last executing test programs: 7m59.905365986s ago: executing program 1 (id=677): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(r0, &(0x7f0000003700)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)={0x4c, r2, 0x1, 0x0, 0x6000000, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x88c7}, @NL80211_ATTR_FRAME={0x1c, 0x33, @data_frame={@msdu=@type10={{}, {}, @from_mac=@broadcast, @device_b}}}]}, 0x4c}}, 0x800) 7m59.716617308s ago: executing program 1 (id=680): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000f80)={{0x14, 0x10, 0x1, 0x0, 0x84000000}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}]}, @NFT_MSG_NEWSETELEM={0x2c, 0xe, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0xb0}}, 0x0) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=@updpolicy={0x238, 0x19, 0x1, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x13}, @in6=@remote, 0x0, 0x966, 0x4e20, 0x0, 0xa, 0x0, 0x20, 0x5e}, {0x0, 0x800, 0x0, 0x7, 0x0, 0x0, 0x3, 0x7}, {0x0, 0x0, 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2}, [@tmpl={0x184, 0x5, [{{@in=@remote, 0x0, 0x3c}, 0x0, @in=@dev={0xac, 0x14, 0x14, 0x8}, 0x0, 0x0, 0x0, 0x56, 0x0, 0xfffffffd, 0x2}, {{@in6=@private2, 0x0, 0x32}, 0x0, @in6=@local, 0x3502, 0x0, 0x2}, {{@in6=@mcast1, 0x0, 0x3c}, 0x2, @in=@dev={0xac, 0x14, 0x14, 0x44}, 0x0, 0x1, 0x3, 0x81, 0x130}, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4d3, 0x3c}, 0x2, @in=@broadcast, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x4, 0x32}, 0x2, @in6=@loopback, 0xffffffff, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, {{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x6c}, 0x2, @in6=@private0, 0x0, 0x7}]}]}, 0x238}}, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) (async) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r1, 0x4001af84, &(0x7f0000000000)) 7m59.378864348s ago: executing program 1 (id=682): r0 = syz_open_dev$loop(&(0x7f0000000000), 0xf01c, 0x0) ioctl$BLKCRYPTOIMPORTKEY(r0, 0xc0401289, &(0x7f0000000200)={&(0x7f00000001c0)="92576485f60aca3a7617ee5a300ca156ef0dfc6c3cbb", 0x16, &(0x7f0000000400)=""/94, 0x5e}) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x7d, 0x0, 0x0, 0x0, 0x1e, 0x1c, "fee8a2ab78fc5e3ed1e00d96072000001ea8a1d91bec8d4b5a6d80b8785d9600010000000000000094d75396dccd0ff600000000a81b00", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "9001001c551265406c7f306003d8a0f4bd0000000300", [0x1]}}) ioctl$VIDIOC_S_AUDOUT(r1, 0x40345632, &(0x7f0000000280)={0x2, "68cde40740af8aa6430d86364c5a48041b1eab59809d392a98ffcfa720988aef", 0x3, 0x1}) ioctl$LOOP_CHANGE_FD(r0, 0x4c06, r1) unshare(0x20000) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r2, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_FLUSH(r2, 0x0, 0xd4, 0x0, 0x0) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x4, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x4}, {0xd, 0x6, 0x0, 0x6}, {0xff01, 0x0, 0x0, 0xc397}, {0xfb, 0x0, 0x6, 0x9}]}) prctl$PR_SET_SECCOMP(0x16, 0x3, &(0x7f00000000c0)={0x2, &(0x7f0000000080)=[{0xd4, 0xd, 0x5, 0xfffffffe}, {0x4, 0x7, 0x7, 0x4}]}) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f000009de40), 0x0) ioctl$SNDRV_TIMER_IOCTL_NEXT_DEVICE(r4, 0xc0145401, &(0x7f000009de80)={0x1, 0x0, 0x0, 0x3}) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x20000000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=@bridge_getlink={0x34, 0x12, 0xdbf44c00c5896d57, 0x10000010, 0x25dfdbfb, {0x7, 0x0, 0x0, 0x0, 0x20000}, [@IFLA_EXT_MASK={0x8, 0x1d, 0xeca}, @IFLA_ADDRESS={0xa, 0x1, @multicast}]}, 0x34}, 0x1, 0x0, 0x0, 0x4}, 0x0) r6 = socket$kcm(0x29, 0x0, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) syz_clone3(&(0x7f0000000b40)={0x2c804000, &(0x7f00000009c0), &(0x7f0000000a00)=0x0, &(0x7f0000000a40), {0xa}, &(0x7f0000000a80)=""/36, 0x24, &(0x7f0000000ac0)=""/12, &(0x7f0000000b00)=[0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0], 0x7, {r1}}, 0x58) ioctl$sock_FIOGETOWN(r6, 0x8903, &(0x7f0000000bc0)=0x0) r9 = gettid() fcntl$getownex(r0, 0x10, &(0x7f0000000c00)={0x0, 0x0}) syz_clone3(&(0x7f0000000c80)={0x30002000, &(0x7f0000000740), &(0x7f0000000780), &(0x7f00000007c0), {0xe}, &(0x7f0000000800)=""/255, 0xff, &(0x7f0000000900)=""/191, &(0x7f0000000c40)=[r7, 0xffffffffffffffff, r8, r9, r10], 0x5}, 0x58) syz_open_dev$char_usb(0xc, 0xb4, 0xc) openat$vnet(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000700)={&(0x7f0000000600)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000006c0)={&(0x7f0000000640)={0x5c, 0x2, 0x6, 0x101, 0x0, 0x0, {0x1, 0x0, 0x7}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_NETMASK={0x5, 0x14, 0x1d}, @IPSET_ATTR_MARK={0x8, 0xa, 0x1, 0x0, 0xa4}]}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x40040) add_key$user(&(0x7f0000000480), &(0x7f00000004c0)={'syz', 0x3}, &(0x7f0000000500)="c47e03070dff01488124bbdfb1fb4f95c132d7bbd65ca2cf22339ebdeb5ca24ad3a183d00295883bfc880b31b4cafc8a80bb1d155a08653289c889b428c33705a8b371d9cee32aaf89f6bb238d40fcfb1b0ad58cfdd601999741205285216a4b3dce3b90bd2d629ef6c32434b9032e599bb9091671ea0d9d954903fb7a8281948030d1059480533e488f675d5b7c8e8d4bb8e4d2eafb536cae4c3fdc3972df81614c7b420c5d00fca5c7e95a4e11cb4b5ae609c41c5de2c1d79260c55bdd1c5e9566c9369cfe1ff2fc45699dc05c62fff6a87945338910fa310439eb76a8cf31a15e6f75b0de8a7f28edeed60bb6c2a10b9f944b455c9f8d4a57f497aba3fa", 0xff, 0xfffffffffffffff9) 7m58.625181938s ago: executing program 1 (id=686): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$kcm(0x10, 0x2, 0x0) connect$pppoe(0xffffffffffffffff, &(0x7f0000000080)={0x18, 0x0, {0x4, @local, 'erspan0\x00'}}, 0x1e) socket$pppoe(0x18, 0x1, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './mnt\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x35, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x6, 0x8, 0x0, 0x3}, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) r7 = socket(0x1e, 0x5, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_SET_MESH(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000440)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000f00000008000300", @ANYRES32=r8, @ANYBLOB="0800320000000000050033"], 0x2c}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x3, &(0x7f0000000040)=[{&(0x7f0000000000)="2e00000010008188e6b62aa73772cc9f1ba1f848430000005e140602000000000e000a000f000000028000001294", 0x2e}], 0x1}, 0x0) sendmsg$kcm(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000b00)=[{&(0x7f0000000280)="576332f56236be7cfa73a36e5e436485a425bc1b921f22ca2d2a337eadf8319fe6a960f0f3b068e86c81441ebd2df73b1face8317ea70caa41f5e55b8523aabbbcdf1da83f227ae1208115de48e2a3fb3d4e4fd419b77a9b8c34a78300e6faa7a8362f89116b85ec1441bd2a13b9cce2ccfc334aba8b9cf61e3061b4b6f93b6ee030ce3a7e5f386f60059793878ca0df7398efba666be33efb40dfcf4a30d81e151d4e9bb23b8440047b2d849f7582e803", 0xb1}, {&(0x7f0000000480)="7540d8d901cb197301018595109be3b8ac14f3059416511cb78798420e7d084d41e734b66c98e3c9aa439b165519a6c55a3c86993e31ad1e667453deeed34482f1bf0d167c1d96209b7a374155a9f136133042ae77c8f58b6baa259d7fd86fe401723eae2826cd9111d7ccba45724c3ed6ef156a7200ef9dfe0399771f6ba6e21b3566efdd19d5d0923261f97c9c6798628817a9c585c1769ffe3f5e03180d30c1a12f3426fb06215cdad006b8d1b0259864de5e393e5032185430d8e114b0b9449ee7fc45158fce125bcce91e39be6adaefe096c433c5dc24f27cba1feb", 0xde}, {&(0x7f0000000680)="6125358b15cfd1b7424c9e026a766ce3b8a4d5bbf0f78ee9c3b094e0c9d272479e798bf977e94be9f42cef87292cbd0c9be18fc48fb0f00fd841aa51a584228890bba345d617e165c3fac9723e53765adc8c13fe93245e4a7e08c5645773b400c755e91dc0af29f46715267afb7947afc0addf510da112fa8b654757a5020f411ed2656909a86fdc6c9ea745882e029f4cefe31858b1facf0c08ea2c59f629dc17b7c3658802215a6f05a9f1", 0xac}, {&(0x7f00000003c0)="49f417814105a46aac87547e8a344dfb0996ec95076a3d12e699218ca98f4bffcfad38993d93bb646043", 0x2a}, {&(0x7f0000000780)="f318b45a3d8aed513e90235d54300a6373f775e36a58ca0f53e3ddcd8b8dccb6a2fc05b6d6f9ecba74e748a991ffbf264467e94b4622db20df0382c1ff1ca8dc6a9f6e05a36e6261f8b9e13e1b8753dd636e8f239d1de3b3f326ef84075a654a454e9f764f190397daee88879aafaa6b81a213802075e23b5dae233523677cbb255ff674afad254ed56fead3035b7bfc225c3d6b235d04d21e516562b0f5f513a7", 0xa1}, {&(0x7f0000000840)="4df37d3624c065eee5f80b7203eb165997617c9d9c98453a7b12458794916e34c2306f321a10e2a52e4651755b7c3b327ba4e778b3c2325b25a00c7909bb00c4c11383282420d9d19c646d545bc67f5d031389fc9fcdc529905ea64d202e493f2eb151a66d555d94946942bcc350f28561f55b9d77d7f402bc8d6f5a958c4ca6bc4c6d7bc99782c5c9d1a35c84b557d29ff533aa244ed6284055338502695a6605660d5763c464a8f68b3178ae21", 0xae}, {&(0x7f00000000c0)}, {&(0x7f00000001c0)="637abbf621eec272636f6ba9", 0xc}, {&(0x7f00000005c0)="91fa44", 0x3}], 0x9, &(0x7f0000000900)=[{0x84, 0x10a, 0x9, "4a6c4c313fb87ee7b5253ac5691001d14e962f43cc66d6432f54e68969165e3f5b5b917b552b721a675ee63edfd8693e949c8a23f03e22eb79c4304c77e701ef9f5b6ddb463087b577861f18bb4ccdb5a43c9bd0acd5c7eff67ed38113ce3706ac84fe777ba0ef077eacdeb6189fe51beef770fe0cdc08b8"}, {0x74, 0x10e, 0x96, "441ca7fddda290dae91e8b290f9a642b066eb2b552ce05ee55be7847bcf07d1d8c31ae790e11969960a62268cb112e53fad6f0e76016d4d57bbf3c33ac20281251fa8c6a47e0bc92230f46f92c58c0d540bd3e8d721f33440919485bd7aa80bfeebf34fc9ee837"}, {0x48, 0x112, 0x24, "99030750f6ddb8744a9be51ac55291b7179d901b69d68583c345dcc2770692fa6ae1a83efb8145a8330b90c65fa083e333a66f67ff3adf520dea91"}, {0x24, 0x116, 0x5, "b118faf3db121fc5d85fc9e5065a1bc379a2874f98"}, {0xc, 0x3a, 0x40}, {0x20, 0x116, 0x24, "18b8c31bbf03e8598596534166b293f904e0"}, {0x54, 0x10e, 0xb, "319c6bae61c5cfef1b1ff11a4066b9f04611f5705cb9113068ef7583e8dd15a12d6dee5ef5f6532579cf788e88ece806fe56d31bc8d122993a3d29a26d850ff8fdb605edc5d0709d"}], 0x1e4}, 0x40000) 7m57.638843562s ago: executing program 1 (id=691): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14}, [], {0x14, 0x10, 0x1, 0x0, 0x0, {0x2, 0x84}}}, 0x28}}, 0x20000000) r0 = socket$kcm(0xf, 0x3, 0x2) sendmsg$inet(r0, &(0x7f0000003780)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000000)="02", 0x33fe0}, {0x0}], 0x2}, 0x400c010) (fail_nth: 3) 7m57.264705398s ago: executing program 1 (id=692): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000440)=[{{&(0x7f0000000240)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000001c0)=""/50, 0x32}, {&(0x7f0000000340)=""/50, 0x32}], 0x2, &(0x7f0000000400)=""/6, 0x6}, 0x400}], 0x1, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x5, 0x0, 0x8004, 0x0, 0xe27, 0x0, 0x6, 0xfa14, 0xffffffff}, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000003c0), 0x729f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000080)=0x3ff) write$dsp(r4, &(0x7f0000000600)="a527dc0edbc9562d6ddfb22da876830a60164c09289e9eb5628678cca3", 0x1d) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="3401000010000100fefffffffc000000fc00000000000000000000000000000164010101000000000000000000000000000107144e2300070000a0003a0000001e4f7beb7a325bbb62a8eba0bbf0d26699a7952dbbce1f83c9981c54725e08619a819cc8ed64701f93c35f1c4a34aaca2cf342606e0cb3736dd422a815b5279dfe6e70f11ae013014ad96bee6e184230bb4f2b93685e9e453df333e4b84f8f04a603ab8569d2fea690f2aa037015a3b06cdacef42ff2cf15738f66de072c79b42d2f0d232a751f11c3681c3dfa", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14143f000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0100000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd7000063500000200010020000000480003006465666c61746500"/236], 0x134}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x5a, &(0x7f00000002c0)=ANY=[@ANYBLOB="c6aaaaaaaaaaffffffffffff080048f0004c006700000306907864010100ac1414aa89071ee000000183039300000000000000000000000000000000000100004e2100004e220000000100000000000000030000000000000001"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="ec00000018000100feffffff0001000000000000000000000000ffffe0000002fc0100000000000000000000000000010001071c4e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14142500000000000000000000000000000100000000009201000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffafffffffcffffff0000000080000000003500000200010020000000"], 0xec}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r6, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000004000000000300060000000e0002000000e2000009000000000000000002000100000000000000000200000000030005000000000002000000e00000010000000000090000"], 0x50}}, 0x0) 7m56.30625748s ago: executing program 32 (id=692): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) syz_open_dev$video(&(0x7f0000000100), 0x3, 0x2000) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000640)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f0000000440)=[{{&(0x7f0000000240)=@l2tp6={0xa, 0x0, 0x0, @private2}, 0x80, &(0x7f00000004c0)=[{&(0x7f00000001c0)=""/50, 0x32}, {&(0x7f0000000340)=""/50, 0x32}], 0x2, &(0x7f0000000400)=""/6, 0x6}, 0x400}], 0x1, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x5, 0x0, 0x8004, 0x0, 0xe27, 0x0, 0x6, 0xfa14, 0xffffffff}, 0x0) recvmmsg(r1, 0x0, 0x0, 0x0, 0x0) r4 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000003c0), 0x729f82, 0x0) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000080)=0x3ff) write$dsp(r4, &(0x7f0000000600)="a527dc0edbc9562d6ddfb22da876830a60164c09289e9eb5628678cca3", 0x1d) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000840)=ANY=[@ANYBLOB="3401000010000100fefffffffc000000fc00000000000000000000000000000164010101000000000000000000000000000107144e2300070000a0003a0000001e4f7beb7a325bbb62a8eba0bbf0d26699a7952dbbce1f83c9981c54725e08619a819cc8ed64701f93c35f1c4a34aaca2cf342606e0cb3736dd422a815b5279dfe6e70f11ae013014ad96bee6e184230bb4f2b93685e9e453df333e4b84f8f04a603ab8569d2fea690f2aa037015a3b06cdacef42ff2cf15738f66de072c79b42d2f0d232a751f11c3681c3dfa", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14143f000000000000000000000000000000000000000092010000000000000600000000000000ffff0000000000001c250800000000000200000000000000f8ffffffffffffff0100000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd7000063500000200010020000000480003006465666c61746500"/236], 0x134}, 0x1, 0x0, 0x0, 0x8801}, 0x0) syz_emit_ethernet(0x5a, &(0x7f00000002c0)=ANY=[@ANYBLOB="c6aaaaaaaaaaffffffffffff080048f0004c006700000306907864010100ac1414aa89071ee000000183039300000000000000000000000000000000000100004e2100004e220000000100000000000000030000000000000001"], 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[@ANYBLOB="ec00000018000100feffffff0001000000000000000000000000ffffe0000002fc0100000000000000000000000000010001071c4e230005000000003a000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000ac14142500000000000000000000000000000100000000009201000000000000a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0000000000000000ffffffffffffffff00000000000000001f00000000000000fefffffffffffffffafffffffcffffff0000000080000000003500000200010020000000"], 0xec}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r6, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000004000000000300060000000e0002000000e2000009000000000000000002000100000000000000000200000000030005000000000002000000e00000010000000000090000"], 0x50}}, 0x0) 3m32.640534901s ago: executing program 0 (id=1405): openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r1 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x1, 0x5, 0x9c3}, &(0x7f00000001c0)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) flock(r1, 0xc) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$vim2m_VIDIOC_S_FMT(r4, 0xc0cc5605, &(0x7f0000000240)={0x2, @sliced={0x8000, [0x7, 0x0, 0x3, 0x37, 0x678, 0x5d5, 0x2, 0x4, 0x0, 0xe000, 0x2, 0x20b9, 0xc, 0x82ff, 0x5fb, 0x1, 0xbf50, 0xfc9b, 0x1, 0xfb9, 0x40, 0x100, 0x40, 0xffff, 0x0, 0xd, 0x57c0, 0x800, 0x9900, 0x40, 0x0, 0x1ff, 0x3, 0x2, 0x2, 0x400, 0x3, 0x1000, 0x63, 0x7ff, 0x3, 0xbfd, 0x2, 0x3, 0x4, 0x4, 0x2, 0x40], 0xef}}) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd=r0, 0xc000000, &(0x7f0000000000), 0x0, 0x1e}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) syz_io_uring_setup(0x88f, &(0x7f0000000180)={0x0, 0xc989, 0x0, 0xffffffdf, 0x173}, &(0x7f0000000000), 0x0) 3m30.832491472s ago: executing program 0 (id=1408): socket$nl_netfilter(0x10, 0x3, 0xc) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x3, {{0x2, 0x0, @multicast2}}}, 0x88) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x9) getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000000000)=""/4091, &(0x7f0000001000)=0xffb) (async) getsockopt$inet_buf(r1, 0x0, 0x30, &(0x7f0000000000)=""/4091, &(0x7f0000001000)=0xffb) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x13, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000040000080000007918a80000000f0095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) (async) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x13, 0x4, &(0x7f0000000480)=ANY=[@ANYBLOB="180000000000000000040000080000007918a80000000f0095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000480)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x1, 0x4, &(0x7f0000000480)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x2000004, 0x13010, r2, 0x53381000) setsockopt$inet6_int(r3, 0x29, 0x2, &(0x7f0000000000)=0x7, 0x4) r4 = socket$rds(0x15, 0x5, 0x0) bind$rds(r4, &(0x7f00000018c0)={0x2, 0x0, @loopback}, 0x10) (async) bind$rds(r4, &(0x7f00000018c0)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) (async) sendmsg$rds(r4, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="98000000000201040000000000005fb72882000004000180440003800c00028005000100890000102c0001801400030900000000000000000000ffffac1e000114000400ff010000000000000000000000000106000340000000003c0002802c00018005c1a324fded61c237ff0200000000000000000000000000011400040000000000000000000000ffffac1414aa0c000280050001008600000000"], 0x98}, 0x1, 0x0, 0x0, 0x24004855}, 0x4) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000003740), 0x2000) ioctl$SNDRV_TIMER_IOCTL_GINFO(r6, 0xc0f85403, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = syz_genetlink_get_family_id$gtp(0x0, r7) sendmsg$GTP_CMD_ECHOREQ(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYRES16=r8, @ANYBLOB="30066fa8f64ce27bff7a14e30000658f4583b3a80018f4bd2d46da319d9247214178c44f42335c017b5e21b5d0e56fa5", @ANYBLOB="040028bd7000fbdbdf25030006000400000014100b006afe88000000000000000000000000010100000000", @ANYRESDEC=r2, @ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x800) (async) sendmsg$GTP_CMD_ECHOREQ(r7, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000580)=ANY=[@ANYRES16=r8, @ANYBLOB="30066fa8f64ce27bff7a14e30000658f4583b3a80018f4bd2d46da319d9247214178c44f42335c017b5e21b5d0e56fa5", @ANYBLOB="040028bd7000fbdbdf25030006000400000014100b006afe88000000000000000000000000010100000000", @ANYRESDEC=r2, @ANYRESDEC=r5], 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x800) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000001140)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001100)={&(0x7f0000001880)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="010028bd7000fddbdf2501000000e0729d35abdde88eed77"], 0x14}, 0x1, 0x0, 0x0, 0x44080}, 0x11) (async) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, &(0x7f0000001140)={&(0x7f0000001040)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000001100)={&(0x7f0000001880)=ANY=[@ANYBLOB="14000000", @ANYRES16=r8, @ANYBLOB="010028bd7000fddbdf2501000000e0729d35abdde88eed77"], 0x14}, 0x1, 0x0, 0x0, 0x44080}, 0x11) getsockopt$inet6_buf(r3, 0x29, 0x6, &(0x7f0000001500)=""/17, &(0x7f0000000180)=0x11) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001900)={0x6, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41000, 0x8}, 0x94) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000019c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a0000000a090400006b693cb05caafa0100000900020073797a32000000000900010073797a30e8a7035f665a04ab00000000140004c010000180090001007866726d0000000005000740da000000140000001100010000000000000000000500000a8a92797a6af5c7e2cdbd8cf4a7a9e7e2022e27d90e32a0e790bf1f8a951c0f6c08764aa332be8b291e8d4b91"], 0x70}, 0x1, 0x0, 0x0, 0x4000011}, 0x800) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000019c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a0000000a090400006b693cb05caafa0100000900020073797a32000000000900010073797a30e8a7035f665a04ab00000000140004c010000180090001007866726d0000000005000740da000000140000001100010000000000000000000500000a8a92797a6af5c7e2cdbd8cf4a7a9e7e2022e27d90e32a0e790bf1f8a951c0f6c08764aa332be8b291e8d4b91"], 0x70}, 0x1, 0x0, 0x0, 0x4000011}, 0x800) socket$nl_route(0x10, 0x3, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) 3m28.820300417s ago: executing program 0 (id=1411): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141101) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x45, &(0x7f0000000300)={0x0, 0x0, 0x40, 0x2, 0x18}, &(0x7f0000000100), &(0x7f00000000c0)) syz_io_uring_setup(0xca7, &(0x7f0000000400)={0x0, 0x358c, 0x10000, 0x7ffe, 0x40024e, 0x0, r2}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_MSG_RING={0x28, 0x40, 0x0, r2, 0x0, 0x0, 0x0, 0x2}) sched_setattr(0x0, &(0x7f0000000140)={0x38, 0x5, 0x1b, 0x8001, 0x0, 0x9, 0x0, 0xfffdfe0000000001, 0xfa11}, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r5, 0x6, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000480)=@newtfilter={0x34, 0x2c, 0x8, 0x70bd26, 0x25dfdc00, {0x0, 0x0, 0x0, 0x0, {0x2, 0x4}, {0x3}, {0x8, 0xf}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8c050}, 0x20000000) sendmsg$nl_route_sched(r6, &(0x7f0000000700)={0x0, 0x1e5, &(0x7f00000006c0)={&(0x7f0000000440)=@deltaction={0x28, 0x32, 0x101, 0x0, 0x0, {}, [@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}]}, 0x28}}, 0x0) unshare(0x2040400) r9 = fsopen(&(0x7f0000000440)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r9, 0x6, 0x0, 0x0, 0x0) unshare(0x2000400) ptrace$PTRACE_SETSIGMASK(0x420b, 0x0, 0x8, &(0x7f0000000000)={[0x8, 0x21]}) fsmount(r9, 0x0, 0x0) r10 = openat$vimc0(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r10, 0xc02c564a, 0x0) 3m27.560816931s ago: executing program 0 (id=1417): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x48) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000000)='./file0\x00') r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=ANY=[@ANYBLOB="3800000040000701feffffff00000000017c0000040042800c00018006000600800a0000140002800d00148004000d0004000d"], 0x38}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) chroot(&(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') setsockopt$inet6_buf(r0, 0x29, 0x20, &(0x7f00000005c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d41000000000000000290000000b000000", 0x30) syz_usb_connect(0x3, 0x7d, &(0x7f0000001140)={{0x12, 0x1, 0x110, 0x87, 0x80, 0x5b, 0x8, 0x557, 0x2008, 0xa708, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6b, 0x2, 0xa2, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x8e, 0x4, 0x2, 0x49, 0xa6, 0xdf, 0x5b, [@uac_control={{0xa, 0x24, 0x1, 0xa, 0x6}, [@extension_unit={0xc, 0x24, 0x8, 0x5, 0x6, 0x7, "0d0a329ce2"}]}], [{{0x9, 0x5, 0x86, 0x10, 0x400, 0xf4, 0x8, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2f, 0x8}]}}, {{0x9, 0x5, 0x0, 0x0, 0x40, 0x81, 0x3, 0xff}}]}}, {{0x9, 0x4, 0x70, 0x1, 0x3, 0xa7, 0x8c, 0x67, 0x3, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0xf7, 0x81, 0x6}}, {{0x9, 0x5, 0x3, 0x3, 0x3ff, 0x8, 0x40, 0x4, [@generic={0x7, 0x5, "a6c6415a9f"}]}}, {{0x9, 0x5, 0x85, 0x3, 0x40, 0xb, 0x82, 0xb}}]}}]}}]}}, 0x0) 3m26.651061006s ago: executing program 0 (id=1421): socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$NL80211_CMD_CRIT_PROTOCOL_START(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0}}, 0x8000) getsockname$packet(r0, &(0x7f0000000600)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14) mremap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000, 0x0, &(0x7f0000c87000/0x2000)=nil) getsockopt(0xffffffffffffffff, 0x200000000114, 