0x4e20, 0x0, @dev}, 0x18, 0x0}}], 0x6c00, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x3, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) 4.72632383s ago: executing program 8 (id=3844): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) r3 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000080)=0xffffffffffffffff, 0x4) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000008c0)=@bpf_lsm={0x1d, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x41000, 0x9, '\x00', 0x0, 0x1b, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000780)={0x5, 0x0, 0x4, 0x5}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80}, 0x94) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a310000000070000000060a010400000000000000000100000008000b400000000048000480440001800b000100657874686472000034000280080001400000000c080003400000000008000440000000220500020007000000080006400000000308000540000000000900010073797a300000000020000000030a010300000000000000000a0000020900030073797a300000000044010000080a01080000000000000000010000073a00074032e97608c07b8f34d704cc507d07a8d4c429672a9b6841e516ce194f03354b3c46a930469ce36ee8391a02352a70d543c633dc17a9d300007900074012119f33dbd27dbba871f33b8206fc0a59dac6df96baf86f3deffa20b8a2b13fa2fbc917a33ad4b9dc903553ff1e7533cd9d1e3f6a3248b10a63552977fab38d9ad7409cbd223b094a0bb6f0884c8839890d122f9b9963668c97749b2304852a8d461ccc39dc307f41ac41688a4f2d64a916dc532d00000008000a40000000000900010073797a30000000000900020073797a31000000002c00058008000140000086dd080001400000002c080001400000001608000140000000736afd014000008100080009"], 0x248}}, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000340)="670f16f466b9b300004066b80000000066ba008000000f300f0db92211bad104b009ee0f3a0f64a300676466660ff892000000000f224526360fae22ea3dc9da00f2d9fd", 0x44}], 0x1, 0x52, 0x0, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f00000000c0)={0x7, 0x8, 0xfa00, {r6, 0x5}}, 0x10) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000001c0)={{0x1, 0x1, 0x18, r1, {0x2}}, './file0\x00'}) ioctl$sock_inet_SIOCRTMSG(r7, 0x890d, &(0x7f00000003c0)={0x0, {0x2, 0x4e21, @empty}, {0x2, 0x4e24, @empty}, {0x2, 0x4e23, @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000200)='veth0_to_bond\x00', 0x4, 0xea4e, 0x6d21}) write$RDMA_USER_CM_CMD_LISTEN(r5, &(0x7f0000000100)={0x7, 0x8, 0xfa00, {r6, 0x4734}}, 0x10) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x6, 0xec, 0x9, 0x8002, 0x7, 0x800004254ff49, 0x9, 0x5d1c000000000000, 0xfffffffd, 0xe, 0xfffffffffffffffe, 0x6, 0xffffffffffffffff, 0x5c, 0x9, 0x5], 0x100000, 0x80402}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 4.70343446s ago: executing program 9 (id=3845): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r3 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0) ioctl$IMADDTIMER(r3, 0x80044940, &(0x7f0000000600)=0x14) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='squashfs\x00', 0x208000, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r6, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) ioctl$sock_inet_SIOCADDRT(r1, 0x890b, &(0x7f0000000000)={0x4000000, {0x2, 0x4e22}, {0x2, 0x0, @local}, {0x2, 0x0, @broadcast}, 0x40, 0x0, 0x0, 0x0, 0xfff8, 0x0, 0xfdff, 0x5, 0x401}) writev(r0, &(0x7f0000000140)=[{&(0x7f0000000080)="b01b16fa07b10fce87a2f3cf10fa499ad5386c5cfb91136274f3e6740d361b8ed76ff390278d7846782a776042532fae7a03ed9554d66ac32036849302d4877a8b2761c92969c017516a2d89849f28b7396e7d0e85448137b7489e9909141858161586874a83d865a5d25f4ef16e483eeff6c4f654082b41", 0x78}, {&(0x7f0000001480)="d2093edf887134c3d6fec56ba7dbb695a2e2012b4d0566a07824af5e3bdaf1a4ee596503b6dd60d7fe29034f40ebae99d2d1d7ced6805770c388b96566b09b7a903f23c613d054b677de4c2ab63390f58daae4fbf6cb59b93e6bf0d204feb3e681efdb2b59b3e95644815f4c97aac5936e11544142c6944c4cec2adeedda66405edd492b656441a297054b95ad601d109c37773642b31a8eb290af893c14cdcdebfbfa8e5475dd28a0439c88659abb3093cf8aae2265a1d2d8583aae28ddf91ec570197bb4624f74789b4e46951ee03cbedec9ba2a35640b2525e6b811c3de6f876bde30bd71e735401592bb835b67d375c9095938f5ecdb790948bea252916e837ce385a64475976f5230cc3c82f1a38d22381eaf5a0df5b7624767a13ba532f65b4171c08d3e58140e51f688e9c007f2939d14c7dfdfb6ee6d8b3ed835817bf1be04db2e804990e3a899c3090504a1d8758676de346a981e31bb3621143f31cf5a182aa8e7001b89e263e4ea5a9725807b3074de1b3331d6e05206bb257b993834e4b3d27209782ae58c5173a85349197cb76a9814e8098682312c4ea8ed8aa8517dfa3a875628b4cff618f47b418214976aba66e2b7f2ed6ce35b7218a9f4e0a36d58e3f93ed72ca52c521ec0b7d62ea43df5b4728d385642e7c51864466d629e94416b464b5f13d634b43fb3b7ae8081b47905f6de4431d229f4307742dce0abe59731a8e87d0306828f37cdcaf1b1d7ab9200a9320aec46bcf4ed730785a662aab2a9d6bcd61f21225fb90b682fb69684f8ab2e0b4dde598f88aed0875a1107abf52bdd6666007246f0e4ab95d06d5f0742cb244540e5ebd3db966e67d7ab16540fe812f74197e39d6311d7aae113d186662f0f88793f39419ebfdbff867ee67fe7523ff2325bda3092f26abe4e6b0f03ba3329e3cd01e34bf3020e22e3893c42ca3bedcb5fe8d3ace760de9e7a358d4c74c693409493a5a2fa17a761c372f0c2c36e5039fb734db97b0537ac170534e5b01e77468bc45783192d850015b477cfa35af614243da1d894263575e2a5dad5d7f585d5feefc26070c80c81a2aa7b1009eee21e7e87ce5a8e8eeca7d6ab6b5a07fcd27ac1d63eb5aa6c31ec8f61ca535ff44f1eaaa63b8d5213cdb0c5636f1cd5e70ee2e2fc05da3422987bf09a95c6426a93644c62701513e315a3fd231a60e4ea18b9e0704831e943761a184c50e5ad8740bcb59216b7105d8811f4fae335036af508aea3de4b3e9eb609a13d554246f46e679d87902fc9877fe3f11a1cfb47c731f5e1a0e71909c874e6af0c6fea313b7dbac6759ba754f906b0fb590fb321fea686e991a309cefca00f6dd54db7f55cc6afca77f7898c54afcce23fa364a0dfa18210dcc55474a081d0e44ceae8b72328f0717051a9f6c281ce1a916be267b842ff9ba76ece263d13c01d3422d50f5f4cad8acde6da54ec0a8e9639143577eca5d40ceb6b29cca737e0887a19c33d013baaa7660290d46a23071a339fc007d2828775ed8d01a5b6593b1364f8b1871b336df5b830ba19e8da46fc724f0ecc3848d8951e8b64458a26f184a908b1918cd395bce6f3d768b60e67cbeff8e3e557b94ba8fc4f0ba584650eb857a495deda26cc27d0c53e044a07e6c037c24eed74ffbb46f71718dd9a0fd9f4f8c51126242d98f554e6d7feb45d44530f13b1b65681bd9fb149763ec260dd5c12ad1e9b33f6e71dcc2e061ba5a781233e5bb4e704e53fee03b995486853354bc8be8ab6dfd2d3ddea0c5746de5ecf3bf350a51ce006f5f155bc44ab05e5655756d3361d5583a2e76f54562e04db8ef5ab80979ba39fe1412f70e0f2fc4dcd0186fcd8a3c725a14859a4e62e03534fe5bd5fcae2b547c66fffea1cbe596b39bc9203431bfee6a6c517c52227db2c3ce0ed39d0a60df1315db719a18326697cf0778258fdaf57c76063791af33232fd9def0310ae6407956bfb9c9d4499a29ec9964258d7357563f1e489a21e73352a722773797decbc09c82daafa609cc6f78056fe04b881d94c1eb60c2afcf33d0dfd0f59aafc3edd0d093e86d01b74ce7691a4f5c039f7123750b56959d4c6d455d73f47b188913ca58afc186da5d1af48bf7881a2a8566c83c77f33831dc84b454f67c30651e8d5b473c403151fbbc40ddbabde82e0999bcd6b8dfc103eb2b6e0be670af535c3db6c348b782253ce144964436276f461526a5938b9fd35a1c92f0ca4eb9cb8454a357d0dad1886b0d4389cd0a516ed0aa5b937c0a9e0de3f2885ca28756bfb5efd814e33e5ec603b9c497003c2492ff3bb7bff43926d8d8db5ffb605adfa45a38464b2cb8d45c12b12ba77b7b34111ea0faffb6e8c700768a1bdd269574a2a5abdeb517fe52f5878ae488f6bd9fb95b15ab2c2f9e7c4e23ae3c269d065ca3d00596e6aaa1b52b523e4c2b606c1eb37d0d49af4fc16ef8629db99668987db18f242bb33a0c00ede39d58cac7cd5268caf5e6375503a1cb8acb7708081c66f17a812b37ade98101d2ca2403e1579ea2a7f80ca085a9c01ca7dff171def5c94d862573a7eb4033ad29f9012f26c86a6282baaf939629294c8fa503788c0f74a7bd9a1416d12ce016589d714f8cb2fa27c8a1927208a65f4f7e57f102cec75c1f7f300970ef30555e6c3a480dc9e5f93c07e01e5f1a28a14f13bca91f5f19a5eedcfd4fcaa7024846ada5bb686b2dd51c16a44ccbd57b1bb49157af877d68195f659b17eaee68a4aca72a15e50d5ac72491000820216a20d0b85b58f36c83b7f0986e3b86adb9a6aea4cb7d33aec29627994c7b9d2e4c40e84e82082b2ba166f4f3e66409591995b8829c7a530a9e25f108d5633a0bd42df82136447b420f6531249b82791204a9bb97ea338c67e867ef0f0f43069860995045b3a9f4f97c07628088d8a098f2ab77598f391bc12b0968beb99a8efe80ed801a7f468523a1d0f3765d134f551d03765774310af0962a0a0e85c69c1a096ebcab1ce277bbbd2808a513e8cec24a085afbbf35bbb0a6f565b92c16b240a0443079ca462e7e69394569ceb35716ac4dde205852ed557678ebf3f392d35636d5a26330a685b714e95960ba0c2da6b70386b1e4e17c81ded6ea09c12e93e58c66989f2f76c86c640a8d047924fb6e8030248a7cf2592f9126a73c402e2fcfc4828f89f4b6dd9e8e66e05fdf87a845f29863996a2973966fc275a5fee61ae2101a1c32ae7990e87f40cb9ce79a7b385ed9b58315cf3b28d1c8c056dfb7b2079e52cd69c410d092b48c37f4a5e5eda84d9beb9e81ef0a51183f747fda282861f7eb1e051325a1b43edc888cea7cd48b0f6ec12d634a1e52860a9be96c946842f6e88e41de7c39176797948b29bd74759b1b3186cf20c3cf4a5fcff0b1c47e789256a02afd3104b189f47b8b3cc3f1f2845d7e298ae97ce6e8cbcc00195259803fe8cd8333c0deecda1e3686181a7400465d3e3fd4702348a14cb20b033c04d3f60671deb2e7a043ddfe462a13420dc43adad2c2d72d40ae5590027d22c83f141fcf43e1339c4172d57ff3a47c1ac532181b2035356d21fb639a7d94acab6d2351b739cb48e1a6ebafcf3800bdd9c48396bcb136588386ebaf93d1dba517bbe5592f8200ec092bced0d2612e8256556bbe3cf788d707bf9338ec258470330429f925da7d96bd0abbb81d336ad3d3713207a07dba8f66203fda3fd56de02478a8b9079ff761de8c2db7c73f377bd5a67cfcb27078856ae4118f56a693ce2045d51efb50f530b41a4fc6bce048d9525d712419b03f6418f22fbae2b33525bbc272e00467ed70001d1ec7dc42191368b76683b63041b43ec17516d42cbc5ca4247d6f02f84b124c3be060a9e1c5f3d20e4edc510221046e98473933a77230c582be187b449d18f5aba9e7aaf9d12079eedb61edef9c4410e1c7ebc173f7375f710c07ba8e60dbbb1446e4cd0b3790ca422426e8791eacb57375b289c8f92f41bf50fa2f4be0bd10efeae63ca84b0090863c158db9fef33538cce5880ea14cb22629fe3db6fc4fb4963e0a194bf51c287906c26ccf44971a436a7e3db32240eeb5914c13e31c24105eaf7095dcccf85b5cc7726e9aa5b69d075df6781e0eef2ded34cfca1c4489560d98adc75b4c89bbd893710a89e2d43b15328f4b2cba70f1b4455c322ed35505cd30fc436f9db1fa46d1e1a121cb279e52932963c5bead8bbbae4f11f81ebdfd56390cab5f4669c129cf98a089c76be61b863020aa939a724aa0a58c8bff520920224bb4ced43632c8070b8694cf8685ec8475a3bb132379fa1ec42f71136d130dbbd612579c01bb5fb76945ea52d10ef3b583a6c80e73a59e482a98b72c064d09416408b3dc3b2d15fa2bccf2230dfdcf457af8a9db133fb495fb597eed9b34a81e3cd93c7abc11e43e452e62fc6961a009d877ade8a0794bdabe0c2818363e05e329a64e70fc15624c4e0d5a3bafaafc0e33426171d4b440b5f7047f76aee26be83057a690654499ab71c742e35c38f93684c34bcb7f9dd5c1c94b78209fdef6dd4fb2a5f08de223cbf5c9fcae4985459760d1a15fc22a92ffd971a893a9b3cc1a5a589b41945408a860cf8a8d89a20ed58fb34f1d76bfa638baf995ba7b8635e233207973f5e7e36eba65bbe0084438db050ef9e49008b5a81b636414dfa394a460c7ccde7bdae08dc4f47125522e98149ff2dea4403628ceba61810caf0cef546f657cbbd071f47a992cc9bb9a9e9432851b7af4a1cddb2e65706a0b28b9a7a6f074c9ca44f21b1673eae5b30e7cfc93dfb0c063da3d2dfbe8c38f4ea78db894c6d3bf4eb2e2ad62b3272ad4cda9b3b87cf2af6dc2ab665c7b99ee075c9f95e23aeb8d72125ae05643a0f372abd7af41603f08f3428b7e87d938c392a7f276f34fc0c857f3f894a83e88900f4ad349750af2d4e6ef43836fdfd8e610be9824b63d4daea9bb1ef2156e74176f30a111b29268578a7f7188c8627d1403e3874abc9cdaffc8c94f43173344dc69f590b8b52d5feafa65ba3d3fa0d94910f5d585352e74acabdee6eaa7594d3e9ba33236be0826767a5a37893f9fcd133f12a867a4cfef49386569f5c17f4428fcf2ca832f851a09072e2b2299f7152c2bc4bac0dff743ffa12769d4e6a50a3ff081054e2d5aab87ed444f00df45f50e52c60c38d2b6374cd21f39e48731c326504dab433c3b8ee222e4512ac80b7a432111d6fb17b120deda9ad89582297dbcfc051bd500dad4b690b1c6e0ebafb28e9ea753f5ec1a9cb9c51536c9b3a64c252d0457fc5f7afdb968d13fd342b45690c64d40c6731b4973d0fc519fc16d2a1495cbba9667f8aebf735dfbd4f919edeac6419c89421a3908cccf091d0a9fb560604cdcbdcf7fe8a66f56af111c62ab657c48fc6e0877c34078ec997623099d8782963b6ce606cfc46ed671e6c418f1d0d84f7f4c9116a3680ace62dfe9ff2a4a9cd1217de7580efcbff80b92b0bb050e948328acb6500e9dfeef0199dd0fb305346ffd95c5dee1388fb9dd11e05a191f1f9425b9aee5177a03c824dcd5d3b71a50816e20d8d584db8d084808aee8c2dfc56d3d0fa2a1b84ac2a4d8cbb3f4c535edcfb61970232c1570a876070af28378e5a5bcc2d575a4af0b82ccdd64d695658d1ba3f7d5aceb0083f23322a287258adcaabcecc3333a4c6c4b7ea29669df2b6e7ff1094375cab7368c62be1b5b5b31612551acc1538610d1de4e42189a1d5096adf0ddf971133c5b583d80f63353580852c3d00d803830aa67eb574fa4f2baa05f92617", 0x1000}, {&(0x7f0000000200)="a3fbc6009460bffbe362abaf1aa23a5797f8dd8874538305101895131def97e2dd78c573b4267132e2e241bde1ac247c7c60f4b12d605977f04354bedda163af903b91c414ab648c3fb09e522b43a8b9d077694846b3d88b4c241cae3c1c56b81d43b51547c92f6e63cf8e902f0b82ecd30f70e1977e301bfc29fe05c94ccaabf78edc772c2c920e0fa98808600c412dd4cea7d5cbc05327409eae3ea1d70fd91e34a93ac1359d4e83b995486be0ce9bd2fcdd6ca5475ad85c887edf92842156d20cd7646be00bcf04d456", 0xcb}], 0x3) r7 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000540)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r8, 0x40045532, &(0x7f0000000100)) r9 = syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x0, 0xa2c65) ioctl$SNDRV_PCM_IOCTL_REWIND(r9, 0xc0844123, &(0x7f0000000300)=0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(0xffffffffffffffff, r7, 0x2) 4.200039404s ago: executing program 0 (id=3846): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x181942, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, &(0x7f0000001100)={0x77359400}, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x200000, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f00000002c0)='./file1\x00') r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) symlinkat(&(0x7f00000000c0)='./file1\x00', r2, &(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, 0x0) ptrace$ARCH_MAP_VDSO_32(0x1e, 0xffffffffffffffff, 0x5, 0x2002) statx(0xffffffffffffffff, 0x0, 0x6100, 0x800, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) 4.044292835s ago: executing program 8 (id=3847): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sched_getscheduler(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet6_udp(0xa, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000680)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x44, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}, @NFT_MSG_NEWSETELEM={0x40, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x14, 0x3, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0xc, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d103"}]}]}]}]}, @NFT_MSG_DELSETELEM={0x20, 0xe, 0xa, 0x201, 0x0, 0x0, {0xa}, [@NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xcc}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.767929215s ago: executing program 0 (id=3848): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=@gettaction={0x30, 0x32, 0x400, 0x70bd2e, 0x25cfdbfd, {}, [@action_dump_flags=@TCA_ROOT_FLAGS={0xc, 0x2, {0x1}}, @action_gd=@TCA_ACT_TAB={0x10, 0x1, [{0xc, 0x2, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x81f8}}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4008000}, 0x4040090) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c00000010000304000003000000000000000400", @ANYRES32=r1, @ANYBLOB="60bc010004a701003c0012"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) 2.742642359s ago: executing program 6 (id=3849): r0 = openat$comedi(0xffffffffffffff9c, 0x0, 0x400, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) sched_setscheduler(0xffffffffffffffff, 0x3, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x1c, 0x0, 0x0) quotactl_fd$Q_GETQUOTA(0xffffffffffffffff, 0xffffffff80000701, 0x0, 0x0) r2 = fsopen(&(0x7f0000000140)='selinuxfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x3000000, 0x0) fsconfig$FSCONFIG_CMD_RECONFIGURE(r2, 0x7, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_GET_STATS_FD_cpu(0xffffffffffffffff, 0xaece) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(0xffffffffffffffff, 0x0, 0x2c008000) syz_usb_connect(0x5, 0x24, 0x0, 0x0) 2.262435576s ago: executing program 0 (id=3850): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$TIOCL_SCROLLCONSOLE(0xffffffffffffffff, 0x541c, 0x0) socket$inet(0x2, 0x1, 0x0) futex(&(0x7f000000cffc), 0x5, 0x2, 0x0, &(0x7f00000001c0)=0x1, 0x44ffffff) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) getpid() r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r3 = socket(0x15, 0x5, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r5, &(0x7f0000000200), 0x806000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) getsockopt(r3, 0x200000000114, 0x2710, 0x0, &(0x7f0000000000)) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) rt_sigaction(0x19, 0x0, 0x0, 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f00000000c0)=0x10) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000002400010000060003accc6fa0280bdcc42967dab1eea2a9252f4669661f5b2cb4d722e9"], 0x1c}}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x10000000013, &(0x7f0000d06000)=0x1, 0x4) ioctl$KVM_CAP_HALT_POLL(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000480)={0xb6, 0x0, 0x8000000000000000}) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xb, &(0x7f0000000740)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYRES64=r3, @ANYRES64=r4, @ANYRESDEC=r0], 0x38}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000001040)="420fc7bc4898580000640f01c50f01c566baf80cb864c95782ef66bafc0cec67670f1b0166b8fb008ec046b4c3c442b90a2c81c442812852fcc744240012000000c74424020b000000ff1c24", 0x4c}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000005c0)={[0x5836, 0x4, 0x7, 0x4000000000000e52, 0x5, 0x5479, 0x103f, 0x80000000, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe, 0x100000000, 0x1, 0x4000000000c, 0x8000000000005, 0x800040068], 0x2000, 0x90}) 2.231160752s ago: executing program 8 (id=3851): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="980000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa"], 0x98}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)=ANY=[], 0x98}, 0x1, 0x0, 0x0, 0x20040800}, 0x0) 1.896298418s ago: executing program 8 (id=3852): bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="2100000000000000030000000000000044010000", @ANYRES32, @ANYBLOB="000000f5ff0800000000000000e159471d37d0c55fc4f350d4ed82cffe124ae257e6c0f5fd0b88244b570c22b1a6f8d5fd6124fd573c31f89fc5f586a2e50a437e046a8dabf4a742b3f3a38d7ce50da051bc79aa707f0c4e9fff7bcc5ac21a2caeb265928b35512edeea8ccf3f11649dcd12fe5d1b85e6cd24a3ace3f61604158c806e7bac51ebd48bef238ca8535fb99674663df70322dbf75d7a51663b17d701a5f4ac639d85c5f3916df8d5ea985c5214551869418458a17d035235a6937919efdc2f90d5ede5f600718838a21694649f165982d7af22b296f9bfe84e0f10ddf959d292a04be422d0188bac1c047e8d45a4fc0ad3844b91c359245c5019ed1200cede041f304ffe92e11f2511a714b2e58e5434e26d6cc48281134af4ae2c4c8b5c0f0a9794d144932f5da9a9ac215a8f1fea1897ce423fda3072edce3f6e6ad4f9925e9546880dde6eecbb274c9a22dba7c688d7190fd48421b8b3a58d03b83839796578f0d47431c8ebaa079affff734e022d619778f85dda1f93334cd349975cdb2bc05842c83042ca0c7faa51ed8e4c6b3a6f8ad8e258e43bd1ad3d2044743c2453b3e859dd26e8cdcb59370d6cac6d7173a42d2a2cc4a431fd913ec66d168f005b9b2e49255b2003838f62f15daa3c3b80474a2f4f1d70eb6a76dc2e19f3a6b4cc9825c30e4a259af67e", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) 1.731062751s ago: executing program 6 (id=3853): openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$kcm(0x29, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0) r1 = openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000400), 0x101201, 0x0) ioctl$IMADDTIMER(r1, 0x80044940, &(0x7f0000000600)=0x14) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='squashfs\x00', 0x208000, 0x0) 1.395794709s ago: executing program 9 (id=3854): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r2 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r2, 0xc0045516, &(0x7f0000000000)=0x3) (async) ppoll(&(0x7f0000000040)=[{r2, 0x1000}, {r2, 0xa270}], 0x2, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r2, 