0x271e, &(0x7f0000000580)=""/102393, &(0x7f0000000040)=0x18ff9) userfaultfd(0x801) socketpair$unix(0x1, 0x4, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) socket(0x28, 0x2, 0x6) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) r3 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000040)={0x9, 0x100, 0x0, {0xffffffff, 0xbde, 0xb, 0x10000}}) r4 = openat$vimc2(0xffffff9c, &(0x7f0000005cc0), 0x2, 0x0) ioctl$VIDIOC_CREATE_BUFS(r4, 0xc0f8565c, &(0x7f0000005e00)={0x5, 0x7, 0x78ba96cc09fd2886, {0xc, @pix_mp={0x3, 0x1, 0x30324c4a, 0x3, 0x4, [{0xfffffffd, 0x5}, {0x2, 0x7fffffff}, {0x400081, 0x1}, {0x1, 0x2}, {0x6, 0x4}, {0x1, 0x1}, {0x8, 0xe90f}, {0x3ad7, 0x5}], 0x0, 0xf, 0x6, 0x1, 0x4}}, 0x80000001}) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r5 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r6 = openat$cgroup_ro(r5, &(0x7f0000000180)='blkio.throttle.io_service_bytes\x00', 0x0, 0x0) preadv(r6, &(0x7f00000000c0)=[{&(0x7f0000000240)=""/140, 0x8c}], 0x1, 0x0, 0x0) pwritev2(0xffffffffffffffff, &(0x7f0000000240)=[{0x0}], 0x1, 0x7000, 0x0, 0x3) syz_open_procfs(0x0, &(0x7f0000000040)='syscall\x00') syz_emit_ethernet(0x10b, &(0x7f00000006c0)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff0800494100fd0065000008029078ac1414bbe000000204440c9f93ac1414aa00000002000000227f90787f000001393416de860432ce7bc329ab7ef37cc09d89387dc2ccf9feb0902b941f136a54d5b5c05ed397b9d94419ffb93e61690bf4592b08db81388570be59b77d8502d17bf1fc8eb595e7d7dec6a851e061646f6cc58e5c8c758b0f440648c1d9b558da96e50a35b8b56b465659b947e1f5a393c4ed43918b6e309f66ca3fd77a4a368fb197ceb5738194a6cafbd6e7f6a02074b3aca0b2e823168cac13548cf0a93c6828a3cdc0ed622d8b3a3912f3307537b23a3d6c4e57a0c540449396ff0aaa07ead60b5c94e0596c1224c42f8b7a8aa0f6c2ba6b52e0ec5309e177c73232735100f7d70ca168f5e3d9eefa84bee489c45497808b6789c3f62e77514ac57665fdaec782a1ceca1ee6854de4e6b72306f9969bb432e5ae9c2545c6b9da914b90b937cc7cb9c890301ae443e7055b2faf86941c48f11d8d3c6a06c85ad91a76aa402b8f5eab96a3305ba78e21cb87d10f205b810714c1ffc6097b9e2decdfaba164e750d6a94dc1360758eb0a6cc96c70075b99e9b18bffdcc00f686db1d35aba63"], 0x0) io_uring_setup(0x598, &(0x7f0000000300)={0x0, 0x77ae, 0x400, 0x8000002, 0x3d7}) syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) 3m26.572245886s ago: executing program 0 (id=1425): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_emit_ethernet(0x52, &(0x7f0000000340)=ANY=[@ANYBLOB="ffffffffffff0180c200000186dd6745208e001c3aff00000000000000000000ffffac1414aaff8200907801ff410b20010000000000400634b45756e7a852e286dc09"], 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80, 0x23456}) r7 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) fchdir(r8) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x44) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) socket$inet6(0xa, 0x805, 0x0) r9 = syz_io_uring_setup(0xa39, &(0x7f00000000c0)={0x0, 0xfdc8, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r10, r11, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r9, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r12 = mq_open(&(0x7f00000001c0)='batadv_slave_1\xbb', 0x8c2, 0x30, &(0x7f0000000080)={0x3, 0x8, 0x6, 0xc07}) mq_getsetattr(r12, &(0x7f0000000040)={0x0, 0x40, 0x4, 0xffff}, 0x0) 3m25.825917548s ago: executing program 33 (id=1425): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r1 = dup(r0) write$6lowpan_enable(r1, &(0x7f0000000000)='0', 0xfffffd2c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_emit_ethernet(0x52, &(0x7f0000000340)=ANY=[@ANYBLOB="ffffffffffff0180c200000186dd6745208e001c3aff00000000000000000000ffffac1414aaff8200907801ff410b20010000000000400634b45756e7a852e286dc09"], 0x0) syz_io_uring_submit(r5, r6, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80, 0x23456}) r7 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x0, 0x32, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x8) fchdir(r8) openat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x103a42, 0x44) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) socket$inet6(0xa, 0x805, 0x0) r9 = syz_io_uring_setup(0xa39, &(0x7f00000000c0)={0x0, 0xfdc8, 0x10100}, &(0x7f0000000180)=0x0, &(0x7f0000000340)=0x0) syz_io_uring_submit(r10, r11, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd_index=0x4, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r9, 0x2ded, 0x4000, 0x0, 0x0, 0x0) r12 = mq_open(&(0x7f00000001c0)='batadv_slave_1\xbb', 0x8c2, 0x30, &(0x7f0000000080)={0x3, 0x8, 0x6, 0xc07}) mq_getsetattr(r12, &(0x7f0000000040)={0x0, 0x40, 0x4, 0xffff}, 0x0) 1m1.697459745s ago: executing program 2 (id=2086): r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x80000, 0x0) ioctl$TUNSETOFFLOAD(r0, 0xc004743e, 0x110c23004a) bpf$BPF_BTF_LOAD(0x12, 0x0, 0xffffffffffffff01) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1980, 0x0) ioctl$TUNSETOFFLOAD(r1, 0xc004743e, 0x110c230007) close(0x3) 1m1.440717781s ago: executing program 2 (id=2088): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000004000000050300060000000e0002000000e2000009000000000000000002000100000000000000000200000000030005000000000002000000e0000001"], 0x50}}, 0x0) 1m1.345863177s ago: executing program 2 (id=2090): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd\x00') exit(0x7) statx(r0, 0x0, 0x1000, 0x10, 0x0) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$zero(0xffffffffffffff9c, &(0x7f0000000240), 0x8202, 0x0) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) splice(r1, 0x0, r3, 0x0, 0x33fe0, 0x8) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r4 = io_uring_setup(0x3697, &(0x7f0000000600)={0x0, 0x96b9, 0x0, 0x200003, 0x23d}) io_uring_register$IORING_REGISTER_BUFFERS(r4, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x1}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @ct={{0x7}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CT_DIRECTION={0x5, 0x3, 0x1}, @NFTA_CT_DREG={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_CT_KEY={0x8}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x80}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) setsockopt$inet6_int(r2, 0x29, 0x13, &(0x7f0000000000)=0x80000001, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 1m0.31163604s ago: executing program 2 (id=2094): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) getsockopt$sock_buf(r2, 0x1, 0xc, &(0x7f00000001c0)=""/97, &(0x7f0000000240)=0x61) pivot_root(&(0x7f0000000200)='./file0/../file0/../file0/../file0/file1\x00', &(0x7f00000000c0)='./file0/../file0/../file0/../file0/file1\x00') chroot(&(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') 1m0.096611932s ago: executing program 2 (id=2096): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r0, &(0x7f00000002c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)={0x1a8, r1, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xa1, 0x3d}}}}, [@NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x3ff}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xbfc}, @NL80211_ATTR_VENDOR_DATA={0xfe, 0xc5, "edae4b946a2fcee4bd76c200547921d39246c9b5ab80c968da0cd1f81546a94e1958bbd62b6b9bc329c8ac10b756cf52ec0706a6e58ea7b5e4ff29b787adec3a5dbfbcc4cab4894a6ee4524c45ab718237ea6bee73d1ab3d0ea097474be4b361050fe0b2ccd2d023f60bb610700667e8b7ac3b69df24e5842b76f6c283e170dcf14b8e4e3b919cfdd1790398fc1981297c5dd94bfe63fae26a1c65a867b6672aa678a6d1887c6ce551ff780d18b5a9c8f19fdaec32f566690be204abd37a71eceb7eeeffafcb19ae18960bd036557545271738874947441895e289b5c3959f5f3cc112bf0c1d28c79711d2cfe72a84a9d65a6c2239db285beab1"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x6}, @NL80211_ATTR_VENDOR_DATA={0x5f, 0xc5, "46c14cb52ad56a9c3b8458955d13302c8c73d3142a144a5dad6dcea555fa5d4b56c5fc1e322a73938c00ad7ca9d1118f1d85c54dfb255a1e3050d3167bf623815ad57b6a0aff222700f602eb20822deac56077997d1f9aa4203afa"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$NL80211_CMD_GET_STATION(r0, &(0x7f0000000480)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000440)={&(0x7f0000000340)={0xf0, r1, 0x200, 0x70bd29, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r2}, @val={0xc, 0x99, {0xc, 0x4b}}}}, [@NL80211_ATTR_STA_TX_POWER_SETTING={0x5, 0x113, 0x2}, @NL80211_ATTR_MESH_PEER_AID={0x6, 0xed, 0xf4}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}, @NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES={0xb0, 0xbe, "04391120372d25602bfc16ea262318111b06031ec0ebb1b623a6509de84c11e155e1e7ca97308e6365fc408042de82b03597293b5282cbb5d75dbd59245e436afb7555892e89426feca52f7aae62d60a91cf903757bc68a2dd484075a6f0f5d94b0c680c43cdff71d0dcba4f200818a46ac49957bb61467865355ec1bfcb61a801b56037189dbcfa10d54b8a6c1bee67eb608761cc129ef32ceaeaefa559c1974a25554af8ff82f097109c28"}]}, 0xf0}}, 0x4000000) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) openat$kvm(0xffffff9c, &(0x7f00000004c0), 0x200000, 0x0) r4 = syz_open_dev$vcsa(&(0x7f0000000500), 0x6, 0x400000) sendmsg$NL80211_CMD_JOIN_IBSS(r4, &(0x7f0000000680)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0x90, r1, 0x8, 0x70bd29, 0x25dfdbfe, {{}, {@void, @void}}, [@NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x2, 0x3, 0x0, 0x0, {0x6, 0x4, 0x0, 0xbb, 0x0, 0x0, 0x1, 0x0, 0x1}, 0x400, 0x10, 0xe}}, @NL80211_ATTR_MCAST_RATE={0x8, 0x6b, 0x1}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_HIDDEN_SSID={0xa, 0x7e, @default_ibss_ssid}, @NL80211_ATTR_CONTROL_PORT_OVER_NL80211={0x4}, @NL80211_ATTR_HT_CAPABILITY={0x1e, 0x1f, {0x2, 0x1, 0x3, 0x0, {0xcdb7, 0x7f, 0x0, 0x4, 0x0, 0x0, 0x1, 0x1, 0x1}, 0x300, 0x1, 0x81}}, @NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x90}, 0x1, 0x0, 0x0, 0x8004}, 0x4000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000800)={'batadv0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c00)={'veth0_macvtap\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000cc0)={'ip6gre0\x00', &(0x7f0000000c40)={'ip6gre0\x00', 0x0, 0x4, 0x7d, 0x9, 0x5, 0x10, @remote, @mcast2, 0x10, 0x40, 0x115df868, 0x2}}) sendmmsg$inet(r4, &(0x7f0000000e00)=[{{&(0x7f00000006c0)={0x2, 0x4e20, @multicast1}, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000700)="1a455026153df90d73538976878b7e6fd1cbbfef61576e478175b0a5309936a28b12de7acbcc0b4f9047676043ea63ddaf380999b575ba368cb39c7e3c1c0a06804d960a4512751367c4c70558b361da1109a6ef7038e9c91a7c2c94b2b752e5e42a84adee04d9dc07c3f5a3931931aca47f6e2f3c424c93a66e9f5827766883d1b7a589ab8cbb0bac660ab8576ed152ab5e24574ac47a83ee1f31444c309fa35ef3ff640fdc43bf8addea84968b58f4833a44e00f5f803a790219561c", 0xbd}], 0x1, &(0x7f0000000840)=[@ip_tos_u8={{0xd, 0x0, 0x1, 0x9}}, @ip_pktinfo={{0x18, 0x0, 0x8, {0x0, @private=0xa010102, @multicast2}}}, @ip_retopts={{0x12c, 0x0, 0x7, {[@noop, @noop, @timestamp_addr={0x44, 0x4c, 0x9f, 0x1, 0x7, [{@local, 0x1}, {@local, 0xfffffbd1}, {@loopback, 0x10}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x6}, {@loopback, 0x5}, {@dev={0xac, 0x14, 0x14, 0x22}, 0xf}, {@multicast1, 0xc}, {@local, 0xe92}, {@rand_addr=0x64010102, 0xd486156}]}, @timestamp_addr={0x44, 0xc, 0xcf, 0x1, 0x7, [{@initdev={0xac, 0x1e, 0x1, 0x0}, 0x7}]}, @cipso={0x86, 0x53, 0x0, [{0x2, 0xc, "ce090135c0b35b0ed78d"}, {0x1, 0x3, "90"}, {0x2, 0xd, "a7058bd9c3f94c0ac341da"}, {0x6, 0x7, "f7677ea68d"}, {0x2, 0x2}, {0x6, 0x11, "2bf5f8dd1ad4d1eaae2a5144ca9178"}, {0x1, 0x11, "239af8ea60f98e11d29324dd6e3c13"}, {0x6, 0x3, "06"}, {0x7, 0x3, 'a'}]}, @cipso={0x86, 0x54, 0x3, [{0x1, 0x5, "2e8a13"}, {0x1, 0x8, "25bfb44e0fab"}, {0x0, 0x12, "6b90b4f12dca309d6410f34f8b771915"}, {0x5, 0x5, "925be4"}, {0x6, 0x6, "35189229"}, {0x5, 0x8, "0d7aa41185c5"}, {0x0, 0x10, "a9a6ac8966c9ce1d0cc02891932f"}, {0x6, 0xc, "2618145f5200cc629282"}]}, @ssrr={0x89, 0x7, 0xc9, [@rand_addr=0x64010100]}, @noop, @lsrr={0x83, 0x17, 0xc1, [@rand_addr=0x64010102, @multicast2, @empty, @rand_addr=0x64010101, @broadcast]}]}}}, @ip_ttl={{0x10, 0x0, 0x2, 0x81}}, @ip_pktinfo={{0x18, 0x0, 0x8, {r5, @empty, @empty}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0xb9}}], 0x18c}}, {{0x0, 0x0, &(0x7f0000000bc0)=[{&(0x7f0000000a00)="e7e1f3b1d9aea4cee55dfb3e1c332b9116e22c24ca089743886ff694a44aca6619c8ce7d88ba690667efd8cf581c99a013b0dc11d56fadaf86ec140805d1f2ad3d66565e0705942d9e667eb33789548c77a4241b07e56bc2ad1932a95f738f9bf8d27175360c7bfe96bea7fb5482dea1331928243d79390b38d168c3ce14c170e9e6309b2f4cb80ef8e1c6214a0f63e84594d8cde44a619abd67e5187ba82766379e", 0xa2}, {&(0x7f0000000ac0)="6006160c874adbc658e1fe9a73dc9f24506eda83e2166ee08582d7a4f762c4912b2d2e5753a3a91d9273ed4100bb7b1cc351a970da9b818c2eeaaa246da33004df721f3295fcdf23affc815c6802cf69ed7d587ef2074cc39339d4c7eb5fb1a4e46a0c443173be27587d0cb1be6feb885da9061dfeee7fc61e4ee5e3788932afa3cc90909233386fcc06461c778cce74ef390f94ce2a9edaa5d10ab46664cf8846205f1993a0b334fac9d0c71138410d3257d8f72fde32709963f36c08c8be14f1466450beecc6ce3ce2cbae6aaec5d3851bfc05136b65709c4cc903c100789fa7b2f47f9c7946b71742", 0xea}], 0x2, &(0x7f0000000d00)=[@ip_retopts={{0x4c, 0x0, 0x7, {[@rr={0x7, 0x17, 0x55, [@broadcast, @initdev={0xac, 0x1e, 0x0, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}, @private=0xa010101, @multicast1]}, @generic={0x7, 0xa, "d185876cac9d91d3"}, @rr={0x7, 0x1f, 0xf6, [@empty, @loopback, @loopback, @broadcast, @empty, @local, @multicast2]}]}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0x8}}, @ip_tos_int={{0x10, 0x0, 0x1, 0x5}}, @ip_tos_int={{0x10, 0x0, 0x1, 0xfffffff0}}, @ip_ttl={{0x10, 0x0, 0x2, 0x4}}, @ip_pktinfo={{0x18, 0x0, 0x8, {r6, @multicast1, @rand_addr=0x64010100}}}, @ip_ttl={{0x10, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x18, 0x0, 0x8, {r7, @local, @empty}}}, @ip_tos_u8={{0xd, 0x0, 0x1, 0x1}}], 0xdc}}], 0x2, 0x4) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000e40)={0xaa, 0x490}) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000e80)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0xc, '\x00', r7, r4, 0x1, 0x1, 0x4}, 0x50) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r4, 0xc0189375, &(0x7f0000000f00)={{0x1, 0x1, 0x18, r4}, './file0\x00'}) getsockopt$IP6T_SO_GET_REVISION_MATCH(r9, 0x29, 0x44, &(0x7f0000000f40)={'ah\x00'}, &(0x7f0000000f80)=0x1e) r10 = socket$inet_udp(0x2, 0x2, 0x0) sendmsg$NL80211_CMD_GET_REG(r4, &(0x7f0000001140)={&(0x7f0000000fc0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001100)={&(0x7f0000001000)={0xe0, r1, 0x119, 0x70bd2a, 0x25dfdbfd, {}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x53}, @NL80211_ATTR_REG_RULES={0xc4, 0x22, 0x0, 0x1, [{0x3c, 0x0, 0x0, 0x1, [@NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0xfffffffb}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8, 0x6, 0x607c}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x9}, @NL80211_ATTR_POWER_RULE_MAX_EIRP={0x8}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xffffffff}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x800}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x7}]}, {0x34, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x7}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x10001}, @NL80211_ATTR_FREQ_RANGE_END={0x8, 0x3, 0x40}, @NL80211_ATTR_FREQ_RANGE_MAX_BW={0x8, 0x4, 0x6}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x2443}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x1}]}, {0xc, 0x0, 0x0, 0x1, [@NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x32}]}, {0x44, 0x0, 0x0, 0x1, [@NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x3}, @NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN={0x8, 0x5, 0x7}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x4}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xee000000}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0x800}, @NL80211_ATTR_DFS_CAC_TIME={0x8, 0x7, 0x2}, @NL80211_ATTR_REG_RULE_FLAGS={0x8, 0x1, 0x513e}, @NL80211_ATTR_FREQ_RANGE_START={0x8, 0x2, 0xc4f2}]}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x20000800}, 0x4044005) symlink(&(0x7f0000001180)='./file0/file0\x00', &(0x7f00000011c0)='./file0\x00') setsockopt$inet6_group_source_req(r4, 0x29, 0x2c, &(0x7f0000001200)={0x8, {{0xa, 0x4e21, 0x3, @private1, 0x83a9}}, {{0xa, 0x4e23, 0x7, @remote, 0x4}}}, 0x104) bpf$BPF_PROG_TEST_RUN_LIVE(0xa, &(0x7f0000001400)={r4, 0x0, 0xb, 0x0, &(0x7f0000001340)="a69ef0e9f090d34c77937b", 0x0, 0x3, 0x0, 0x4f, 0x0, &(0x7f0000001380)="b5c1a99aae96fc7067a5a603d16c495d87da118efc13d05b2390a60587831071452df0ff5034d2476891ec1420126d809a1b0c0d7f7c3e5759d916eaf8d03fad32f11f0d3c581444dea500de2c62db", 0x0, 0x2, 0x0, 0x8}, 0x4c) clock_gettime(0x0, &(0x7f0000001480)={0x0, 0x0}) setsockopt$sock_timeval(r10, 0x1, 0x15, &(0x7f00000014c0)={r11, r12/1000+60000}, 0x8) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f00000015c0)={0x0, 0x0}, &(0x7f0000001600)=0xc) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r9, 0xc018937b, &(0x7f0000001640)={{0x1, 0x1, 0x18, r8, {0xffffffffffffffff, 0xee00}}, './file0/file0\x00'}) read$FUSE(r4, &(0x7f0000001680)={0x2020, 0x0, 0x0, 0x0}, 0x2020) statx(r9, &(0x7f00000036c0)='./file0\x00', 0x100, 0x7ff, &(0x7f0000003700)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuseblk(&(0x7f0000001500), &(0x7f0000001540)='./file0\x00', &(0x7f0000001580), 0x1020, &(0x7f0000003800)={{'fd', 0x3d, r9}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {'user_id', 0x3d, r13}, 0x2c, {'group_id', 0x3d, r14}, 0x2c, {[{@default_permissions}, {@blksize={'blksize', 0x3d, 0xa00}}], [{@defcontext={'defcontext', 0x3d, 'staff_u'}}, {@fsuuid={'fsuuid', 0x3d, {[0x64, 0x64, 0x32, 0x38, 0x35, 0x35, 0x64, 0x35], 0x2d, [0x35, 0x64, 0x36, 0x35], 0x2d, [0x31, 0x38, 0x32, 0x61], 0x2d, [0x3, 0x35, 0x64], 0x2d, [0x64, 0x62, 0x65, 0x36, 0x0, 0x34, 0x61, 0x66]}}}, {@smackfsdef={'smackfsdef', 0x3d, '\x00'}}, {@euid_eq={'euid', 0x3d, 0xee00}}, {@euid_lt={'euid<', r15}}, {@euid_gt={'euid>', r16}}, {@fsuuid={'fsuuid', 0x3d, {[0x33, 0x33, 0x61, 0x61, 0x31, 0x64, 0x61, 0x65], 0x2d, [0x39, 0x66, 0x36, 0x66], 0x2d, [0x62, 0x36, 0x30, 0x31], 0x2d, [0x39, 0x35, 0x64, 0x65], 0x2d, [0x61, 0x36, 0x32, 0x36, 0x38, 0x62, 0x39, 0x37]}}}, {@obj_user={'obj_user', 0x3d, 'batadv0\x00'}}, {@subj_user={'subj_user', 0x3d, 'PPPPPP'}}]}}) getsockopt$TIPC_CONN_TIMEOUT(r4, 0x10f, 0x82, &(0x7f00000039c0), &(0x7f0000003a00)=0x4) 59.508556739s ago: executing program 2 (id=2099): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000009c0), 0x42, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) cachestat(r0, &(0x7f0000001180)={0x5, 0x1000002}, &(0x7f000009de80), 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$nbd(r1, &(0x7f0000000c80)=ANY=[@ANYBLOB="67446698000000000400000003000000b4c0fc7b89fc291f0c7858b295fe99e4afe64d8580df92947742ba0898f4f1575051a4d9350f1a4dc35b26f8b8c2cf202bd672012f9b55cbd3fe0ab5231539835cf3eade98e1d98deebba8e315c34ea8ce79e22973ba0ca26824d3681990814d5c6348fcf0a912e7b8573573f27c7c846aba0e0de340ee2d9762af7072209830c3c7767ee24a1d9f9699c39df1eccbd370ccc903341e776b79778253e0262661165e0468a4cd6570724b66fbc2cda917e62b7b362bcc47c6fe5bc40e4c87d0458d187f925bfc39b160eec24a252e79b7faf6ea4826"], 0x8d) write$cgroup_subtree(r1, &(0x7f00000025c0)=ANY=[@ANYBLOB="5045c1884f167908870d8c4b80edb0d849fe308be5efd7482924b75b3189dc990ef5420d5aff716720ac3f8669c71a21a1ff1ef0647c8e3884fa5cb60b6a5b722fb1d0a5b50257c2a0a74f5382f4c7c2ce18dd9277397ed0cbce96175dde83672e4208169d6821bebed1249dcde96aaf794295914ae94794d8b9ade845f2c17b4f3fd07df0f39fbd5fb7038c0d0756907ea5ae466fba186e716af497d51475d38a65be1c0a4f25da78e423f50c7a88fcb3ed0d1648b85a812ec6889e5fd27ddafb09fb2f86ce970b60967114b719c0daad50ebb517e3e615543abcc12a6dc78b9092bd92e7d4b41471e69a7ed3714294f1c7c820a08490c7a1a933c1d932d33ee9e949bd3de7c6740c94099aad9202038e1a1666bfb0aaa24b7cf0e55ebbb3f7e9fadb262dddb117750341118ae9af9c8de3ca40898f68c4e41ee1fc2e99c0f9eb7cda8709845d16733f1e122c154cf2b1abf915d35af8732332387ed0ad677fa5ea8db3a4820865eeb4de5476448e5a08c83652b41185e7865c619bfe93442e1d5fc007efbc021e14fe675574c7975b553cef6b1a8c1fbafab1ab1cec233dc55e58363f953ebd1152eae0d1e99ffbc07c1abe0e0674785806441e097aaa310f3058bd9e890351eec967f51a4f2d72d77c63f76dbe16e0f0912593e09c116deddc1b445d3a9dc56d67db6e41f4db891ec1100bf63f657ae1e4a46c21a7815798d6fd2e5cf00a3b0919b4b638ec67059fd85ea11e4056c4b8c65aac5d70af899115037ee29a98fec9407eaa26a26d01112fe450ebf6d85274cdfc12ec87f395"], 0x32600) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r1, 0x0) r2 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0xe, &(0x7f00000011c0)=ANY=[@ANYRES32=r0, @ANYRES16=r2, @ANYRESOCT=0x0], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x24}, 0x94) 59.103920758s ago: executing program 34 (id=2099): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000009c0), 0x42, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) cachestat(r0, &(0x7f0000001180)={0x5, 0x1000002}, &(0x7f000009de80), 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$nbd(r1, &(0x7f0000000c80)=ANY=[@ANYBLOB="67446698000000000400000003000000b4c0fc7b89fc291f0c7858b295fe99e4afe64d8580df92947742ba0898f4f1575051a4d9350f1a4dc35b26f8b8c2cf202bd672012f9b55cbd3fe0ab5231539835cf3eade98e1d98deebba8e315c34ea8ce79e22973ba0ca26824d3681990814d5c6348fcf0a912e7b8573573f27c7c846aba0e0de340ee2d9762af7072209830c3c7767ee24a1d9f9699c39df1eccbd370ccc903341e776b79778253e0262661165e0468a4cd6570724b66fbc2cda917e62b7b362bcc47c6fe5bc40e4c87d0458d187f925bfc39b160eec24a252e79b7faf6ea4826"], 0x8d) write$cgroup_subtree(r1, &(0x7f00000025c0)=ANY=[@ANYBLOB="5045c1884f167908870d8c4b80edb0d849fe308be5efd7482924b75b3189dc990ef5420d5aff716720ac3f8669c71a21a1ff1ef0647c8e3884fa5cb60b6a5b722fb1d0a5b50257c2a0a74f5382f4c7c2ce18dd9277397ed0cbce96175dde83672e4208169d6821bebed1249dcde96aaf794295914ae94794d8b9ade845f2c17b4f3fd07df0f39fbd5fb7038c0d0756907ea5ae466fba186e716af497d51475d38a65be1c0a4f25da78e423f50c7a88fcb3ed0d1648b85a812ec6889e5fd27ddafb09fb2f86ce970b60967114b719c0daad50ebb517e3e615543abcc12a6dc78b9092bd92e7d4b41471e69a7ed3714294f1c7c820a08490c7a1a933c1d932d33ee9e949bd3de7c6740c94099aad9202038e1a1666bfb0aaa24b7cf0e55ebbb3f7e9fadb262dddb117750341118ae9af9c8de3ca40898f68c4e41ee1fc2e99c0f9eb7cda8709845d16733f1e122c154cf2b1abf915d35af8732332387ed0ad677fa5ea8db3a4820865eeb4de5476448e5a08c83652b41185e7865c619bfe93442e1d5fc007efbc021e14fe675574c7975b553cef6b1a8c1fbafab1ab1cec233dc55e58363f953ebd1152eae0d1e99ffbc07c1abe0e0674785806441e097aaa310f3058bd9e890351eec967f51a4f2d72d77c63f76dbe16e0f0912593e09c116deddc1b445d3a9dc56d67db6e41f4db891ec1100bf63f657ae1e4a46c21a7815798d6fd2e5cf00a3b0919b4b638ec67059fd85ea11e4056c4b8c65aac5d70af899115037ee29a98fec9407eaa26a26d01112fe450ebf6d85274cdfc12ec87f395"], 0x32600) mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x2000001, 0x12, r1, 0x0) r2 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r0}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x14, 0xe, &(0x7f00000011c0)=ANY=[@ANYRES32=r0, @ANYRES16=r2, @ANYRESOCT=0x0], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x24}, 0x94) 12.268551324s ago: executing program 4 (id=2306): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x9, 0x0, 0x3, 0x0) r2 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000cef8bd08410e424176bc0102030109061b000547bba29209040002016a2ff6000905010800020b0864"], 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) sendmsg(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r5, 0xc0405602, &(0x7f0000000040)={0x2, 0x2, 0x0, "11010000001400000100b64c0000005c4b7c1500", 0x30314442}) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x0, 0x6, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) syz_open_dev$evdev(&(0x7f0000000040), 0xb, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x101341) openat$rdma_cm(0xffffffffffffff9c, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000014c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000702000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff6d6405000000000065040400010000000404000001000000b7050000400000006a0a80fe000000008500000053000000b7000000000000009500001000000000a80501363034fdb117168bd07ba00af739d1a1ee35fe163a255c33282044b32495ef8ab9adc67ccc945f105d802f5132143c0a9fc7a84452569957c1002ed7d4d8e17f791f4798c8eb483e9973320d046c3126c6afcfd84de03352c69b3edff5be26f8ffa5f8f2879021c2ea53ea79acd7fb38dd1abb75aa393cea26d465637d11f705000000473e7b7c4ae7dd5e4dee88518ddf12dddd4bfc6a4dd3b6beba51074229b0d4b504516c4c3e5d1aa044d8d00728141cd67bcd68f253288e655c6b34e02e90637ef2912ba7de26ff2357ef17f95a25780c3a057844f226ef4e912f01a201e694e3806e8c70e8b69524cd19f7525d8d66bb766f7f3f918c86a70252236800001897133af94a5a4cfc794d8b9d7c33632152c48eaf302f0b2e0c252b00000000000000006f1bbefbe08de65e3762e194ba4cae8b13535d7d11ee917bca4885bbf597a14ab2458efce78510d86272d88e0c8088f404f011289ebc5623faa1182632161e073af1d69a2e36bed435000025ecd201d2ffb0a7fa4f5d11060cdcf071defd0a8be3b69ce3e4f361aca75827426dde87fdf4617222674280f55e98107450c19b9d86329bd5b4697336112b0b8754ce3574046bf6114d1a88597850b77378fa8edfff8faf8b8ec039bab385cac0535373bb8fab90539b1a65ddff841eb671f3faf37ebdfccea0c002ad2b42047c9ec43193ccf617dbf8a12b4f189edbf9fb7c42b1f435ccd4d96822e6b70100912c92e3943e9c4f45d8bcd528fa8a3ea847f10e9b"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x49}, 0x94) openat$kvm(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x2e15, &(0x7f00000002c0)={0x0, 0x1, 0x1, 0x1, 0x1be}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0xc, &(0x7f00000000c0)={0x0, 0x0}) write(r5, &(0x7f0000000440)="e97cddd73914576039e2b6b35976e34789d440278d309437e296afb0d613e654c48404d2855bcf413a322dc4484a3dbcadec3e90151ce0e63600000000000000000000000000000052ae230bbc99686c52afc1413845d29b35d382140cbb2c689bee70bb1d75034e36981ca2983d6c8d6668048fe63d1ec8441c7ca5", 0x29) r6 = socket(0x848000000015, 0x805, 0x0) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x0, 0x0, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x10}, 0x1c) sendto$inet6(r6, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x0, &(0x7f0000000000)=0x7) 9.116897039s ago: executing program 4 (id=2326): r0 = openat$sndseq(0xffffff9c, &(0x7f0000000180), 0x40) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000000c0)={{0x80, 0x4}, 'port0\x00', 0x786520dbf34c80ff, 0x20a03, 0x122, 0x0, 0x0, 0xc, 0x400, 0x0, 0x0, 0x87}) io_uring_setup(0x6a90, &(0x7f0000000200)={0x0, 0x2, 0xc2, 0x2, 0x1ed}) openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x123482, 0x0) r1 = syz_io_uring_setup(0x113, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x10000006, 0x1eb}, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) connect$qrtr(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r4, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x20, 0x0, @fd_index=0x2, 0x5, 0x0, 0xb, 0x7}) io_uring_enter(r1, 0x7277, 0x0, 0x28, 0x0, 0x0) 9.051268505s ago: executing program 4 (id=2327): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000100), 0x10) sendmsg$can_bcm(r0, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000300)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x2000c014}, 0x800) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2cf6, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000400)={0x2c, &(0x7f0000000100)=ANY=[@ANYBLOB=' \n\a'], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000001e40)={0x84, &(0x7f0000001980)={0x0, 0x16, 0x3, "b844a7"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io(r2, 0x0, &(0x7f0000000800)={0x44, &(0x7f0000000280)={0x40, 0x10, 0xd, "9d9bff44794aa1c29c2d976c09"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000680)={0x18, &(0x7f0000000400)={0x40, 0x17, 0x50, "87238925ed7af22b2a8409bb17c6692d59b94ca4aa5ec0bd019f91df4b3a2ab3b43216544f4f7df86f0e5ce12bdb5e8b7855c474c66d06cd74cf1d08ce2339edae5a328cd79dab34e43ef450abcb5ae5"}, &(0x7f0000000500)={0x0, 0xa, 0x1, 0xfc}, 0x0, &(0x7f00000005c0)={0x20, 0x1, 0x44, "0ab7d924c7c831b6c88dc5a19ca0c32dc3c54157225f83897c7364dc89159e959e5f3d9835d72d730be910a980e5d3fe96be1be30933b7478569fbef6209be1b7727c2af"}, &(0x7f0000000640)={0x20, 0x3, 0x1, 0x6}}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x2) ioctl$KVM_SET_CPUID2(r5, 0x4008ae90, &(0x7f0000000580)={0x1, 0x0, [{0x1, 0x90, 0x1, 0xe00, 0x1, 0x8, 0x8000}]}) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000380)="ab26c0381d7804426d4f0ffeb17ad39b63362343370409f922040d63962fc2aeececbb3caeac9078a61cd82cd18765242b2dcebd0d4ff85fe6905ff54ef66387522551cdf76761c6370caf27f2992f1665d5d39e016fae7579a3b9255ce20c8c68fa9fbdf0d3fe6786f38019f7f803b323515bbc59f5ebfb620276a9f768603f8c17b3e8856af9155d3247349dc4bc29af164f8bd6c3317f21f04bb7047c6d4fc6186e49baf7f7ca520d4a17ccf651629e88a92f3e0cb8b771d447c0bb51a3eee9d64beeaf4de4584ddc6ed048722fde6f4db950d410e96ef621c2a89ebd98f103dd02106bf5135ef3dac237d8573a813c2b61d56d6f4a07ff46105f870da50745", 0x101}], 0x1}, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r5, 0x4400ae8f, &(0x7f0000000100)=@x86={0x6, 0x2, 0x10, 0x0, 0xb, 0x7, 0x2, 0x9, 0x1, 0x51, 0x0, 0x8, 0x0, 0x4, 0x10, 0xff, 0xb, 0x2, 0x7, '\x00', 0x6, 0x4080000000000005}) sendmsg$can_bcm(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x1d, r1}, 0x10, &(0x7f0000000180)={&(0x7f0000000580)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x8001) syz_open_dev$tty20(0xc, 0x4, 0x1) 6.643837288s ago: executing program 3 (id=2337): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) recvmmsg(r0, &(0x7f00000030c0)=[{{&(0x7f0000000000)=@l2={0x1f, 0x0, @none}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000080)=""/139, 0x8b}], 0x1}, 0x9}, {{&(0x7f0000000180)=@vsock, 0x80, &(0x7f0000001240)=[{&(0x7f0000000200)=""/18, 0x12}, {&(0x7f0000000240)=""/4096, 0x1000}], 0x2, &(0x7f0000001280)=""/205, 0xcd}}, {{&(0x7f0000001380)=@ax25={{0x3, @rose}, [@bcast, @default, @netrom, @rose, @rose, @default, @null, @bcast]}, 0x80, &(0x7f00000015c0)=[{&(0x7f0000001400)=""/243, 0xf3}, {&(0x7f0000001500)=""/24, 0x18}, {&(0x7f0000001540)=""/13, 0xd}, {&(0x7f0000001580)=""/13, 0xd}], 0x4}}, {{&(0x7f0000001600)=@nfc_llcp, 0x80, &(0x7f0000001980)=[{&(0x7f0000001680)=""/76, 0x4c}, {&(0x7f0000001700)=""/119, 0x77}, {&(0x7f0000001780)=""/94, 0x5e}, {&(0x7f0000001800)=""/134, 0x86}, {&(0x7f00000018c0)=""/133, 0x85}], 0x5}, 0x8}, {{&(0x7f00000019c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000002f80)=[{&(0x7f0000001a40)=""/4096, 0x1000}, {&(0x7f0000002a40)=""/223, 0xdf}, {&(0x7f0000002b40)=""/183, 0xb7}, {&(0x7f0000002c00)=""/18, 0x12}, {&(0x7f0000002c40)=""/136, 0x88}, {&(0x7f0000002d00)=""/34, 0x22}, {&(0x7f0000002d40)=""/228, 0xe4}, {&(0x7f0000002e40)=""/46, 0x2e}, {&(0x7f0000002e80)=""/65, 0x41}, {&(0x7f0000002f00)=""/114, 0x72}], 0xa, &(0x7f0000003000)=""/137, 0x89}, 0x7}], 0x5, 0x122, &(0x7f0000003180)) (async) r2 = syz_open_dev$vcsn(&(0x7f00000031c0), 0x81, 0x40000) (async) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f00000036c0)={&(0x7f0000003200)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000003680)={&(0x7f0000003240)={0x40c, 0xd, 0xa, 0x3, 0x0, 0x0, {0x2, 0x0, 0x7}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x3e8, 0x3, 0x0, 0x1, [{0x3e4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_EXPRESSIONS={0xd8, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @synproxy={{0xd}, @void}}, {0xc, 0x1, 0x0, 0x1, @rt={{0x7}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x10, 0x1, 0x0, 0x1, @limit={{0xa}, @void}}, {0x44, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_HASH_MODULUS={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_HASH_LEN={0x8, 0x3, 0x1, 0x0, 0x96}, @NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_HASH_OFFSET={0x8, 0x6, 0x1, 0x0, 0x5}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x10}]}}}, {0x24, 0x1, 0x0, 0x1, @numgen={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_NG_TYPE={0x8}, @NFTA_NG_DREG={0x8, 0x1, 0x1, 0x0, 0xc}]}}}, {0x2c, 0x1, 0x0, 0x1, @hash={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_HASH_TYPE={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_HASH_SREG={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HASH_SEED={0x8, 0x5, 0x1, 0x0, 0xaec3}]}}}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_EXPRESSIONS={0x2a8, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @inner={{0xa}, @void}}, {0x44, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x13}, @NFTA_EXTHDR_SREG={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x83}, @NFTA_EXTHDR_SREG={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x44}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0xe4}]}}}, {0x4c, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_TUNNEL_KEY={0x8}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0xd}, @NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_MODE={0x8, 0x3, 0x1, 0x0, 0x1}]}}}, {0x1dc, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x1d0, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_CMP_DATA={0x84, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8}]}, @NFTA_DATA_VERDICT={0x58, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0x7, 0x1, "59cbef"}]}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_CMP_DATA={0xd8, 0x3, 0x0, 0x1, [@NFTA_DATA_VALUE={0xd3, 0x1, "115066bdfd4de005a7d184301ad4256f772ff87c3ee0ae1833f01c7c5863706085ef549319af424b67519f2350a485e8b44ee895444d2aededb3c6217557591f53ada3324837ba55a546169cf6c05f22a0e8b1cd570aa81d936a58666ab8fe7d01e274d9f8949e91d3fede5ab4d2cc9c58333c284d15f3d0a5b75dd699946694762cc3bdbd91ad4d0e567d6bf00e359dfcb7877a3d83f0a097c6d427274307d2fc113429c29ee317ea54aa19126c712c64ea9449dceedbe0ad4e212b604cfbeb8a2ea6469efe8598f1fd60266a9e2a"}]}, @NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_CMP_DATA={0x50, 0x3, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}]}}}, {0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0xf}]}}}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}]}, 0x40c}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) r3 = mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x0, 0x12, r2, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x104, &(0x7f0000003700)=0x4a3, 0x0, 0x4) (async) mount$fuse(0x0, &(0x7f0000003740)='./file0\x00', &(0x7f0000003780), 0x8850, &(0x7f00000037c0)={{'fd', 0x3d, r2}, 0x2c, {'rootmode', 0x3d, 0x1000}, 0x2c, {'user_id', 0x3d, 0xee01}, 0x2c, {'group_id', 0x3d, 0xffffffffffffffff}, 0x2c, {[{@allow_other}, {@blksize={'blksize', 0x3d, 0x2400}}, {@blksize}], [{@fowner_gt={'fowner>', 0xffffffffffffffff}}]}}) (async) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc00c64b5, &(0x7f0000003900)={&(0x7f00000038c0)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_GETENCODER(r2, 0xc01464a6, &(0x7f0000003940)={0x0, 0x0, 0x0}) (async) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000039c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000003980)=[0x0]}) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f0000003a40)={r4, r5, r6, 0x0, 0x0, 0x2, &(0x7f0000003a00)=[0x0, 0x0]}) setsockopt$inet_sctp_SCTP_HMAC_IDENT(r2, 0x84, 0x16, &(0x7f0000003a80)={0x4, [0x7, 0xfff9, 0x5, 0xa]}, 0xc) (async) setsockopt$TIPC_IMPORTANCE(r1, 0x10f, 0x7f, &(0x7f0000003ac0)=0x2, 0x4) (async) ioctl$BLKTRACESETUP(r2, 0xc0401273, &(0x7f0000003b00)={'\x00', 0x8, 0xfffffffd, 0x9, 0x2, 0x6ac, 0x0}) getpgrp(r8) (async) ptrace$ARCH_GET_FS(0x1e, 0x0, &(0x7f0000003b40), 0x1003) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000003b80)={0xffff, 0xd, 0xe, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r2, 0xc00464b4, &(0x7f0000003bc0)={r9}) r10 = getpid() ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, r10, 0x5, 0x4002) (async) r11 = syz_open_dev$dri(&(0x7f0000003c00), 0x646d, 0x1110c0) (async) ioctl$DRM_IOCTL_RES_CTX(r2, 0xc0086426, &(0x7f0000003c80)={0x2, &(0x7f0000003c40)=[{}, {0x0}]}) ioctl$DRM_IOCTL_SET_SAREA_CTX(r11, 0x4008641c, &(0x7f0000004cc0)={r12, &(0x7f0000003cc0)=""/4096}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc00c64b5, &(0x7f0000004d40)={&(0x7f0000004d00)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x9}) ioctl$DRM_IOCTL_MODE_SETPLANE(r11, 0xc03064b7, &(0x7f0000004d80)={r14, 0x0, r7, 0x9, 0x80b, 0xaea2, 0x7, 0x5, 0xffffffff, 0x7, 0x6, 0xc3b2}) (async) fsetxattr$trusted_overlay_nlink(r11, &(0x7f0000004dc0), &(0x7f0000004e00)={'U+', 0x1}, 0x16, 0x1) ioctl$SNDRV_CTL_IOCTL_RAWMIDI_INFO(0xffffffffffffffff, 0xc10c5541, &(0x7f0000004e40)={0x2, 0x8, 0x1}) ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r11, 0xc00464be, &(0x7f0000004f80)={r13}) (async) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) (async) syz_genetlink_get_family_id$devlink(&(0x7f0000004fc0), 0xffffffffffffffff) 6.516628129s ago: executing program 3 (id=2338): syz_usb_connect(0x0, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0x0, 0x0) fcntl$setlease(r1, 0x400, 0x0) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/4\x00') preadv(r2, &(0x7f0000000640)=[{&(0x7f00000008c0)=""/201, 0xc9}], 0x1, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000180)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x4000)=nil, 0x0, 0x12) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x8, 0x10000, 0x2477, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0x6}, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) r5 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r0, &(0x7f0000000540)={'#! ', './file1', [{0x20, '$[*\\&\''}, {0x20, '#! '}, {0x20, '#! '}], 0xa, "1f410e2852ad52cb07410969e814977e4f2c4a80522094786c8673fb61cf8b86bd030000005a3c7c04055f1f70e4064d46b2bb9e5100d446bb6afb2c0fc07b58f4a9c1006a0b6c05639e23ec12979ff9b48ca61e6dec58682449c75d86eb4337b8d343ed9c18927289d3d788fa281a5742690ff5a505cfff34fc1503afbfd2d44b50e4ca119f67b2890064d83a34eae5f4e64ae0c7c124730f21dcbc2d36ade1464efc381735512e000bc2b08cd6d659d3cfb1f79688235dd8"}, 0xd3) write$FUSE_NOTIFY_STORE(r5, &(0x7f00000003c0)=ANY=[@ANYBLOB="332460dbbae2991af904b62a085f9039f0af340dd89804cf6c0a11c5606ab2f3efc6c55bf8de5398f2bcbee9202e05ba25216b82375c7d193da25cf267e672994ab7505cd1cb012443d3bd6d0ce6a005f61cf714926630119521792e14cbb94f294a2b", @ANYRES16=r3], 0x28) close(r5) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0100000005000000fd0900008400000005010000", @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000984ad5b9e9201aca2b649b2eeef7ec76c227a0f9ce018e04cb19cc39848cd86e53112b37907f3ecf8579f3fffd59d9c0a4e6575bec2f1677ad57248eaee69bcb9ae5cf42bef777046c386b4d9948f50d2ac8fbd50db32d61ed85aff1a4f7e4f43b7f7851dc9df434b76b", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0xffffffffffffffff, 0x0, &(0x7f00000000c0), &(0x7f0000000240), 0x800, r6}, 0x38) 6.338609889s ago: executing program 6 (id=2339): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000003980)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a010400000000000000000200000038000480340001800c0001007061796c6f6164002400028008000440000000010800014000000001080003400100000008000240000000000900010073797a30000000000900020073797a32"], 0x8c}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000ac0)=@newtfilter={0xc4, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0x3}, {}, {0xfff3, 0xffe0}}, [@filter_kind_options=@f_matchall={{0xd}, {0x90, 0x2, [@TCA_MATCHALL_ACT={0x8c, 0x2, [@m_ife={0x88, 0x1, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x10000000, 0x3, 0x4}}}, @TCA_IFE_TYPE={0x6}, @TCA_IFE_METALST={0x38, 0x6, [@IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_TCINDEX={0x6, 0x5, @val=0x81}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_TCINDEX={0x4, 0x5, @void}, @IFE_META_PRIO={0x8, 0x3, @val=0x200}, @IFE_META_TCINDEX={0x6, 0x5, @val=0x8}, @IFE_META_PRIO={0x8, 0x3, @val=0xfaed}, @IFE_META_SKBMARK={0x8, 0x1, @val=0x7}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0xc4}, 0x1, 0x0, 0x0, 0x20000811}, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000200)={'sit0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=@newtfilter={0x84, 0x2c, 0xd27, 0x70bd2d, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x0, 0x3}, {}, {0xfff3, 0x1f}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0xd, 0xd0ea, 0x20000001, 0x3, 0x4}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x50}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x674081, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCADDRT(r11, 0x890b, &(0x7f0000000140)={0x0, @qipcrtr={0x2a, 0x4, 0x3fff}, @llc={0x1a, 0x300, 0x0, 0x9, 0x45, 0xee, @local}, @tipc=@name={0x1e, 0x2, 0x1, {{0x2}}}, 0x1000, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000100)='wlan1\x00', 0x9, 0x0, 0xd}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) unshare(0x8040480) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) 6.025194395s ago: executing program 7 (id=2340): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x38) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000080)=0x9fe, 0x4) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x4c}}, 0x2) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000002c0)={0x1, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CAP_MAX_VCPU_ID(r4, 0x4068aea3, &(0x7f0000000000)={0x80, 0x0, 0x5}) 5.545655143s ago: executing program 5 (id=2341): r0 = landlock_create_ruleset(&(0x7f00000001c0)={0xa019, 0x1, 0x3}, 0x18, 0x0) landlock_restrict_self(r0, 0x1) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x408, 0x3, 0x1}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) landlock_create_ruleset(&(0x7f0000000000)={0x19a1, 0x2, 0x3}, 0x18, 0x0) socket$kcm(0x10, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket(0xb, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xfdffffff}, 0x0) r4 = add_key$user(&(0x7f0000000040), 0x0, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) mlock(&(0x7f0000289000/0x4000)=nil, 0x4000) timer_create(0x0, 0x0, &(0x7f0000bbdffc)) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCL_SCROLLCONSOLE(r5, 0x541c, 0x0) pipe2$watch_queue(0x0, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x100000000000f7) memfd_secret(0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_mount_image$fuse(0x0, &(0x7f0000002080)='./file0\x00', 0x2210052, 0x0, 0x3e, 0x0, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 5.537428659s ago: executing program 4 (id=2342): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x420302, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x112}) (async) ioctl$TUNSETQUEUE(r0, 0x400454d9, &(0x7f0000000000)={'veth1_to_bond\x00', 0x400}) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000200)={'veth0_vlan\x00', 0x200}) (async) ioctl$TUNSETQUEUE(r1, 0x400454d9, &(0x7f0000000740)={'pim6reg1\x00', 0x400}) (async) r2 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'wg0\x00'}) (async, rerun: 64) socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) ioctl$UI_SET_KEYBIT(0xffffffffffffffff, 0x40045565, 0xe0) (async) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async, rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x300000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) (rerun: 32) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={0x0, 0x33fe0}}, 0x40010) (async) pipe(&(0x7f0000000100)) (async) r6 = socket$rds(0x15, 0x5, 0x0) bind$rds(r6, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000880)=""/4092, 0xffc}], 0x1, 0x0, 0x0, 0x20000800}, 0x0) (async) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x22004001, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="c4", 0x1, 0x404c814, 0x0, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) 5.305192844s ago: executing program 4 (id=2343): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_usb_connect(0x5, 0x2d, &(0x7f0000000400)={{0x12, 0x1, 0x0, 0xce, 0xf8, 0xbd, 0x8, 0xe41, 0x4142, 0xbc76, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x6a, 0x2f, 0xf6, 0x0, [], [{{0x9, 0x5, 0x1, 0x8, 0x200, 0xb, 0x8, 0x64}}]}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) sendmsg(r1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(0xffffffffffffffff, 0xc01064c2, &(0x7f00000001c0)) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) timer_create(0x0, 0x0, &(0x7f0000000180)=0x0) timer_settime(r5, 0x0, &(0x7f0000000340)={{}, {0x77359400}}, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0x2000) open_by_handle_at(r4, &(0x7f0000000240)=ANY=[], 0x10000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x9) ioctl$TIOCSERGETLSR(0xffffffffffffffff, 0x5459, &(0x7f0000000000)) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x6a, 0x4) bind$inet(r8, &(0x7f0000001c00)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$SO_TIMESTAMPING(r8, 0x1, 0x41, &(0x7f0000000180)=0xb27, 0x4) connect$inet(r8, &(0x7f0000001bc0)={0x2, 0x4e23, @loopback}, 0x10) sendto(r8, &(0x7f0000000740)="50fbdf12a30d7a48b2c5c84948f3426077a9f0ca1475183db3bf52a6b2cdb77ef9af2a603a3e78adff59fbb22bae1b2443011fd801251bcef8f165533aac58c7556dd51edc5a6865d4e29f0bbd0ed602050000000000002944de604d849a1e", 0x5f, 0x4008044, 0x0, 0x0) write$binfmt_misc(r8, &(0x7f0000000000)='}', 0x1) sendto$inet(r8, &(0x7f00000002c0)="01a4acc7cf28ab9f6c7fc745c30bfc165466072a660bbf56352083db9d40454a67f8010000004bd29585885c89773ca3ba28a1e85ffe2a9220e0ecd440e345b745bf2146835ad015c801f95be5b890e44fb3dfbe8e88a1e5176e584c970207f23b0073ca5375abddf56331be396eaa2398ea66b93a74fd4147e826abed1b5d1de578682288c19ac23c1ccc1cdd936d2571c3510b0000000000000000000000000000000000f32bb3874c926a8944caa4677d2eae3bc831e748000000", 0xfffffffffffffe88, 0x0, 0x0, 0x0) 5.293335655s ago: executing program 6 (id=2344): ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x100, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_VLAN(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000500)={&(0x7f00000004c0)={0x24, 0x0, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [@BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_MULTICAST_FORCEFLOOD_ENABLED={0x5, 0x37, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0xc000}, 0x40808) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socket$pppoe(0x18, 0x1, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000000780)={0xc, {"a2e3ad214fc752f91b25470987f70e06d038e7ff7fc6e5539b3264078b089b3b08346c060890e0878f0e1ac6e70a9b3368959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31350d095d0636cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62239c6f30e065cd5b91cd0a03000000000018001b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd7878a37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4040d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b412435139000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a4cd13c257ac06c7d8ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190ba4d7909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a4d429a04a6a2b83c7068ae949ed06e288e810ba2e201007e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e8134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b000000807ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd776d443e8b40426db6fe2907ac0ca3d24145a2e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a0400000000000000f463661c953fcad6f37725c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2ca8378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa04006651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed004000000b53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f090056b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b5c7fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d050000002a308e15fc37d06aeac289c0523f652f2ef91d4f2b01987b0f463934c54edc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a3b89f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ed60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d3560aba573bd16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22005b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db239dfe785b54c34a0a5db4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbf4c807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9edbaaadaea56765404e0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901003a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d00000000000000000000000000004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d50b00", 