0xc1105517, &(0x7f0000000340)={{0xfffffffe, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x6, 0x2, 0x4, 0x0, 0x0, 0x0, 'syz1\x00', 0x0}) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r3, 0x541b, &(0x7f0000004b80)) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) r5 = socket$rds(0x15, 0x5, 0x0) (async) r6 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x40, 0x0) setsockopt$RDS_FREE_MR(r6, 0x114, 0x3, &(0x7f0000000040)={{0x8a, 0x7}}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x1c, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}]}], {0x14}}, 0x7c}}, 0x0) (async) r7 = socket$netlink(0x10, 0x3, 0x15) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000040)={0x0, @dev={0xac, 0x14, 0x14, 0x1b}, 0x0, 0x0, 'dh\x00'}, 0x2c) (async) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="04010000100053"], 0x104}, 0x1, 0x0, 0x0, 0x20040890}, 0x200080c0) (async) setsockopt$RDS_CONG_MONITOR(r5, 0x114, 0xa, 0x0, 0x0) (async) setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f0000000f40)=@raw={'raw\x00', 0x8, 0x3, 0x478, 0x1c0, 0xffffffff, 0xffffffff, 0x1c0, 0xffffffff, 0x3a8, 0xffffffff, 0xffffffff, 0x3a8, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@remote, @loopback, [0xff, 0x0, 0xff, 0xff], [0xffffffff, 0xff, 0xff], 'team_slave_0\x00', 'netdevsim0\x00', {}, {0xff}, 0x29, 0x3, 0x0, 0x60}, 0x0, 0x1a0, 0x1c0, 0x60030000, {0x0, 0xff000000}, [@common=@inet=@recent0={{0xf8}, {0x9, 0x2, 0x24, 0x0, 'syz0\x00'}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x1c8, 0x1e8, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x0, 0x0, 0x1, 0x1, 'syz0\x00', 0xfe}}, @common=@mh={{0x28}, {"b11c", 0x1}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x4d8) 1.395476855s ago: executing program 8 (id=3855): socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet_tcp(0x2, 0x1, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(0xffffffffffffffff, &(0x7f00000000c0)={0x1d, r1}, 0x10) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000001600)=ANY=[@ANYBLOB="0100000000002000000000ff00000000", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r2 = dup(0xffffffffffffffff) read$FUSE(r2, 0x0, 0x0) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) unshare(0x4020400) openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x4020400) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x1) r3 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r3, &(0x7f0000002700)=""/102392, 0x18ff8) bpf$MAP_CREATE(0x0, 0x0, 0x48) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0x720, 0x0, 0xfffffffffffffd25) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000000)=@IORING_OP_READ_FIXED={0x4, 0x14, 0x6000, @fd, 0x0, 0x20000003, 0x8020, 0x0, 0x1, {0x2}}) r4 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SCSI_IOCTL_GET_PCI(r4, 0x5393, &(0x7f0000000000)) 1.35203863s ago: executing program 6 (id=3856): sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x400c000) r0 = bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mkdir(&(0x7f0000000040)='./file0\x00', 0x80) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) ioprio_set$pid(0x2, 0x0, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x80, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000440)='./bus\x00') r4 = open(&(0x7f0000000580)='./file1\x00', 0x80242, 0x1df2a23c5997fa5f) write$FUSE_CREATE_OPEN(r4, &(0x7f00000002c0)={0xa0, 0x0, 0x0, {{0x1000000000003, 0x3, 0x8000000000007, 0xaa, 0x3, 0x80001, {0x0, 0x180, 0x20fe, 0x0, 0x87, 0xd615, 0x9, 0x9, 0xfffffffe, 0x8000, 0x0, 0xee00, 0x0, 0x3ff, 0x1}}, {0x0, 0x11}}}, 0xa0) sendfile(r4, r4, &(0x7f0000000080)=0x3000000, 0x7f03) fcntl$getown(r0, 0x9) 1.276292978s ago: executing program 0 (id=3857): socket(0x1, 0x2, 0x0) r0 = socket(0xa, 0x5, 0x0) r1 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r1, 0x12) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000140)=[@in6={0xa, 0x4e24, 0x4, @loopback}, @in={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}], 0x2c) sendmsg$inet(r0, &(0x7f0000000500)={&(0x7f0000000000)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x19}}, 0x10, &(0x7f00000003c0)=[{&(0x7f0000000180)='2', 0x1}], 0x1}, 0xc001) sendto$inet6(r0, &(0x7f0000000040)='\x00', 0x1, 0x44004, &(0x7f0000000100)={0xa, 0x4e24, 0xb, @loopback={0xf000000}, 0xc5f}, 0x1c) close(0x4) 497.758589ms ago: executing program 0 (id=3858): mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) openat(0xffffffffffffff9c, 0x0, 0x181942, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) gettid() timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) futex_waitv(&(0x7f0000001080)=[{0x3, &(0x7f0000001040)=0x3, 0x82}], 0x1, 0x0, &(0x7f0000001100)={0x77359400}, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) mkdirat(0xffffffffffffff9c, 0x0, 0x1c0) mount$fuse(0x0, 0x0, 0x0, 0x200000, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000140)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f00000002c0)='./file1\x00') r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) r2 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) symlinkat(&(0x7f00000000c0)='./file1\x00', r2, &(0x7f0000000100)='./file0\x00') ioctl$AUTOFS_IOC_PROTOSUBVER(r1, 0x40049366, 0x0) ptrace$ARCH_MAP_VDSO_32(0x1e, 0xffffffffffffffff, 0x5, 0x2002) statx(0xffffffffffffffff, 0x0, 0x6100, 0x800, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) 388.530101ms ago: executing program 9 (id=3859): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) r3 = fsmount(r2, 0x0, 0x0) r4 = syz_usb_connect$lan78xx(0x3, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f0000001140)={0x34, &(0x7f0000000040)={0x0, 0x16}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f0000001540)={0x34, &(0x7f00000003c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000180)={0x40, 0xe}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, &(0x7f0000003f00)={0x84, &(0x7f0000003b00)={0x40, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f0000004300)={0x34, &(0x7f00000040c0)={0x40, 0xc}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f00000010c0)={0x34, &(0x7f0000000f00)={0x20, 0x5, 0x1, "f9"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io$lan78xx(r4, 0x0, &(0x7f0000000380)={0x1c, &(0x7f0000000140)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) fchdir(r3) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) pivot_root(&(0x7f00000001c0)='./file0\x00', &(0x7f00000000c0)='./file0\x00') sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x44014) recvmmsg(r1, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f00000004c0)=""/4091, 0xffb}, {&(0x7f0000002580)=""/4096}, {&(0x7f00000014c0)=""/155}, {&(0x7f00000024c0)=""/170}], 0x1}}], 0x40000000000013e, 0x2, 0x0) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r5}, 0x4) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="18020000000400000000000000000000b7080000000000007b8af8ff00000000b7080000050000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r5, @ANYBLOB="850000008500000085000000070000009500000000000000ce3961806b080be3185bc0ee65baf28ed23cf8a521c400"/62], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000008c0)={r6, 0x0, 0xe, 0x0, &(0x7f0000000600)="87585d85da215305627e5695c108", 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) r8 = socket$kcm(0x29, 0x5, 0x0) setsockopt$kcm_KCM_RECV_DISABLE(r8, 0x119, 0x1, &(0x7f0000000000)=0x2, 0x4) setsockopt$kcm_KCM_RECV_DISABLE(r8, 0x119, 0x1, &(0x7f0000000080)=0x4, 0x4) poll(&(0x7f0000000200)=[{r7, 0x2700}, {r0, 0x804a}, {r7, 0x8112}, {r0, 0x4}, {r1, 0x6042}, {r8, 0x38c}, {r0, 0x4001}, {r0, 0x40}, {r0, 0x41d0}, {r0, 0x4400}, {r1}, {r7, 0x9184}, {r8, 0xc5}], 0xd, 0x29) 342.3704ms ago: executing program 6 (id=3860): pipe(&(0x7f0000000280)={0xffffffffffffffff}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1b319ee30969b6c7, 0x0, 0x5}, 0x50) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000400)=ANY=[], 0x8) connect$inet6(r1, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000001, @mcast2, 0x6}, 0x1c) r2 = epoll_create(0x7) r3 = epoll_create1(0x0) epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, &(0x7f0000000180)={0x4}) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r2, &(0x7f0000000140)={0xa0000006}) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r5, &(0x7f0000000080)) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r1, &(0x7f00000000c0)="8f2a0a65bd8c002b0304000e0580a7b6070d63e286a5cefe", 0x5ac) 240.730329ms ago: executing program 6 (id=3861): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000005c0)='sched_switch\x00'}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) r1 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000700)={0x84, &(0x7f0000000080)={0x0, 0x8, 0x2, '5E'}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000540)={0x2c, &(0x7f0000000280)={0x0, 0xb}, 0x0, 0x0, 0x0, 0x0}) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) r3 = socket$rxrpc(0x21, 0x2, 0xa) setsockopt$RXRPC_MIN_SECURITY_LEVEL(r3, 0x110, 0x4, &(0x7f00000001c0), 0x4) connect$unix(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$key(0xffffffffffffffff, 0x0, 0x4000040) bind$netlink(r4, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x20}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0xa}]}], {0x14}}, 0x64}}, 0x0) connect$inet6(r2, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000300)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x318, 0x1, 0x24}, 0x9c) (fail_nth: 2) 0s ago: executing program 8 (id=3862): r0 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000140)=0xffffffffffffffff, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000000180), &(0x7f00000001c0)}, 0x20) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$team(&(0x7f00000044c0), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000004700)={'team0\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f0000004bc0)={0x0, 0x0, &(0x7f0000004b80)={&(0x7f0000000000)={0x58, r3, 0x405, 0x70bd29, 0x25dfdbfe, {}, [{{0x8, 0x1, r4}, {0x3c, 0x2, 0x0, 0x1, [{0x38, 0x1, @notify_peers_count={{0x24}, {0x5}, {0x8, 0x4, 0x5}}}]}}]}, 0x58}, 0x1, 0x0, 0x0, 0x4008401}, 0x44084) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x3, 0x1, 0x0, r1, 0x1, '\x00', r4, r0, 0x4, 0x3, 0x2}, 0x50) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0x4e21, @empty}], 0x10) sendmsg$inet_sctp(r6, &(0x7f0000000140)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f0000000380)=[{&(0x7f00000001c0)='N', 0x1}], 0x1, 0x0, 0x0, 0x80c0}, 0x4000891) setsockopt$inet_sctp_SCTP_PEER_ADDR_THLDS(r6, 0x84, 0x1f, &(0x7f0000000200)={0x0, @in6={{0xa, 0x4e24, 0x200, @empty, 0x6c9b}}, 0x101, 0x7465}, 0x90) syz_emit_ethernet(0x7e, &(0x7f0000000480)={@local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @source_quench={0x4, 0x0, 0x0, 0x0, {0x15, 0x4, 0x1, 0x9, 0xf61, 0x64, 0x6, 0x7, 0x88, 0x8a, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast2, {[@timestamp_prespec={0x44, 0x3c, 0x54, 0x3, 0x4, [{@empty, 0x401}, {@empty, 0xa70}, {@multicast1, 0x3}, {@local, 0xe40}, {@multicast1, 0xe8}, {@multicast1, 0x12}, {@private=0xa010102, 0x5}]}, @ssrr={0x89, 0x3, 0xf}]}}}}}}}, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x18, 0x20, &(0x7f0000000300)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x2}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x402}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}, @printk={@lld, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x9}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xed41d0969ec40515, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r7}, 0x10) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x0, 0x200000005c832, 0xffffffffffffffff, 0x0) kernel console output (not intermixed with test programs): dv: batadv0: Interface activated: batadv_slave_1 [ 1048.039457][ T8936] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1048.060057][T17781] usb 7-1: Using ep0 maxpacket: 16 [ 1048.066756][ T8936] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1048.098680][T17781] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1048.112679][ T8936] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1048.126046][T17781] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1048.147423][ T8936] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1048.159240][T17781] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1048.170200][T17781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1048.186748][T17781] usb 7-1: Product: syz [ 1048.196708][T17781] usb 7-1: Manufacturer: syz [ 1048.205250][T17781] usb 7-1: SerialNumber: syz [ 1048.223899][T17781] usb 7-1: config 0 descriptor?? [ 1048.253006][T17781] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1048.308805][T17781] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1048.329085][ T5825] Bluetooth: hci1: command tx timeout [ 1048.504806][ T8939] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1048.520739][ T8939] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1048.570208][ T8921] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1048.600132][ T8921] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1048.915556][T17781] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1048.997019][T17781] em28xx 7-1:0.0: Config register raw data: 0x00 [ 1049.294262][T18445] netlink: 48 bytes leftover after parsing attributes in process `syz.8.3342'. [ 1049.647312][ T30] audit: type=1400 audit(2000000304.966:2020): avc: denied { bind } for pid=18439 comm="syz.0.3321" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1049.675516][T18441] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1049.684158][T18441] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1049.704002][T18444] Can't find ip_set type hash:n [ 1050.035252][T17802] usb 1-1: new high-speed USB device number 121 using dummy_hcd [ 1050.194877][T18460] netdevsim netdevsim8 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1050.267350][T18460] netdevsim netdevsim8 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1050.326399][T17802] usb 1-1: device descriptor read/64, error -71 [ 1050.333735][T18460] netdevsim netdevsim8 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1050.388373][T18460] netdevsim netdevsim8 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1050.409242][ T5825] Bluetooth: hci1: command tx timeout [ 1050.592698][T17787] usb 7-1: USB disconnect, device number 26 [ 1050.598826][ T8948] netdevsim netdevsim8 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.609797][T17787] em28xx 7-1:0.0: Disconnecting em28xx [ 1050.748801][T17802] usb 1-1: new high-speed USB device number 122 using dummy_hcd [ 1050.777609][ T8948] netdevsim netdevsim8 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.787713][T17787] em28xx 7-1:0.0: Freeing device [ 1050.794030][ T8948] netdevsim netdevsim8 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.803067][ T8948] netdevsim netdevsim8 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1050.820649][T18453] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1050.829415][ T30] audit: type=1400 audit(2000000306.146:2021): avc: denied { read } for pid=18450 comm="syz.2.3344" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1050.853329][ T30] audit: type=1400 audit(2000000306.146:2022): avc: denied { ioctl } for pid=18450 comm="syz.2.3344" path="/dev/fb0" dev="devtmpfs" ino=629 ioctlcmd=0x4611 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1050.915142][T17802] usb 1-1: device descriptor read/64, error -71 [ 1051.035888][T17802] usb usb1-port1: attempt power cycle [ 1051.322397][T17787] usb 3-1: new high-speed USB device number 76 using dummy_hcd [ 1051.385004][T17802] usb 1-1: new high-speed USB device number 123 using dummy_hcd [ 1051.415499][T17802] usb 1-1: device descriptor read/8, error -71 [ 1051.486469][T17787] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1051.496752][T17787] usb 3-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1051.505879][T17787] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1051.516964][T17787] usb 3-1: config 0 descriptor?? [ 1051.523844][T17787] pwc: Askey VC010 type 2 USB webcam detected. [ 1051.676473][T17802] usb 1-1: new high-speed USB device number 124 using dummy_hcd [ 1051.692409][T18487] veth0_to_bridge: entered promiscuous mode [ 1051.706011][T17802] usb 1-1: device descriptor read/8, error -71 [ 1051.825400][T17802] usb usb1-port1: unable to enumerate USB device [ 1051.926336][T17787] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1051.933385][T17787] pwc: recv_control_msg error -32 req 02 val 2700 [ 1051.935049][T13005] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 1051.940600][T17787] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1051.954583][T17787] pwc: recv_control_msg error -32 req 04 val 1000 [ 1051.961980][T17787] pwc: recv_control_msg error -32 req 04 val 1300 [ 1051.968923][T17787] pwc: recv_control_msg error -32 req 04 val 1400 [ 1051.976301][T17787] pwc: recv_control_msg error -32 req 02 val 2000 [ 1051.983290][T17787] pwc: recv_control_msg error -32 req 02 val 2100 [ 1052.007217][T17787] pwc: recv_control_msg error -32 req 04 val 1500 [ 1052.014331][T17787] pwc: recv_control_msg error -32 req 02 val 2500 [ 1052.021563][T17787] pwc: recv_control_msg error -32 req 02 val 2400 [ 1052.105348][T13005] usb 7-1: Using ep0 maxpacket: 32 [ 1052.123233][T13005] usb 7-1: config 0 has an invalid interface number: 230 but max is 0 [ 1052.132432][T13005] usb 7-1: config 0 has no interface number 0 [ 1052.138943][T13005] usb 7-1: config 0 interface 230 has no altsetting 0 [ 1052.359466][T13005] usb 7-1: New USB device found, idVendor=0781, idProduct=0005, bcdDevice= 0.05 [ 1052.359864][T17787] pwc: recv_control_msg error -71 req 02 val 2900 [ 1052.368910][T13005] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.383399][T13005] usb 7-1: Product: syz [ 1052.383695][T17787] pwc: recv_control_msg error -71 req 02 val 2800 [ 1052.387746][T13005] usb 7-1: Manufacturer: syz [ 1052.387764][T13005] usb 7-1: SerialNumber: syz [ 1052.389638][T13005] usb 7-1: config 0 descriptor?? [ 1052.415323][T17787] pwc: recv_control_msg error -71 req 04 val 1100 [ 1052.416766][T13005] ums-usbat 7-1:0.230: USB Mass Storage device detected [ 1052.435509][T17787] pwc: recv_control_msg error -71 req 04 val 1200 [ 1052.436875][T13005] ums-usbat 7-1:0.230: Quirks match for vid 0781 pid 0005: 1 [ 1052.465384][T17787] pwc: Registered as video103. [ 1052.478621][T17787] input: PWC snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/input/input68 [ 1052.489395][ T5825] Bluetooth: hci1: command tx timeout [ 1052.498352][T17787] usb 3-1: USB disconnect, device number 76 [ 1053.203013][T18503] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3352'. [ 1053.212295][T18503] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1053.226319][ T30] audit: type=1400 audit(2000000308.536:2023): avc: denied { listen } for pid=18504 comm="syz.2.3357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1053.256437][T18506] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3352'. [ 1053.260674][ T30] audit: type=1400 audit(2000000308.536:2024): avc: denied { accept } for pid=18504 comm="syz.2.3357" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1053.296721][T18503] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1053.365467][T18506] bridge_slave_1: left allmulticast mode [ 1053.371330][T18506] bridge_slave_1: left promiscuous mode [ 1053.378877][T18506] bridge0: port 2(bridge_slave_1) entered disabled state [ 1053.508375][T18506] bridge_slave_0: left allmulticast mode [ 1053.533058][T18506] bridge_slave_0: left promiscuous mode [ 1053.545041][T18506] bridge0: port 1(bridge_slave_0) entered disabled state [ 1053.817204][T18510] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.909481][T18510] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1053.964166][T18510] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.027320][T18510] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1054.205601][T18513] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3359'. [ 1054.235872][ T7092] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.250928][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.317486][ T30] audit: type=1400 audit(2000000309.576:2025): avc: denied { append } for pid=18512 comm="syz.2.3359" name="fb0" dev="devtmpfs" ino=629 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 1054.381667][ T7092] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.412770][ T7092] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.424821][ T7092] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1054.647783][T18486] veth0_to_bridge: left promiscuous mode [ 1054.685057][T13005] ums-usbat 7-1:0.230: probe with driver ums-usbat failed with error -5 [ 1054.697382][T13005] usb 7-1: USB disconnect, device number 27 [ 1055.585754][T18531] No memory to map [ 1056.378246][T18547] netlink: 'syz.2.3369': attribute type 1 has an invalid length. [ 1056.385160][ T30] audit: type=1400 audit(2000000311.696:2026): avc: denied { read } for pid=18544 comm="syz.6.3368" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1056.414470][T18547] bond2: entered promiscuous mode [ 1056.420990][T18547] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1056.489283][T18547] 8021q: adding VLAN 0 to HW filter on device bond3 [ 1056.501914][T18547] bond2: (slave bond3): making interface the new active one [ 1056.510463][T18547] bond3: entered promiscuous mode [ 1056.518921][T18547] bond2: (slave bond3): Enslaving as an active interface with an up link [ 1056.538195][T18547] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3369'. [ 1056.545027][T13005] usb 1-1: new high-speed USB device number 125 using dummy_hcd [ 1056.554097][T18547] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3369'. [ 1056.659522][T18557] program syz.2.3370 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1056.708163][T13005] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1056.722547][T13005] usb 1-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1056.746092][T13005] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1056.754430][T13005] usb 1-1: Product: syz [ 1056.758878][T13005] usb 1-1: Manufacturer: syz [ 1056.763657][T13005] usb 1-1: SerialNumber: syz [ 1056.773119][T13005] usb 1-1: config 0 descriptor?? [ 1056.792117][T13005] ums-isd200 1-1:0.0: USB Mass Storage device detected [ 1057.000093][ T30] audit: type=1326 audit(2000000312.316:2027): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18539 comm="syz.0.3366" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f62cf78eec9 code=0x0 [ 1057.110099][T18562] netlink: 'syz.2.3371': attribute type 1 has an invalid length. [ 1057.131022][T18562] bond4: entered promiscuous mode [ 1057.136373][T18562] 8021q: adding VLAN 0 to HW filter on device bond4 [ 1057.167608][T18562] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1057.176261][T18562] bond4: (slave bond5): making interface the new active one [ 1057.183671][T18562] bond5: entered promiscuous mode [ 1057.194184][T18562] bond4: (slave bond5): Enslaving as an active interface with an up link [ 1057.247656][T18562] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3371'. [ 1057.258024][T18562] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3371'. [ 1057.751892][T18582] No control pipe specified [ 1058.687403][T18597] netlink: 'syz.2.3378': attribute type 15 has an invalid length. [ 1058.695597][T18597] netlink: 666 bytes leftover after parsing attributes in process `syz.2.3378'. [ 1058.835040][T18595] ceph: No mds server is up or the cluster is laggy [ 1059.317420][ T5931] usb 1-1: USB disconnect, device number 125 [ 1059.389692][ T911] dvb-usb: did not find the firmware file 'dvb-usb-az6027-03.fw' (status -110). You can use /scripts/get_dvb_firmware to get the firmware [ 1059.553746][ T911] dvb_usb_az6027 9-1:84.0: probe with driver dvb_usb_az6027 failed with error -110 [ 1060.110042][ T911] usb 9-1: USB disconnect, device number 16 [ 1060.757880][T18620] comedi comedi1: pcm3724: I/O port conflict (0x6,16) [ 1060.978691][T18625] netlink: 160 bytes leftover after parsing attributes in process `syz.6.3383'. [ 1060.989757][T18625] nbd: must specify a device to reconfigure [ 1061.025321][ T5901] usb 1-1: new high-speed USB device number 126 using dummy_hcd [ 1061.038187][ T30] audit: type=1400 audit(2000000316.356:2028): avc: denied { write } for pid=18624 comm="syz.2.3387" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 1061.215018][ T5901] usb 1-1: Using ep0 maxpacket: 32 [ 1061.375043][ T5901] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 1061.383396][ T5901] usb 1-1: config 0 has no interface number 0 [ 1061.393753][ T5901] usb 1-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=b6.d8 [ 1061.403362][ T5901] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.413393][ T5901] usb 1-1: Product: syz [ 1061.418769][ T5901] usb 1-1: Manufacturer: syz [ 1061.423725][ T5901] usb 1-1: SerialNumber: syz [ 1061.432088][ T5901] usb 1-1: config 0 descriptor?? [ 1061.442372][ T5901] usb 1-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1061.451969][ T5901] usb 1-1: selecting invalid altsetting 1 [ 1061.458279][ T5901] usb 1-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1061.468110][ T5901] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1061.479049][ T5901] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1061.487634][ T5901] usb 1-1: media controller created [ 1061.511732][ T5901] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1061.946935][T18642] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1062.309355][T18642] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1062.663954][ T30] audit: type=1326 audit(2000000317.226:2029): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18634 comm="syz.8.3390" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fdd7838eec9 code=0x0 [ 1062.718084][ T5901] usb 1-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1062.845060][ T5901] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1062.982950][T18648] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3392'. [ 1063.556630][T18650] macvtap1: entered promiscuous mode [ 1063.562251][T18650] macvtap1: entered allmulticast mode [ 1063.568299][T18650] batadv0: entered promiscuous mode [ 1063.574418][T18650] batadv0: entered allmulticast mode [ 1063.581706][T18650] 8021q: adding VLAN 0 to HW filter on device macvtap1 [ 1063.590911][T18650] team0: Device macvtap1 failed to register rx_handler [ 1063.600860][T18650] batadv0: left allmulticast mode [ 1063.608869][T18650] batadv0: left promiscuous mode [ 1063.625051][ T5901] usb 1-1: USB disconnect, device number 126 [ 1064.364658][T18661] Invalid source name [ 1064.369301][T18661] UBIFS error (pid: 18661): cannot open "/dev/sg0", error -22 [ 1064.526380][T18667] x_tables: ip_tables: rpfilter match: used from hooks FORWARD, but only valid from PREROUTING [ 1065.460774][T18676] netlink: 20 bytes leftover after parsing attributes in process `syz.6.3398'. [ 1065.625289][ T911] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1065.715124][ T5901] usb 1-1: new high-speed USB device number 127 using dummy_hcd [ 1065.794993][ T911] usb 9-1: Using ep0 maxpacket: 8 [ 1065.808303][ T911] usb 9-1: New USB device found, idVendor=0545, idProduct=800c, bcdDevice= 3.0a [ 1065.817666][ T911] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1065.826088][ T911] usb 9-1: Product: syz [ 1065.835473][ T911] usb 9-1: Manufacturer: syz [ 1065.840135][ T911] usb 9-1: SerialNumber: syz [ 1065.861121][ T911] usb 9-1: config 0 descriptor?? [ 1065.875045][ T911] gspca_main: xirlink-cit-2.14.0 probing 0545:800c [ 1065.900167][ T911] input: xirlink-cit as /devices/platform/dummy_hcd.8/usb9/9-1/input/input69 [ 1065.919320][ T5901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 32, changing to 9 [ 1065.949923][ T5901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1040, setting to 1024 [ 1065.969575][ T5901] usb 1-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 1065.978777][ T5901] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1066.009753][ T5901] usb 1-1: config 0 descriptor?? [ 1066.016174][T18674] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 1066.251969][ T911] usb 9-1: USB disconnect, device number 17 [ 1066.664623][T18674] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3399'. [ 1066.678856][ T5901] usbhid 1-1:0.0: can't add hid device: -71 [ 1066.685345][ T5901] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1067.074451][ T5901] usb 1-1: USB disconnect, device number 127 [ 1067.269929][T18685] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.318932][T18685] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.371318][T18685] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.426889][T18685] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1067.626449][ T8939] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.847034][ T8939] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.871369][ T8939] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.904788][ T8939] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1067.944024][ T30] audit: type=1400 audit(2000000323.256:2030): avc: denied { open } for pid=18701 comm="syz.0.3405" path="/dev/ttyq5" dev="devtmpfs" ino=380 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1067.975154][T17805] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1068.135280][T17805] usb 9-1: Using ep0 maxpacket: 16 [ 1068.159764][T17805] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1068.392574][T17805] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1068.451970][T17805] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1068.980958][T17805] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.001708][T17805] usb 9-1: Product: syz [ 1069.013298][T17805] usb 9-1: Manufacturer: syz [ 1069.026471][T17805] usb 9-1: SerialNumber: syz [ 1069.040992][T17805] usb 9-1: config 0 descriptor?? [ 1069.058049][T17805] em28xx 9-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1069.084276][T17805] em28xx 9-1:0.0: Audio interface 0 found (Vendor Class) [ 1070.320907][T17805] em28xx 9-1:0.0: chip ID is em2874 [ 1070.381538][ T30] audit: type=1326 audit(2000000325.696:2031): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1070.560907][ T30] audit: type=1326 audit(2000000325.696:2032): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1070.620408][T18699] netlink: 216 bytes leftover after parsing attributes in process `syz.8.3404'. [ 1070.635173][T18699] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3404'. [ 1070.648370][T18699] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3404'. [ 1070.695004][ T30] audit: type=1326 audit(2000000325.696:2033): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1070.718544][ C1] vkms_vblank_simulate: vblank timer overrun [ 1070.892040][ T30] audit: type=1326 audit(2000000325.726:2034): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1070.916830][T17805] usb 9-1: USB disconnect, device number 18 [ 1070.925641][T17805] em28xx 9-1:0.0: Disconnecting em28xx [ 1070.935926][ T30] audit: type=1326 audit(2000000325.726:2035): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1070.960110][T17805] em28xx 9-1:0.0: Freeing device [ 1070.966716][ T30] audit: type=1326 audit(2000000325.726:2036): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1070.990172][ C1] vkms_vblank_simulate: vblank timer overrun [ 1071.001627][ T30] audit: type=1326 audit(2000000325.726:2037): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1071.026592][ T30] audit: type=1326 audit(2000000325.726:2038): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1071.051444][ T30] audit: type=1326 audit(2000000325.726:2039): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18717 comm="syz.2.3410" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1071.429195][T18730] binder: 18727:18730 ioctl 4018620d 0 returned -22 [ 1071.517029][T18729] SELinux: policydb magic number 0xa does not match expected magic number 0xf97cff8c [ 1071.557150][T18729] SELinux: failed to load policy [ 1071.735148][T13005] usb 3-1: new full-speed USB device number 77 using dummy_hcd [ 1071.896218][T13005] usb 3-1: config 5 has an invalid interface number: 123 but max is 0 [ 1071.914873][T13005] usb 3-1: config 5 has an invalid descriptor of length 0, skipping remainder of the config [ 1071.946420][ T5931] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1071.984448][T13005] usb 3-1: config 5 has no interface number 0 [ 1072.058562][T13005] usb 3-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 1072.122674][ T5931] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1072.148721][T13005] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1072.194549][T13005] usb 3-1: Product: syz [ 1072.198866][ T5931] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1072.203513][T13005] usb 3-1: Manufacturer: syz [ 1072.215069][T13005] usb 3-1: SerialNumber: syz [ 1072.245575][ T5931] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1072.297526][ T5931] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1072.329584][ T5931] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1072.361371][ T5931] usb 9-1: config 0 descriptor?? [ 1072.511214][T13005] comedi comedi5: Wrong number of endpoints [ 1072.537922][T13005] ni6501 3-1:5.123: driver 'ni6501' failed to auto-configure device. [ 1072.580789][T13005] usb 3-1: USB disconnect, device number 77 [ 1072.803635][ T5931] plantronics 0003:047F:FFFF.0016: unknown main item tag 0x0 [ 1072.838632][ T5931] plantronics 0003:047F:FFFF.0016: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 1072.845014][T17781] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1073.055577][T17781] usb 7-1: Using ep0 maxpacket: 8 [ 1073.086215][T17781] usb 7-1: New USB device found, idVendor=0545, idProduct=800c, bcdDevice= 3.0a [ 1073.125246][T17781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.160708][T17781] usb 7-1: Product: syz [ 1073.175104][T17781] usb 7-1: Manufacturer: syz [ 1073.179777][T17781] usb 7-1: SerialNumber: syz [ 1073.195553][T17781] usb 7-1: config 0 descriptor?? [ 1073.210421][T17781] gspca_main: xirlink-cit-2.14.0 probing 0545:800c [ 1073.218749][T17781] input: xirlink-cit as /devices/platform/dummy_hcd.6/usb7/7-1/input/input70 [ 1073.275049][T13005] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 1073.395000][ T5931] usb 3-1: new full-speed USB device number 78 using dummy_hcd [ 1073.446600][T13005] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1073.538675][T13005] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1073.586256][ T5931] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 1073.608032][ T5931] usb 3-1: config 0 has no interface number 0 [ 1073.608039][T13005] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1073.608061][T13005] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1073.645853][ T5931] usb 3-1: config 0 interface 184 has no altsetting 0 [ 1073.676622][ T5931] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1073.703824][ T5931] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1073.712229][T17787] usb 9-1: USB disconnect, device number 19 [ 1073.733259][ T5931] usb 3-1: Product: syz [ 1073.739498][ T5931] usb 3-1: Manufacturer: syz [ 1073.745154][ T5931] usb 3-1: SerialNumber: syz [ 1073.754793][ T5931] usb 3-1: config 0 descriptor?? [ 1073.761162][ T5931] smsc75xx v1.0.0 [ 1073.769415][T18742] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 1073.779287][ T5931] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): usbnet_get_endpoints failed: -22 [ 1073.814455][ T5931] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -22 [ 1073.938998][T13005] usb 1-1: Quirk or no altset; falling back to MIDI 1.0 [ 1074.023086][T18744] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1074.031797][T18744] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1074.061556][T13005] usb 3-1: USB disconnect, device number 78 [ 1074.595147][ T5931] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1074.816453][ T5931] usb 9-1: config 0 has an invalid interface number: 199 but max is 1 [ 1074.831346][ T5931] usb 9-1: config 0 has no interface number 1 [ 1074.845109][ T5931] usb 9-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1074.857533][ T5931] usb 9-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1074.917440][ T5931] usb 9-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 1074.936906][ T5931] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1074.956801][ T5931] usb 9-1: SerialNumber: syz [ 1074.973428][ T5931] usb 9-1: config 0 descriptor?? [ 1075.665403][ T5931] uvcvideo 9-1:0.199: Found UVC 0.00 device (0002:0000) [ 1075.696274][ T5931] uvcvideo 9-1:0.199: No valid video chain found. [ 1075.714020][T17787] usb 1-1: USB disconnect, device number 2 [ 1075.774833][ T5931] usb 9-1: USB disconnect, device number 20 [ 1075.801340][ T5901] usb 7-1: USB disconnect, device number 28 [ 1077.135153][T17787] usb 9-1: new high-speed USB device number 21 using dummy_hcd [ 1077.301463][ T30] kauditd_printk_skb: 66 callbacks suppressed [ 1077.301481][ T30] audit: type=1400 audit(2000000332.616:2106): avc: denied { getopt } for pid=18772 comm="syz.6.3426" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1077.445329][T17787] usb 9-1: Using ep0 maxpacket: 16 [ 1077.455014][ T5901] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 1077.463810][T17787] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1077.482893][T17787] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1077.557510][ T30] audit: type=1400 audit(2000000332.866:2107): avc: denied { bind } for pid=18772 comm="syz.6.3426" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1077.908936][T17787] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1077.942177][T17787] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1077.959125][ T5901] usb 1-1: Using ep0 maxpacket: 8 [ 1077.969510][T17787] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1077.974673][ T5901] usb 1-1: New USB device found, idVendor=0545, idProduct=800c, bcdDevice= 3.0a [ 1077.992024][ T5901] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.000699][ T5901] usb 1-1: Product: syz [ 1078.005040][ T5901] usb 1-1: Manufacturer: syz [ 1078.010027][ T5901] usb 1-1: SerialNumber: syz [ 1078.017112][ T5901] usb 1-1: config 0 descriptor?? [ 1078.024099][T17787] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1078.040602][ T5901] gspca_main: xirlink-cit-2.14.0 