0x1000}}, 0x1006) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x218, 0x0) clock_getres(0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r2, 0x16, &(0x7f0000000680)={&(0x7f0000002000)={[{&(0x7f0000000100)="45f3e3d61999b7b189c842b5d686d73fb7155b59909a0703c590083bed6f49b670a4a1", 0x23, 0x1}, {&(0x7f0000000180)}, {&(0x7f00000002c0)="b3fc1d23806ba0075461438f73c9ee685f98f0638a8d265d8b009dbecd827761ffc9e0f0a3106a4a4cfb40bc5f2023369371e6bf16469c6974a6f6afdd74f8d19f321521b7b55c98f2adc7edbf37deed5a42e7b40f5f674b3954701093338dcdb32f15cd498344a92096fd5afc10943b8a92dc9415a6dfc1f74b24e5b2fdf3a7f746101017ea33ef002683f85d714ee35926767262d23ab574d7bc1edfea0aadc1e6297cf727b3b290520cc55a25bb0de2cdb2f5a0f7f7dd544a1543990f4b08f7eba5d5a5348d4c2a44dec90da85070092beadeaeaa010b979d0d", 0xdb, 0x3}, {&(0x7f00000003c0)="33d3cdeefa2a95c669f6c55c2790d7d05242583611f10e58d260feabd2cac56527802630466e4492a54fca81519b1cb089d911bedfbdd89ffa106de129b2fea8391e42325fc0d21947d500645953b5d0d2c9e68aa1362131add2e4758db5a802897fe20720ba073749b32bc2c6b33d5f61e9c0a33d173d3786fb63f75bf964a3a2825a5c886e6e2a3bc72288e64a932465c24eb7df8f7f3521d32436c8ad545ec4aac274e3e39272aefed6a385e6322ba9455322766a5fec3a013f0c5bcc0576108f0f45b8dbb04a64845611847012599561027658ba061f2d33e7a7cf47c3c8a33ca794f0c915a5fc29d685c61600311d", 0xf1}, {&(0x7f00000001c0)="25962a9948bdcb851f0484de663d07ed7f307e81265b9b29a39fb20089e3587a24cbecc905d05db212b216a9eaac061c053c3777ae40562dd358d2e10f55c5bf950faa3a7fd33404d3a1afb893c71e6af2f5b47ec0f581ea741b2baae1dd032ae95cf0bd42129dfb46d7a3301002f2969d9fa817721ec7eeef357912fcb049e5471fde66b54b0333b0e12ca0e593535ae6868a012d82f81a55f0e68b3b9003788a5bfe6fb2bd8f743fafa36cb5450af6dff3f0c73951b824c1578b44", 0xbc}, {&(0x7f00000017c0)="f31b0f35a13dd9944426c16a2b6cc14ae480554c0e3e1718b46bdfcdf35602b6f700d154ca9a5ab7c6c33be4eda28a9b87cb79a2c7084df46fe696de0134201d538a337b28adbf382d64791ef7d0e00d1f79e964090e31a04c6784e4a7e4301179686183c95ac0e256954e1a1cc2ca1e50e5a14b22fe1ea1d651dcc23aca84a2f21f203a7ba942ea3b40a46d3f11b5d11de18028ac7e4c5e39d8781b", 0x9c}, {&(0x7f00000006c0)="3e059301baae321578238e0a9faa032ebbd5bc5c02c7293ea264353381dbc9dd7e02e47655ca5c772d38c5e5ec0100c4aa15e3b3966395f86351a051f7a8b778732bc10c50db3c0dc6bd06598ec0a8435fc13df32e5a2dc7553d5fc595715c75512ad2c09fe27d6faa4072732bf8a13f6f0ff7a0029bfc78844030334d6d27", 0x7f}, {&(0x7f0000000600)="eec3764a053aa09bb673f25919506ed78f508aec6e7eee8f718f43b24d4c106bae0c1575072397f4cdc80aaa79743fc9f4926863aeff4488317f950860f052d8549aaf6e9388b1d0d7963e3d453388d12267a2f68ea78a25dc12e3c0ff71b240afb6f11e27f5269d68dcf357", 0x6c, 0x4}]}, 0x8, 0x5}, 0x1) timer_create(0x3, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@ipv6_delrule={0x24, 0x18, 0x1, 0x0, 0x25dfdbfc, {0xa, 0x80, 0x0, 0x0, 0xff, 0x0, 0x0, 0x7}, [@FIB_RULE_POLICY=@FRA_SUPPRESS_IFGROUP={0x8, 0xd, 0x8}]}, 0x24}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket(0x200000000000011, 0x2, 0x0) r6 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$peekuser(0x3, r6, 0xd8) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000740)=ANY=[@ANYBLOB="7000000010000304000080000000000000007400", @ANYRES32=r7, @ANYBLOB="0000000003120100500012800b0001006272696467650000400002800800050001000000"], 0x70}, 0x1, 0x0, 0x0, 0x800}, 0x40) 3.859140683s ago: executing program 6 (id=2345): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xde, 0x4, 0x7, 0x1a142, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x4, 0x5}, 0x50) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r3, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r1], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001300010026bd7000fedbdf2500000000", @ANYRES32=r3, @ANYBLOB="d66100000800000005001100060000000c0019800543020000000000080004"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r4 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@enum64={0xd, 0x1, 0x0, 0x13, 0x1, 0x1, [{0xe, 0x67, 0xfff}]}]}, {0x0, [0x61, 0x61, 0x30]}}, &(0x7f00000000c0)=""/220, 0x35, 0xdc, 0x1, 0x3}, 0x28) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0xf, '\x00', r3, r4, 0x1, 0x2, 0x2}, 0x50) r5 = socket(0x11, 0x2, 0x10001) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'team0\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x3b, 0x2, [{0x3f1, 0x6}, {0x10007, 0x30000080}]}}) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@bloom_filter={0x1e, 0xde, 0x4, 0x7, 0x1a142, 0x1, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x3, 0x4, 0x4, 0x5}, 0x50) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket(0x10, 0x803, 0x0) (async) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) (async) getsockname$packet(r2, &(0x7f0000000280)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) (async) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r3, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r1], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c0000001300010026bd7000fedbdf2500000000", @ANYRES32=r3, @ANYBLOB="d66100000800000005001100060000000c0019800543020000000000080004"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000001c0)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x5, [@enum64={0xd, 0x1, 0x0, 0x13, 0x1, 0x1, [{0xe, 0x67, 0xfff}]}]}, {0x0, [0x61, 0x61, 0x30]}}, &(0x7f00000000c0)=""/220, 0x35, 0xdc, 0x1, 0x3}, 0x28) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000200)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0xf, '\x00', r3, r4, 0x1, 0x2, 0x2}, 0x50) (async) socket(0x11, 0x2, 0x10001) (async) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f0000000040)={'team0\x00', &(0x7f0000000080)=@ethtool_sfeatures={0x3b, 0x2, [{0x3f1, 0x6}, {0x10007, 0x30000080}]}}) (async) syz_usb_connect$hid(0x2, 0x36, &(0x7f00000000c0)=ANY=[], 0x0) (async) 3.623957947s ago: executing program 5 (id=2346): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x3fe, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0d05605, &(0x7f0000000580)={0x1, @vbi={0x4, 0x80000000, 0x4, 0x34325258, [0x88000], [0xaf09, 0x7], 0x1}}) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_RMFB(0xffffffffffffffff, 0xc00464af, &(0x7f0000000480)) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f00000003c0), 0xffffffffffffffff) mknod(&(0x7f00000000c0)='./file0\x00', 0x0, 0x0) lsetxattr(&(0x7f0000000240)='./file0\x00', &(0x7f0000000200)=@known='user.incfs.id\x00', 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x0, 0x0, 0x1) listxattr(&(0x7f00000001c0)='./file0\x00', 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b80)={0x28, r5, 0x1, 0x70bd28, 0x0, {}, [@WGDEVICE_A_IFNAME={0x14, 0x2, 'wg0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4004840}, 0x40000) ioctl$TCSETAW(r3, 0x5407, &(0x7f0000000040)={0x6, 0x7, 0x9, 0x0, 0x1, "100056f200"}) ioctl$TIOCMSET(r3, 0x5418, &(0x7f0000000000)=0x8001) openat$ttyS3(0xffffff9c, &(0x7f0000000140), 0x20040, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1, {0xdaf}}, './file0\x00'}) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x30b001, 0x0) socket$kcm(0xa, 0x3, 0x87) sendmsg$NFNL_MSG_ACCT_NEW(r6, &(0x7f00000002c0)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000000400000000000000000000000f00000608000540000000010c0003408000000000000001"], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) syz_emit_ethernet(0x1de, &(0x7f0000001180)=ANY=[@ANYBLOB="aaaaaaaaaaaae130aeaaba3086dd606410a601a8000000000000000000000000ffffffffffffff020000000000000000000000000001223431d5c9a46b9fa14172170a013589317d2af31ba55431762f462a5abc3f46494ee91bfca594d52f8c3785143e92da5d2d81edc09f68f122fbf741257bf1319408347a17c89212dfe27a0fc65362487e5afe673f0954f60d9d08b61276ce0b3aa520b5f30a9f52c4aa53fc003f8570383ca63530d93b78a7875338b3d7645ef2c24ab05db63cfdcde7b3cac2248c9d1c73d0d4382b3f520ad6e9be698eaa9bf5b939ce09919c9485c4725690ee2483315829a196f85a5ae552ebe19a2d6768ce2a6bf60fbb53104c7919b7cf28fa555fc9460df11e72eddebb2fc4eb6f83b16e0d65307e4210dfc209f0c68df65b57f414dc215546b798af6b6ab7bfb2fe6bd6142f877852717370b1ca39d199c149c3ead97c4e16229ce4c08a111a0fc64651c21e9174dd72442a9ae2a42d9433c7b54c8dd4b59203f9a2e227e9b043eb430e606cf98f3428ac8511948dd553bc07"], 0x0) 3.564786673s ago: executing program 7 (id=2347): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_route(0x10, 0x3, 0x0) (async) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) (async) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) (async) ioctl$KVM_CLEAR_DIRTY_LOG(0xffffffffffffffff, 0xc018aec0, &(0x7f0000000140)={0x1fd, 0x2c0, 0x380, &(0x7f0000000180)=[0x6bd1a312, 0xec66, 0x8000000000000000, 0x8, 0x98bd, 0x800000000000009, 0xfffffffffffffffd, 0x100000000000004, 0x10000, 0x100, 0x9004, 0x0, 0x3, 0x5, 0x5, 0x517, 0x3ff, 0x5, 0x1ff, 0x9, 0x8, 0x7, 0x0, 0x1000000003, 0x2, 0x6, 0x6, 0x7, 0x96, 0xffffffff, 0xffffffff00000000, 0x0, 0x4, 0x7, 0x23b, 0x3, 0x800, 0xd49, 0x4, 0x8, 0x6, 0x6, 0x3, 0xa3de, 0x20000000006, 0x8, 0x40005c3e, 0x400, 0x3, 0xfffffffffffffff7, 0xfffffffffffffffa, 0x2, 0xe, 0x8, 0x4, 0xe6, 0x200000000000101, 0x5, 0x9, 0x66, 0x6, 0x7, 0x40000005, 0xc39d, 0xc, 0xd, 0x9, 0xe8, 0x80000000, 0xfffffffffffffbff, 0x84, 0x4, 0x2, 0xcdc, 0x7, 0x2, 0x3, 0x2, 0x5, 0xfff, 0x8, 0x0, 0x6, 0xab6, 0x0, 0x2, 0xfff, 0xffffffffffffff81, 0x9, 0xff, 0x80000000000006, 0x28000000, 0x5, 0x400000000008061d, 0x3, 0x8, 0xf6, 0x4, 0x6, 0x200, 0x7, 0xe53e, 0x2c, 0xa, 0x4, 0x6, 0x5, 0x0, 0xd, 0x2, 0x6, 0x2, 0x2, 0x7, 0xdfd4, 0xfffd, 0x10, 0x4, 0x8, 0x1, 0x53e0f0fe, 0xeb4, 0x3, 0xfffffffffffffffe, 0xecd, 0xcc, 0x8, 0x3]}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) (async) r5 = socket(0x10, 0x803, 0x0) bind$netlink(r5, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc) (async) sendmsg$nl_route(r4, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40040}, 0x0) (async) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f00000000c0)={0x9}, 0x10) (async) sendmsg$nl_route_sched(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@gettaction={0x14, 0x5a, 0xc6b747b6bf1c6b95}, 0x14}, 0x1, 0x0, 0x0, 0x40}, 0x20000000) (async, rerun: 32) r7 = socket$nl_route(0x10, 0x3, 0x0) (rerun: 32) sendmsg$nl_route(r7, 0x0, 0x0) (async) r8 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) (async) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r9, 0x4138ae84, &(0x7f0000000c40)=@arm64={0x9, 0x40, 0x3, '\x00', 0x7}) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r2, 0x84, 0x1, &(0x7f0000000580)={0x0, 0x1, 0xfff, 0x0, 0x8, 0x339}, 0x14) 3.454699938s ago: executing program 3 (id=2348): socket$packet(0x11, 0x3, 0x300) socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffdffffffffff, 0xfa11, 0xffffffff}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(0xffffffffffffffff, 0x40505330, &(0x7f0000000400)={0x800100, 0xffffffff, 0x22, 0xe1d9, 0x1101, 0xff}) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) r2 = syz_open_dev$sg(0x0, 0x5de, 0x103b00) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000180)={0x0, 0xf5, &(0x7f00000000c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8800000000000000000000000000010c00028005000100000000000800074000000000180006801400040020010000000000000000000000000001"], 0xac}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x3a00, &(0x7f00000000c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="ac0000000001010400000000000000000a0000003c0001802c000180140003000000000000000000000000000000000014000400ff0100000000000000000000000000010c00028005000100000000003c0002802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000aa0c00028005000100000000000800074000000000180006801400040020010000000000000000000000000001"], 0xac}, 0x1, 0x0, 0x0, 0x4000}, 0x4000894) r4 = syz_open_dev$vim2m(0x0, 0x8, 0x2) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000280)=0x2) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) syz_open_dev$usbmon(&(0x7f0000000900), 0x7, 0x0) fcntl$dupfd(r5, 0x406, r5) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000940)=@urb_type_iso={0x0, {0xf}, 0x4acc, 0xe6, &(0x7f0000000000)="4c4ebaa2a3a1487affc04e6dca425a4e69363cd4da45434a537ad2d8a2405e3c8932", 0x22, 0x5, 0x0, 0x62, 0x651, 0x0, &(0x7f00000001c0)="60cc45624f3f922d3a74a588d9b721cbf73bebfc01441f59a79b3cfc4db3087f27d2714e53a2cec0974a55aeb1fb645b2b87c5e915767fe575d7f6f61d4f1090ac3de891ae57b881af1338256d68308bedf7ec2aaaee77a03cd255558d90477912c0a4e386f6ac261f3436a77936b18bf8", [{0x5, 0x6, 0x5}, {0x2, 0xc, 0x3}, {0x4, 0x6, 0x7}, {0xfffffffe, 0x7, 0xffff8000}, {0x5, 0x3, 0x2}, {0x3, 0x6, 0x1000}, {0xfffffff9, 0x6, 0xb2}, {0x6, 0x5, 0x8}, {0x8, 0x218e18db, 0x7fffffff}, {0x7ff, 0x200, 0xffffffff}, {0xc, 0x5, 0x9}, {0x8000, 0x7, 0x7}, {0x9, 0xb0, 0x7fffffff}, {0xfffffff8, 0x3ff, 0x81}, {0x2, 0x7fffffff, 0xfffffffc}, {0x3, 0x19, 0xd}, {0x8, 0xc, 0x9bc5}, {0x7, 0x1, 0x1}, {0x1, 0x76, 0x6}, {0x5083, 0x3, 0x633}, {0x7f3, 0x8, 0x2}, {0x47e46bd, 0x2, 0xcb17}, {0x3, 0x1, 0x9}, {0x0, 0x14a9, 0x522e}, {0x1, 0x37e4}, {0x0, 0x400, 0x9}, {0xf, 0x905}, {0x2d07c48f, 0x80, 0x6}, {0x4, 0x10000, 0x12}, {0x2c, 0x1, 0x7}, {0x7, 0x4, 0x846}, {0x4, 0x7, 0x7fffffff}, {0xc, 0xfffffffb, 0x5}, {0x3, 0x3, 0x3ff}, {0xa, 0x30, 0xd27}, {0x100, 0x83, 0x3}, {0x0, 0x10001, 0x3}, {0x1, 0x0, 0x6}, {0x88, 0x80, 0x8aa2}, {0x9f61, 0x9, 0x9}, {0xe9, 0xfffffffe, 0x7fffffff}, {0x9, 0x7ff, 0xdef}, {0x7, 0x374, 0xc63}, {0x1102, 0x2, 0x999}, {0xb, 0x3, 0x3}, {0x5, 0xffffffff, 0x8}, {0x2, 0x86, 0x8000}, {0xe, 0x6, 0x4}, {0x6, 0x0, 0x5}, {0x5, 0x85e7, 0x4}, {0xf276, 0x100, 0x5}, {0x3, 0x1c000000, 0xe8}, {0x8000, 0x3, 0x4}, {0x7f, 0x6, 0x7}, {0x4, 0x9, 0x8c9a}, {0x12f, 0x6, 0x5}, {0x5, 0x7, 0x8}, {0x0, 0x10000, 0x6}, {0x7, 0x4, 0xfffff97a}, {0x3, 0x5, 0x50}, {0x4, 0x0, 0xffffffef}, {0x5, 0xffffffff, 0x5}, {0x8, 0x4}, {0x60000000, 0x3f, 0x8000}, {0x7fff, 0x7, 0xffffff01}, {0x55e89b96, 0xfffffffa, 0x8}, {0x1c0000, 0xffff, 0x6}, {0xfffffff4, 0x5, 0x2}, {0x2, 0x200004, 0xfffc}, {0x1d, 0x4483, 0x1}, {0x10, 0x2, 0x1}, {0x5, 0x5, 0x3}, {0x0, 0x5, 0x9}, {0x2, 0x8, 0x8}, {0x9, 0x200, 0x2}, {0xa, 0x3, 0xb}, {0x6, 0x800, 0x1}, {0x8001, 0xe5a4, 0x5}, {0x64cd2f40, 0x200, 0x6}, {0xc6, 0x2, 0x1ff}, {0xcc24, 0x1f, 0xc24}, {0x10001, 0x401, 0xfffffff9}, {0x0, 0x1, 0x645}, {0x8be, 0x8, 0xa}, {0x80000000, 0x6, 0xa}, {0x2, 0x9, 0x2}, {0x69, 0x7, 0x1ff}, {0x3, 0x7, 0x9}, {0x8, 0x8, 0x8}, {0xffffffff, 0x800, 0x68}, {0x8, 0x6, 0x1}, {0x6953, 0xd05, 0xfffff001}, {0x2, 0x1ae9}, {0x6, 0x10, 0x200}, {0x2, 0x0, 0x9}, {0x9, 0x5, 0x5}, {0x8, 0x8d40}, {0x2, 0x6, 0x1ecc}]}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_PRIVFLAGS_SET(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000500)=ANY=[@ANYBLOB="2c000004", @ANYRES16=r7, @ANYBLOB="010001000000fddbdf250e000000180001801400020076657468315f746f5f68737200000000"], 0x2c}}, 0x8000) 2.745262744s ago: executing program 7 (id=2349): r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0x10) fsopen(&(0x7f0000000000)='udf\x00', 0x0) getsockopt$inet_sctp6_SCTP_MAX_BURST(r0, 0x84, 0x83, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f00000002c0)={0x9e, 0x6, 0x7fff, 0x2026652d, r1}, 0x10) r2 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$VT_SETMODE(r2, 0x5602, 0x0) 2.183990736s ago: executing program 7 (id=2350): r0 = open(&(0x7f00000001c0)='./file0\x00', 0x80ff, 0x88) syz_clone3(&(0x7f00000003c0)={0x1000a00, &(0x7f0000000200), &(0x7f0000000240), &(0x7f0000000280), {0x24}, &(0x7f00000002c0)=""/86, 0x56, &(0x7f0000000340)=""/42, &(0x7f0000000380)=[0x0, 0xffffffffffffffff, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x0], 0xa, {r0}}, 0x58) statx(r0, &(0x7f0000000700)='./file0\x00', 0x800, 0x10, &(0x7f0000000740)) fstat(r0, &(0x7f0000000840)) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000080)={0x50, 0x0, r2, {0x7, 0x29, 0x9, 0xffffffff90acedc6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9}}, 0x50) syz_fuse_handle_req(r1, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r1, &(0x7f00000063c0)="99529ca7d265e2dba44891e35e7d5dab7921b730436ecd4e999a25bcf86a25f8f029c0dd50373e90b7cf7779b12ecd4423c5b13cfac186975cd723976f3c747612913029d42517c189364bc59d8ebad53ed1b86f8f66c99b1f9b5b40d78cef1f14f81815d53bdca7fef40607358db69eb8c0b1f6b0942ab4b1ee7ca8deb4eddef06381a3d1c52d6147fc5109c7c607591497a6b2477f60cc881d3219c96bffb34aadec3fa97250713cce17cd536721bf9c40a019531ed0bbad139e26a3d4d39b68ab1bf37cb1a4bd197a8789cb1940cd86d9e56713bc36c7cffd07a311f5bc2e91f16d152eb480645e85ec9b3bf09c7fa140dced0afd55d7b99e90a96e7748e2d0dc09672ac199ce529e631efe1783769819c182ca106f6184bcbb387ed246c43562d74c36ac3a7ec2f0e11f70bad0007c03bb9c0d2dacc2148cce4a4aea327c7319016ad146b52bfae0357f9e892e9bec61a13c93551cfa3d4f4bfa7585c93bb0bef01a9114f3dc54179cf9a57fe88f5cff3403e33c9d09e3e9c2e10f1f16894e1b59e3cad47c1f202cf7b756f2851fc96d09459c9a8d34c19e6a3525cd5001aac5181f57286d0e1e88ce5092c7c76b6abdaebf2c499aa47587b48eb12a2b72548c190b0324ebedb81a63333b6edb25550f859c5ccc404a944ff7f61af8800888192fbd4c8e0e417d1d181b4b335a6f52e0a7dae18397e81e3f747cab7be902ed903bdd6a622f178f9b4244718ee1206237257374d2fd1466ab6135ef7ef4a114ae170eafe9cd78cf9ffc36974cbc4b8003072bed78765a0b9f1240f24dec6a9e46db9bb498d40f727c0cbf8f4a6a49539bd0805caf65d80130d7fb60a69dc7ed890874a17530c042cf33a977d331435d68ef33885f638c777ad49564ca77d8b81ddd853a21cd55d95b627310dd633a4f005853a5506cd8f744c367f3cb6998b0fa97de6bb35b166b0c6408c4e0a38ed26235a88520c38ca97ac8a6dc81e6dc6483d383fa09f198997b8eea1c68c9e3320683c9a02dd89ddc34c241e7294ccc88d6b35762892e8746e558bfbc2251949f2ecb763dad5b975eaf36e2864be6a41d3e20514d32f5d4b6350dc7e3cc3a85428ea98efb3b1edc2a2ec1e618452949cc7e2ba1251990168fee342d4f304b7a7af9162bcbe6b09c75d7420d2c547b4e3cee1836df6eddd5dff73a4e308fcd8eaa7a33e6980a6f8ead03257a37d72d3b265d02fa42f57db877654ed513e31c35e1af0bd28511d6b57cfe07b27cbe9767a534b426dfc3dd257d5899444f34cbf4dc74b9eab2e7e3e1e1a8a6ac5e4359d653506b299a5b7c67b92dc462f1216655f952362a3387ad9966b606d98e8d1b544dc27dc6bc78fd18a446736e25c51143db9886b6c09812d5825b5d9e0932f218ff8bea4d9e1c4df9c9d4eb19336d48163a921c4ff1f0beef26b01b7e8c0d23fb59b84e229eaabb791f2cffc9aa4db75162cbfe4c9ae8d76a5b6bc4bff20e3f8f125b9aadb3e728d7f78d61fd55f46b7f59511b876e6563256686e44f25cf38d393a9b762bada272eba8df28e4086c4cd2fe3c9fab97756fb145373e6ca1991bb1ee6589e49c821ff29f047970819f88f724bd077cd3f0ae463d99b3e53078431e3f9bebabc5289a65479359efe3909186aac60a29f561de8c590988c913c9e693ab8106e8287f6565eee6735f7c88cad7124d1c8d9ff347e97912824088ee954de01c6d8a06447f06899607eadbfd078bc3df506252005749378dbd7399c9eca60b81dc0d88dedec31e5cf6e7b6d6d411958df8f9e0bf4443e8d3bdfe49d05f811d17088024d0629fc8ab8e05e309bf55e8e60d342623765f4e8d2dc4a90291cd4354ff9568c8170e6ea56e028bcf2719595253adb8c84050bb9ce4927a1c1f4560da87d109ceda90bbe45a1717763d8025f1ff40f157185ddf17079da272ae10c4f34162caf4b0d31221a57b3059fd449c87554d968a54b2eebd760dc3263c40d9eedf5905d5699d29706ea6e9e81ff2bf92489a06deffe7e978661f37a88450783e23f107c2bfce000dfc91c5fca49e46d9ea978f215a45984699f0d2503b30a741e13be56b7abe3e5663c0825c3cb04ead44ce97719c4ee6f4cdd3c452775ad7163d5c9034583cc2dbc2b0c04917a3e1aa3d0a8bb6fcf94d7922eb1d543c09185827aeb1b72ae7103ef2c014af2ff4b47fca40fb0e66ddf0264476d7a84e9b8dc551d4c407bdbac6757f7a25bd404b45bec1091696203cc438860131ad5f2fd80e3c45629864dd9f7d302b66fb8fb86735c9a6dcf8b135a273dd2ae9473bc905081be9fcb8f91b1ddba1ac692798dac0b9ccffe0319a779f5e10c65f294b22fe475283b023f9cd890e92c5447b1bc1528255c5af383bc1fb6e72cb9a67215a9e25cde63c89baa8c7125c7e8b748b728d07d9cb66778404f54e6a9e3ae1ae82f3d0ce77199f23f94a01b71b805b476fedbebeb52c83a1b857f23ba438c56a6c4c2a5909f721e6e3d240e4a16455e92220d13022ce7ec0b1365ba4e67aa6ecb324f8826579e12cebdfc0d8af63e83b5e5624d5b791f99093f9a27f7baea9fd10111209c0857a04f07408111063ef34026aee27a3d51b40e53883f9094402534bdd21cc49d7f5593e99cb204cd805bee4add0f82cf4b6dc5da14d6b79fbc68c9ccf7fb5fe774f8879e13079b024a8ad24bf123c420d630837a84ba05abf0ae4dc3fc04f25c7f74ff91d0d609c958642a48551e51b5c0074a56a7da10ce153b08cabea636f8489d8e7b655758a41d7f7474c9d76bf4d54d789bfceaffef139854065de6a94b0275a9626aab99ae838364b1a491e55017e4212b6b01f7a41bc9c215ecd17c49a8610db28c699259c58b81a0e84c45fd8e719c05c48501c49e8a6515044d247f58e4cd0bf22fd6ae31f45339d1f801196d426c52269b1aaffaf18e2a03760bb231cb7cefa6d72f1d7eb6a3bbd65d0914221b8fbf531dbd562eb4a1b28983ac7d83d4813b10b34c9525ba644f61a2c4800d4fe96a7bca63da1041ed73cc57fb9d42f9dfc8ca41d80292bbb311c89b0a0fcee1d88a025a7416863342aea00e6f049cb2ddebd17c5c617ff562a8af0c965cbe8341431a30ea239e4a62aa2b19757a3b0de04229a9907f8610c27b26591405845bf8b5b83706ed18d910c4f68777378366ff565617b19168a04560a32ce5ad64aaef9f4377118c4335b24826cdcde78fb4bdb11498553f56d8dfeb3a482c70cc6580c399b92339cbdb3464fcc7b00e9839fd0d2b8b6db90c56b33593a0048bf7983421f29b1285c81a239045b96a9b0cacd70d6d9853206471f06915efc8d3ec4c50fb13601abc73247a656066fd7b329159b3ce9e3302b4c0d6aec58cb0946a8ee8e7f55f1af604f1edb4d887fa6292dc0ce57705c1a25dc62650c127d11a364b397aefc2fcc3a164bdc53165a461b01de9180c1461b309c75af0911b4cc1b8aa05652b62119c87b4b235c573aa15b1516cddf61efd6a7f8c953fbaaee9c0e800e8f519e1494de850ddb976864088fe0cf90bbc54395078ea2501e8baa84d6807e184105bc2a140b663416496886422643bbf764d406af06e7d086678828defda0b648b25666b7b5ea29e927141740d5be0e61bf25d40b8404ffd3c67bb855b11d4faf82b7b8051615c101c3deb0601a0fa9ecd8b4a95082ccbc8222b0982802dd8430e653d6eea2786dc3a91397135faffdc65a5bae048f5c463b1a6648becce961d39d063d28d1ad6dafcea0b0878379adb16cc0d4cea572abeacd9a168a4fe2e338092b5bc93ecf02ac6ccda03e5b23adf511fdf7a79442093233b79c67d3fdd3c36c96a8f67aa79e4743d99cf963ae6161877f73656eb0314d889f4b8649bbce8a759f90eac6c006197b54b2bbac7c9b237f1e3dc099c62a65481960e6ad697fc66316ac084ba99c60f58bf44ff45f3b2006cbc4196a25f124dfaf247e863a855ef6070deb45219a922dcf2be9bd01c340e1ca5ed7c3ddac9f7a677c5d00610991d21e0751ac8044585b39f3fec5b672a11a9bce32196c2003d01ea50b0f0403e16df188ecbbb74f295f01398363ddfecdb63a49347c912c125670205d7b6be999688df85bb7d5ac12b62b4fdc4eadcc2a9a7897028404f697b007603a0ad588c772952d6670ee870771774ad157c0b9cccd4b2192d835606198ea0c65036ae4e406cdc539ff3aa81fa20b7ab58d6f3abdb69cc1f503d593f7025d2035e7f21db76336efc2843a0dc9bd2eb8794718134ee68fc57d4d2bcc18969d08177f442b87433b48540c661940cf9e2462c53efa310c7e47487deab2ae15b1978ef05aa1e14110943f649d82486f710a39854409e74edcaf06b4a92d3580b9cdabf83c6351657698d3d5af7514f382e75d1c912cded577258603fc9ed002e010747cddf7885d34afc9a84d82696c6660cb5ecafb68b564908fc49c4db6a187d037241a26b1141cf20f2e968a53366db0f60b79cd98cf3c897c50b7b9728e6e7100f99e4d5ed2428dbd285516ca6660777a39b4b2617c1be5b0232d60b9c8099f5daedbf190109439c40b46090985200d6c0501313f3fa4d244864575c275faca47aeff32c7b3e3c59392618562a7c2d4b3af85a37a8847f595352024cb63d3a9085c2a502c6a3248f43c5fc828e636cb634b2d393d853ae2dc9605985cf85c060860a90256c7b574c1e01c320687a2bb0b2d51cc2950c485f2ffa5db0ad7aaf753f543de7f86efb775c6bac2989a33757a28836fd27f9347229a0004bd2e546994c69c678fe5717f613f905d945c072004c3a80e0e54215e19ff9972521890d4e705e429f16fc35fe5a15f2e6b75cd719d38f76b087b62e4b5dcdb35f4baa2bab167150bafb6c69e260ca51004bc826d46b77c3f67eaa08497294868e6d91b7b867e4da62052f4f891677256cfbaf19cf32bad99a7da69d8a66537686f89a58d78c7eeaa99cd38009a1a32582bedc5c718e57b19cd405ae659a89909356a07fcef89384d160fa5ae6683cc379642aea4f0c915f72d679bd521399cb16112f2abdede3001400b4a64d2173e153a68631183679b56b8f389ba889784133453a7e892fd3b092f5040870a3cfd6f982990143e7c0882b4ff4c5d049192d36925a25ae4be441aa30dc7e74398b340c45b52c73ed3b0cd640e3cc9fd4be24e7355f386106f65895f1ee850b2a781d1d1d322ca5a3b0fdb78ce1eda048ece94af25437969c99c58c08f1446ca5541e03987a20fd75283e3e116dc4c9222ab7522e4ccf6da14aef49cac9a6a2cd4aba1c54d49e6da4179a66b84e384cd3da53908579b28c11d525ebdc4dc69074cef8a9ecd3aab98f2858769d656b46141c3a4e69a5ed6c0a732c9ec1fce080eaebf537fa5e17236a44ba9c931f555d193e475ffafd20c53ccbab607c1a15fd06742a64691205eb0d00f7f40e4dd8efb279cf09b2522aac0729a631aacb92d5cfa2ce6bb07385b981890b5916755d5cc3a51c8c36bd2987068cc24fcf73840895469bbb9aff