probing 0545:800c [ 1078.043528][T17787] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1078.066869][T17787] usb 9-1: Manufacturer: syz [ 1078.106791][T17787] usb 9-1: config 0 descriptor?? [ 1078.345886][ T5901] input: xirlink-cit as /devices/platform/dummy_hcd.0/usb1/1-1/input/input71 [ 1079.084995][T17787] rc_core: IR keymap rc-hauppauge not found [ 1079.090986][T17787] Registered IR keymap rc-empty [ 1079.105139][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.148821][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.175009][ T5901] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1079.295487][T17787] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 1079.318581][T17787] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input72 [ 1079.335437][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.355114][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.387044][ T30] audit: type=1400 audit(2000000334.696:2108): avc: denied { read } for pid=18786 comm="syz.2.3429" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1079.410457][ T5901] usb 7-1: Using ep0 maxpacket: 8 [ 1079.410478][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.423582][ T30] audit: type=1400 audit(2000000334.696:2109): avc: denied { open } for pid=18786 comm="syz.2.3429" path="/dev/snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1079.424277][ T5901] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 1079.447580][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.471041][T12898] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci4/hci4:201' [ 1079.482216][T12898] CPU: 0 UID: 0 PID: 12898 Comm: kworker/u9:2 Not tainted syzkaller #0 PREEMPT(full) [ 1079.482247][T12898] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1079.482265][T12898] Workqueue: hci4 hci_rx_work [ 1079.482299][T12898] Call Trace: [ 1079.482305][T12898] [ 1079.482311][T12898] dump_stack_lvl+0x16c/0x1f0 [ 1079.482331][T12898] sysfs_warn_dup+0x7f/0xa0 [ 1079.482351][T12898] sysfs_create_dir_ns+0x24b/0x2b0 [ 1079.482367][T12898] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1079.482388][T12898] ? find_held_lock+0x2b/0x80 [ 1079.482417][T12898] ? do_raw_spin_unlock+0x172/0x230 [ 1079.482440][T12898] kobject_add_internal+0x2c4/0x9b0 [ 1079.482460][T12898] kobject_add+0x16e/0x240 [ 1079.482471][T12898] ? __pfx_kobject_add+0x10/0x10 [ 1079.482482][T12898] ? do_raw_spin_unlock+0x172/0x230 [ 1079.482495][T12898] ? kobject_put+0xab/0x5a0 [ 1079.482518][T12898] device_add+0x288/0x1aa0 [ 1079.482546][T12898] ? __pfx_dev_set_name+0x10/0x10 [ 1079.482564][T12898] ? __pfx_device_add+0x10/0x10 [ 1079.482590][T12898] ? mgmt_send_event_skb+0x2fb/0x460 [ 1079.482614][T12898] hci_conn_add_sysfs+0x17e/0x230 [ 1079.482632][T12898] le_conn_complete_evt+0x1260/0x2150 [ 1079.482652][T12898] ? __pfx_le_conn_complete_evt+0x10/0x10 [ 1079.482672][T12898] ? hci_event_packet+0x459/0x11c0 [ 1079.482703][T12898] hci_le_enh_conn_complete_evt+0x23d/0x380 [ 1079.482728][T12898] ? skb_pull_data+0x166/0x210 [ 1079.482751][T12898] hci_le_meta_evt+0x354/0x5e0 [ 1079.482768][T12898] ? __pfx_hci_le_enh_conn_complete_evt+0x10/0x10 [ 1079.482785][T12898] hci_event_packet+0x682/0x11c0 [ 1079.482800][T12898] ? __pfx_hci_le_meta_evt+0x10/0x10 [ 1079.482825][T12898] ? __pfx_hci_event_packet+0x10/0x10 [ 1079.482852][T12898] ? kcov_remote_start+0x3c9/0x6d0 [ 1079.482873][T12898] ? lockdep_hardirqs_on+0x7c/0x110 [ 1079.482898][T12898] hci_rx_work+0x2c5/0x16b0 [ 1079.482919][T12898] process_one_work+0x9cf/0x1b70 [ 1079.482938][T12898] ? __pfx_process_one_work+0x10/0x10 [ 1079.482959][T12898] ? assign_work+0x1a0/0x250 [ 1079.482980][T12898] worker_thread+0x6c8/0xf10 [ 1079.483011][T12898] ? __pfx_worker_thread+0x10/0x10 [ 1079.483029][T12898] kthread+0x3c2/0x780 [ 1079.483042][T12898] ? __pfx_kthread+0x10/0x10 [ 1079.483054][T12898] ? rcu_is_watching+0x12/0xc0 [ 1079.483068][T12898] ? __pfx_kthread+0x10/0x10 [ 1079.483080][T12898] ret_from_fork+0x672/0x7d0 [ 1079.483090][T12898] ? __pfx_kthread+0x10/0x10 [ 1079.483105][T12898] ret_from_fork_asm+0x1a/0x30 [ 1079.483139][T12898] [ 1079.483219][T12898] kobject: kobject_add_internal failed for hci4:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 1079.485026][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.492928][T12898] Bluetooth: hci4: failed to register connection device [ 1079.517891][T18788] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1079.521158][ T5901] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1079.526324][T18788] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1079.539240][ T5901] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1079.783717][ T5901] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1079.785907][T18788] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1079.794017][ T5901] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1079.799715][T18788] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1079.812743][ T5901] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1079.828537][ T5901] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1079.829240][T18788] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1079.848855][T18788] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1079.854841][T18788] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1079.861864][T18788] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1079.867856][T18788] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1079.876720][T18788] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1079.920680][ T30] audit: type=1400 audit(2000000335.236:2110): avc: denied { bind } for pid=18762 comm="syz.8.3422" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1079.955057][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1079.975114][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1080.071834][T18783] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1080.111819][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1080.122895][T17790] usb 1-1: USB disconnect, device number 3 [ 1080.141870][ T5901] usb 7-1: GET_CAPABILITIES returned 0 [ 1080.157194][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1080.171948][ T5901] usbtmc 7-1:16.0: can't read capabilities [ 1080.205349][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1080.235038][T17787] mceusb 9-1:0.0: Error: mce write submit urb error = -90 [ 1080.261322][T18799] team0: No ports can be present during mode change [ 1080.340948][T17787] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 90 [ 1080.385239][T17787] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1080.429890][T17787] usb 9-1: USB disconnect, device number 21 [ 1080.488723][T18783] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3428'. [ 1080.532441][ T5825] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1080.544416][ T5825] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1080.656844][ T5825] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1080.665939][ T5825] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1080.673408][ T5825] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1080.766331][T18808] input: syz0 as /devices/virtual/input/input73 [ 1081.649090][ T5825] Bluetooth: hci5: command 0x0405 tx timeout [ 1081.680732][ T911] usb 7-1: USB disconnect, device number 29 [ 1081.847828][ T5825] Bluetooth: hci4: command 0x0406 tx timeout [ 1081.899917][T18814] xt_hashlimit: max too large, truncated to 1048576 [ 1081.925055][ T5825] Bluetooth: hci1: command 0x0c1a tx timeout [ 1081.931192][T12898] Bluetooth: hci6: command 0x0406 tx timeout [ 1082.024424][ T30] audit: type=1400 audit(2000000337.336:2111): avc: denied { mounton } for pid=18813 comm="syz.8.3437" path="/92/file0" dev="tmpfs" ino=496 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 1082.467120][T18819] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3436'. [ 1082.711064][T18826] netlink: 'syz.6.3439': attribute type 6 has an invalid length. [ 1082.726488][T12898] Bluetooth: hci3: command tx timeout [ 1082.837387][ T30] audit: type=1400 audit(2000000338.026:2112): avc: denied { write } for pid=18824 comm="syz.6.3439" name="mouse0" dev="devtmpfs" ino=927 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1082.920027][T18804] chnl_net:caif_netlink_parms(): no params data found [ 1082.943478][ T30] audit: type=1326 audit(2000000338.156:2113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18823 comm="syz.2.3438" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f048ff8eec9 code=0x0 [ 1083.264967][T17787] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1083.501252][T18804] bridge0: port 1(bridge_slave_0) entered blocking state [ 1083.535050][T17787] usb 7-1: Using ep0 maxpacket: 32 [ 1083.544247][T18804] bridge0: port 1(bridge_slave_0) entered disabled state [ 1083.549501][T17787] usb 7-1: config 0 has an invalid interface number: 133 but max is 0 [ 1083.569853][T17787] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1083.605758][T18804] bridge_slave_0: entered allmulticast mode [ 1083.642685][T17787] usb 7-1: config 0 has no interface number 0 [ 1083.646752][T18804] bridge_slave_0: entered promiscuous mode [ 1083.658040][T17787] usb 7-1: config 0 interface 133 altsetting 0 bulk endpoint 0xB has invalid maxpacket 1024 [ 1083.686651][T12898] Bluetooth: hci5: command 0x0405 tx timeout [ 1083.711621][T17787] usb 7-1: config 0 interface 133 altsetting 0 bulk endpoint 0xF has invalid maxpacket 47 [ 1083.712434][T18804] bridge0: port 2(bridge_slave_1) entered blocking state [ 1083.735169][T17787] usb 7-1: config 0 interface 133 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1083.779001][T17787] usb 7-1: New USB device found, idVendor=0424, idProduct=012c, bcdDevice=71.1e [ 1083.790315][T17787] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1083.798636][T17787] usb 7-1: Product: syz [ 1083.805210][T17787] usb 7-1: Manufacturer: syz [ 1083.811729][T17787] usb 7-1: SerialNumber: syz [ 1083.861943][T17787] usb 7-1: config 0 descriptor?? [ 1083.891211][T18830] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1083.892341][T18804] bridge0: port 2(bridge_slave_1) entered disabled state [ 1083.920237][T18830] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1083.935083][T12898] Bluetooth: hci4: command 0x0406 tx timeout [ 1083.951167][T18804] bridge_slave_1: entered allmulticast mode [ 1083.997047][T18804] bridge_slave_1: entered promiscuous mode [ 1084.006691][T12898] Bluetooth: hci6: command 0x0406 tx timeout [ 1084.008054][ T5825] Bluetooth: hci1: command 0x0c1a tx timeout [ 1084.087856][T18804] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1084.120492][T18804] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1084.197260][T17787] usb 7-1: probing VID:PID(0424:012C) [ 1084.245138][T17787] usb 7-1: vub300 testing BULK OUT EndPoint(0) 0B [ 1084.276876][T17787] usb 7-1: vub300 testing BULK OUT EndPoint(1) 0F [ 1084.283802][T17787] usb 7-1: Could not find two sets of bulk-in/out endpoint pairs [ 1084.324994][T17787] vub300 7-1:0.133: probe with driver vub300 failed with error -22 [ 1084.415237][T17787] usb 7-1: USB disconnect, device number 30 [ 1084.517557][T18804] team0: Port device team_slave_0 added [ 1084.537358][T18804] team0: Port device team_slave_1 added [ 1084.828428][T12898] Bluetooth: hci3: command tx timeout [ 1085.484582][T18804] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1085.504974][T18804] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.548245][ T30] audit: type=1400 audit(2000000340.866:2114): avc: denied { ioctl } for pid=18863 comm="syz.2.3449" path="socket:[79897]" dev="sockfs" ino=79897 ioctlcmd=0x6611 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1085.565044][T18804] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1085.676760][T18804] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1085.704402][T18804] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1085.758826][T18804] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1085.770018][ T30] audit: type=1400 audit(2000000341.086:2115): avc: denied { getopt } for pid=18873 comm="syz.8.3452" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1086.005147][T12898] Bluetooth: hci4: command 0x0406 tx timeout [ 1086.084998][T12898] Bluetooth: hci1: command 0x0c1a tx timeout [ 1086.242221][T18862] ieee802154 phy1 wpan1: encryption failed: -22 [ 1086.283051][T18862] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3448'. [ 1086.322637][T18862] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3448'. [ 1086.323449][T18804] hsr_slave_0: entered promiscuous mode [ 1086.368449][T18862] netlink: 'syz.6.3448': attribute type 11 has an invalid length. [ 1086.389670][T18804] hsr_slave_1: entered promiscuous mode [ 1086.401073][T18862] netlink: 'syz.6.3448': attribute type 7 has an invalid length. [ 1086.422645][T18804] debugfs: 'hsr0' already exists in 'hsr' [ 1086.521541][T18804] Cannot create hsr debugfs directory [ 1086.582982][ T8936] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.682085][ T8936] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.855960][ T8936] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1086.885113][T12898] Bluetooth: hci3: command tx timeout [ 1086.951458][ T30] audit: type=1400 audit(2000000342.246:2116): avc: denied { bind } for pid=18891 comm="syz.2.3456" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1086.973826][ T8936] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1087.237673][ T30] audit: type=1400 audit(2000000342.556:2117): avc: denied { accept } for pid=18891 comm="syz.2.3456" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1087.383360][ T30] audit: type=1400 audit(2000000342.696:2118): avc: denied { getopt } for pid=18891 comm="syz.2.3456" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1087.443678][ T8936] bridge_slave_1: left allmulticast mode [ 1087.449780][ T8936] bridge_slave_1: left promiscuous mode [ 1087.458657][ T8936] bridge0: port 2(bridge_slave_1) entered disabled state [ 1087.577761][ T8936] bridge_slave_0: left allmulticast mode [ 1087.592822][ T8936] bridge_slave_0: left promiscuous mode [ 1087.599155][ T8936] bridge0: port 1(bridge_slave_0) entered disabled state [ 1087.728417][ T30] audit: type=1400 audit(2000000342.996:2119): avc: denied { execute_no_trans } for pid=18900 comm="syz.0.3458" path=2F6D656D66643A5B0BDB58AE5B1AA9FDFAAED16D64C885202864656C6574656429 dev="hugetlbfs" ino=79682 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 1087.757070][ C1] vkms_vblank_simulate: vblank timer overrun [ 1088.645938][ T5901] usb 9-1: new full-speed USB device number 22 using dummy_hcd [ 1088.837934][ T5901] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1088.848750][ T5901] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1088.857961][ T5901] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1088.867264][ T5901] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1088.878533][ T5901] usb 9-1: config 0 descriptor?? [ 1088.886531][ T5901] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1088.894564][ T5901] dvb-usb: bulk message failed: -22 (3/0) [ 1088.902580][ T5901] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1088.957619][ T5901] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1088.964815][ T5901] usb 9-1: media controller created [ 1088.972151][ T5901] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1088.980654][T12898] Bluetooth: hci3: command tx timeout [ 1088.984114][ T5901] dvb-usb: bulk message failed: -22 (6/0) [ 1088.996412][ T5901] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1089.010234][ T5901] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input74 [ 1089.044011][ T5901] dvb-usb: schedule remote query interval to 150 msecs. [ 1089.063647][ T5901] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1089.083942][ T8936] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1089.105887][ T8936] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1089.119393][ T8936] bond0 (unregistering): Released all slaves [ 1089.217124][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1089.224171][ T5901] dvb-usb: error while querying for an remote control event. [ 1089.380081][T17787] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 1089.405430][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1089.411398][ T5901] dvb-usb: error while querying for an remote control event. [ 1089.457553][ T8936] bond1 (unregistering): Released all slaves [ 1089.490984][T18804] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1089.508916][T18804] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1089.551958][T17787] usb 3-1: New USB device found, idVendor=0c72, idProduct=0012, bcdDevice=22.96 [ 1089.585011][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1089.591031][ T5901] dvb-usb: error while querying for an remote control event. [ 1089.612002][T17787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.624742][T18804] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1089.631771][T17787] usb 3-1: Product: syz [ 1089.639726][T17787] usb 3-1: Manufacturer: syz [ 1089.644364][T17787] usb 3-1: SerialNumber: syz [ 1089.691843][T17787] usb 3-1: config 0 descriptor?? [ 1089.726701][T18804] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1089.765646][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1089.772129][ T5901] dvb-usb: error while querying for an remote control event. [ 1089.905922][T17787] peak_usb 3-1:0.0: PEAK-System PCAN-USB FD v0 fw v0.0.0 (1 channels) [ 1089.935131][T13005] dvb-usb: bulk message failed: -22 (1/0) [ 1089.953101][T18804] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1089.980849][T13005] dvb-usb: error while querying for an remote control event. [ 1090.032217][T18804] 8021q: adding VLAN 0 to HW filter on device team0 [ 1090.108977][ T5990] bridge0: port 1(bridge_slave_0) entered blocking state [ 1090.116122][ T5990] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1090.126810][T17787] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 1090.146254][T17787] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 1090.155422][T13005] dvb-usb: bulk message failed: -22 (1/0) [ 1090.166777][T13005] dvb-usb: error while querying for an remote control event. [ 1090.167837][T17787] peak_usb 3-1:0.0 can0: sending command failure: -22 [ 1090.211281][ T5990] bridge0: port 2(bridge_slave_1) entered blocking state [ 1090.218448][ T5990] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1090.294403][ T8936] hsr_slave_0: left promiscuous mode [ 1090.301480][T17787] peak_usb 3-1:0.0: probe with driver peak_usb failed with error -22 [ 1090.322178][ T8936] hsr_slave_1: left promiscuous mode [ 1090.328892][ T8936] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1090.355565][ T8936] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1090.369030][ T8936] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1090.385039][T13005] dvb-usb: bulk message failed: -22 (1/0) [ 1090.390976][T13005] dvb-usb: error while querying for an remote control event. [ 1090.398622][ T8936] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1090.448987][ T8936] veth1_macvtap: left promiscuous mode [ 1090.455051][ T8936] veth0_macvtap: left promiscuous mode [ 1090.507666][ T8936] veth1_vlan: left promiscuous mode [ 1090.534086][ T8936] veth0_vlan: left promiscuous mode [ 1090.575029][T13005] dvb-usb: bulk message failed: -22 (1/0) [ 1090.581335][T13005] dvb-usb: error while querying for an remote control event. [ 1090.746341][T13005] dvb-usb: bulk message failed: -22 (1/0) [ 1090.752353][T13005] dvb-usb: error while querying for an remote control event. [ 1090.927631][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1090.933751][ T5901] dvb-usb: error while querying for an remote control event. [ 1091.099111][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1091.105328][ T5901] dvb-usb: error while querying for an remote control event. [ 1091.286983][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1091.293019][ T5901] dvb-usb: error while querying for an remote control event. [ 1091.337217][ T8936] team0 (unregistering): Port device team_slave_1 removed [ 1091.419251][ T8936] team0 (unregistering): Port device team_slave_0 removed [ 1091.428692][ T911] usb 9-1: USB disconnect, device number 22 [ 1091.455089][ T5901] dvb-usb: bulk message failed: -22 (1/0) [ 1091.461026][ T5901] dvb-usb: error while querying for an remote control event. [ 1091.522466][ T911] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1091.704982][T13005] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 1091.862593][ T30] audit: type=1326 audit(2000000347.176:2120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18943 comm="syz.6.3467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1091.878412][T13005] usb 1-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 1091.913822][T13005] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1091.933066][T13005] usb 1-1: Product: syz [ 1091.947446][T13005] usb 1-1: Manufacturer: syz [ 1091.958787][T13005] usb 1-1: SerialNumber: syz [ 1091.989414][T13005] usb 1-1: config 0 descriptor?? [ 1092.042125][T13005] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 1092.114112][ T911] usb 3-1: USB disconnect, device number 79 [ 1092.340921][ T30] audit: type=1326 audit(2000000347.656:2121): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18943 comm="syz.6.3467" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1092.820354][T13005] gspca_sunplus: reg_w_riv err -110 [ 1092.825769][T13005] sunplus 1-1:0.0: probe with driver sunplus failed with error -110 [ 1093.331936][T13005] usb 1-1: USB disconnect, device number 4 [ 1093.775756][T18972] ptrace attach of "./syz-executor exec"[18962] was attempted by "./syz-executor exec"[18972] [ 1093.927127][T18978] FAULT_INJECTION: forcing a failure. [ 1093.927127][T18978] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1093.964969][T18978] CPU: 1 UID: 0 PID: 18978 Comm: syz.6.3473 Not tainted syzkaller #0 PREEMPT(full) [ 1093.964998][T18978] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1093.965009][T18978] Call Trace: [ 1093.965015][T18978] [ 1093.965021][T18978] dump_stack_lvl+0x16c/0x1f0 [ 1093.965052][T18978] should_fail_ex+0x512/0x640 [ 1093.965077][T18978] ? page_copy_sane+0xcd/0x2d0 [ 1093.965103][T18978] copy_folio_from_iter_atomic+0x36f/0x1ac0 [ 1093.965132][T18978] ? simple_xattr_get+0x179/0x1d0 [ 1093.965158][T18978] ? __pfx_copy_folio_from_iter_atomic+0x10/0x10 [ 1093.965173][T18978] ? shmem_write_begin+0x176/0x300 [ 1093.965201][T18978] ? __pfx_shmem_write_begin+0x10/0x10 [ 1093.965234][T18978] ? balance_dirty_pages_ratelimited_flags+0x92/0x1260 [ 1093.965259][T18978] generic_perform_write+0x221/0x900 [ 1093.965289][T18978] ? __pfx_generic_perform_write+0x10/0x10 [ 1093.965311][T18978] ? inode_needs_update_time.part.0+0x191/0x270 [ 1093.965335][T18978] shmem_file_write_iter+0x10e/0x140 [ 1093.965353][T18978] vfs_write+0x7d0/0x11d0 [ 1093.965367][T18978] ? __pfx_shmem_file_write_iter+0x10/0x10 [ 1093.965383][T18978] ? __pfx___mutex_lock+0x10/0x10 [ 1093.965407][T18978] ? __pfx_vfs_write+0x10/0x10 [ 1093.965448][T18978] ksys_write+0x12a/0x250 [ 1093.965463][T18978] ? __pfx_ksys_write+0x10/0x10 [ 1093.965485][T18978] do_syscall_64+0xcd/0xfa0 [ 1093.965512][T18978] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1093.965528][T18978] RIP: 0033:0x7f45a5b8eec9 [ 1093.965542][T18978] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1093.965559][T18978] RSP: 002b:00007f45a6a94038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1093.965577][T18978] RAX: ffffffffffffffda RBX: 00007f45a5de5fa0 RCX: 00007f45a5b8eec9 [ 1093.965588][T18978] RDX: 00000000000055af RSI: 0000200000000040 RDI: 0000000000000008 [ 1093.965599][T18978] RBP: 00007f45a6a94090 R08: 0000000000000000 R09: 0000000000000000 [ 1093.965610][T18978] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1093.965620][T18978] R13: 00007f45a5de6038 R14: 00007f45a5de5fa0 R15: 00007fff33a21dc8 [ 1093.965646][T18978] [ 1094.319449][T18804] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1097.162825][ T30] audit: type=1400 audit(2000000352.476:2122): avc: denied { unmount } for pid=16165 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 1097.182675][ C1] vkms_vblank_simulate: vblank timer overrun [ 1097.269049][ T8936] IPVS: stop unused estimator thread 0... [ 1097.529721][T18804] veth0_vlan: entered promiscuous mode [ 1098.112263][ T30] audit: type=1326 audit(2000000352.996:2123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19006 comm="syz.6.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1098.135760][ C1] vkms_vblank_simulate: vblank timer overrun [ 1098.191083][T18804] veth1_vlan: entered promiscuous mode [ 1098.197685][ T30] audit: type=1326 audit(2000000353.406:2124): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19006 comm="syz.6.3480" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1099.004735][T18804] veth0_macvtap: entered promiscuous mode [ 1099.022489][T18804] veth1_macvtap: entered promiscuous mode [ 1099.053885][T18804] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1099.070178][T18804] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1099.090306][ T8921] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1099.121039][ T8921] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1099.224679][ T8921] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1099.272278][ T8921] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1099.328583][ T8921] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1099.340595][ T8921] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1099.361823][ T8935] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1099.370130][ T8935] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1100.051695][T19040] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3430'. [ 1101.223663][T19054] netlink: 140 bytes leftover after parsing attributes in process `syz.6.3490'. [ 1102.014997][T17805] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 1102.416778][T17805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1102.450633][T17805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1102.489647][T17805] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1102.580288][T17805] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1102.601672][T17805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1102.619193][T17805] usb 1-1: config 0 descriptor?? [ 1103.252322][T17805] plantronics 0003:047F:FFFF.0017: unknown main item tag 0x0 [ 1103.275003][ T5901] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 1103.312546][T17805] plantronics 0003:047F:FFFF.0017: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 1103.442516][T19083] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3498'. [ 1103.463497][ T5901] usb 7-1: Using ep0 maxpacket: 8 [ 1103.470429][ T5901] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 1103.495079][ T5901] usb 7-1: config 179 has no interface number 0 [ 1103.515102][ T5901] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1103.535933][ T5901] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1103.549479][T17781] usb 1-1: USB disconnect, device number 5 [ 1103.559873][ T5901] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1103.574691][ T5901] usb 7-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1103.591995][T19087] input: syz1 as /devices/virtual/input/input75 [ 1103.606730][ T5901] usb 7-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1103.632884][ T5901] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1103.642629][ T5901] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1103.891188][T19081] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1104.115789][ T30] audit: type=1400 audit(2000000359.406:2125): avc: denied { read } for pid=19094 comm="syz.8.3501" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1106.125878][ T5931] usb 7-1: USB disconnect, device number 31 [ 1106.125882][ C0] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1106.734688][ T30] audit: type=1400 audit(2000000362.046:2126): avc: denied { ioctl } for pid=19119 comm="syz.6.3507" path="/dev/usbmon7" dev="devtmpfs" ino=737 ioctlcmd=0x9207 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1106.760045][ C1] vkms_vblank_simulate: vblank timer overrun [ 1109.375703][T19143] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3512'. [ 1110.205186][ T5931] usb 3-1: new full-speed USB device number 80 using dummy_hcd [ 1110.371909][ T5931] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1110.384417][ T5931] usb 3-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 1110.404467][ T5931] usb 3-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1110.415477][ T5931] usb 3-1: New USB device strings: Mfr=16, Product=0, SerialNumber=0 [ 1110.427156][ T5931] usb 3-1: Manufacturer: syz [ 1110.449636][T19162] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1110.458784][T19162] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1110.500925][ T5931] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1110.622933][T19169] ptrace attach of "./syz-executor exec"[19170] was attempted by "./syz-executor exec"[19169] [ 1110.652460][ T30] audit: type=1400 audit(2000000365.966:2127): avc: denied { bind } for pid=19168 comm="syz.0.3520" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1110.685972][T12898] Bluetooth: hci1: unexpected event for opcode 0x2011 [ 1110.947722][T19178] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3518'. [ 1111.824699][T19195] team0: No ports can be present during mode change [ 1111.900745][ T5901] usb 3-1: USB disconnect, device number 80 [ 1111.999145][T19200] No control pipe specified [ 1112.101041][ T30] audit: type=1400 audit(2000000367.416:2128): avc: denied { connect } for pid=19198 comm="syz.6.3527" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 1112.102362][T19199] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3527'. [ 1112.923762][ T30] audit: type=1400 audit(2000000368.236:2129): avc: denied { setattr } for pid=19208 comm="syz.6.3530" name="/" dev="fuse" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1113.031568][T19218] kAFS: No cell specified [ 1114.578498][T19236] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=4120 sclass=netlink_route_socket pid=19236 comm=syz.2.3537 [ 1114.638769][T19230] x_tables: ip_tables: DNAT target: used from hooks INPUT, but only usable from PREROUTING/OUTPUT [ 1115.039470][T19235] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1115.171761][T19235] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1115.644073][T17805] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1115.687395][T19235] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1115.716927][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.918297][T19235] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1115.945165][T17805] usb 10-1: Using ep0 maxpacket: 32 [ 1115.952454][T17805] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1115.964725][T17805] usb 10-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1115.976928][T19253] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3543'. [ 1115.985963][T19253] netlink: 28 bytes leftover after parsing attributes in process `syz.8.3543'. [ 1115.994956][T19253] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3543'. [ 1116.004085][T19253] netlink: 28 bytes leftover after parsing attributes in process `syz.8.3543'. [ 1116.013137][T19253] netlink: 'syz.8.3543': attribute type 6 has an invalid length. [ 1116.028206][T17805] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.039555][T17805] usb 10-1: Product: syz [ 1116.043995][T17805] usb 10-1: Manufacturer: syz [ 1116.087867][T17805] usb 10-1: SerialNumber: syz [ 1116.105899][T17805] usb 10-1: config 0 descriptor?? [ 1116.106157][ T8939] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.118202][T17805] usb 10-1: bad CDC descriptors [ 1116.215928][ T30] audit: type=1400 audit(2000000371.446:2130): avc: denied { read } for pid=19250 comm="syz.8.3543" path="socket:[82945]" dev="sockfs" ino=82945 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1116.235631][T17805] usb 10-1: unsupported MDLM descriptors [ 1116.247572][ T8939] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.270420][ T8939] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.295470][ T8939] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1116.314135][ T30] audit: type=1400 audit(2000000371.626:2131): avc: denied { setopt } for pid=19257 comm="syz.6.3545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1116.461595][ T30] audit: type=1400 audit(2000000371.776:2132): avc: denied { read write } for pid=19257 comm="syz.6.3545" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1116.492175][ T30] audit: type=1400 audit(2000000371.776:2133): avc: denied { open } for pid=19257 comm="syz.6.3545" path="/dev/cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1116.537677][T17805] usb 10-1: USB disconnect, device number 2 [ 1116.580809][ T30] audit: type=1326 audit(2000000371.896:2134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19250 comm="syz.8.3543" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7838eec9 code=0x7fc00000 [ 1116.648593][ T30] audit: type=1326 audit(2000000371.896:2135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19250 comm="syz.8.3543" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fdd7838eec9 code=0x7fc00000 [ 1116.732144][ T30] audit: type=1326 audit(2000000371.896:2136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19250 comm="syz.8.3543" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7838eec9 code=0x7fc00000 [ 1116.756938][ T30] audit: type=1326 audit(2000000371.896:2137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19250 comm="syz.8.3543" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7838eec9 code=0x7fc00000 [ 1117.320675][T19285] kvm: kvm [19284]: vcpu0, guest rIP: 0xfff0 Unhandled WRMSR(0x40000074) = 0x0 [ 1117.954997][ T5901] usb 7-1: new high-speed USB device number 32 using dummy_hcd [ 1118.214982][ T5901] usb 7-1: Using ep0 maxpacket: 8 [ 1118.230754][ T5901] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1118.262343][ T5901] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1118.277647][ T5901] usb 7-1: can't read configurations, error -61 [ 1118.388055][T19304] input: syz1 as /devices/virtual/input/input76 [ 1118.425415][ T5901] usb 7-1: new high-speed USB device number 33 using dummy_hcd [ 1118.616043][T19306] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 1118.624914][T19306] overlayfs: missing 'lowerdir' [ 1119.564996][ T5901] usb 7-1: Using ep0 maxpacket: 8 [ 1119.574497][ T5901] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1119.872381][ T5901] usb 7-1: unable to read config index 0 descriptor/start: -61 [ 1119.883958][ T5901] usb 7-1: can't read configurations, error -61 [ 1119.890885][ T5901] usb usb7-port1: attempt power cycle [ 1120.255533][ T5901] usb 7-1: new high-speed USB device number 34 using dummy_hcd [ 1120.729915][ T5901] usb 7-1: device descriptor read/8, error -71 [ 1120.740549][T19320] netlink: 14 bytes leftover after parsing attributes in process `syz.0.3558'. [ 1121.037446][T19326] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3561'. [ 1121.056420][T19326] netlink: 4 bytes leftover after parsing attributes in process `syz.9.3561'. [ 1121.345630][T19320] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1121.498909][T19320] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1121.635128][T19320] bond0 (unregistering): Released all slaves [ 1121.828491][T19336] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1122.766316][T19336] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1122.981523][T19336] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.015779][T19364] syz_tun: entered allmulticast mode [ 1123.209627][T19336] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.238239][T19371] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3573'. [ 1123.433267][ T8939] netdevsim netdevsim9 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.480062][ T8939] netdevsim netdevsim9 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.486117][T19376] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3575'. [ 1123.509238][ T8939] netdevsim netdevsim9 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.516376][T19376] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3575'. [ 1123.543624][ T8939] netdevsim netdevsim9 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1123.636751][T19380] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3571'. [ 1123.757476][T19384] netlink: 'syz.6.3578': attribute type 1 has an invalid length. [ 1123.765528][T19384] netlink: 'syz.6.3578': attribute type 1 has an invalid length. [ 1123.773749][T19383] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 1124.677971][ T30] audit: type=1400 audit(1124.636:2138): avc: denied { ioctl } for pid=19407 comm="syz.6.3586" path="socket:[83531]" dev="sockfs" ino=83531 ioctlcmd=0x89eb scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 1125.854536][T19424] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3588'. [ 1125.905201][T19422] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3588'. [ 1128.095560][T19461] netlink: 1000 bytes leftover after parsing attributes in process `syz.0.3598'. [ 1128.196087][T19461] netlink: 32 bytes leftover after parsing attributes in process `syz.0.3598'. [ 1128.205324][T19461] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3598'. [ 1128.831369][ T30] audit: type=1326 audit(1128.656:2139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19463 comm="syz.6.3600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1129.246700][ T30] audit: type=1326 audit(1129.186:2140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19463 comm="syz.6.3600" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1132.115322][T17781] usb 3-1: new high-speed USB device number 81 using dummy_hcd [ 1132.200498][ T5931] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1132.241175][ T30] audit: type=1326 audit(1132.206:2141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19519 comm="syz.8.3614" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdd7838eec9 code=0x7fc00000 [ 1132.264406][T17781] usb 3-1: device descriptor read/64, error -71 [ 1132.775012][ T5931] usb 1-1: Using ep0 maxpacket: 16 [ 1132.781515][ T5931] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1132.793198][ T5931] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1132.807161][ T5931] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1132.817134][ T30] audit: type=1326 audit(1132.786:2142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19519 comm="syz.8.3614" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fdd7838eec9 code=0x7fc00000 [ 1132.845352][ T5931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1132.853475][ T5931] usb 1-1: Product: syz [ 1132.857732][ T5931] usb 1-1: Manufacturer: syz [ 1132.862409][ T5931] usb 1-1: SerialNumber: syz [ 1132.867308][T17781] usb 3-1: new high-speed USB device number 82 using dummy_hcd [ 1132.869113][ T5931] usb 1-1: config 0 descriptor?? [ 1132.882761][ T5931] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1132.894429][ T5931] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 1133.014977][T17781] usb 3-1: device descriptor read/64, error -71 [ 1133.094034][T19533] netlink: 12 bytes leftover after parsing attributes in process `syz.9.3617'. [ 1133.103696][T19533] bond0: entered allmulticast mode [ 1133.109083][T19533] bond_slave_0: entered allmulticast mode [ 1133.114970][T19533] bond_slave_1: entered allmulticast mode [ 1133.135412][T17781] usb usb3-port1: attempt power cycle [ 1133.145873][T19535] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(6) [ 1133.152425][T19535] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1133.181552][T19535] vhci_hcd vhci_hcd.0: Device attached [ 1133.260722][T19539] syz.8.3616 (19539): /proc/19529/oom_adj is deprecated, please use /proc/19529/oom_score_adj instead. [ 1133.465014][T17805] usb 50-1: SetAddress Request (2) to port 0 [ 1133.471596][T17805] usb 50-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1133.503067][T17781] usb 3-1: new high-speed USB device number 83 using dummy_hcd [ 1133.535558][T17781] usb 3-1: device descriptor read/8, error -71 [ 1133.602327][ T5931] em28xx 1-1:0.0: chip ID is em2874 [ 1133.609954][T19545] /dev/nullb0: Can't open blockdev [ 1133.724984][T17787] usb 9-1: new full-speed USB device number 23 using dummy_hcd [ 1133.785020][T17781] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 1133.825665][T17781] usb 3-1: device descriptor read/8, error -71 [ 1133.854990][T13005] usb 7-1: new high-speed USB device number 36 using dummy_hcd [ 1133.887083][T17787] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1133.919990][T19546] netlink: 216 bytes leftover after parsing attributes in process `syz.0.3613'. [ 1133.929193][T19546] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3613'. [ 1133.938317][T19546] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3613'. [ 1134.003957][T17781] usb usb3-port1: unable to enumerate USB device [ 1134.827712][T17787] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1134.836651][T13005] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1134.844783][T17787] usb 9-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1134.853913][T17787] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1134.953759][T13005] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 49919, setting to 1024 [ 1134.980562][T13005] usb 7-1: config 1 interface 1 has no altsetting 0 [ 1134.981136][T17787] usb 9-1: config 0 descriptor?? [ 1134.994602][T13005] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1135.003829][T13005] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1135.011984][T13005] usb 7-1: Product: syz [ 1135.020812][T13005] usb 7-1: Manufacturer: syz [ 1135.040016][T13005] usb 7-1: SerialNumber: syz [ 1135.059548][T17787] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1135.105582][T17787] dvb-usb: bulk message failed: -22 (3/0) [ 1135.107231][ T5901] usb 1-1: USB disconnect, device number 6 [ 1135.118026][ T5901] em28xx 1-1:0.0: Disconnecting em28xx [ 1135.129109][T17787] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1135.155614][ T5901] em28xx 1-1:0.0: Freeing device [ 1135.155878][T17787] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1135.167944][T17787] usb 9-1: media controller created [ 1135.174677][T17787] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1135.213550][T17787] dvb-usb: bulk message failed: -22 (6/0) [ 1135.221629][T17787] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1135.231012][T17787] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input77 [ 1135.243353][T17787] dvb-usb: schedule remote query interval to 150 msecs. [ 1135.250367][T17787] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1135.296155][T13005] usb 7-1: 2:1 : no or invalid class specific endpoint descriptor [ 1135.315024][T13005] usb 7-1: found format II with max.bitrate = 2418, frame size=7 [ 1135.347933][T13005] usb 7-1: 2:1: All rates were zero [ 1135.531581][T17787] dvb-usb: bulk message failed: -22 (1/0) [ 1135.558494][T19559] netdevsim netdevsim9 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1135.561268][T17787] dvb-usb: error while querying for an remote control event. [ 1135.642263][T13005] usb 7-1: USB disconnect, device number 36 [ 1135.699827][T19559] netdevsim netdevsim9 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1135.748222][T19559] netdevsim netdevsim9 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1135.758266][T17787] dvb-usb: bulk message failed: -22 (1/0) [ 1135.766576][T17787] dvb-usb: error while querying for an remote control event. [ 1135.818888][T19559] netdevsim netdevsim9 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1135.908051][ T8939] netdevsim netdevsim9 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1135.929699][T17787] dvb-usb: bulk message failed: -22 (1/0) [ 1135.937060][T17787] dvb-usb: error while querying for an remote control event. [ 1135.952835][ T8939] netdevsim netdevsim9 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1135.989884][ T8939] netdevsim netdevsim9 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1136.055189][T17552] netdevsim netdevsim9 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1136.125381][T17790] dvb-usb: bulk message failed: -22 (1/0) [ 1136.131595][T17790] dvb-usb: error while querying for an remote control event. [ 1136.294985][T17790] dvb-usb: bulk message failed: -22 (1/0) [ 1136.306839][T17790] dvb-usb: error while querying for an remote control event. [ 1136.363185][ T30] audit: type=1326 audit(1136.326:2143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19567 comm="syz.6.3626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1136.595221][T17790] dvb-usb: bulk message failed: -22 (1/0) [ 1136.629085][T17790] dvb-usb: error while querying for an remote control event. [ 1136.825347][T17790] dvb-usb: bulk message failed: -22 (1/0) [ 1136.831150][T17790] dvb-usb: error while querying for an remote control event. [ 1136.886118][T17790] usb 9-1: USB disconnect, device number 23 [ 1136.900263][T17790] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1136.928585][ T30] audit: type=1326 audit(1136.886:2144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19567 comm="syz.6.3626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1136.961000][T19536] vhci_hcd: connection reset by peer [ 1136.990157][ T8939] vhci_hcd: stop threads [ 1136.994602][ T8939] vhci_hcd: release socket [ 1136.999243][ T8939] vhci_hcd: disconnect device [ 1137.046777][T19581] tipc: Enabled bearer , priority 0 [ 1137.054372][T19581] syzkaller0: entered promiscuous mode [ 1137.060302][T19581] syzkaller0: entered allmulticast mode [ 1137.091335][T19581] tipc: Resetting bearer [ 1137.102099][T19581] x_tables: ip6_tables: rpfilter match: used from hooks INPUT, but only valid from PREROUTING [ 1137.117194][T19580] tipc: Resetting bearer [ 1137.156794][T19580] tipc: Disabling bearer [ 1137.537292][T19594] loop7: detected capacity change from 0 to 7 [ 1137.544444][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.553660][ C1] buffer_io_error: 6 callbacks suppressed [ 1137.553674][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.595098][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.604312][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.612711][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.621889][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.630326][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.639524][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.652626][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.661839][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.670474][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.679821][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.688489][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.697664][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.705897][T19594] ldm_validate_partition_table(): Disk read failed. [ 1137.713129][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.722306][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.735176][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.744391][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.754912][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 1137.764121][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1137.774719][T19594] Dev loop7: unable to read RDB block 0 [ 1137.823141][T19594] loop7: unable to read partition table [ 1137.829206][T19594] loop7: partition table beyond EOD, truncated [ 1137.835692][T19594] loop_reread_partitions: partition scan of loop7 (gCj̖P=!MX %`搘ȵ4FLQk݊5) failed (rc=-5) [ 1138.346485][T19596] ldm_validate_partition_table(): Disk read failed. [ 1138.366669][T19596] Dev loop7: unable to read RDB block 0 [ 1138.378433][T19596] loop7: unable to read partition table [ 1138.385162][T19596] loop7: partition table beyond EOD, truncated [ 1138.405409][T17781] usb 7-1: new high-speed USB device number 37 using dummy_hcd [ 1138.605334][T17781] usb 7-1: Using ep0 maxpacket: 8 [ 1138.616804][T17781] usb 7-1: config 0 has an invalid interface number: 160 but max is 0 [ 1138.634197][T17781] usb 7-1: config 0 has no interface number 0 [ 1138.642862][T17781] usb 7-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1138.665233][T17781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1138.682731][T17781] usb 7-1: Product: syz [ 1138.691848][T17781] usb 7-1: Manufacturer: syz [ 1138.696721][T17781] usb 7-1: SerialNumber: syz [ 1138.725017][T17805] usb 50-1: device descriptor read/8, error -110 [ 1139.015186][T17781] usb 7-1: config 0 descriptor?? [ 1139.020560][ T30] audit: type=1326 audit(1138.676:2145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19610 comm="syz.9.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3fd258eec9 code=0x7fc00000 [ 1139.300314][ T30] audit: type=1326 audit(1139.236:2146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19610 comm="syz.9.3639" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f3fd258eec9 code=0x7fc00000 [ 1139.323214][ C0] vkms_vblank_simulate: vblank timer overrun [ 1139.356622][T17781] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1139.368305][T17781] gspca_sonixj: reg_w1 err -71 [ 1139.373183][T17781] sonixj 7-1:0.160: probe with driver sonixj failed with error -71 [ 1139.415108][T17781] usb 7-1: USB disconnect, device number 37 [ 1139.585173][T17805] usb usb50-port1: attempt power cycle [ 1139.876529][T17787] usb 9-1: new high-speed USB device number 24 using dummy_hcd [ 1139.916769][T19628] sp0: Synchronizing with TNC [ 1139.986209][T19626] [U] `` [ 1140.075076][T17787] usb 9-1: Using ep0 maxpacket: 16 [ 1140.082423][T17787] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1140.113368][T17787] usb 9-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1140.178738][T17805] usb usb50-port1: unable to enumerate USB device [ 1140.217685][T17787] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1140.271385][T17787] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1140.279703][T17787] usb 9-1: SerialNumber: syz [ 1140.330689][T19644] loop4: detected capacity change from 0 to 2560 [ 1140.338748][T19644] ldm_validate_partition_table(): Disk read failed. [ 1140.345542][T19644] Dev loop4: unable to read RDB block 0 [ 1140.351275][T19644] loop4: unable to read partition table [ 1140.356994][T19644] loop_reread_partitions: partition scan of loop4 (3 ) failed (rc=-5) [ 1140.508292][T19629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1140.517702][T19629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1140.527931][T12898] Bluetooth: hci3: unexpected event 0x05 length: 10 > 4 [ 1141.123179][T17805] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1141.140538][T17787] cdc_acm 9-1:1.0: skipping garbage [ 1141.145795][T17787] cdc_acm 9-1:1.0: skipping garbage [ 1141.151294][T17787] cdc_acm 9-1:1.0: Control and data interfaces are not separated! [ 1141.213919][T17787] cdc_acm 9-1:1.0: This needs exactly 3 endpoints [ 1141.224697][T17787] cdc_acm 9-1:1.0: probe with driver cdc_acm failed with error -22 [ 1141.248567][T17787] usb 9-1: USB disconnect, device number 24 [ 1141.445152][T17805] usb 1-1: Using ep0 maxpacket: 32 [ 1141.456119][T17805] usb 1-1: config 0 has an invalid interface number: 164 but max is 0 [ 1141.464383][T17805] usb 1-1: config 0 has no interface number 0 [ 1141.474943][T17805] usb 1-1: config 0 interface 164 has no altsetting 0 [ 1141.487379][T17805] usb 1-1: New USB device found, idVendor=2077, idProduct=7001, bcdDevice=77.e2 [ 1141.506549][T17805] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1141.510291][T19655] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3649'. [ 1141.527635][T17805] usb 1-1: Product: syz [ 1141.531877][T17805] usb 1-1: Manufacturer: syz [ 1141.544997][T17805] usb 1-1: SerialNumber: syz [ 1141.557069][T19655] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3649'. [ 1141.557115][T17805] usb 1-1: config 0 descriptor?? [ 1141.575306][T19655] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3649'. [ 1141.892371][T17805] option 1-1:0.164: GSM modem (1-port) converter detected [ 1141.920545][T19655] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3649'. [ 1141.957562][T19658] netlink: 104 bytes leftover after parsing attributes in process `syz.6.3649'. [ 1141.994361][T19655] /dev/nullb0: Can't open blockdev [ 1142.015396][T19655] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=19655 comm=syz.6.3649 [ 1143.869010][T19692] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1143.877688][T19692] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1144.364970][T17781] usb 9-1: new high-speed USB device number 25 using dummy_hcd [ 1144.433106][ T30] audit: type=1400 audit(1144.396:2147): avc: denied { write } for pid=19701 comm="syz.9.3663" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1144.516943][T17781] usb 9-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 223, changing to 11 [ 1144.581616][T17781] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1144.612108][T17781] usb 9-1: New USB device found, idVendor=0419, idProduct=0001, bcdDevice= 0.00 [ 1144.641679][T17781] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1144.680328][T17781] usb 9-1: config 0 descriptor?? [ 1144.698831][T19690] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1144.817901][T19710] vlan2: entered allmulticast mode [ 1144.824436][T19710] macvtap0: entered allmulticast mode [ 1145.112702][T17787] usb 1-1: USB disconnect, device number 7 [ 1145.132125][T17787] option 1-1:0.164: device disconnected [ 1145.392173][T17781] samsung 0003:0419:0001.0018: hidraw0: USB HID v0.01 Device [HID 0419:0001] on usb-dummy_hcd.8-1/input0 [ 1145.817725][T19715] /dev/nullb0: Can't open blockdev [ 1145.969773][T19715] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1146.311015][T19722] netlink: 28 bytes leftover after parsing attributes in process `syz.9.3666'. [ 1146.451174][T19723] /dev/nullb0: Can't open blockdev [ 1146.555049][T19715] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1146.689733][T19715] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1146.893025][T19715] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1147.122286][T17787] usb 9-1: USB disconnect, device number 25 [ 1147.175814][ T8921] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1147.229163][ T8921] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1147.277283][ T8921] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1147.327811][ T8921] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1147.514180][T19739] FAULT_INJECTION: forcing a failure. [ 1147.514180][T19739] name failslab, interval 1, probability 0, space 0, times 0 [ 1147.545281][T19739] CPU: 0 UID: 0 PID: 19739 Comm: syz.8.3671 Not tainted syzkaller #0 PREEMPT(full) [ 1147.545310][T19739] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1147.545321][T19739] Call Trace: [ 1147.545328][T19739] [ 1147.545335][T19739] dump_stack_lvl+0x16c/0x1f0 [ 1147.545367][T19739] should_fail_ex+0x512/0x640 [ 1147.545393][T19739] ? __kmalloc_cache_noprof+0x5f/0x780 [ 1147.545420][T19739] should_failslab+0xc2/0x120 [ 1147.545441][T19739] __kmalloc_cache_noprof+0x72/0x780 [ 1147.545466][T19739] ? rdma_resolve_addr+0x722/0x20c0 [ 1147.545495][T19739] ? rdma_resolve_addr+0x722/0x20c0 [ 1147.545517][T19739] rdma_resolve_addr+0x722/0x20c0 [ 1147.545541][T19739] ? xa_load+0x153/0x2c0 [ 1147.545566][T19739] ? __pfx_rdma_resolve_addr+0x10/0x10 [ 1147.545588][T19739] ? do_raw_spin_unlock+0x172/0x230 [ 1147.545618][T19739] ? __pfx_ucma_get_ctx+0x10/0x10 [ 1147.545651][T19739] ? ucma_resolve_addr+0x1aa/0x270 [ 1147.545674][T19739] ucma_resolve_addr+0x1aa/0x270 [ 1147.545699][T19739] ? __pfx_ucma_resolve_addr+0x10/0x10 [ 1147.545755][T19739] ? __pfx_ucma_resolve_addr+0x10/0x10 [ 1147.545780][T19739] ucma_write+0x1fb/0x330 [ 1147.545803][T19739] ? __pfx_ucma_write+0x10/0x10 [ 1147.545825][T19739] ? bpf_lsm_file_permission+0x9/0x10 [ 1147.545843][T19739] ? security_file_permission+0x71/0x210 [ 1147.545863][T19739] ? rw_verify_area+0xcf/0x6c0 [ 1147.545888][T19739] ? __pfx_ucma_write+0x10/0x10 [ 1147.545910][T19739] vfs_write+0x2a0/0x11d0 [ 1147.545932][T19739] ? __pfx_vfs_write+0x10/0x10 [ 1147.545956][T19739] ? find_held_lock+0x2b/0x80 [ 1147.545978][T19739] ? __fget_files+0x204/0x3c0 [ 1147.546000][T19739] ? __fget_files+0x20e/0x3c0 [ 1147.546024][T19739] ksys_write+0x1f8/0x250 [ 1147.546040][T19739] ? __pfx_ksys_write+0x10/0x10 [ 1147.546065][T19739] do_syscall_64+0xcd/0xfa0 [ 1147.546092][T19739] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1147.546110][T19739] RIP: 0033:0x7fdd7838eec9 [ 1147.546125][T19739] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1147.546142][T19739] RSP: 002b:00007fdd792cc038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1147.546160][T19739] RAX: ffffffffffffffda RBX: 00007fdd785e5fa0 RCX: 00007fdd7838eec9 [ 1147.546171][T19739] RDX: 0000000000000118 RSI: 0000200000000280 RDI: 0000000000000003 [ 1147.546182][T19739] RBP: 00007fdd792cc090 R08: 0000000000000000 R09: 0000000000000000 [ 1147.546192][T19739] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1147.546202][T19739] R13: 00007fdd785e6038 R14: 00007fdd785e5fa0 R15: 00007fff5066e178 [ 1147.546229][T19739] [ 1147.909746][ T30] audit: type=1400 audit(1147.876:2148): avc: denied { lock } for pid=19736 