1059601f771afedf0a48d5921103920515b27d7e607951982feba197df8c61600feb3622b9eea13a4db4068728cb98cca76cfae197f6258758490bf41673ee29acd91fd296ec863c646e0ca6a0f0e9de146c663ba13d962964d7c32804fd12a14c1ca7212ad48bdfab469c6570dca562220ecbe7b6b163ed4c9361c5c10bed5c92861b8786ada20a99245d282e4454187ec02adfe354e30647cb10661c85168f7958e3ce69ab48c9455214707a63c9b1167f0845a6bfcce2a96cd53eab430f13cd527f1666290719a47c517cfa22fec2e9916af8aa93c78e567993d7fb8ee60fc4b903b8c67a3658302c5e5f35250c30427e4c055b6c54705bc599861f80b7200d361965ff98c88cc698a2615cadeac4bdfd3d613377cea52d2bbcb7e6b78ac31d4b2c33eaf0b2ed40b963e3cb25c7dfea3ebfe7b4aff2aaaaf184dc80ab649a108e2c830ce7eaea58a263392aa9cd13d7f7bd607dc7c804b19dfa41b3e5a5155201a87311e22062c93896e70f3a5c4b03521300b61cc311ebd5beb9838d0ed207c6bfc99e4392508e95804b10b36024f32e1fe1138e9ee7773f797b2bc6be7416f4e9691ef4c2a8d06af6c8b84bd1e6fd1ba3d3183475ef6c139ccf8dcf37671fbb96a2ab5e0e042f7c4728cf30bcc1a0de28a5024276ceaa194b4926e7f6a97b78bac36e47f832d56a96cd266434d37bcf2c2f57877717d91b1854972f832354acc207a2ee8caace7504e0e6197dd7e64a01c4c67bb2de8acc0cccc6c6bff0b0cbfe345542c5a795dfa48cc0990ab5702574d36494bc44c20f5b324f7c984d986cc8cb40cb2550076d96a069b6688d22171beed2dc5b6ff3ede8fff4c4a9de6d3817357a7ca7d24d87300b4545ebbac8cf7f09ec637a4f4d6bd07673709b6c363a75ccef585610c5f15de7851b5ab53e02a757bfc3caeb9a9a8996beffdc0cfd1201b6cd99cb035584e51a6c15a5d2e17d2f8aa6b41e26809392fac6caed1e02a53dcea8a413203608780dab33315a76eba24d540e4c5b9790420834bc8d4e47bc65ae52a54c0ff308427a8d7aff746aa6589d17514e40fee5d0b3533cf4ad2c5f9d96db9f50bd69ed8c92b860e199a35cf268c66ed13516a3b4b024f62d4b2a656067eece95575bdb4907efc488a9821bc3a9c81dd11b2128b7a01aa7a9ce6e73de3b4e9beced70206f91575baddbcbe5722337953c8016a0f4b62120d776c43b7d1a879b692107954f45acdf8967dcaa994aad4922d4fe093e16c2d0090906f5036af99e50bb09b04e9c9b3b5085abf621297ce203010249cede92e9b66b446b86b43eaaae228dfdd3b4408c12b404bb727f7e969e7da04fc59900112bf8d38af0416dc616e75f167aa1352215f07115a6f4eb6bb5fff6f5c2fc9ab906392036b44090e65fdaf017dc53bc94e0807d679d793df18cc44e6c846d414cef1569530f7692daf91eaaf4ae89fe2522f2c9cf33b6ca508ebcd006bc1a61f0c800553aff9dc7d57200b25ecb83e1e0b8cd29520b63aa649d3f71a62570eee56e03223ddf31f0c04fa686b7f6dd054e7a259d9ba335c2c5b2c508897506c0db7f01878dec1411c33f0af61b81dbcf9ff8bdc0c50044963a79f3ee1462150c6bd03a32dbdfef8d72f0b8b3a395ffb0cc85792e7bc867feb5e312cb64e29e193388e9f173c162f4a1320a6f99ea3795fb77d982605959909a1aa11076fcc779ea6b80ec1bf0edfc2569ec04d15a0bdeebccf3c75393dca5e81663532f8ced12d08e4c2ae6e2954d427c7bf053dc4718f56f453bc88d74045bd2f9747aae9b5298a0de927f1d6b1308f4e1483487f083e71ed09298deb52bb10079b13def7453eb432498069edb5ade70c5c54913684d934a3febf78753ac13300a91f467ff3f6e2f00898f015d08f7739047b321b3eaee5ad8aa7adbf7833f014d8c576a491af9fca6843b327ed513821cb3951b2e67a275225d7af6b382e2f955adaacba5d1fdea2223202dee132b91d5cf381b51da94145255f584a70c5e8d11e06a44afa6599bf3ed0cb61703eba254333af53afac60e54cf6397f9f7302249ab644f0b576c713b15007be1f4f9bb213660bca8a70251472b86669d361ef968f542e81ddbe8f4d2e9cabe8d7bf6a31f14a2cc272963553a424c105e7750437ec5bf316e30ce60b4b0c27ccc1eb27e60f6472fef27654da49905ff9c01b28695310ecd8701aedff25a83da4b7c41995f902bdf249769dcb53a3efa894710dd66ba8745ae2253cc6b75a038183a0bee21226d48239320efad6727093e4f94bbc2fdcc216200d903c32bb9f16dd17d5dac423ae0696f3decc576b8f1fdce63d0532370af7d1e2fa2ca5c5d17bd88f5e3abb4792dac8689ca13752f83d753b06b037bf5a80a3748983790352775685b0414c9d74849fd217e388f904278ddb6b0abdda941b61579c796e2bb77a9bc363b18642c401faa502a31011544111b6eedaa369976c814773d83220a75f31026d6ad0b8b4298ea6062234db232bc435e096e84f740e55bb14d46ae04af0500aa5bb218aff6c76aa8a8e3140a1b0d6638538fd7f30fa8d992e53abf8af2fbc16b9e8a668c1aac72cea1a746ee5f7f3392a4ec8f1d19f2f426b6069b1cd347cbc38bceba96ce5da49198083403143c740c04639cd1089abb34fe812d85921c47437604f684bca44a1eaa965c0a6e1c1fd1f70ee932af3455b36184cc15934cdb3f28959d37d8fc10696f8ec1e4b0c3d1b9ff74a01b796d1bb68954a3768c8bcec741b3b69da892f8922142b16b2cabb469a9906b34216243fac80374c10e178c5fd36440f8d7a8588a9c2510d86ffa8cb68ce8c330d2111c94724e522f04573dad43bce252eb505d29ca9379a6b281519d38b7174f3ae8f185544f3003c936a7e6b23ca97a313aac6a061caa45fda73522f3061767bb4e33dbe4bde390eb0f07225a8aef939cb6ab2ada10c02527281abad394cd4ea9f59467a08b72047cdb75d7b2b98e5b4542554a60f953ac7a4b980f42518eec05ff2c044549cab0cf33eef36dfbabcbc0300009d898862d2194cfcdd9a713c30bbe52291105193656ea5eb830873ac956469d31689cc3c69edb5cb9a6e31ce3e6fb50ddd4e52ef9fdeacfc0db21e1e83e0d8d0a64f17cacb4dc208a893e7fd8ffa86cfc554dfba3d9fd281115eccb4b9d909f2fbf3fbb66bedd7b5db3f6d4f076f5d8fb54f8832896f8ef6f624162f1dd589be7a8e87dd5065708a8b0bfb18a5c2299f5605ac8a11c1add55b2018e6099380a70bee3e0727ca6ec58928fe6eb3147b47401e8d822eebade713b58335787669e5e0de5d328a1067df4cd9124665bb02ee8adfd1b3618374ef167df1f0fe79456f78aee3da4c1bf397e4637b0cf41a0f4a2910efd02b17bf5f3c15b0084b36fa7d4e85a53e5be366b428244eeba7499c3e54397227928e2ff6e583f332d6f7e8cf4d058f379b58a7d03a4bfa454bb4b6d543804b8970e6a9fe8886179eb418a8ce9e509e8433571f7d32378f2e983fa418c8c91760ec9fb20968e7fc23b7c4ac71693b2576ac0f8ce2020ff1e7a7ff24301b48b544fb29a1ca4f2502daded865e488a16dd33ec67b2eee3025cdc5ef90f253c4b5e0a61d51e495b675c5a1d55b4ba3812c5f44cd08487e61d36b0c2dc32d27333a5ee8a0906bfbcd388bd9389d1509912c0471c7b706a5aff880569a3fb11ac5f14d780deb4c1b1afe30fb6b8daf87b27a4ceb869d587a97f2f5af8d819aa47bbf207db68a6ecbbefb1e109ed0bfbbf3b54fba9e79de8fad9c3bcd3e74b8b92ccea3ff5c558c6cd72d78a711fc39df603bd4aa1439dd302258edd2204e52d7f435c6f552b612fbc321bea971195cd4d8bb033e2a779e239164d7eea6d8fd233b0b9b776246564cfcf44b31a83031a2413bf98a398c9f93da243cef9ce73d81bade8ad551fb0ffa75bc874c11d23ac9d7752f22a0f54c3870f3314a83e64332db810da1ebb288e10c4eb9be9ec037317b8f813e68160a887da3f5c0389510a0734b69ef275e19973b169d340610cf2112e9964cc0566b9b690c3feb36c8526491d3a563f0bead2abbcf0665e048aa3f929351b2f89876580633a403250ae3b5244c8c0e996bf888938dfc8920348d88e272e6eadc7c0387ca1dae228bd620ce3975d43b58758d9412d304a227245587065f58c4573ba2557f1d8333ba007709b1239d682f03405b22135757178fb701bbde81d2f8faaa7666c025d8a8bb426dc4b8e61aed79b3b3d3a9b01ee9142772d869677ede166e7a8be8ab84cdd6946b1478ce77ba307213971cfb24c86c344310f279e38d22254bf4caf83c02e715cb0550e615dc9f8dd2400fa749e3527493c15fb454c158e4c0603ae6e962b7890058ec7c10f0618ee274a15bca6ca9fe5bc5f9e7797c0950299912be9c58463c07d667d4bffe8aa590ae43db08512b40f3d265026bef2facdd508984e5f6d2ac7ef573397f14ed2e2ccdcbe5796e60ae64d173814906d1da5a5bfe8a2a4c5d6bb0b3315b878b4877d0c045f6e6cfa0dfc1ea4de7abe26f2b2d8c93299ed1d83f1b7853c756bfa346cd53b008fec169883983fe0f2405777dd85e17b2e4e8b23432c0dc4c386d67b6597184d0b4b95877362304638484cc0951400f66ee8391dd44417c58b3d46a8345a8049fcd70f7b5f4a6f912e2b18760947c74ef2b732b342878d7e7cc99902de87db36469555fbbfe76189f108d6ab31f4727fe4e22d075afaf6cc726ab17a5e1b4ab6c8f29a459da3c4266b5ad8ff55906a190f8b19a3bb92a50df49647c03d5d6106ec07e9300038d059a75b54ac31683ef8e5eee946e1c84d016ee1e7800a92c0a3823b62e0417fe86b191951f65abc0c38c1e0e8f1121a04b62a8a720790560f922804b1b7e7eaa497e1bede6e3d0dcf0312dbf221561958fa1e85a8f99e6fc82f919e78c17d1beda16cfef25fb5d00f7c32df9a51eac76000c988ffdf011564aa0e319764b16a5a7c728a470ff70772fb76c9ada26a0ac073fcbfa12501c2454b19e02d928e3939a40bfff76c002533b3849cdf8016728445131e5f1e292b7d3dc06bb3a3cfff6fabae0b7341694a8938c1d2497cd70b76c337c9a312e96c8f736d7625a535e1906eba53d199221ca60202a65be0f7e530aca10e61fa39c7601d65954e5ed4cab94345c6b89c7f8a0de5c61a7945e1564731b6715331d13263b2961a163382f7c4934d847033860e402f3aadb4f3e6cf47a97a2031401da4d2c8de8c80cdad71b97b4deb2075a02282f958ac6772354e67f097ca693778224b80892490015e7d697fb9107f75cea708178ffec93fb1d44e8493bad1d42c918e661219ea819e0200759037a5a585c0fe074fd407536fe58013f42612c41bfc66e16870d7a9c00ee93a3122b253fecbf5de3837641f4a1376af0f053463413c26c29f9a346318565276856b963da30ba6ab8c4c8ef6cfddc432328586d9d9829895835759bcde0851ae0c838a3927ea63fe5ba793fae94da61cab00fc05f3a265a2da1221bb2b66775ed7ba856b41011652d4984991e56249360ddfc997245ac1547a1c16382d42df383a8d1c852643b24895c422712e79c436fdfffece4ed1c50922d4f25296aaf6b204522086d188bee254f8303b60537ead1195ac5dd301286f0042dd68aa05a70e4beb779aa0b61a316f736b72c9ab7ed860a0908a078f4b8a53f2df0abf993f689de4b02b9138ca5047fb0bfc9ba3b92bff033e36fc9553260b008cef3d147c62d1d3944fd1eaff79bc5a922ec2190907bfda1b51c2c7fb867db1f8e13a37b5e3ae0165e93350b958a239ec1f2b78561cff854b975307b5b5dd23b040602a5a36bd79947ee04c7d0e5e30f9c4c79f7b4e6eada98bfc6c357cdf8939213423f1b21ba26cfc2b2756ea3eb992372db0ab8a7c37d8ae96bf3ed6be873c1891550ef741812032e1ae938326c399ee43a3061602dda006f1b6b620bebb6a5752bee77e8acf9921ebf4d4c8af7eb5e937c65697c0664c594e31a62377a25605051996c474ca322ce8e0e6ef8a7988be", 0x2000, &(0x7f0000001240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000a00)=ANY=[@ANYBLOB="300200e4fffffffff8ffffffffffff000001000000000000000300000000000000feffffffffff2a3cb92ecc318cff7fffff0500000005000000060020000000000009000000000000000000000000000000ff0000000000000003000000000000000000000000000000ffffff7f570000000300000000800000ff030000", @ANYRES32=0x0, @ANYRES32=r4, @ANYBLOB="000000000400000000000000000000000000200037050000000000002b000000090000003a2d285cc980000000c30000f3397dd86d4d928d24d3a461b60245898556c60000000000002b133b0000000000000000050000000000000001000000000000000e000000000000000900000000000000090000000300000002000000000000000200000000000000e90000000000000005000000000000008300000000000000040000000000000001010000080000000400000000c0000001000000", @ANYRES32=r3, @ANYRES32=r4, @ANYBLOB="060000000d00000000000000030000000000000037bc000000000000020000001bd200003a5d00000000000000000000000000000200000000000000020000000000000000000000000000000000000001010000050000000000000000800000000000000400000000000000030000000000000002000000000000000000000000000080ffffffffff010000000200000080000007000000", @ANYRES32=r3, @ANYRES32=0x0, @ANYBLOB="03000000040000000000000006000000000000000800000000000000550000005d270000b420795f8edf66dc00f94eff0100000000000047db7f910d1684000000000000"], 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r0, 0xc018937b, &(0x7f0000002a80)={{0x1, 0x1, 0x18, r0, {0x0, 0xffffffffffffffff}}, './file0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe8000000000000000000400000000aa"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r6 = socket$inet6(0xa, 0x2, 0x0) sendmsg$inet6(r6, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="14000003000000ff370000003c"], 0x14}, 0xc044) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x5000002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040804}, 0x4048080) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=0x0, @ANYBLOB="cf0400000000fcffffff1200000008000300", @ANYRES32=0x0, @ANYBLOB="cd155bcc94fc5a40c79e42b7052011f43bf7653f1221d02c2bc5ddd84dfefc1d4314e2065e7b8701763b232db1bc93bbed06ec71c77270c62c53aeff6ee6a95b0abbe9bbe7e05c2524cde3e1330b2e16cac10be97243ee8685a93fd82d87a703cc2929911856cd9e6453cc347b00000000000000ffea5ac6e2c6641029360024c09adae1fd5b929be9fbdb776eac614da36e9106b8df04e1865e4f368284ff41f1438145677ea0a76335ee87a18bf4042855bb3cf35787176e8c914bd5632c4c05bf8affa85b82f053182676ae34d60cf421da41dadd5931ae16338efd575b4159772d83438c4844e03c1a115628ed5e"], 0x1c}}, 0x0) r7 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f00000000c0)={&(0x7f00000001c0)={0xa, 0x4e20, 0x80004, @dev={0xfe, 0x80, '\x00', 0x20}, 0xfffffffe}, 0x43, 0x0}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000000)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) ioctl$KVM_RUN(r8, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000080)=[{0x200000000006, 0x0, 0x0, 0xe}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) ioctl$KVM_RUN(r8, 0xae80, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r0, 0x29, 0x22, &(0x7f0000002c00)={{{@in6=@private0, @in6=@initdev}}, {{@in6=@private1}, 0x0, @in6=@empty}}, &(0x7f0000002d00)=0xe4) 1.995651684s ago: executing program 7 (id=2351): timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400)) unshare(0x42000000) 1.893267675s ago: executing program 5 (id=2352): r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000040)={0x0, 0x0, 0xa21d}) mmap(&(0x7f00002ad000/0xc00000)=nil, 0xc00000, 0x3, 0x100010, 0xffffffffffffffff, 0x0) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000640)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @multicast1, @multicast2}}}], 0x20}, 0x0) r1 = inotify_init1(0x0) inotify_add_watch(r1, &(0x7f00000006c0)='.\x00', 0xaa) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000240)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) readv(r2, &(0x7f0000000440)=[{&(0x7f0000000080)=""/48, 0x30}], 0x1) (async) mremap(&(0x7f00007ff000/0x4000)=nil, 0x4000, 0x4000, 0x7, &(0x7f0000580000/0x4000)=nil) (async, rerun: 64) r3 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) (async, rerun: 64) r4 = fsopen(&(0x7f00000001c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) (async, rerun: 64) r5 = fsmount(r4, 0x0, 0x8f) (rerun: 64) mknodat$loop(r5, &(0x7f0000000140)='./file0\x00', 0x4, 0x1) (async) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000e40)={0x84, &(0x7f0000000180)=ANY=[@ANYBLOB="001e1400000009"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) mremap(&(0x7f0000580000/0x4000)=nil, 0x4000, 0x2000, 0x3, &(0x7f00007ff000/0x2000)=nil) 1.81791983s ago: executing program 4 (id=2353): socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$xdp(0x2c, 0x3, 0x0) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x1a3c82) syz_open_dev$sg(&(0x7f00000008c0), 0x0, 0x82) close_range(r2, 0xffffffffffffffff, 0x0) r4 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f000000a440), 0x1, 0x0) write$binfmt_register(r4, &(0x7f000000a480)={0x3a, 'syz1', 0x3a, 'M', 0x3a, 0x0, 0x3a, '\xc2\\-:\x00', 0x3a, '#.\\#\'+\x00', 0x3a, './file0'}, 0x33) connect$unix(r1, &(0x7f0000000240)=@file={0x1, './file0\x00'}, 0x6e) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r5, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @local, 'geneve0\x00'}}, 0x1e) r6 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r6, &(0x7f0000000080)={0x18, 0x0, {0xfffe, @local, 'geneve0\x00'}}, 0x1e) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_PEER_REMOVE(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000002c0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="81bd2bbd7000fbdbdf251400000018000780080002"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c8c5}, 0x80) close(r5) connect$pppoe(r6, &(0x7f0000000000)={0x18, 0x0, {0x0, @broadcast, 'vxcan1\x00'}}, 0x1e) r9 = syz_usb_connect(0x3, 0x24, &(0x7f0000000040)=ANY=[@ANYRES32=r0], 0x0) syz_usb_control_io(r9, 0x0, &(0x7f0000000100)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000004c0)=[{{&(0x7f0000000200)={0xa, 0x4e22, 0x1, @private1, 0x1}, 0x1c, 0x0}}], 0x1, 0x200400c4) madvise(&(0x7f0000130000/0xd000)=nil, 0xd000, 0x66) mincore(&(0x7f000013a000/0x3000)=nil, 0x3000, &(0x7f0000000000)=""/238) syz_usb_control_io$uac1(r9, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r9, 0x0, &(0x7f0000000480)={0x1c, &(0x7f00000001c0)=ANY=[@ANYBLOB="c00c49"], 0x0, 0x0}) 1.599434826s ago: executing program 7 (id=2354): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@newqdisc={0x8c0, 0x24, 0xd0f, 0x70bd2d, 0x2000, {0x60, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xfea9, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x14b9}, @TCA_TBF_PBURST={0x8, 0x7, 0xa64}, @TCA_TBF_BURST={0x8, 0x6, 0x72}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0xff9d, 0x84d, 0x9, 0x7fff}, {0x1, 0x0, 0xa660, 0xfffd, 0x7, 0xfffffffa}, 0x6, 0xfffffffb, 0x1798}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x55673cfc4de2c680}, @TCA_TBF_PTAB={0x404, 0x3, [0x80000000, 0x7, 0x3, 0x100, 0x2, 0xfffffff1, 0x8bdb, 0x159, 0x2, 0x0, 0x6, 0x5, 0xfffffff7, 0x2, 0x1, 0x1, 0x8, 0x0, 0x9, 0x1, 0x6, 0x3, 0x3, 0x4, 0x3, 0x8, 0x3ff, 0x2, 0x7, 0x4, 0x21, 0x6, 0x6, 0x1, 0x8, 0xfff, 0x8, 0x400, 0x9, 0xffff8000, 0x1, 0x8, 0x4, 0x8, 0x1, 0xc, 0x1ff, 0x2, 0x4, 0x5, 0xe, 0xe, 0x1aa2b372, 0x3, 0x0, 0x6, 0x10000, 0xffffffff, 0x6, 0x9778, 0x5, 0x2, 0xb1ad, 0xffff8000, 0xb, 0x86fe, 0x99, 0x5, 0x6, 0xfffffff7, 0x4, 0xffc00000, 0x5ca0, 0x8, 0x5, 0x80000001, 0x401, 0x1, 0x3, 0xff1, 0x5, 0x0, 0x3, 0x1, 0xde, 0x9, 0x8, 0x7f7, 0x7fe00, 0x0, 0x75e, 0x7, 0x3, 0x6, 0x7, 0x2, 0x401, 0xf, 0x3, 0x1ff, 0x4, 0x7f, 0x3, 0x8, 0x1, 0xaf21, 0xf9, 0xfffffffd, 0x5, 0xec44, 0x7, 0x2, 0x7, 0x9000000, 0x8, 0x2, 0x10001, 0x7fff, 0x10000, 0x84, 0x2, 0xa5ac, 0x0, 0x7fff, 0x8, 0xe, 0x200, 0x6e, 0x7388, 0x0, 0x6, 0xfffffffb, 0x2, 0x80000000, 0x6, 0x2, 0xffffffc0, 0x80000000, 0xfffffffd, 0x3, 0x3, 0x1, 0x100, 0x6, 0x7, 0x200, 0x1a, 0xc20, 0x5, 0x100, 0x400, 0x6, 0x1, 0x0, 0x7, 0x1c00000, 0xf0000000, 0x7, 0x0, 0xffffffff, 0x8, 0x8001, 0x2, 0x3, 0x1, 0x7, 0x7, 0x5, 0x8, 0x7, 0x3, 0x2, 0x6, 0x0, 0xa9, 0x3, 0xff, 0x9, 0x4, 0x1, 0xfffffc01, 0x100, 0x8, 0x4249, 0x6, 0x1, 0x0, 0x9, 0x3ff, 0xb, 0x7, 0x80000000, 0x0, 0x7, 0xd594, 0x9d7, 0x1, 0x2, 0x80, 0x500, 0x7, 0x6, 0x2, 0xfffffb11, 0xfffffffe, 0x1, 0x81, 0x7, 0x7, 0xfffffff9, 0x6, 0x1, 0x62fe, 0x0, 0x0, 0x1ff, 0x9, 0x70dfabfe, 0x200, 0xf9, 0x14000000, 0x400, 0x4, 0x4, 0x5, 0x0, 0x146, 0x2, 0x9, 0x0, 0x4, 0x4, 0x9, 0x4, 0x1, 0x7f, 0xae6f, 0x5, 0xfffffffa, 0x3, 0x40, 0x8, 0x66cc, 0x0, 0xa, 0x2d, 0x2400, 0x1, 0x3, 0x3, 0x9, 0x7b, 0x7, 0x400, 0x0, 0xfffff1c0]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x8, 0x1, 0x3, 0x0, 0x9, 0x5}, {0x2, 0x0, 0x1, 0x5, 0x80, 0xc7d}, 0x4, 0x4, 0x1414}}, @TCA_TBF_RATE64={0xc, 0x4, 0x3f6335dbcb9ab090}, @TCA_TBF_PTAB={0x404, 0x3, [0xdb90, 0x0, 0x1000, 0x2ee, 0xcf, 0x6, 0xde5d, 0x3, 0x1, 0x3ff, 0x4, 0x6, 0x3ff, 0x4, 0x8, 0x1f4, 0xb, 0x4, 0x7, 0xffffff80, 0x200, 0x239, 0x0, 0x0, 0x1, 0x7, 0x3f0d, 0x1, 0x7, 0x3, 0x8000000, 0x3a, 0x0, 0x9000, 0x9, 0xa58, 0x4131, 0x0, 0xfffffff9, 0x3, 0x6, 0x1, 0x7, 0xe5d6, 0x400, 0x2, 0x2, 0x1, 0x7fff, 0x80, 0x7, 0x18, 0x8c3, 0x148, 0x6, 0x1000, 0x6fea, 0x8, 0xdc2, 0xfffffffc, 0x800, 0x0, 0x3, 0x1, 0x4, 0x400, 0x7, 0x401, 0x1, 0x3, 0x0, 0x6c, 0x40, 0x5, 0x5, 0x9e, 0x0, 0x80000000, 0xff, 0x101, 0x7, 0x2, 0x9, 0x401, 0x4, 0x6, 0x8ea2, 0x1, 0x9, 0x7, 0x5, 0x5, 0x6, 0x1, 0x10001, 0x0, 0x6, 0x2, 0x7, 0x2, 0x6, 0x5, 0x7fc00000, 0x527c09d8, 0x8, 0x3, 0x400, 0x6, 0xfffffffc, 0x80, 0x4, 0x91, 0x1, 0x8, 0x1ff, 0x3, 0x595, 0x2, 0x3, 0x4, 0x101, 0x2, 0x7, 0xffff9a41, 0x10, 0x7, 0xc, 0x7fff, 0x7, 0x7, 0x0, 0x8001, 0x4, 0x8000, 0x7, 0x4, 0xf, 0x2, 0x7, 0x2, 0xfffffffc, 0x3, 0x7, 0x100, 0x2, 0x1, 0x7, 0x4, 0x3, 0x0, 0x5, 0x5, 0x8001, 0x8, 0x8, 0x81, 0x401, 0x5, 0x5, 0x8, 0x0, 0xffffff51, 0x80000001, 0x7, 0x5, 0x8, 0x8, 0xd4, 0x48000000, 0x6, 0x10000, 0x3, 0x3, 0x8, 0x8, 0x5, 0xf1f, 0x6, 0x4, 0x9, 0x4c34, 0x0, 0x0, 0x1, 0x1, 0x60bd, 0x8, 0x7, 0x9, 0x80000000, 0x8, 0x2, 0x7, 0x2, 0xfffffffc, 0x7f, 0x2, 0x8e5, 0xfffffffb, 0x8, 0xd4, 0x4, 0xffff, 0x6, 0x79, 0x7, 0x0, 0xf2, 0x9b, 0xe6, 0x3, 0x1, 0xfffffff8, 0x8d7, 0xf4f, 0x7ff, 0x0, 0x4, 0x6, 0x101, 0x658, 0x5, 0x4, 0x3, 0x4, 0xd6, 0x0, 0xc11, 0x1000, 0x80000000, 0x5, 0x8, 0x8000, 0x2a0, 0x9, 0x2a86, 0xc4, 0x1000, 0x4, 0x7, 0x3ff, 0x2, 0xffffffff, 0x1, 0x4, 0x7ff, 0x2, 0x5, 0xa, 0x8, 0x74f2, 0x9, 0x0, 0x10, 0xd6, 0x3]}, @TCA_TBF_PBURST={0x8, 0x7, 0x1719}]}}]}, 0x8c0}, 0x1, 0x0, 0x0, 0x80d1}, 0x30008000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) socketpair$tipc(0x1e, 0x1, 0x0, 0x0) (async) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00003, 0x8) (async) socket$netlink(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)) (async) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000003c0)={'dummy0\x00'}) (async) sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@newqdisc={0x8c0, 0x24, 0xd0f, 0x70bd2d, 0x2000, {0x60, 0x0, 0x0, r2, {0x0, 0x3}, {0xffff, 0xffff}, {0x0, 0x4}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0xfea9, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0x14b9}, @TCA_TBF_PBURST={0x8, 0x7, 0xa64}, @TCA_TBF_BURST={0x8, 0x6, 0x72}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0xff9d, 0x84d, 0x9, 0x7fff}, {0x1, 0x0, 0xa660, 0xfffd, 0x7, 0xfffffffa}, 0x6, 0xfffffffb, 0x1798}}, @TCA_TBF_PRATE64={0xc, 0x5, 0x55673cfc4de2c680}, @TCA_TBF_PTAB={0x404, 0x3, [0x80000000, 0x7, 0x3, 0x100, 0x2, 0xfffffff1, 0x8bdb, 0x159, 0x2, 0x0, 0x6, 0x5, 0xfffffff7, 0x2, 0x1, 0x1, 0x8, 0x0, 0x9, 0x1, 0x6, 0x3, 0x3, 0x4, 0x3, 0x8, 0x3ff, 0x2, 0x7, 0x4, 0x21, 0x6, 0x6, 0x1, 0x8, 0xfff, 0x8, 0x400, 0x9, 0xffff8000, 0x1, 0x8, 0x4, 0x8, 0x1, 0xc, 0x1ff, 0x2, 0x4, 0x5, 0xe, 0xe, 0x1aa2b372, 0x3, 0x0, 0x6, 0x10000, 0xffffffff, 0x6, 0x9778, 0x5, 0x2, 0xb1ad, 0xffff8000, 0xb, 0x86fe, 0x99, 0x5, 0x6, 0xfffffff7, 0x4, 0xffc00000, 0x5ca0, 0x8, 0x5, 0x80000001, 0x401, 0x1, 0x3, 0xff1, 0x5, 0x0, 0x3, 0x1, 0xde, 0x9, 0x8, 0x7f7, 0x7fe00, 0x0, 0x75e, 0x7, 0x3, 0x6, 0x7, 0x2, 0x401, 0xf, 0x3, 0x1ff, 0x4, 0x7f, 0x3, 0x8, 0x1, 0xaf21, 0xf9, 0xfffffffd, 0x5, 0xec44, 0x7, 0x2, 0x7, 0x9000000, 0x8, 0x2, 0x10001, 0x7fff, 0x10000, 0x84, 0x2, 0xa5ac, 0x0, 0x7fff, 0x8, 0xe, 0x200, 0x6e, 0x7388, 0x0, 0x6, 0xfffffffb, 0x2, 0x80000000, 0x6, 0x2, 0xffffffc0, 0x80000000, 0xfffffffd, 0x3, 0x3, 0x1, 0x100, 0x6, 0x7, 0x200, 0x1a, 0xc20, 0x5, 0x100, 0x400, 0x6, 0x1, 0x0, 0x7, 0x1c00000, 0xf0000000, 0x7, 0x0, 0xffffffff, 0x8, 0x8001, 0x2, 0x3, 0x1, 0x7, 0x7, 0x5, 0x8, 0x7, 0x3, 0x2, 0x6, 0x0, 0xa9, 0x3, 0xff, 0x9, 0x4, 0x1, 0xfffffc01, 0x100, 0x8, 0x4249, 0x6, 0x1, 0x0, 0x9, 0x3ff, 0xb, 0x7, 0x80000000, 0x0, 0x7, 0xd594, 0x9d7, 0x1, 0x2, 0x80, 0x500, 0x7, 0x6, 0x2, 0xfffffb11, 0xfffffffe, 0x1, 0x81, 0x7, 0x7, 0xfffffff9, 0x6, 0x1, 0x62fe, 0x0, 0x0, 0x1ff, 0x9, 0x70dfabfe, 0x200, 0xf9, 0x14000000, 0x400, 0x4, 0x4, 0x5, 0x0, 0x146, 0x2, 0x9, 0x0, 0x4, 0x4, 0x9, 0x4, 0x1, 0x7f, 0xae6f, 0x5, 0xfffffffa, 0x3, 0x40, 0x8, 0x66cc, 0x0, 0xa, 0x2d, 0x2400, 0x1, 0x3, 0x3, 0x9, 0x7b, 0x7, 0x400, 0x0, 0xfffff1c0]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x8, 0x1, 0x3, 0x0, 0x9, 0x5}, {0x2, 0x0, 0x1, 0x5, 0x80, 0xc7d}, 0x4, 0x4, 0x1414}}, @TCA_TBF_RATE64={0xc, 0x4, 0x3f6335dbcb9ab090}, @TCA_TBF_PTAB={0x404, 0x3, [0xdb90, 0x0, 0x1000, 0x2ee, 0xcf, 0x6, 0xde5d, 0x3, 0x1, 0x3ff, 0x4, 0x6, 0x3ff, 0x4, 0x8, 0x1f4, 0xb, 0x4, 0x7, 0xffffff80, 0x200, 0x239, 0x0, 0x0, 0x1, 0x7, 0x3f0d, 0x1, 0x7, 0x3, 0x8000000, 0x3a, 0x0, 0x9000, 0x9, 0xa58, 0x4131, 0x0, 0xfffffff9, 0x3, 0x6, 0x1, 0x7, 0xe5d6, 0x400, 0x2, 0x2, 0x1, 0x7fff, 0x80, 0x7, 0x18, 0x8c3, 0x148, 0x6, 0x1000, 0x6fea, 0x8, 0xdc2, 0xfffffffc, 0x800, 0x0, 0x3, 0x1, 0x4, 0x400, 0x7, 0x401, 0x1, 0x3, 0x0, 0x6c, 0x40, 0x5, 0x5, 0x9e, 0x0, 0x80000000, 0xff, 0x101, 0x7, 0x2, 0x9, 0x401, 0x4, 0x6, 0x8ea2, 0x1, 0x9, 0x7, 0x5, 0x5, 0x6, 0x1, 0x10001, 0x0, 0x6, 0x2, 0x7, 0x2, 0x6, 0x5, 0x7fc00000, 0x527c09d8, 0x8, 0x3, 0x400, 0x6, 0xfffffffc, 0x80, 0x4, 0x91, 0x1, 0x8, 0x1ff, 0x3, 0x595, 0x2, 0x3, 0x4, 0x101, 0x2, 0x7, 0xffff9a41, 0x10, 0x7, 0xc, 0x7fff, 0x7, 0x7, 0x0, 0x8001, 0x4, 0x8000, 0x7, 0x4, 0xf, 0x2, 0x7, 0x2, 0xfffffffc, 0x3, 0x7, 0x100, 0x2, 0x1, 0x7, 0x4, 0x3, 0x0, 0x5, 0x5, 0x8001, 0x8, 0x8, 0x81, 0x401, 0x5, 0x5, 0x8, 0x0, 0xffffff51, 0x80000001, 0x7, 0x5, 0x8, 0x8, 0xd4, 0x48000000, 0x6, 0x10000, 0x3, 0x3, 0x8, 0x8, 0x5, 0xf1f, 0x6, 0x4, 0x9, 0x4c34, 0x0, 0x0, 0x1, 0x1, 0x60bd, 0x8, 0x7, 0x9, 0x80000000, 0x8, 0x2, 0x7, 0x2, 0xfffffffc, 0x7f, 0x2, 0x8e5, 0xfffffffb, 0x8, 0xd4, 0x4, 0xffff, 0x6, 0x79, 0x7, 0x0, 0xf2, 0x9b, 0xe6, 0x3, 0x1, 0xfffffff8, 0x8d7, 0xf4f, 0x7ff, 0x0, 0x4, 0x6, 0x101, 0x658, 0x5, 0x4, 0x3, 0x4, 0xd6, 0x0, 0xc11, 0x1000, 0x80000000, 0x5, 0x8, 0x8000, 0x2a0, 0x9, 0x2a86, 0xc4, 0x1000, 0x4, 0x7, 0x3ff, 0x2, 0xffffffff, 0x1, 0x4, 0x7ff, 0x2, 0x5, 0xa, 0x8, 0x74f2, 0x9, 0x0, 0x10, 0xd6, 0x3]}, @TCA_TBF_PBURST={0x8, 0x7, 0x1719}]}}]}, 0x8c0}, 0x1, 0x0, 0x0, 0x80d1}, 0x30008000) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) (async) 1.53725758s ago: executing program 3 (id=2355): socket$nl_route(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file1\x00'}, 0x6e) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r2, 0x10e, 0xc, &(0x7f0000000040)={0x4001}, 0xfea3) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) (async) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$inet6_int(r3, 0x29, 0xce, 0x0, &(0x7f00000007c0)=0xffffff78) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xfffffffc}, 0x0) (async) socket$inet_udp(0x2, 0x2, 0x0) (async) r4 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) bpf$MAP_CREATE(0xc00000000000018, &(0x7f0000000380)=@base={0x1e, 0xfffffffe, 0x4, 0xfffffc75, 0x7002, 0xffffffffffffffff, 0x1e, '\x00', 0x0, r4, 0x0, 0x11, 0x2}, 0x50) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) (async) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0x401, 0x2000000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x24, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @private=0xa010101}}, @IFLA_GRE_IKEY={0x8}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r5, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) r7 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000006c0)={0x1, 0xf, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000400000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000010000008500000084000000b7000000000000009500000000000000c52b5ac18c87c5d7f122e0a49f1d52676645e1382b565acf331595ceda2bbd"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) (async) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a00000000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r9}, &(0x7f0000000000), &(0x7f0000000140)=r8}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x1, 0x8, &(0x7f0000000180)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r9, @ANYBLOB="0000000000000000b703000000000000850000000c000000b70000002000000095"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r10 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) ioctl$VIDIOC_S_SELECTION(r10, 0xc040565f, &(0x7f0000000940)={0xa, 0x0, 0x7, {0x8000, 0x1000, 0x4, 0x6}}) socket$tipc(0x1e, 0x5, 0x0) ioctl$sock_SIOCBRDELBR(0xffffffffffffffff, 0x89a2, &(0x7f0000000000)='bridge0\x00') (async) socket$nl_route(0x10, 0x3, 0x0) 1.485204881s ago: executing program 5 (id=2356): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000), 0x0}, 0x50) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r1 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r2 = syz_io_uring_complete(0x0) ioctl$TIOCGPGRP(r0, 0x540f, 0x0) getsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000100)={{{@in6=@mcast1, @in6=@ipv4={""/10, ""/2, @dev}}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f0000000080)=0xe8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$alg(0x26, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r4, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(0xffffffffffffffff, 0xc01064b5, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r5 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r5, 0xc004500a, &(0x7f0000000240)=0x3) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)={0x34, r7, 0x801, 0x70bd2c, 0x25dfdbfe, {}, [@TIPC_NLA_MEDIA={0x20, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x70}]}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x24008000}, 0x8040) sendmsg$TIPC_NL_BEARER_SET(r1, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000440)={&(0x7f0000000380)={0xb8, r7, 0x2, 0x70bd2c, 0x25dfdbff, {}, [@TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x401}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x3}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x9}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x1}]}, @TIPC_NLA_NET={0x58, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1ff}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffffffffffff}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x9}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfff}]}, @TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0xb8}, 0x1, 0x0, 0x0, 0x200008d0}, 0x4010) syz_open_procfs(0x0, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r5, 0xc0045006, &(0x7f0000000080)=0x7f) ioctl$SNDCTL_DSP_SPEED(r5, 0xc0045002, &(0x7f0000000000)) read$dsp(r5, &(0x7f0000000300)=""/79, 0x4f) ioctl$RTC_WKALM_RD(r1, 0x80287010, &(0x7f0000000200)) pselect6(0x40, &(0x7f00000000c0)={0x6, 0xfffffffffffffffd, 0x9, 0x40, 0x2, 0xd}, 0x0, &(0x7f0000000680)={0x7ff, 0x7, 0x5, 0x7, 0xffffffffffffff22, 0x2, 0x5, 0x8}, 0x0, 0x0) 955.25936ms ago: executing program 3 (id=2357): openat$btrfs_control(0xffffff9c, &(0x7f0000000000), 0x40000, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000005c0)=@newtfilter={0x98, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0xfff1, 0xa}, {}, {0x7, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x6c, 0x2, [@TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_ACT={0x5c, 0x1, [@m_tunnel_key={0x58, 0x1, 0x0, 0x0, {{0xf}, {0x28, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_PARMS={0x1c, 0x2, {{0x3, 0x3ff, 0x2, 0x1, 0x29}, 0x1}}, @TCA_TUNNEL_KEY_ENC_IPV4_SRC={0x8, 0x3, @broadcast}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}]}, 0x98}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) socket$nl_generic(0x10, 0x3, 0x10) openat$fb0(0xffffffffffffff9c, &(0x7f00000000c0), 0x143800, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$pppl2tp(0x18, 0x1, 0x1) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x21, 0x2, 0xa) openat$sequencer2(0xffffff9c, &(0x7f0000000180), 0x2001, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000300), 0x80) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) pipe2(&(0x7f0000000000), 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = syz_io_uring_setup(0x462, &(0x7f0000000040)={0x0, 0x40000020, 0x10, 0x0, 0x1bc}, &(0x7f0000000100)=0x0, &(0x7f0000000000)) r8 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_WRITE_FIXED={0x5, 0x43, 0x0, @fd, 0x11e, 0x5, 0x0, 0x5, 0x0, {0x3, r8}}) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) 788.470076ms ago: executing program 6 (id=2358): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz0\x00', 0x200002, 0x0) openat$vhost_vsock(0xffffff9c, &(0x7f0000000440), 0x2, 0x0) (async, rerun: 64) fchdir(r0) (async, rerun: 64) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xc817}, @IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x1, 0x0, 0x5c}]}, @IPSET_ATTR_FAMILY={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}]}, 0x5c}}, 0x0) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000033a80)=""/102386, 0x18ff2}], 0x100000000000019e, 0x0, 0x0) (async, rerun: 32) openat$cgroup_freezer_state(r0, &(0x7f00000002c0), 0x2, 0x0) (rerun: 32) r3 = socket(0x11, 0x800, 0x0) setsockopt$packet_rx_ring(r3, 0x107, 0x5, &(0x7f0000000000)=@req3={0x1000, 0x3a, 0x1000, 0x3a}, 0x1c) socket$kcm(0x2, 0xa, 0x2) (async, rerun: 32) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000380)=0x3, 0xac5) (rerun: 32) syz_clone3(&(0x7f0000000180)={0x23800000, &(0x7f0000000040), 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) r4 = openat$vsock(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) (async, rerun: 32) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (rerun: 32) close(r6) r7 = socket(0x10, 0x3, 0x0) mount$fuse(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000200), 0x400a8, &(0x7f00000007c0)=ANY=[@ANYBLOB='\x00\x00\x00', @ANYRESHEX=r4, @ANYBLOB=',rootmode=00000000000000000060000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0xee00, @ANYBLOB=',default_permissions,max_read=0x0000000100000000,allow_other,allow_other,blksize=0x232d288d8cd1ed36,blksize=0x0000000000000000,smackfstransmute=lo\x00,euid>', @ANYRESDEC=0x0, @ANYBLOB=',smackfshat=.,fowner=', @ANYRESDEC=0x0, @ANYBLOB=',']) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000300)={0x0, 0x9, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r8, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x1}, @TCA_CAKE_AUTORATE={0x8}]}}]}, 0x44}}, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r9) sendmsg$TIPC_CMD_ENABLE_BEARER(r9, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="32d2e1c4ace0"}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r11) (async) socket$unix(0x1, 0x5, 0x0) 630.739291ms ago: executing program 3 (id=2359): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x202400, 0x0) r3 = syz_open_dev$video(&(0x7f0000000280), 0x6, 0x8003) ioctl$VIDIOC_G_INPUT(r3, 0x80045626, &(0x7f0000000300)) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x9, 0x6, 0x0, 0x3}, 0x0) add_key(&(0x7f00000000c0)='pkcs7_test\x00', 0x0, &(0x7f0000000000)="100c0681000000ba8b0ad775b31b", 0xe, 0xfffffffffffffffc) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, &(0x7f0000000300)={0x8}) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, &(0x7f0000000340)={0x8}) ioctl$IOMMU_GET_HW_INFO(r2, 0x3b8a, &(0x7f0000000380)={0x28, 0x0, 0x0, 0x95, &(0x7f0000000180)=""/149}) sendmsg$NL80211_CMD_NEW_STATION(0xffffffffffffffff, 0x0, 0x0) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000140)={0x0, 0xdffffffe, 0x80, 0x0, 0x0, "8100e1c8e80b598c36ff000800"}) r5 = syz_open_pts(r4, 0x141601) fcntl$setstatus(r5, 0x4, 0x102800) write(r5, &(0x7f0000000000)="d5", 0xfffffedf) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, &(0x7f00000002c0)={0xaa, 0x582}) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000040)=0x3) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000f40)=@base={0x5, 0x4, 0x43, 0x1}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600), &(0x7f00000001c0), 0x71, r6}, 0x38) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) bpf$BPF_GET_PROG_INFO(0x4, &(0x7f0000000140)={r2, 0xe0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa6, 0x8, 0x0, 0x0}}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000340)={0x1, &(0x7f0000000000)=[{0x6, 0xf, 0x0, 0x7fff8000}]}) r7 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000040)={0x23, 0x3, 0x17, 0x6, 0x0, 0x5, 0x0}) 364.399555ms ago: executing program 6 (id=2360): r0 = openat$sndseq(0xffffff9c, &(0x7f0000000180), 0x40) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r0, 0xc0a45320, &(0x7f00000000c0)={{0x80, 0x4}, 'port0\x00', 0x786520dbf34c80ff, 0x20a03, 0x122, 0x0, 0x0, 0xc, 0x400, 0x0, 0x0, 0x87}) io_uring_setup(0x6a90, &(0x7f0000000200)={0x0, 0x2, 0xc2, 0x2, 0x1ed}) openat$sequencer2(0xffffff9c, &(0x7f0000000040), 0x123482, 0x0) r1 = syz_io_uring_setup(0x113, &(0x7f0000000140)={0x0, 0x334e, 0x10, 0x10000006, 0x1eb}, &(0x7f0000000280)=0x0, &(0x7f0000000300)=0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, 0x0) connect$qrtr(0xffffffffffffffff, 0x0, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_TEE={0x21, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, 0x7}) write$UHID_CREATE2(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r4, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x20, 0x0, @fd_index=0x2, 0x5, 0x0, 0xb, 0x7}) io_uring_enter(r1, 0x7277, 0x0, 0x28, 0x0, 0x0) 250.694523ms ago: executing program 6 (id=2361): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902b901010000003f0904"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async, rerun: 64) syz_usb_control_io$uac1(r0, 0x0, 0x0) (rerun: 64) syz_usb_control_io$printer(r0, 0x0, 0x0) (async) r1 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r1, &(0x7f0000000880)={0x2c2, 0x7d, 0x0, {{0x500, 0xfa, 0x0, 0x6a, {0x40}, 0x10000000, 0x2000000, 0x0, 0x0, 0x1f, '\x04nodev{cvfox%\xff\xff\xff\x81\x02\x00'/31, 0x38, 'pJ\x86\xce\xc6\x02\x00}\xfag>\xff\xeb\t\xb55\x1f[\xde\x05@\x00\x00\x00\x00\x18{\x82\x00\xb5\x00\x00;Y_\xcb\x14\x03CT\xb9\xfd\x9e\xf1\x96\xa5\x1c\xd5\x15z\xdc\x81\x06\xb4\x94\xe1', 0x12, '\xfb\xe1a\xe9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf3\x13\xf6\x00', 0x5e, '\xf8\xf6~\xfbqm\xcf1^\xca\xf3\x85@\x9a\xc6[\x94\bg\x9d,;\x9e\x1dR\xc3\xd6\xda\x9b\xf1\x99V\x88\xda\xcel\xde{\xa4\xa4\x00\xb4\xb0\xb4\xdb\xe6Od\xb1\xd6?&ym\xcb\xecI\x86#\xd6\xa88\xc6\x9ai\xdf\xcc\x9c\xddY\x06\xf1t\xa6f\xa8R\x9aEw4\a\xdb\xda\xb2\x88[\xaf\x05\x00\x00\x00\x00\x00'}, 0x1b3, 'odev-n\xb1{#\x00\xf9\xda\xa1\xee#&n\xcf\x85\xfe\xa6^\xb2\xd9y\xa3\xfd\xe5\xf4u\xda\xf0;\x11r\xd9{\xad\xc7\tZ\xfdv\xfeO\x04A\xf7\xf7t\x1e\xac\x03\x00\x00\xec\xff\x00\x00\xdb\xa0\xc2\xf7\xf0\x9f\xf5<~M\x1a\xd6n-\a\x01\x98\x01\x9f0\x11\x84G\xaa\x9at\xf5\x16\x85\xf5\x06\xae\x89H\x06\x87\xbd\x7f=\x7f)\x8dy,J7\xf2\xe1\xcb\xbd$\x82\x92\x9a\r\x89r\xb5\xcfs.\xa5\xb0\xd7#\x85\x01\x00\x00\x00\xae\xd3\xb4.\xe7\xca\xc0}\xe0\x9d\x1dh\xa6\x033\xa8\x82F}+1\xaa\xcd\xf9\xcf>\xe3\x88@\x02\xa9\x1cTR\x8b\x80z\x89\xca\x18M\x16d_\x06\x18\x85I\xb1\x12]lL\x9b\x18\xc2\xfbV\xc5}}\xc6&\xe49\a\x96\xa1\xebH\'Fi\xab\x13\xf8\xb1\x1d\x14`Y\xf3\x10\xe2cMY?\xece\xd5)\xf3\x82\x06fd\xdf$NL\x90W\np\x04\x9f)\x9f\x06\x1fu\xb7y|\xe1\xe4\x11\xea\x91\x8e\xbd\x88\x8c\x1e\x15k\x84V\x93\x1d.\xa7&\xba\x96\t\xd5\x1aA\xdd=\xe3\x04\xbd|~\xd0\xa4V\xf0\xae\x12Qa\x05\xc9G\x8f}\xf5\xa6\xe0\xb6\xa7}Yl\xf8\x8b\xa6\xe5\xc69|}P!\xd7\x98\x95(\xfd\x179\xe1\xc2\xd8\x7f\xff\x00\x00\x00\x00\x00\x00\x00ta\xb0\xcc\xaa\xa1\x93:\x0e\x8a\x82k\x14\xd4\xfc\xb2\x98\x9f\xfa\xaa\x1a\xcf\xfa\x80T\xe9U\x9d\xfa\xe4iz\xa0\v\x03\xb3\xd8\x0eU$\xf8I_\xee~\x8d\x88\xcbZ\x04\x03\x02\xac\xb0\xd1&\x0f%\x84\xdbH\xe8\xd9\x06N\x8c\xe1x\xce9n\x85\xb9~H\x86D@I\x81\x0f%\xf1\xce\xca\x97]\xebI\x1a\x12[\xf0\xd7/\x87\xcc\x10\xb0\x15N\b\x93m\xaa\xdd\x8b\x1e\x97'}}, 0x2c2) (async) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) (async) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f00000005c0)={0x2c, &(0x7f0000000280)={0x40, 0xd}, 0x0, 0x0, 0x0, 0x0}) 97.256723ms ago: executing program 5 (id=2362): openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x10000, &(0x7f0000000300)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x2000}}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000006040), r1) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000006080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000006180)={0x0, 0x0, &(0x7f0000006140)={&(0x7f0000000140)=ANY=[@ANYBLOB="5e99469716ac36", @ANYRES16=r2, @ANYBLOB="11002bbd7000fddbdf250700000008000300", @ANYRES32=r3, @ANYBLOB="0c009900fbffffff2d00000008000500060000001400040070696d726567000000000000000000000800178004000600"], 0x4c}, 0x1, 0x0, 0x0, 0x4}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4008054}}, {{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x400400c0}}], 0x2, 0x0) 0s ago: executing program 5 (id=2363): r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000800)={0x0, 0x0, &(0x7f00008feff0)={&(0x7f0000000380)=ANY=[@ANYBLOB="020101090800000000170006ffffff00030006001000000002000000e0000009f9ff0f0005000000030005007217440502000000e0000001"], 0x40}}, 0x0) sendmsg$key(r0, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020300090a00000000000004000000000300060000000e000a000000e2000009000000000000000002000100000000000000000200000000030005000000000002000000e0000001"], 0x50}}, 0x0) kernel console output (not intermixed with test programs): evice= 0.40 [ 603.434829][ T911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 603.449832][ T911] usb 5-1: Product: syz [ 603.459964][ T911] usb 5-1: Manufacturer: syz [ 603.473480][ T911] usb 5-1: SerialNumber: syz [ 603.518442][ T911] cdc_subset 5-1:1.0: probe with driver cdc_subset failed with error -22 [ 603.536996][ T911] cdc_ncm 5-1:1.0: NCM or ECM functional descriptors missing [ 603.556433][ T911] cdc_ncm 5-1:1.0: bind() failure [ 603.587744][ T911] cdc_subset 5-1:1.1: probe with driver cdc_subset failed with error -22 [ 603.622826][ T911] cdc_ncm 5-1:1.1: CDC Union missing and no IAD found [ 603.636962][ T911] cdc_ncm 5-1:1.1: bind() failure [ 603.713413][ T911] usb 5-1: USB disconnect, device number 72 [ 603.928596][T12794] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1910'. [ 604.281057][ T30] audit: type=1326 audit(1767883879.603:522): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12789 comm="syz.5.1909" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f23539 code=0x0 [ 604.477373][ T911] usb 3-1: new high-speed USB device number 78 using dummy_hcd [ 604.937357][ T911] usb 3-1: Using ep0 maxpacket: 8 [ 604.942290][ T911] usb 3-1: config index 0 descriptor too short (expected 1167, got 821) [ 604.942325][ T911] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 604.942348][ T911] usb 3-1: config 0 has an invalid descriptor of length 128, skipping remainder of the config [ 604.942370][ T911] usb 3-1: config 0 has no interface number 0 [ 604.942415][ T911] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 604.942444][ T911] usb 3-1: config 0 interface 67 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 604.942467][ T911] usb 3-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 604.942492][ T911] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 604.942518][ T911] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x2 has invalid maxpacket 1048, setting to 1024 [ 604.942545][ T911] usb 3-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 604.942569][ T911] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0x6 has invalid maxpacket 7472, setting to 1024 [ 604.942596][ T911] usb 3-1: config 0 interface 67 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1024 [ 604.942621][ T911] usb 3-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0x2, skipping [ 604.942644][ T911] usb 3-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 604.942668][ T911] usb 3-1: config 0 interface 67 altsetting 0 endpoint 0xE has an invalid bInterval 236, changing to 7 [ 604.942695][ T911] usb 3-1: config 0 interface 67 altsetting 0 has 10 endpoint descriptors, different from the interface descriptor's value: 14 [ 604.942740][ T911] usb 3-1: New USB device found, idVendor=045e, idProduct=040a, bcdDevice=7c.8c [ 604.942765][ T911] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.974112][ T911] usb 3-1: config 0 descriptor?? [ 605.008840][T12799] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 605.248135][ T5980] usb 3-1: USB disconnect, device number 78 [ 605.857153][T12813] bond5: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 605.879356][T12813] bond5 (unregistering): Released all slaves [ 606.104327][T12819] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1917'. [ 606.359200][T12829] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1919'. [ 606.368432][T12829] netlink: 16 bytes leftover after parsing attributes in process `syz.2.1919'. [ 606.425073][T12829] kvm: requested 7542 ns i8254 timer period limited to 200000 ns [ 607.656210][T12856] syzkaller0: entered promiscuous mode [ 607.671041][T12856] syzkaller0: entered allmulticast mode [ 607.897800][T12861] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 607.912942][T12861] bond2 (unregistering): Released all slaves [ 608.087462][ T5922] usb 3-1: new high-speed USB device number 79 using dummy_hcd [ 608.107803][T12864] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1930'. [ 608.224047][ T30] audit: type=1326 audit(1767883883.553:523): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.278015][ T30] audit: type=1326 audit(1767883883.593:524): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.287299][ T5922] usb 3-1: Using ep0 maxpacket: 32 [ 608.345412][ T5922] usb 3-1: config index 0 descriptor too short (expected 16420, got 36) [ 608.351292][ T30] audit: type=1326 audit(1767883883.593:525): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.381026][ T5922] usb 3-1: config 0 has an invalid interface number: 116 but max is 0 [ 608.402370][ T5922] usb 3-1: config 0 descriptor has 1 excess byte, ignoring [ 608.425472][ T5922] usb 3-1: config 0 has no interface number 0 [ 608.425535][ T5922] usb 3-1: New USB device found, idVendor=0bfd, idProduct=0113, bcdDevice= 0.f2 [ 608.425630][ T5922] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 608.431862][ T5922] usb 3-1: config 0 descriptor?? [ 608.460932][ T30] audit: type=1326 audit(1767883883.593:526): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.460986][ T30] audit: type=1326 audit(1767883883.593:527): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.461030][ T30] audit: type=1326 audit(1767883883.593:528): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.461077][ T30] audit: type=1326 audit(1767883883.603:529): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.461122][ T30] audit: type=1326 audit(1767883883.603:530): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.461166][ T30] audit: type=1326 audit(1767883883.603:531): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12865 comm="syz.6.1931" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf702d539 code=0x7ffc0000 [ 608.637406][ T5922] usb 3-1: string descriptor 0 read error: -71 [ 608.650134][ T5922] kvaser_usb 3-1:0.116: error -ENODEV: Cannot get usb endpoint(s) [ 608.659826][ T5922] usb 3-1: USB disconnect, device number 79 [ 608.867304][ T7635] usb 5-1: new high-speed USB device number 73 using dummy_hcd [ 609.038992][ T7635] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 609.039023][ T7635] usb 5-1: config 0 has no interface number 0 [ 609.039067][ T7635] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 609.039096][ T7635] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 609.039136][ T7635] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 609.039168][ T7635] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 609.050788][ T7635] usb 5-1: config 0 descriptor?? [ 609.183502][T12886] xt_NFQUEUE: number of total queues is 0 [ 609.394641][T12891] syzkaller0: entered promiscuous mode [ 609.394663][T12891] syzkaller0: entered allmulticast mode [ 609.499205][ T7635] prodikeys 0003:041E:2801.001D: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.4-1/input1 [ 609.507646][ T5922] usb 3-1: new high-speed USB device number 80 using dummy_hcd [ 609.539983][ T7635] hid_prodikeys: hid-prodikeys: failed to find output report [ 609.539983][ T7635] [ 609.668884][ T5922] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 609.668907][ T5922] usb 3-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 609.668928][ T5922] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 609.668956][ T5922] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 609.668973][ T5922] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 609.692130][ T5922] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 609.692155][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 609.692169][ T5922] usb 3-1: Product: syz [ 609.692179][ T5922] usb 3-1: Manufacturer: syz [ 609.705330][ T5922] cdc_wdm 3-1:1.0: skipping garbage [ 609.705346][ T5922] cdc_wdm 3-1:1.0: skipping garbage [ 609.709644][ T5922] cdc_wdm 3-1:1.0: cdc-wdm0: USB WDM device [ 609.709737][ T5922] cdc_wdm 3-1:1.0: Unknown control protocol [ 609.713861][ T5922] usb 5-1: USB disconnect, device number 73 [ 609.908953][T12898] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 609.909463][T12898] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 609.978482][ T7635] usb 3-1: USB disconnect, device number 80 [ 610.218067][T12906] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 610.235325][T12906] bond2 (unregistering): Released all slaves [ 610.287122][T12910] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1944'. [ 610.428679][ T7635] usb 3-1: new low-speed USB device number 81 using dummy_hcd [ 610.494176][T12916] xt_CT: You must specify a L4 protocol and not use inversions on it [ 610.548149][T12916] netlink: 188 bytes leftover after parsing attributes in process `syz.6.1940'. [ 610.597352][ T7635] usb 3-1: Invalid ep0 maxpacket: 32 [ 610.727359][ T7635] usb 3-1: new low-speed USB device number 82 using dummy_hcd [ 610.997838][ T7635] usb 3-1: Invalid ep0 maxpacket: 32 [ 611.007537][ T7635] usb usb3-port1: attempt power cycle [ 611.107400][ T911] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 