comm="syz.2.3672" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1148.114364][T19738] Invalid source name [ 1148.118455][T19738] UBIFS error (pid: 19738): cannot open "./file0", error -22 [ 1148.130424][ T30] audit: type=1400 audit(1148.076:2149): avc: denied { listen } for pid=19736 comm="syz.2.3672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1148.181443][ T30] audit: type=1400 audit(1148.076:2150): avc: denied { mounton } for pid=19736 comm="syz.2.3672" path="/204/file0" dev="tmpfs" ino=1081 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1148.471060][T19753] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3675'. [ 1148.857577][T19755] netlink: 52 bytes leftover after parsing attributes in process `syz.9.3677'. [ 1149.272177][ T30] audit: type=1326 audit(1149.236:2151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19760 comm="syz.6.3678" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1149.544453][T19775] xt_hashlimit: max too large, truncated to 1048576 [ 1149.978803][ T30] audit: type=1326 audit(1149.796:2152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19760 comm="syz.6.3678" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f45a5b8eec9 code=0x7fc00000 [ 1150.197592][ T1206] usb 9-1: new low-speed USB device number 26 using dummy_hcd [ 1150.198776][T19788] netlink: 16 bytes leftover after parsing attributes in process `syz.9.3686'. [ 1150.273957][T19790] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3684'. [ 1150.687609][T19791] netlink: 52 bytes leftover after parsing attributes in process `syz.2.3685'. [ 1150.904979][ T1206] usb 9-1: Invalid ep0 maxpacket: 64 [ 1150.950684][T19792] netlink: 'syz.0.3683': attribute type 11 has an invalid length. [ 1150.958792][T19792] netlink: 448 bytes leftover after parsing attributes in process `syz.0.3683'. [ 1151.065463][ T1206] usb 9-1: new low-speed USB device number 27 using dummy_hcd [ 1151.125047][ T5901] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 1151.186108][T17805] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1151.265089][ T1206] usb 9-1: Invalid ep0 maxpacket: 64 [ 1151.270690][ T1206] usb usb9-port1: attempt power cycle [ 1151.305023][ T5901] usb 3-1: Using ep0 maxpacket: 16 [ 1151.312662][ T5901] usb 3-1: too many endpoints for config 0 interface 0 altsetting 2: 39, using maximum allowed: 30 [ 1151.327859][ T5901] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1151.354949][T17805] usb 10-1: Using ep0 maxpacket: 8 [ 1151.367881][ T5901] usb 3-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 39 [ 1151.367921][T17805] usb 10-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1151.449097][T17805] usb 10-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 1151.468640][ T5901] usb 3-1: config 0 interface 0 has no altsetting 0 [ 1151.469252][T17805] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1151.495635][ T5901] usb 3-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 1151.514071][ T5901] usb 3-1: New USB device strings: Mfr=1, Product=8, SerialNumber=3 [ 1151.525578][ T5901] usb 3-1: Product: syz [ 1151.563321][ T5901] usb 3-1: Manufacturer: syz [ 1151.593725][ T5901] usb 3-1: SerialNumber: syz [ 1151.613079][ T5901] usb 3-1: config 0 descriptor?? [ 1151.665137][ T1206] usb 9-1: new low-speed USB device number 28 using dummy_hcd [ 1151.687004][ T1206] usb 9-1: Invalid ep0 maxpacket: 64 [ 1151.825140][ T1206] usb 9-1: new low-speed USB device number 29 using dummy_hcd [ 1151.845792][ T1206] usb 9-1: Invalid ep0 maxpacket: 64 [ 1152.109633][ C0] imon 3-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 1152.146603][ T1206] usb usb9-port1: unable to enumerate USB device [ 1152.234437][ T5901] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/input/input78 [ 1152.349936][ T5901] imon:send_packet: packet tx failed (-71) [ 1152.394988][ T5901] imon 3-1:0.0: panel buttons/knobs setup failed [ 1152.566471][ T5901] rc_core: IR keymap rc-imon-pad not found [ 1152.599517][ T5901] Registered IR keymap rc-empty [ 1152.609741][T17805] usb 10-1: string descriptor 0 read error: -71 [ 1152.614396][ T5901] imon 3-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 1152.637932][ T5901] imon 3-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1152.671584][ T5901] imon:send_packet: packet tx failed (-71) [ 1152.710924][T17805] usb 10-1: USB disconnect, device number 3 [ 1152.726245][ T5901] imon 3-1:0.0: remote input dev register failed [ 1152.736493][ T5901] imon 3-1:0.0: imon_init_intf0: rc device setup failed [ 1153.552492][ T5901] imon 3-1:0.0: unable to initialize intf0, err 0 [ 1153.612230][ T5901] imon:imon_probe: failed to initialize context! [ 1153.728200][T19826] netlink: 40 bytes leftover after parsing attributes in process `syz.8.3693'. [ 1153.800052][ T5901] imon 3-1:0.0: unable to register, err -19 [ 1153.993197][ T5901] usb 3-1: USB disconnect, device number 85 [ 1154.709628][T19839] /dev/nullb0: Can't open blockdev [ 1154.810035][T19837] netdevsim netdevsim8 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1154.825651][T19838] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3694'. [ 1154.873241][T19837] netdevsim netdevsim8 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1154.976873][T19837] netdevsim netdevsim8 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1155.029919][T19837] netdevsim netdevsim8 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1155.279356][T17805] usb 1-1: new full-speed USB device number 8 using dummy_hcd [ 1155.796639][T17805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1155.817843][T17805] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1155.844334][T17805] usb 1-1: New USB device found, idVendor=04f3, idProduct=0755, bcdDevice= 0.00 [ 1155.871747][T17805] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1155.918581][T17805] usb 1-1: config 0 descriptor?? [ 1156.064072][T19858] team0 (unregistering): Port device team_slave_0 removed [ 1156.113069][T19858] team0 (unregistering): Port device team_slave_1 removed [ 1156.276015][ T8921] netdevsim netdevsim8 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1156.289218][ T8921] netdevsim netdevsim8 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1156.297607][ T8921] netdevsim netdevsim8 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1156.307179][ T8921] netdevsim netdevsim8 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1156.330853][T17805] elan 0003:04F3:0755.0019: unknown main item tag 0x0 [ 1156.332106][T19867] netlink: 36 bytes leftover after parsing attributes in process `syz.2.3703'. [ 1156.337805][ T30] audit: type=1400 audit(1156.296:2153): avc: denied { create } for pid=19866 comm="syz.2.3703" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 1156.375140][T17805] elan 0003:04F3:0755.0019: unknown main item tag 0x0 [ 1156.381957][T17805] elan 0003:04F3:0755.0019: unknown main item tag 0x0 [ 1156.415782][T17805] elan 0003:04F3:0755.0019: unknown main item tag 0x0 [ 1156.427857][T17805] elan 0003:04F3:0755.0019: unknown main item tag 0x0 [ 1156.442908][ T30] audit: type=1400 audit(1156.296:2154): avc: denied { getopt } for pid=19866 comm="syz.2.3703" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 1156.464541][T17805] elan 0003:04F3:0755.0019: failed to start in urb: -90 [ 1156.473681][T17805] elan 0003:04F3:0755.0019: hidraw0: USB HID v1.01 Device [HID 04f3:0755] on usb-dummy_hcd.0-1/input0 [ 1156.529185][ T30] audit: type=1400 audit(1156.496:2155): avc: denied { getopt } for pid=19853 comm="syz.0.3700" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1156.530214][T19856] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1156.557370][T19856] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1156.584715][T17787] usb 1-1: USB disconnect, device number 8 [ 1156.755902][T17805] usb 7-1: new high-speed USB device number 38 using dummy_hcd [ 1156.935511][T17805] usb 7-1: Using ep0 maxpacket: 8 [ 1156.951779][T17805] usb 7-1: New USB device found, idVendor=0c45, idProduct=613e, bcdDevice=c4.6d [ 1156.961595][T17805] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1156.970565][T17805] usb 7-1: Product: syz [ 1156.975599][T17787] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1156.983174][T17805] usb 7-1: Manufacturer: syz [ 1156.990931][T17805] usb 7-1: SerialNumber: syz [ 1157.013529][T17805] usb 7-1: config 0 descriptor?? [ 1157.029443][T17805] gspca_main: sonixj-2.14.0 probing 0c45:613e [ 1157.154967][T17787] usb 1-1: Using ep0 maxpacket: 16 [ 1157.161788][T17787] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1157.173367][T17787] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1157.186355][T17787] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1157.195610][T17787] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1157.203654][T17787] usb 1-1: Product: syz [ 1157.207908][T17787] usb 1-1: Manufacturer: syz [ 1157.212514][T17787] usb 1-1: SerialNumber: syz [ 1157.218515][T17787] usb 1-1: config 0 descriptor?? [ 1157.225739][T17787] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1157.235556][T17787] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 1157.490552][ T30] audit: type=1326 audit(1157.456:2156): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1157.528960][ T30] audit: type=1326 audit(1157.456:2157): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1157.860844][ T30] audit: type=1326 audit(1157.456:2158): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1157.898483][ T30] audit: type=1326 audit(1157.456:2159): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1158.009335][ T30] audit: type=1326 audit(1157.456:2160): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1158.081686][T17787] em28xx 1-1:0.0: chip ID is em2874 [ 1158.128712][ T30] audit: type=1326 audit(1157.456:2161): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1158.209682][ T30] audit: type=1326 audit(1157.456:2162): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=19885 comm="syz.2.3708" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f048ff8eec9 code=0x7ffc0000 [ 1158.482426][T19908] netlink: 216 bytes leftover after parsing attributes in process `syz.0.3707'. [ 1158.491775][T19908] netlink: 24 bytes leftover after parsing attributes in process `syz.0.3707'. [ 1158.500826][T19908] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3707'. [ 1158.641851][T19893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1159.098580][T19893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1159.423779][ T5901] usb 7-1: USB disconnect, device number 38 [ 1159.460914][T19914] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3713'. [ 1159.507747][T17787] usb 1-1: USB disconnect, device number 9 [ 1159.514229][T17787] em28xx 1-1:0.0: Disconnecting em28xx [ 1159.521332][T17787] em28xx 1-1:0.0: Freeing device [ 1161.157722][T17790] usb 7-1: new high-speed USB device number 39 using dummy_hcd [ 1161.515990][T17790] usb 7-1: Using ep0 maxpacket: 16 [ 1161.540892][T17790] usb 7-1: config 0 interface 0 altsetting 16 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1161.563087][T17790] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1161.579537][T17790] usb 7-1: New USB device found, idVendor=18d1, idProduct=9400, bcdDevice= 0.00 [ 1161.605017][T17790] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1161.614982][T17790] usb 7-1: config 0 descriptor?? [ 1162.046841][T17790] stadia 0003:18D1:9400.001A: unknown main item tag 0x0 [ 1162.065280][T17790] stadia 0003:18D1:9400.001A: unknown main item tag 0x0 [ 1162.072291][T17790] stadia 0003:18D1:9400.001A: item fetching failed at offset 2/5 [ 1162.080904][T17790] stadia 0003:18D1:9400.001A: parse failed [ 1162.089986][T17790] stadia 0003:18D1:9400.001A: probe with driver stadia failed with error -22 [ 1162.262972][T19938] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3718'. [ 1162.273386][ T5901] usb 7-1: USB disconnect, device number 39 [ 1162.764975][T13005] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1162.934942][T13005] usb 10-1: Using ep0 maxpacket: 8 [ 1162.948796][T13005] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1163.017176][T13005] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1163.048787][T13005] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1163.061206][T13005] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1163.075263][T13005] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1163.084486][T13005] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1163.306507][T13005] usb 10-1: GET_CAPABILITIES returned 0 [ 1163.317460][T13005] usbtmc 10-1:16.0: can't read capabilities [ 1163.840207][T17790] usb 10-1: USB disconnect, device number 4 [ 1163.878715][T19985] netlink: 'syz.8.3731': attribute type 9 has an invalid length. [ 1164.073836][T19990] kvm: kvm [19989]: vcpu2, guest rIP: 0x9131 Unhandled WRMSR(0x11e) = 0x0 [ 1164.185069][T17787] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 1164.206560][T19998] /dev/nullb0: Can't open blockdev [ 1164.387283][T17787] usb 9-1: config 1 has an invalid interface number: 7 but max is 0 [ 1164.405087][T17787] usb 9-1: config 1 has no interface number 0 [ 1164.425477][T17787] usb 9-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1164.442847][T17787] usb 9-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1164.455809][T17787] usb 9-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1164.484704][T17787] usb 9-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1164.494564][T17787] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1164.502843][T17787] usb 9-1: Product: syz [ 1164.507295][T17787] usb 9-1: Manufacturer: syz [ 1164.511973][T17787] usb 9-1: SerialNumber: syz [ 1164.669434][T19987] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1165.085364][T19987] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1165.292287][T20018] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1165.403436][T17787] usb 9-1: Incompatible driver and firmware versions [ 1165.546738][T17787] usb 9-1: USB disconnect, device number 30 [ 1165.650989][T20029] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3742'. [ 1166.526209][T20037] /dev/nullb0: Can't open blockdev [ 1167.445605][ T5901] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 1167.572409][T20053] /dev/nullb0: Can't open blockdev [ 1167.794954][ T5901] usb 9-1: Using ep0 maxpacket: 16 [ 1167.802672][ T5901] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1167.825899][ T5901] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1167.843120][ T5901] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1167.863854][ T5901] usb 9-1: Product: syz [ 1167.874256][ T5901] usb 9-1: Manufacturer: syz [ 1167.891617][ T5901] usb 9-1: SerialNumber: syz [ 1167.901537][ T5901] usb 9-1: config 0 descriptor?? [ 1168.148092][T20041] netlink: 216 bytes leftover after parsing attributes in process `syz.8.3747'. [ 1168.171550][T20041] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3747'. [ 1168.620213][T20041] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3747'. [ 1168.634346][T20070] /dev/nullb0: Can't open blockdev [ 1168.648152][T17790] usb 9-1: USB disconnect, device number 31 [ 1168.660754][T20069] sp0: Synchronizing with TNC [ 1168.923713][T20061] [U] `` [ 1168.937909][T20070] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1169.162804][T20076] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1169.246101][T20080] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3757'. [ 1169.727243][T20070] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1170.061523][T20070] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1170.168170][T20070] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1170.289461][ T8936] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.328594][ T8936] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.348510][ T8939] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1170.363549][ T8939] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1171.512967][ T911] hid-generic 0005:16BF:5505.001B: unknown main item tag 0x0 [ 1171.583819][ T911] hid-generic 0005:16BF:5505.001B: unknown main item tag 0x0 [ 1171.637464][ T911] hid-generic 0005:16BF:5505.001B: hidraw0: BLUETOOTH HID vc3.b8 Device [syz0] on aa:aa:aa:aa:aa:aa [ 1172.774594][T20131] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3770'. [ 1173.668678][T20143] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1173.808857][T20116] loop6: detected capacity change from 0 to 524288000 [ 1174.735343][ T911] usb 1-1: new full-speed USB device number 10 using dummy_hcd [ 1174.764963][T17790] usb 7-1: new high-speed USB device number 40 using dummy_hcd [ 1174.940698][T17790] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1174.950341][T17790] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1174.959149][T17790] usb 7-1: Product: syz [ 1174.963630][T17790] usb 7-1: Manufacturer: syz [ 1174.975904][T17790] usb 7-1: SerialNumber: syz [ 1175.018222][ T911] usb 1-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 1175.035499][T17790] usb 7-1: config 0 descriptor?? [ 1175.051164][ T911] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1175.099854][ T911] usb 1-1: config 0 descriptor?? [ 1175.144005][ T911] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 1175.875173][T12898] Bluetooth: hci5: unexpected Set CIG Parameters response data [ 1175.884205][T12898] Bluetooth: hci5: unexpected event for opcode 0x2062 [ 1176.412896][T20190] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1176.445980][T20190] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1177.129814][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.200615][T17790] usb 7-1: USB disconnect, device number 40 [ 1177.206726][T17787] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 1177.396284][T17787] usb 3-1: Using ep0 maxpacket: 16 [ 1177.430347][T17787] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1177.642109][T17787] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1177.661771][T17787] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1177.672703][T17787] usb 3-1: Product: syz [ 1177.678809][T17787] usb 3-1: Manufacturer: syz [ 1177.690050][T17787] usb 3-1: SerialNumber: syz [ 1177.724511][T17787] usb 3-1: config 0 descriptor?? [ 1177.925953][ T911] gp8psk: usb out operation failed. [ 1177.935895][T20193] netlink: 216 bytes leftover after parsing attributes in process `syz.2.3784'. [ 1177.944972][T20193] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3784'. [ 1177.954140][T20193] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3784'. [ 1177.972651][T17787] usb 3-1: USB disconnect, device number 86 [ 1178.020128][ T911] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1178.144671][ T911] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 1178.189272][T20211] netlink: 'syz.8.3793': attribute type 5 has an invalid length. [ 1178.197042][T20211] netlink: 'syz.8.3793': attribute type 11 has an invalid length. [ 1178.464646][T20212] loop6: detected capacity change from 0 to 524288000 [ 1178.520720][ T5901] usb 1-1: USB disconnect, device number 10 [ 1179.070082][T20236] netlink: 28 bytes leftover after parsing attributes in process `syz.8.3798'. [ 1179.804435][T20243] /dev/nullb0: Can't open