611.210685][T12927] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1948'. [ 611.313071][ T911] usb 6-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 611.329454][ T911] usb 6-1: config 27 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 611.349725][ T911] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 611.377667][ T7635] usb 3-1: new low-speed USB device number 83 using dummy_hcd [ 611.387593][ T911] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 611.419466][ T911] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 611.427835][ T7635] usb 3-1: Invalid ep0 maxpacket: 32 [ 611.444088][ T911] usb 6-1: invalid MIDI out EP 0 [ 611.507344][ T5902] usb 4-1: new high-speed USB device number 107 using dummy_hcd [ 611.568754][ T7635] usb 3-1: new low-speed USB device number 84 using dummy_hcd [ 611.609524][ T7635] usb 3-1: Invalid ep0 maxpacket: 32 [ 611.642629][ T7635] usb usb3-port1: unable to enumerate USB device [ 611.662214][ T911] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -22 [ 611.688005][ T5902] usb 4-1: Using ep0 maxpacket: 8 [ 611.704351][ T5902] usb 4-1: unable to get BOS descriptor or descriptor too short [ 611.723600][ T5902] usb 4-1: config index 0 descriptor too short (expected 16420, got 36) [ 611.733927][ T5902] usb 4-1: config 7 has an invalid interface number: 6 but max is 0 [ 611.742278][ T5902] usb 4-1: config 7 has no interface number 0 [ 611.748755][ T5902] usb 4-1: config 7 interface 6 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 611.764841][ T5902] usb 4-1: config 7 interface 6 has no altsetting 0 [ 611.778301][ T5902] usb 4-1: New USB device found, idVendor=1a8d, idProduct=100d, bcdDevice=10.9e [ 611.787975][ T5902] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 611.796393][ T5902] usb 4-1: Product: syz [ 611.801440][ T5902] usb 4-1: Manufacturer: syz [ 611.806199][ T5902] usb 4-1: SerialNumber: syz [ 612.725963][ T30] kauditd_printk_skb: 5 callbacks suppressed [ 612.725985][ T30] audit: type=1804 audit(1767883888.053:537): pid=12929 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.6.1949" name="/newroot/97/file1" dev="tmpfs" ino=518 res=1 errno=0 [ 612.844306][T12931] syzkaller0: entered promiscuous mode [ 612.851169][T12931] syzkaller0: entered allmulticast mode [ 613.247082][T12933] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 613.266824][T12933] bond2 (unregistering): Released all slaves [ 613.554390][ T5832] usb 6-1: USB disconnect, device number 50 [ 613.805912][T12947] netlink: 'syz.5.1954': attribute type 8 has an invalid length. [ 613.816375][T12947] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1954'. [ 613.826111][T12947] netlink: 'syz.5.1954': attribute type 7 has an invalid length. [ 613.834374][T12947] netlink: 'syz.5.1954': attribute type 8 has an invalid length. [ 613.842738][T12947] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1954'. [ 613.868858][T12949] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1955'. [ 613.968566][T12947] ip6gretap0: entered promiscuous mode [ 613.988727][T12947] syz_tun: entered promiscuous mode [ 614.057663][T12947] gretap0: entered promiscuous mode [ 614.730707][ T5902] option 4-1:7.6: GSM modem (1-port) converter detected [ 614.769308][ T5902] usb 4-1: USB disconnect, device number 107 [ 614.800881][ T5902] option 4-1:7.6: device disconnected [ 614.948606][T12960] netlink: 'syz.3.1959': attribute type 1 has an invalid length. [ 615.024274][T12960] workqueue: Failed to create a rescuer kthread for wq "bond5": -EINTR [ 615.061542][T12967] syzkaller0: entered promiscuous mode [ 615.099345][T12967] syzkaller0: entered allmulticast mode [ 615.111069][T12971] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1952'. [ 615.138784][T12970] netlink: 60 bytes leftover after parsing attributes in process `syz.4.1952'. [ 615.173974][T12975] program syz.3.1963 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 615.183800][T12975] sd 0:0:1:0: ioctl_internal_command: ILLEGAL REQUEST asc=0x20 ascq=0x0 [ 615.193108][T12974] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1963'. [ 615.224071][T12974] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1963'. [ 615.234177][T12974] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1963'. [ 615.245039][T12974] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1963'. [ 615.263980][T12974] netlink: 64 bytes leftover after parsing attributes in process `syz.3.1963'. [ 615.278237][ T5902] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 615.333633][T12974] 8021q: adding VLAN 0 to HW filter on device bond0 [ 615.345015][T12974] 8021q: adding VLAN 0 to HW filter on device team0 [ 615.369420][T12974] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 615.414047][T12977] bond5: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 615.440915][ T5902] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 615.457821][ T5902] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 615.469521][T12977] bond5 (unregistering): Released all slaves [ 615.493723][ T5902] usb 6-1: config 0 descriptor?? [ 615.532958][ T5902] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 615.540817][T12981] vlan3: entered promiscuous mode [ 615.546871][T12981] dummy0: entered promiscuous mode [ 615.933711][ T5902] cpia1 6-1:0.0: unexpected state after lo power cmd: 00 [ 616.067378][ T5832] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 616.237641][ T5832] usb 4-1: Using ep0 maxpacket: 32 [ 616.246463][ T5832] usb 4-1: config 0 interface 0 altsetting 74 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 616.271737][ T5832] usb 4-1: config 0 interface 0 altsetting 74 endpoint 0x81 has invalid wMaxPacketSize 0 [ 616.285001][ T5832] usb 4-1: config 0 interface 0 has no altsetting 0 [ 616.293348][ T5832] usb 4-1: New USB device found, idVendor=18b1, idProduct=0037, bcdDevice= 0.00 [ 616.306330][ T5832] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 616.318986][ T5832] usb 4-1: config 0 descriptor?? [ 616.331346][T13013] syzkaller0: entered promiscuous mode [ 616.342671][T13013] syzkaller0: entered allmulticast mode [ 616.535323][T13018] xt_socket: unknown flags 0x50 [ 616.704214][T13024] bond3: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 616.718016][T13024] bond3 (unregistering): Released all slaves [ 616.822293][ T5832] petalynx 0003:18B1:0037.001E: unknown main item tag 0x0 [ 616.843066][ T5832] petalynx 0003:18B1:0037.001E: unknown main item tag 0x0 [ 616.858261][ T5832] petalynx 0003:18B1:0037.001E: unknown main item tag 0x0 [ 616.870092][ T5832] petalynx 0003:18B1:0037.001E: hidraw0: USB HID v0.00 Device [HID 18b1:0037] on usb-dummy_hcd.3-1/input0 [ 616.907673][ T911] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 617.025100][ T7635] usb 4-1: USB disconnect, device number 108 [ 617.069737][ T911] usb 5-1: Using ep0 maxpacket: 32 [ 617.092073][ T911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 617.127476][ T911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 617.147661][ T5902] gspca_cpia1: usb_control_msg 02, error -110 [ 617.156975][ T911] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 617.168970][ T5902] gspca_cpia1: usb_control_msg 05, error -32 [ 617.179892][ T5902] gspca_cpia1: usb_control_msg 05, error -32 [ 617.196059][ T911] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 617.204721][ T5902] gspca_cpia1: usb_control_msg 05, error -32 [ 617.215869][ T5902] gspca_cpia1: usb_control_msg 05, error -32 [ 617.224410][ T911] usb 5-1: config 0 descriptor?? [ 617.236594][ T5902] cpia1 6-1:0.0: unexpected systemstate: 00 [ 617.463354][ T30] audit: type=1326 audit(1767883892.793:538): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 617.668182][ T911] savu 0003:1E7D:2D5A.001F: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.4-1/input0 [ 618.004245][ T911] usb 6-1: USB disconnect, device number 51 [ 618.041185][T13054] mac80211_hwsim hwsim14 syzkaller0: entered promiscuous mode [ 618.065211][T13054] mac80211_hwsim hwsim14 syzkaller0: entered allmulticast mode [ 618.077479][ T5980] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 618.271692][ T5980] usb 4-1: config 0 has no interfaces? [ 618.288244][ T5980] usb 4-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice= 0.00 [ 618.301293][ T5980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.313484][ T5980] usb 4-1: Product: syz [ 618.318101][ T5980] usb 4-1: Manufacturer: syz [ 618.322983][ T5980] usb 4-1: SerialNumber: syz [ 618.337338][ T911] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 618.337962][ T5980] usb 4-1: config 0 descriptor?? [ 618.409770][ T30] audit: type=1326 audit(1767883893.743:539): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.455101][ T30] audit: type=1326 audit(1767883893.743:540): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.483061][ T30] audit: type=1326 audit(1767883893.743:541): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.541220][T13064] ip6t_REJECT: ECHOREPLY is not supported [ 618.570759][ T30] audit: type=1326 audit(1767883893.743:542): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.595914][ T30] audit: type=1326 audit(1767883893.743:543): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.706411][ T911] usb 3-1: unable to get BOS descriptor or descriptor too short [ 618.720744][ T30] audit: type=1326 audit(1767883893.743:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.745827][ T30] audit: type=1326 audit(1767883893.743:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.773741][ T911] usb 3-1: config 66 interface 0 has no altsetting 0 [ 618.786023][ T911] usb 3-1: New USB device found, idVendor=0471, idProduct=0602, bcdDevice=a4.95 [ 618.795591][ T30] audit: type=1326 audit(1767883893.743:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.819715][ T911] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 618.834654][ T911] usb 3-1: Product: syz [ 618.842922][ T911] usb 3-1: Manufacturer: syz [ 618.849401][ T911] usb 3-1: SerialNumber: syz [ 618.856683][ T30] audit: type=1326 audit(1767883893.743:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 618.882440][ T30] audit: type=1326 audit(1767883893.743:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13037 comm="syz.6.1982" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702d539 code=0x7fc00000 [ 619.017344][ T5902] usb 5-1: reset high-speed USB device number 74 using dummy_hcd [ 619.536961][T13072] __nla_validate_parse: 31 callbacks suppressed [ 619.536986][T13072] netlink: 20 bytes leftover after parsing attributes in process `syz.6.1991'. [ 619.670533][ T911] ati_remote2 3-1:66.0: ati_remote2_probe(): interface 0 must have an endpoint [ 619.706186][ T911] usb 3-1: USB disconnect, device number 85 [ 620.171020][T13083] netlink: 'syz.2.1994': attribute type 1 has an invalid length. [ 620.303084][T13083] 8021q: adding VLAN 0 to HW filter on device bond3 [ 620.458517][T13085] gretap1: entered promiscuous mode [ 620.486968][T13085] bond3: (slave gretap1): making interface the new active one [ 620.501241][ T7635] usb 5-1: USB disconnect, device number 74 [ 620.510473][T13085] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 620.595100][T13089] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1994'. [ 620.687658][ T7635] usb 5-1: new full-speed USB device number 75 using dummy_hcd [ 620.750057][ T5902] usb 4-1: USB disconnect, device number 109 [ 620.881169][ T7635] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 620.922957][ T7635] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 127, setting to 64 [ 620.950175][ T7635] usb 5-1: config 27 interface 0 altsetting 0 endpoint 0xB has invalid maxpacket 35185, setting to 64 [ 620.980146][ T7635] usb 5-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 620.998453][ T7635] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.080473][T13081] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 621.131200][T13081] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 621.195939][ T7635] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 621.379153][T13099] syzkaller0: entered promiscuous mode [ 621.384779][T13099] syzkaller0: entered allmulticast mode [ 621.397355][ T5840] Bluetooth: hci3: command 0x0406 tx timeout [ 621.682027][T13108] [U] [ 621.684963][T13108] [U] [ 621.687686][T13108] [U] [ 621.690407][T13108] [U] [ 621.702218][T13108] [U] [ 621.704987][T13108] [U] [ 621.707711][T13108] [U] [ 621.710428][T13108] [U] [ 621.714621][T13108] [U] [ 621.717353][T13108] [U] [ 621.720086][T13108] [U] [ 621.752197][T13110] [U] [ 621.767467][ T7635] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 621.945824][ T7635] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 621.962406][ T7635] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 621.978490][ T7635] usb 6-1: Product: syz [ 621.985332][ T7635] usb 6-1: Manufacturer: syz [ 621.993652][ T7635] usb 6-1: SerialNumber: syz [ 622.006209][ T7635] usb 6-1: config 0 descriptor?? [ 622.067284][ T5902] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 622.221560][ T7635] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 622.230779][ T5902] usb 4-1: Using ep0 maxpacket: 32 [ 622.240413][ T5902] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 622.251352][ T5902] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 622.260464][ T5902] usb 4-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 622.280362][ T5902] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 622.290240][ T5902] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 622.327596][ T5902] usb 4-1: Product: syz [ 622.332824][ T5902] usb 4-1: Manufacturer: syz [ 622.351453][ T5902] usb 4-1: SerialNumber: syz [ 622.379415][ T5902] cdc_ncm 4-1:1.0: invalid descriptor buffer length [ 622.389896][ T5902] cdc_ncm 4-1:1.0: CDC Union missing and no IAD found [ 622.400340][ T5902] cdc_ncm 4-1:1.0: bind() failure [ 622.523706][T13120] ALSA: seq fatal error: cannot create timer (-19) [ 622.591914][ T5922] usb 4-1: USB disconnect, device number 110 [ 622.907334][ T5922] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 623.059526][ T5922] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has an invalid bInterval 0, changing to 7 [ 623.072941][ T5922] usb 3-1: New USB device found, idVendor=2040, idProduct=5530, bcdDevice=a8.82 [ 623.083264][ T5922] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 623.094322][ T5922] usb 3-1: config 0 descriptor?? [ 623.104141][ T5922] smsusb:smsusb_probe: board id=8, interface number 0 [ 623.124052][ T5922] smsusb:smsusb_probe: Device initialized with return code -19 [ 623.192341][ T5902] usb 5-1: USB disconnect, device number 75 [ 623.326716][T13125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 623.350105][T13125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 623.370972][ T5922] usb 3-1: USB disconnect, device number 86 [ 623.510054][T13136] syzkaller0: entered promiscuous mode [ 623.515615][T13136] syzkaller0: entered allmulticast mode [ 623.843707][ T7635] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 623.864753][ T7635] usb 6-1: USB disconnect, device number 52 [ 624.019300][T13155] syzkaller0: entered promiscuous mode [ 624.024803][T13155] syzkaller0: entered allmulticast mode [ 624.434335][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.440862][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.488936][ T5922] usb 3-1: new high-speed USB device number 87 using dummy_hcd [ 624.662519][T13169] fuse: Unknown parameter 'grou;p' [ 624.680060][ T5922] usb 3-1: config 64 has an invalid interface number: 39 but max is 0 [ 624.701622][ T5922] usb 3-1: config 64 has no interface number 0 [ 624.728256][ T5922] usb 3-1: config 64 interface 39 altsetting 0 endpoint 0xE has invalid maxpacket 1024, setting to 64 [ 624.737749][T13169] delete_channel: no stack [ 624.770372][ T5922] usb 3-1: New USB device found, idVendor=fff0, idProduct=fff0, bcdDevice=71.df [ 624.797489][ T5922] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 624.825926][ T5922] usb 3-1: Product: syz [ 624.828683][T13174] syzkaller0: entered promiscuous mode [ 624.835887][T13174] syzkaller0: entered allmulticast mode [ 624.841539][ T5922] usb 3-1: Manufacturer: syz [ 624.864423][ T5922] usb 3-1: SerialNumber: syz [ 624.901259][ T5922] usbtest 3-1:64.39: couldn't get endpoints, -22 [ 624.919570][ T5922] usbtest 3-1:64.39: probe with driver usbtest failed with error -22 [ 625.121326][ T10] usb 3-1: USB disconnect, device number 87 [ 625.654599][T13196] xt_TPROXY: Can be used only with -p tcp or -p udp [ 625.785417][T13200] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 625.878974][T13200] bond2 (unregistering): Released all slaves [ 626.471617][T13229] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 626.816704][T13233] fuse: Bad value for 'fd' [ 627.459566][T13245] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2042'. [ 627.498884][T13244] netlink: 52 bytes leftover after parsing attributes in process `syz.2.2044'. [ 627.576500][T13239] 8021q: adding VLAN 0 to HW filter on device bond5 [ 627.617328][T13245] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2042'. [ 627.677890][T13245] bond0: left promiscuous mode [ 627.685629][T13245] 8021q: adding VLAN 0 to HW filter on device bond0 [ 627.723011][T13245] bond5: (slave bond0): Enslaving as an active interface with a down link [ 627.838826][T13253] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 627.853128][T13253] bond6 (unregistering): Released all slaves [ 627.992478][ T5902] usb 4-1: new full-speed USB device number 111 using dummy_hcd [ 628.217581][ T5902] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 628.231020][ T5902] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 628.254748][ T5902] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.00 [ 628.274344][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 628.294538][ T5902] usb 4-1: SerialNumber: syz [ 628.328778][ T5902] usb 4-1: 0:2 : does not exist [ 628.547683][ T24] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 628.576805][ T5902] usb 4-1: USB disconnect, device number 111 [ 628.587477][ T7635] usb 3-1: new high-speed USB device number 88 using dummy_hcd [ 628.708569][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 628.732948][ T24] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 628.767855][ T24] usb 5-1: config 0 has no interface number 0 [ 628.774058][ T24] usb 5-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 628.787644][ T7635] usb 3-1: Using ep0 maxpacket: 32 [ 628.794704][ T7635] usb 3-1: config 0 has an invalid interface number: 128 but max is 0 [ 628.837313][ T7635] usb 3-1: config 0 has no interface number 0 [ 628.843851][ T24] usb 5-1: config 0 interface 1 has no altsetting 0 [ 628.850762][ T7635] usb 3-1: config 0 interface 128 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 628.897406][ T7635] usb 3-1: config 0 interface 128 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 628.908454][ T24] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 628.934387][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 628.947699][ T7635] usb 3-1: config 0 interface 128 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 628.969745][ T24] usb 5-1: Product: syz [ 628.973971][ T24] usb 5-1: Manufacturer: syz [ 628.989679][ T7635] usb 3-1: New USB device found, idVendor=0543, idProduct=e621, bcdDevice= 0.00 [ 628.999616][ T24] usb 5-1: SerialNumber: syz [ 629.006441][ T24] usb 5-1: config 0 descriptor?? [ 629.026209][ T7635] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.054633][ T7635] usb 3-1: config 0 descriptor?? [ 629.127316][ T5902] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 629.177310][ T10] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 629.260594][ T24] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 629.274612][ T24] cx231xx 5-1:0.1: Failed to read PCB config [ 629.284625][ T24] cx231xx 5-1:0.1: probe with driver cx231xx failed with error -71 [ 629.293220][ T5902] usb 4-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 629.305831][ T5902] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.315508][ T24] usb 5-1: USB disconnect, device number 76 [ 629.345768][ T5902] usb 4-1: config 0 descriptor?? [ 629.367914][ T10] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 629.370773][ T5902] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 629.381304][ T10] usb 6-1: New USB device found, idVendor=0979, idProduct=0227, bcdDevice=6d.4d [ 629.407428][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 629.418906][ T10] usb 6-1: config 0 descriptor?? [ 629.430609][ T10] gspca_main: jl2005bcd-2.14.0 probing 0979:0227 [ 629.438048][ T10] command write [95] error -22 [ 629.637134][ T10] usb 6-1: USB disconnect, device number 53 [ 629.667731][ T7635] hid (null): report_id 31543 is invalid [ 629.672634][ T7635] viewsonic 0003:0543:E621.0020: unknown main item tag 0x6 [ 629.672663][ T7635] viewsonic 0003:0543:E621.0020: report_id 31543 is invalid [ 629.672674][ T7635] viewsonic 0003:0543:E621.0020: item 0 2 1 8 parsing failed [ 629.673364][ T7635] viewsonic 0003:0543:E621.0020: probe with driver viewsonic failed with error -22 [ 629.808430][ T5902] gspca_cpia1: usb_control_msg 05, error -71 [ 629.819804][ T24] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 629.829090][ T5902] gspca_cpia1: usb_control_msg 01, error -71 [ 629.835176][ T5902] cpia1 4-1:0.0: only firmware version 1 is supported (got: 0) [ 629.847961][ T5902] usb 4-1: USB disconnect, device number 112 [ 629.987294][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 629.994237][ T24] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 630.002872][ T24] usb 5-1: config 0 has no interface number 0 [ 630.009106][ T24] usb 5-1: config 0 interface 1 altsetting 9 has an invalid descriptor for endpoint zero, skipping [ 630.020429][ T24] usb 5-1: config 0 interface 1 has no altsetting 0 [ 630.029329][ T24] usb 5-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 630.038723][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 630.046824][ T24] usb 5-1: Product: syz [ 630.052123][ T24] usb 5-1: Manufacturer: syz [ 630.056776][ T24] usb 5-1: SerialNumber: syz [ 630.064539][ T24] usb 5-1: config 0 descriptor?? [ 630.586613][T13299] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 630.607786][T13299] bond2 (unregistering): Released all slaves [ 631.007314][T10863] usb 6-1: new full-speed USB device number 54 using dummy_hcd [ 631.180327][T10863] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 631.191433][T10863] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 631.203151][T10863] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10 [ 631.214295][T10863] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 631.224309][T10863] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 631.241240][T10863] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 631.250673][T10863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 631.259292][T10863] usb 6-1: Product: syz [ 631.263627][T10863] usb 6-1: Manufacturer: syz [ 631.268363][T10863] usb 6-1: SerialNumber: syz [ 631.276181][T10863] usb 6-1: config 0 descriptor?? [ 631.373389][ T10] usb 3-1: USB disconnect, device number 88 [ 631.490618][T10863] radio-si470x 6-1:0.0: DeviceID=0xaa61 ChipID=0x43dd [ 631.537416][ T24] cx231xx 5-1:0.