blockdev [ 1179.876384][ T5901] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1179.926730][T12898] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 1179.940394][T12898] Bluetooth: hci5: Injecting HCI hardware error event [ 1179.953306][T12898] Bluetooth: hci5: hardware error 0x00 [ 1180.127092][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=22 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.144935][ T5901] usb 1-1: Using ep0 maxpacket: 8 [ 1180.157025][ T5901] usb 1-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 1180.175055][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=58 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.189465][ T5901] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1180.234017][ T5901] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 129 [ 1180.260677][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=41 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.273677][ T5901] usb 1-1: New USB device found, idVendor=0dfc, idProduct=0102, bcdDevice= 0.00 [ 1180.283267][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=51 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.296202][ T5901] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1180.308505][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=54 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.325149][ T5901] usb 1-1: config 0 descriptor?? [ 1180.330621][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=57 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.343468][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=44 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.357719][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=58 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1180.376219][T20247] SELinux: unrecognized netlink message: protocol=9 nlmsg_type=59 sclass=netlink_audit_socket pid=20247 comm=syz.8.3802 [ 1181.314980][ T1206] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 1181.468410][ T1206] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1181.503661][ T1206] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1181.534742][ T1206] usb 3-1: New USB device found, idVendor=0b05, idProduct=19b4, bcdDevice= 0.00 [ 1181.543938][ T1206] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1181.557740][ T1206] usb 3-1: config 0 descriptor?? [ 1182.014984][T12898] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 1182.675560][ T5901] usbhid 1-1:0.0: can't add hid device: -71 [ 1182.693559][ T5901] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 1182.723841][ T5901] usb 1-1: USB disconnect, device number 11 [ 1182.966048][T20305] netlink: 'syz.0.3818': attribute type 5 has an invalid length. [ 1183.034976][ T911] usb 9-1: new high-speed USB device number 32 using dummy_hcd [ 1183.049191][T20308] /dev/nullb0: Can't open blockdev [ 1183.084306][T20308] netdevsim netdevsim6 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.218647][T20308] netdevsim netdevsim6 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.224042][ T911] usb 9-1: Using ep0 maxpacket: 16 [ 1183.235771][ T911] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1183.246435][ T911] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1183.292968][ T911] usb 9-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1183.302323][ T911] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1183.310755][ T911] usb 9-1: Product: syz [ 1183.318063][ T911] usb 9-1: Manufacturer: syz [ 1183.324208][ T911] usb 9-1: SerialNumber: syz [ 1183.355723][T20308] netdevsim netdevsim6 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.391430][ T911] usb 9-1: config 0 descriptor?? [ 1183.440907][T20308] netdevsim netdevsim6 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1183.573039][ T8936] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.588722][ T8936] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.616611][T20302] netlink: 216 bytes leftover after parsing attributes in process `syz.8.3817'. [ 1183.625749][T20302] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3817'. [ 1183.634665][T20302] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3817'. [ 1183.744014][ T911] usb 9-1: USB disconnect, device number 32 [ 1183.774077][T20313] netlink: 'syz.0.3821': attribute type 2 has an invalid length. [ 1183.782008][T20313] netlink: 137592 bytes leftover after parsing attributes in process `syz.0.3821'. [ 1183.791374][ T8936] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1183.822436][ T8936] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1184.885916][ T1206] usb 3-1: string descriptor 0 read error: -71 [ 1184.901765][T20322] /dev/nullb0: Can't open blockdev [ 1184.916570][ T1206] usb 3-1: USB disconnect, device number 87 [ 1184.922710][T20326] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3824'. [ 1184.962622][T20330] mac80211_hwsim hwsim22 wlan1: entered allmulticast mode [ 1184.996954][T20330] netlink: 'syz.2.3826': attribute type 10 has an invalid length. [ 1185.008483][T20330] mac80211_hwsim hwsim22 wlan1: left allmulticast mode [ 1185.259607][T20330] bond0: (slave wlan1): Opening slave failed [ 1185.414018][ T30] kauditd_printk_skb: 20 callbacks suppressed [ 1185.414036][ T30] audit: type=1400 audit(1185.376:2183): avc: denied { append } for pid=20337 comm="syz.6.3829" name="video8" dev="devtmpfs" ino=953 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1187.243771][T20369] IPVS: Scheduler module ip_vs_ not found [ 1187.362079][T20375] random: crng reseeded on system resumption [ 1187.385418][ T30] audit: type=1400 audit(1187.326:2184): avc: denied { append } for pid=20374 comm="syz.0.3838" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1187.652618][ T30] audit: type=1400 audit(1187.616:2185): avc: denied { ioctl } for pid=20374 comm="syz.0.3838" path="/dev/snapshot" dev="devtmpfs" ino=92 ioctlcmd=0x330f scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1188.922224][T17781] usb 7-1: new high-speed USB device number 41 using dummy_hcd [ 1189.107779][T17781] usb 7-1: Using ep0 maxpacket: 16 [ 1189.212049][T20395] /dev/nullb0: Can't open blockdev [ 1189.292487][T20395] netdevsim netdevsim9 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.328284][T17781] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1189.377649][T17781] usb 7-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1189.404476][T20394] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3844'. [ 1189.456437][T17781] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1189.486711][T17781] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1189.496443][T17781] usb 7-1: Product: syz [ 1189.500745][T17781] usb 7-1: Manufacturer: syz [ 1189.505521][T17781] usb 7-1: SerialNumber: syz [ 1189.513041][T17781] usb 7-1: config 0 descriptor?? [ 1189.533934][T20395] netdevsim netdevsim9 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.608148][T20395] netdevsim netdevsim9 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.679011][T20395] netdevsim netdevsim9 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1189.818169][T20380] netlink: 216 bytes leftover after parsing attributes in process `syz.6.3839'. [ 1189.840622][T20380] netlink: 24 bytes leftover after parsing attributes in process `syz.6.3839'. [ 1189.851080][T20380] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3839'. [ 1190.423015][T17805] usb 7-1: USB disconnect, device number 41 [ 1190.565969][ T8939] netdevsim netdevsim9 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.577986][ T8939] netdevsim netdevsim9 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.587041][ T8939] netdevsim netdevsim9 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1190.596112][ T8939] netdevsim netdevsim9 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1191.347639][T20422] netlink: 44 bytes leftover after parsing attributes in process `syz.0.3848'. [ 1191.586391][T20428] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3851'. [ 1191.625224][T20428] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3851'. [ 1191.634203][T20428] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3851'. [ 1191.637853][T20430] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3851'. [ 1191.743347][T20430] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3851'. [ 1192.182121][T20435] /dev/nullb0: Can't open blockdev [ 1193.734970][T13005] usb 7-1: new high-speed USB device number 42 using dummy_hcd [ 1193.775065][ T31] INFO: task syz-executor:6898 blocked for more than 143 seconds. [ 1193.782910][ T31] Not tainted syzkaller #0 [ 1193.797118][ T31] Blocked by coredump. [ 1193.812011][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1193.826613][ T31] task:syz-executor state:D stack:23944 pid:6898 tgid:6898 ppid:1 task_flags:0x40054c flags:0x00080003 [ 1193.839275][ T31] Call Trace: [ 1193.842600][ T31] [ 1193.846470][ T31] __schedule+0x1190/0x5de0 [ 1193.851116][ T31] ? __lock_acquire+0x62e/0x1ce0 [ 1193.856202][ T31] ? __pfx___schedule+0x10/0x10 [ 1193.861188][ T31] ? find_held_lock+0x2b/0x80 [ 1193.866004][ T31] ? schedule+0x2d7/0x3a0 [ 1193.870371][ T31] schedule+0xe7/0x3a0 [ 1193.874522][ T31] schedule_timeout+0x257/0x290 [ 1193.879584][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1193.885211][ T31] ? rcu_is_watching+0x12/0xc0 [ 1193.890046][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1193.895459][T13005] usb 7-1: Using ep0 maxpacket: 16 [ 1193.900797][ T31] __wait_for_common+0x2f9/0x4e0 [ 1193.906410][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1193.912102][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 1193.917868][T13005] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1193.932095][ T31] ? find_held_lock+0x2b/0x80 [ 1193.936994][T13005] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1193.948203][ T31] ? __flush_work+0x938/0xcc0 [ 1193.952944][ T31] ? __flush_work+0x4d0/0xcc0 [ 1193.954939][T17787] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1193.965596][ T31] __flush_work+0x7d7/0xcc0 [ 1193.970246][ T31] ? __pfx___flush_work+0x10/0x10 [ 1193.975710][ T31] ? try_to_grab_pending+0x450/0x850 [ 1193.981152][ T31] ? __pfx_wq_barrier_func+0x10/0x10 [ 1193.987119][ T31] ? __pfx___might_resched+0x10/0x10 [ 1193.992505][T13005] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1194.001699][T13005] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1194.009812][ T31] __cancel_work_sync+0x10c/0x130 [ 1194.014985][ T31] hci_cmd_sync_clear+0x33/0x100 [ 1194.019989][T13005] usb 7-1: Product: syz [ 1194.024187][ T31] hci_unregister_dev+0x1cc/0x640 [ 1194.031991][T13005] usb 7-1: Manufacturer: syz [ 1194.036701][ T31] vhci_release+0x17d/0x230 [ 1194.041280][T13005] usb 7-1: SerialNumber: syz [ 1194.046085][ T31] ? __pfx_vhci_release+0x10/0x10 [ 1194.051822][ T31] __fput+0x3ff/0xb70 [ 1194.056193][ T31] task_work_run+0x14d/0x240 [ 1194.060825][ T31] ? __pfx_task_work_run+0x10/0x10 [ 1194.066189][ T31] do_exit+0x86f/0x2bf0 [ 1194.070466][ T31] ? __pfx_do_exit+0x10/0x10 [ 1194.075316][ T31] ? do_raw_spin_lock+0x12c/0x2b0 [ 1194.080401][ T31] ? find_held_lock+0x2b/0x80 [ 1194.089432][T13005] usb 7-1: config 0 descriptor?? [ 1194.094532][ T31] do_group_exit+0xd3/0x2a0 [ 1194.100632][T13005] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1194.110105][ T31] get_signal+0x2671/0x26d0 [ 1194.114654][T13005] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1194.122098][ T31] ? __pfx_get_signal+0x10/0x10 [ 1194.127056][ T31] arch_do_signal_or_restart+0x8f/0x7c0 [ 1194.132741][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1194.138941][ T31] ? ksys_read+0x1ac/0x250 [ 1194.143414][ T31] ? __pfx_ksys_read+0x10/0x10 [ 1194.148277][ T31] exit_to_user_mode_loop+0x85/0x130 [ 1194.153620][ T31] do_syscall_64+0x426/0xfa0 [ 1194.158240][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1194.164212][ T31] RIP: 0033:0x7f09f098d8dc [ 1194.168893][ T31] RSP: 002b:00007ffd4e6cabe0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1194.177383][ T31] RAX: 0000000000000000 RBX: 0000000000000003 RCX: 00007f09f098d8dc [ 1194.185448][ T31] RDX: 0000000000000030 RSI: 00007ffd4e6caca0 RDI: 00000000000000f9 [ 1194.193468][ T31] RBP: 00007ffd4e6cac4c R08: 0000000000000000 R09: 0079746972756365 [ 1194.201688][ T31] R10: 00007f09f0bb4800 R11: 0000000000000246 R12: 0000000000000258 [ 1194.209998][ T31] R13: 000055558f441590 R14: 00000000000fdc80 R15: 00007ffd4e6caca0 [ 1194.218012][ T31] [ 1194.221127][ T31] [ 1194.221127][ T31] Showing all locks held in the system: [ 1194.228978][ T31] 1 lock held by khungtaskd/31: [ 1194.233883][ T31] #0: ffffffff8e3c44a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1194.243760][ T31] 3 locks held by kworker/0:2/1206: [ 1194.249084][ T31] #0: ffff88813ff51948 ((wq_completion)events){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1194.259600][ T31] #1: ffffc90003eafd00 ((work_completion)(&data->fib_event_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1194.271732][ T31] #2: ffff88807971c240 (&data->fib_lock){+.+.}-{4:4}, at: nsim_fib_event_work+0x1b6/0x6da0 [ 1194.282090][ T31] 3 locks held by kworker/u9:1/5134: [ 1194.287453][ T31] #0: ffff888053bba148 ((wq_completion)hci0){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1194.297789][ T31] #1: ffffc9000ffbfd00 ((work_completion)(&hdev->cmd_sync_work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1194.310022][ T31] #2: ffff888079bd0dc8 (&hdev->req_lock){+.+.}-{4:4}, at: hci_cmd_sync_work+0x175/0x430 [ 1194.320635][ T31] 2 locks held by getty/5571: [ 1194.325431][ T31] #0: ffff888035ded0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1194.335284][ T31] #1: ffffc9000332e2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1194.345534][ T31] 6 locks held by kworker/0:3/13005: [ 1194.350841][ T31] #0: ffff88801b759548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1194.361690][ T31] #1: ffffc9000bc1fd00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1194.373034][ T31] #2: ffff888029943198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 1194.381970][ T31] #3: ffff888029142198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1194.391521][ T31] #4: ffff8880253fe160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1194.400772][ T31] #5: ffff88805391dc38 (&dev->ctrl_urb_lock){+.+.}-{4:4}, at: em28xx_write_regs_req+0x145/0x3f0 [ 1194.411768][ T31] 5 locks held by kworker/1:9/17787: [ 1194.417142][ T31] 1 lock held by syz.2.3843/20412: [ 1194.422316][ T31] 2 locks held by dhcpcd/20468: [ 1194.427621][ T31] #0: ffff88802644c258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 [ 1194.437381][ T31] #1: ffffffff8e3cfa38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 1194.447524][ T31] 2 locks held by dhcpcd/20469: [ 1194.452389][ T31] #0: ffff88803c5d0258 (sk_lock-AF_PACKET){+.+.}-{0:0}, at: packet_do_bind+0x2c/0xf60 [ 1194.462138][ T31] #1: ffffffff8e3cfa38 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 [ 1194.472314][ T31] [ 1194.474646][ T31] ============================================= [ 1194.474646][ T31] [ 1194.483108][ T31] NMI backtrace for cpu 0 [ 1194.483121][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1194.483134][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1194.483140][ T31] Call Trace: [ 1194.483145][ T31] [ 1194.483150][ T31] dump_stack_lvl+0x116/0x1f0 [ 1194.483169][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1194.483186][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1194.483204][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1194.483217][ T31] watchdog+0xf3f/0x1170 [ 1194.483234][ T31] ? rcu_is_watching+0x12/0xc0 [ 1194.483248][ T31] ? __pfx_watchdog+0x10/0x10 [ 1194.483260][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1194.483277][ T31] ? __kthread_parkme+0x19e/0x250 [ 1194.483293][ T31] ? __pfx_watchdog+0x10/0x10 [ 1194.483306][ T31] kthread+0x3c2/0x780 [ 1194.483317][ T31] ? __pfx_kthread+0x10/0x10 [ 1194.483328][ T31] ? rcu_is_watching+0x12/0xc0 [ 1194.483341][ T31] ? __pfx_kthread+0x10/0x10 [ 1194.483352][ T31] ret_from_fork+0x672/0x7d0 [ 1194.483361][ T31] ? __pfx_kthread+0x10/0x10 [ 1194.483372][ T31] ret_from_fork_asm+0x1a/0x30 [ 1194.483390][ T31] [ 1194.483404][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1194.603261][ C1] NMI backtrace for cpu 1 [ 1194.603276][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 1194.603294][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1194.603302][ C1] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1194.603328][ C1] Code: e7 75 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d d3 f6 24 00 fb f4 0c 0a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1194.603342][ C1] RSP: 0018:ffffc90000197de8 EFLAGS: 000002c2 [ 1194.603354][ C1] RAX: 00000000054b4a51 RBX: 0000000000000001 RCX: ffffffff8b6522d9 [ 1194.603364][ C1] RDX: 0000000000000000 RSI: ffffffff8db026b0 RDI: ffffffff8bf1cfc0 [ 1194.603386][ C1] RBP: ffffed1003b50490 R08: 0000000000000001 R09: ffffed10170a6655 [ 1194.603395][ C1] R10: ffff8880b85332ab R11: 0000000000000000 R12: 0000000000000001 [ 1194.603403][ C1] R13: ffff88801da82480 R14: ffffffff908324d0 R15: 0000000000000000 [ 1194.603412][ C1] FS: 0000000000000000(0000) GS:ffff888124adf000(0000) knlGS:0000000000000000 [ 1194.603427][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1194.603436][ C1] CR2: 00007fa60b761700 CR3: 0000000066d5c000 CR4: 00000000003526f0 [ 1194.603446][ C1] Call Trace: [ 1194.603452][ C1] [ 1194.603457][ C1] default_idle+0x13/0x20 [ 1194.603470][ C1] default_idle_call+0x6c/0xb0 [ 1194.603483][ C1] do_idle+0x38d/0x500 [ 1194.603503][ C1] ? __pfx_do_idle+0x10/0x10 [ 1194.603521][ C1] ? trace_sched_exit_tp+0x2f/0x120 [ 1194.603538][ C1] cpu_startup_entry+0x4f/0x60 [ 1194.603554][ C1] start_secondary+0x21d/0x2b0 [ 1194.603574][ C1] ? __pfx_start_secondary+0x10/0x10 [ 1194.603593][ C1] common_startup_64+0x13e/0x148 [ 1194.603613][ C1] [ 1194.730778][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1194.730792][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1194.730807][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1194.730814][ T31] Call Trace: [ 1194.730820][ T31] [ 1194.730825][ T31] dump_stack_lvl+0x3d/0x1f0 [ 1194.730847][ T31] vpanic+0x640/0x6f0 [ 1194.730867][ T31] panic+0xca/0xd0 [ 1194.730883][ T31] ? __pfx_panic+0x10/0x10 [ 1194.730899][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1194.730915][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 1194.730929][ T31] ? watchdog+0xe48/0x1170 [ 1194.730943][ T31] ? watchdog+0xe3b/0x1170 [ 1194.730957][ T31] watchdog+0xe59/0x1170 [ 1194.730973][ T31] ? rcu_is_watching+0x12/0xc0 [ 1194.730988][ T31] ? __pfx_watchdog+0x10/0x10 [ 1194.731001][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1194.731018][ T31] ? __kthread_parkme+0x19e/0x250 [ 1194.731036][ T31] ? __pfx_watchdog+0x10/0x10 [ 1194.731049][ T31] kthread+0x3c2/0x780 [ 1194.731060][ T31] ? __pfx_kthread+0x10/0x10 [ 1194.731072][ T31] ? rcu_is_watching+0x12/0xc0 [ 1194.731086][ T31] ? __pfx_kthread+0x10/0x10 [ 1194.731097][ T31] ret_from_fork+0x672/0x7d0 [ 1194.731109][ T31] ? __pfx_kthread+0x10/0x10 [ 1194.731120][ T31] ret_from_fork_asm+0x1a/0x30 [ 1194.731137][ T31] [ 1194.731260][ T31] Kernel Offset: disabled