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 631.573011][ T24] cx231xx 5-1:0.1: Failed to read PCB config [ 631.593351][ T24] cx231xx 5-1:0.1: probe with driver cx231xx failed with error -71 [ 631.632963][ T24] usb 5-1: USB disconnect, device number 77 [ 631.692376][T13304] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2061'. [ 631.764189][T13315] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2066'. [ 631.776728][T13315] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2066'. [ 631.796754][T13315] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2066'. [ 631.811350][T13315] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2066'. [ 631.823159][T13315] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2066'. [ 631.827472][ T10] usb 3-1: new high-speed USB device number 89 using dummy_hcd [ 631.855009][T13317] misc userio: Invalid payload size [ 632.007439][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 632.015672][ T10] usb 3-1: config 0 has an invalid interface number: 55 but max is 0 [ 632.024671][ T10] usb 3-1: config 0 has no interface number 0 [ 632.031227][ T10] usb 3-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 632.037872][T10863] radio-si470x 6-1:0.0: si470x_get_report: usb_control_msg returned -110 [ 632.042577][ T10] usb 3-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 632.065603][T10863] radio-si470x 6-1:0.0: si470x_get_scratch: si470x_get_report returned -110 [ 632.091068][T10863] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -5 [ 632.111076][ T10] usb 3-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 632.143165][ T10] usb 3-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 632.160888][ T10] usb 3-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 632.170947][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 632.199612][ T10] usb 3-1: config 0 descriptor?? [ 632.223745][ T10] ldusb 3-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 632.429875][T10863] usb 3-1: USB disconnect, device number 89 [ 632.435859][ C1] ldusb 3-1:0.55: usb_submit_urb failed (-19) [ 632.468331][T10863] ldusb 3-1:0.55: LD USB Device #0 now disconnected [ 632.903869][T10863] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 632.942048][ T24] usb 6-1: USB disconnect, device number 54 [ 633.109733][T10863] usb 5-1: unable to get BOS descriptor or descriptor too short [ 633.141444][T10863] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 633.183431][T10863] usb 5-1: config 1 has no interface number 1 [ 633.207370][T10863] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 633.284594][T10863] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 633.347137][T10863] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 633.354113][T13335] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2070'. [ 633.379783][T13339] bond4: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 633.391751][T10863] usb 5-1: Product: syz [ 633.438618][T13339] bond4 (unregistering): Released all slaves [ 633.489334][T10863] usb 5-1: Manufacturer: syz [ 633.494038][T10863] usb 5-1: SerialNumber: syz [ 633.625514][T13335] veth0: entered promiscuous mode [ 633.657981][T13335] macvtap1: entered promiscuous mode [ 633.663939][T13335] macvtap1: entered allmulticast mode [ 633.671860][T13335] veth0: entered allmulticast mode [ 633.779536][T13329] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 633.841438][T13329] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 633.872169][T10863] usb 5-1: 2:1 : invalid UAC_AS_GENERAL desc [ 633.914075][T10863] usb 5-1: USB disconnect, device number 78 [ 633.958552][T13331] loop5: detected capacity change from 0 to 14 [ 633.987312][ T24] usb 3-1: new high-speed USB device number 90 using dummy_hcd [ 633.989775][T13331] Dev loop5: unable to read RDB block 14 [ 634.054691][T13332] netlink: 'syz.3.2069': attribute type 4 has an invalid length. [ 634.073880][T13331] loop5: unable to read partition table [ 634.097611][T13332] netlink: 17 bytes leftover after parsing attributes in process `syz.3.2069'. [ 634.110685][T13331] loop5: partition table beyond EOD, truncated [ 634.129820][ T24] usb 3-1: device descriptor read/64, error -71 [ 634.137382][T13331] loop_reread_partitions: partition scan of loop5 (被x ) failed (rc=-5) [ 634.397537][ T24] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 634.447531][T10863] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 634.557885][ T24] usb 3-1: device descriptor read/64, error -71 [ 634.630976][T13361] netlink: 212368 bytes leftover after parsing attributes in process `syz.4.2076'. [ 634.642846][T10863] usb 6-1: Using ep0 maxpacket: 32 [ 634.655377][T10863] usb 6-1: too many configurations: 212, using maximum allowed: 8 [ 634.690689][T10863] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 634.699072][ T24] usb usb3-port1: attempt power cycle [ 634.735515][T10863] usb 6-1: can't read configurations, error -61 [ 634.887388][T10863] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 635.067361][T10863] usb 6-1: Using ep0 maxpacket: 32 [ 635.077929][ T24] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 635.089259][T10863] usb 6-1: too many configurations: 212, using maximum allowed: 8 [ 635.106998][T10863] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 635.118456][ T24] usb 3-1: device descriptor read/8, error -71 [ 635.129684][T10863] usb 6-1: can't read configurations, error -61 [ 635.138175][ T7635] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 635.155721][T10863] usb usb6-port1: attempt power cycle [ 635.290070][ T7635] usb 5-1: device descriptor read/64, error -71 [ 635.377369][ T24] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 635.421672][ T24] usb 3-1: device descriptor read/8, error -71 [ 635.508897][T10863] usb 6-1: new high-speed USB device number 57 using dummy_hcd [ 635.547629][ T7635] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 635.555865][ T24] usb usb3-port1: unable to enumerate USB device [ 635.564451][T10863] usb 6-1: Using ep0 maxpacket: 32 [ 635.579308][T10863] usb 6-1: too many configurations: 212, using maximum allowed: 8 [ 635.606148][T10863] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 635.624753][T10863] usb 6-1: can't read configurations, error -61 [ 635.709747][ T7635] usb 5-1: device descriptor read/64, error -71 [ 635.767338][T10863] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 635.799564][T10863] usb 6-1: Using ep0 maxpacket: 32 [ 635.819321][T10863] usb 6-1: too many configurations: 212, using maximum allowed: 8 [ 635.827696][ T7635] usb usb5-port1: attempt power cycle [ 635.849788][T10863] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 635.874039][T10863] usb 6-1: can't read configurations, error -61 [ 635.892836][T10863] usb usb6-port1: unable to enumerate USB device [ 636.197705][ T7635] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 636.247930][ T7635] usb 5-1: device descriptor read/8, error -71 [ 636.457368][ T10] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 636.517317][ T7635] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 636.538060][ T7635] usb 5-1: device descriptor read/8, error -71 [ 636.587509][ T10] usb 4-1: device descriptor read/64, error -71 [ 636.648417][ T7635] usb usb5-port1: unable to enumerate USB device [ 636.827611][ T10] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 636.957273][ T10] usb 4-1: device descriptor read/64, error -71 [ 637.013511][T13380] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2082'. [ 637.043166][T13380] 8021q: adding VLAN 0 to HW filter on device bond2 [ 637.056398][T13381] macvlan2: entered promiscuous mode [ 637.062769][T13381] macvlan2: entered allmulticast mode [ 637.069009][ T10] usb usb4-port1: attempt power cycle [ 637.080844][T13380] bond2: (slave gtp0): refused to change device type [ 637.099102][T13381] bridge0: port 3(vlan2) entered blocking state [ 637.105718][T13381] bridge0: port 3(vlan2) entered disabled state [ 637.112711][T13381] vlan2: entered allmulticast mode [ 637.119215][T13381] bridge0: entered allmulticast mode [ 637.127898][T13381] vlan2: left allmulticast mode [ 637.133125][T13381] bridge0: left allmulticast mode [ 637.165408][T13380] bond2: (slave gtp0): refused to change device type [ 637.185421][T13381] bridge0: port 3(vlan2) entered blocking state [ 637.192117][T13381] bridge0: port 3(vlan2) entered disabled state [ 637.200200][T13381] vlan2: entered allmulticast mode [ 637.205545][T13381] bridge0: entered allmulticast mode [ 637.214838][T13381] vlan2: left allmulticast mode [ 637.220236][T13381] bridge0: left allmulticast mode [ 637.282692][T13380] bond2: (slave gtp0): refused to change device type [ 637.326004][ T30] kauditd_printk_skb: 57 callbacks suppressed [ 637.326025][ T30] audit: type=1326 audit(1767883912.653:606): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.355865][T13381] bridge0: port 3(vlan2) entered blocking state [ 637.364960][T13381] bridge0: port 3(vlan2) entered disabled state [ 637.377100][T13381] vlan2: entered allmulticast mode [ 637.382860][T13381] bridge0: entered allmulticast mode [ 637.400735][T13381] vlan2: left allmulticast mode [ 637.405696][T13381] bridge0: left allmulticast mode [ 637.410953][ T30] audit: type=1326 audit(1767883912.653:607): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=429 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.417274][ T10] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 637.456459][ T30] audit: type=1326 audit(1767883912.653:608): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.461234][ T10] usb 4-1: device descriptor read/8, error -71 [ 637.479400][ T30] audit: type=1326 audit(1767883912.653:609): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.479461][ T30] audit: type=1326 audit(1767883912.693:610): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.479508][ T30] audit: type=1326 audit(1767883912.693:611): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f23567 code=0x7ffc0000 [ 637.479561][ T30] audit: type=1326 audit(1767883912.693:612): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.581050][ T30] audit: type=1326 audit(1767883912.693:613): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.610844][T13380] bond2: (slave gtp0): refused to change device type [ 637.682115][ T30] audit: type=1326 audit(1767883912.703:614): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 637.747784][ T30] audit: type=1326 audit(1767883912.703:615): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13384 comm="syz.5.2083" exe="/root/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf7f23567 code=0x7ffc0000 [ 637.773356][ T10] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 637.799174][T13381] bridge0: port 3(vlan2) entered blocking state [ 637.808516][T13381] bridge0: port 3(vlan2) entered disabled state [ 637.815159][T13381] vlan2: entered allmulticast mode [ 637.829120][ T10] usb 4-1: device descriptor read/8, error -71 [ 637.839718][T13381] bridge0: entered allmulticast mode [ 637.848926][T13381] vlan2: left allmulticast mode [ 637.853858][T13381] bridge0: left allmulticast mode [ 637.888452][T13380] bond2: (slave gtp0): refused to change device type [ 637.948054][ T10] usb usb4-port1: unable to enumerate USB device [ 637.977281][ T5922] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 638.154346][ T5922] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 638.207366][ T5922] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 638.252041][ T5922] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 638.283813][ T5922] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 638.305344][ T5922] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 638.330180][ T5922] usb 6-1: config 0 descriptor?? [ 638.344714][T13387] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 638.627480][ T10] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 638.770790][ T5922] plantronics 0003:047F:FFFF.0021: reserved main item tag 0xd [ 638.784946][ T5922] plantronics 0003:047F:FFFF.0021: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 638.803358][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 638.819270][ T10] usb 5-1: config 1 interface 0 altsetting 7 endpoint 0x81 has invalid wMaxPacketSize 0 [ 638.847026][ T10] usb 5-1: config 1 interface 0 has no altsetting 0 [ 638.869400][ T10] usb 5-1: New USB device found, idVendor=0458, idProduct=5013, bcdDevice= 0.40 [ 638.886104][ T10] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 638.898955][ T10] usb 5-1: Product: Љ [ 638.903089][ T10] usb 5-1: Manufacturer: ኞ廗麡뮋ᙊዹꁥ糋聁鋐䀃柛冇嵜띫쬒㞻ᷦ [ 638.913559][ T10] usb 5-1: SerialNumber: 揖뱞Ừ䶍ﯝ㯇譋緽鑇臤웳䴭 [ 638.969712][ T7635] usb 6-1: USB disconnect, device number 59 [ 639.350391][ T10] usbhid 5-1:1.0: can't add hid device: -71 [ 639.368804][ T10] usbhid 5-1:1.0: probe with driver usbhid failed with error -71 [ 639.401678][ T10] usb 5-1: USB disconnect, device number 83 [ 639.918993][ T7635] usb 4-1: new high-speed USB device number 117 using dummy_hcd [ 640.111003][ T7635] usb 4-1: config 0 has an invalid interface number: 42 but max is 0 [ 640.131147][ T7635] usb 4-1: config 0 has no interface number 0 [ 640.151310][ T7635] usb 4-1: New USB device found, idVendor=04cb, idProduct=0100, bcdDevice= 0.ae [ 640.186373][ T7635] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.219798][ T7635] usb 4-1: config 0 descriptor?? [ 640.250376][ T7635] usb-storage 4-1:0.42: USB Mass Storage device detected [ 640.283350][ T7635] usb-storage 4-1:0.42: Quirks match for vid 04cb pid 0100: 9 [ 640.291803][ T7635] usb-storage 4-1:0.42: This device (04cb,0100,00ae S 04 P e0) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 640.291803][ T7635] Please send a copy of this message to and [ 640.377350][ T10] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 640.435937][T13443] TCP: request_sock_subflow_v6: Possible SYN flooding on port [fe80::aa]:20002. Sending cookies. [ 640.565668][ T10] usb 5-1: Using ep0 maxpacket: 32 [ 640.582141][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 640.595235][ T10] usb 5-1: New USB device found, idVendor=0525, idProduct=2888, bcdDevice=d0.43 [ 640.635331][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.648414][ T5840] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 640.660035][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 640.747845][ T5840] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 640.756567][ T5840] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 640.765010][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 640.780051][ T10] usb 5-1: config 0 descriptor?? [ 641.007988][ T10] cdc_subset 5-1:0.0: probe with driver cdc_subset failed with error -22 [ 641.236406][T13450] chnl_net:caif_netlink_parms(): no params data found [ 641.475825][T13450] bridge0: port 1(bridge_slave_0) entered blocking state [ 641.496230][T13450] bridge0: port 1(bridge_slave_0) entered disabled state [ 641.528488][T13450] bridge_slave_0: entered allmulticast mode [ 641.536038][T13450] bridge_slave_0: entered promiscuous mode [ 641.546118][T13450] bridge0: port 2(bridge_slave_1) entered blocking state [ 641.554304][T13450] bridge0: port 2(bridge_slave_1) entered disabled state [ 641.565573][T13450] bridge_slave_1: entered allmulticast mode [ 641.581866][T13450] bridge_slave_1: entered promiscuous mode [ 641.614641][T13450] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 641.627149][T13450] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 641.666570][T13450] team0: Port device team_slave_0 added [ 641.678452][T13450] team0: Port device team_slave_1 added [ 641.731229][T13450] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 641.738565][T13450] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 641.765274][T13450] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 641.781561][T13450] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 641.794341][T13450] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 641.798781][T13460] netlink: 'syz.5.2106': attribute type 10 has an invalid length. [ 641.821391][T13450] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 641.847776][T13460] team0: Port device netdevsim0 added [ 641.855240][T13461] netlink: 'syz.5.2106': attribute type 10 has an invalid length. [ 641.867067][T13461] team0: Port device netdevsim0 removed [ 641.877368][T13461] bond0: (slave netdevsim0): Enslaving as an active interface with an up link [ 641.936150][T13450] hsr_slave_0: entered promiscuous mode [ 641.942981][T13450] hsr_slave_1: entered promiscuous mode [ 641.953671][T13450] debugfs: 'hsr0' already exists in 'hsr' [ 641.959614][T13450] Cannot create hsr debugfs directory [ 642.150659][T13450] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 642.161847][T13450] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 642.173395][T13450] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 642.184088][T13450] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 642.278959][T13450] 8021q: adding VLAN 0 to HW filter on device bond0 [ 642.303752][T13450] 8021q: adding VLAN 0 to HW filter on device team0 [ 642.317847][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 642.325143][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 642.346176][ T3486] bridge0: port 2(bridge_slave_1) entered blocking state [ 642.353543][ T3486] bridge0: port 2(bridge_slave_1) entered forwarding state [ 642.472312][T13450] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 642.567151][T13450] veth0_vlan: entered promiscuous mode [ 642.583877][T13450] veth1_vlan: entered promiscuous mode [ 642.640392][ T7635] usb 4-1: USB disconnect, device number 117 [ 642.669139][T13450] veth0_macvtap: entered promiscuous mode [ 642.695123][T13450] veth1_macvtap: entered promiscuous mode [ 642.726842][T13450] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 642.800600][T13450] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 642.820517][T12141] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.835089][T12141] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.844605][ T5843] Bluetooth: hci0: command tx timeout [ 642.852486][T12141] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 642.868290][T12141] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 643.024108][ T7112] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 643.043693][ T7112] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 643.057646][ T7635] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 643.086738][ T5922] usb 5-1: USB disconnect, device number 84 [ 643.108741][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 643.122334][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 643.232454][ T7635] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x3 has an invalid bInterval 0, changing to 7 [ 643.258075][ T7635] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 643.298882][ T7635] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.317302][ T7635] usb 4-1: Product: syz [ 643.331164][ T7635] usb 4-1: Manufacturer: syz [ 643.347267][ T7635] usb 4-1: SerialNumber: syz [ 643.515152][T13485] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 643.546926][T13485] bond6 (unregistering): Released all slaves [ 643.777127][ T7635] cdc_ncm 4-1:1.0: failed GET_NTB_PARAMETERS [ 643.783253][ T7635] cdc_ncm 4-1:1.0: bind() failure [ 643.812874][ T7635] cdc_ncm 4-1:1.1: CDC Union missing and no IAD found [ 643.839548][ T7635] cdc_ncm 4-1:1.1: bind() failure [ 644.561605][T13512] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 644.614736][T13512] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 644.787760][ T5922] usb 6-1: new low-speed USB device number 60 using dummy_hcd [ 644.910843][ T5840] Bluetooth: hci0: command tx timeout [ 644.949493][ T5922] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 644.986285][ T5922] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 645.020017][ T5922] usb 6-1: New USB device found, idVendor=12d1, idProduct=42f7, bcdDevice=aa.47 [ 645.036426][ T5922] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.083817][ T5922] usb 6-1: config 0 descriptor?? [ 645.298567][ T5922] usb 6-1: string descriptor 0 read error: -71 [ 645.321853][ T5922] qmi_wwan 6-1:0.0: probe with driver qmi_wwan failed with error -22 [ 645.350041][ T5922] usb 6-1: USB disconnect, device number 60 [ 645.795283][T13531] openvswitch: netlink: IPv4 tun info is not correct [ 645.819461][ T5922] usb 4-1: USB disconnect, device number 118 [ 645.838801][T13528] bond1: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 645.909703][T13528] bond1 (unregistering): Released all slaves [ 646.188614][T13538] xt_cluster: you have exceeded the maximum number of cluster nodes (37482740 > 32) [ 646.199665][T10863] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 646.617265][T10863] usb 5-1: Using ep0 maxpacket: 16 [ 646.656840][T10863] usb 5-1: config index 0 descriptor too short (expected 251, got 18) [ 646.700840][T10863] usb 5-1: config 0 has an invalid descriptor of length 234, skipping remainder of the config [ 646.734649][T10863] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 646.761653][T13545] netlink: 12 bytes leftover after parsing attributes in process `syz.7.2128'. [ 646.788926][T10863] usb 5-1: New USB device found, idVendor=052b, idProduct=1803, bcdDevice=3e.75 [ 646.800884][T10863] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 646.842190][T10863] usb 5-1: Product: syz [ 646.870587][T10863] usb 5-1: Manufacturer: syz [ 646.875614][T10863] usb 5-1: SerialNumber: syz [ 646.898502][T10863] usb 5-1: config 0 descriptor?? [ 646.987644][ T5840] Bluetooth: hci0: command tx timeout [ 647.171615][T10863] usb 5-1: USB disconnect, device number 85 [ 647.213940][ T30] kauditd_printk_skb: 29 callbacks suppressed [ 647.213959][ T30] audit: type=1326 audit(1767883922.543:645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.371209][ T30] audit: type=1326 audit(1767883922.573:646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.420715][ T30] audit: type=1326 audit(1767883922.573:647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.471483][ T30] audit: type=1326 audit(1767883922.573:648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.506147][ T30] audit: type=1326 audit(1767883922.573:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.596689][ T30] audit: type=1326 audit(1767883922.573:650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.621300][ T30] audit: type=1326 audit(1767883922.573:651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.662116][ T30] audit: type=1326 audit(1767883922.583:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.720342][ T30] audit: type=1326 audit(1767883922.583:653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 647.839251][T10863] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 647.856833][ T30] audit: type=1326 audit(1767883922.583:654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13547 comm="syz.3.2129" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 648.017867][T10863] usb 6-1: Using ep0 maxpacket: 32 [ 648.209951][T10863] usb 6-1: config 0 has an invalid interface number: 12 but max is 0 [ 648.247277][T10863] usb 6-1: config 0 has no interface number 0 [ 648.285789][T10863] usb 6-1: config 0 interface 12 has no altsetting 0 [ 648.304795][T10863] usb 6-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 648.320312][T10863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 648.340079][T10863] usb 6-1: Product: syz [ 648.344839][T10863] usb 6-1: Manufacturer: syz [ 648.367527][T10863] usb 6-1: SerialNumber: syz [ 648.386229][T13568] sch_tbf: peakrate 7 is lower than or equals to rate 6829859379779001161 ! [ 648.387650][T10863] usb 6-1: config 0 descriptor?? [ 648.508105][T13572] bond3: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 648.673020][T13572] bond3 (unregistering): Released all slaves [ 648.928160][ T5922] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 649.070159][ T5840] Bluetooth: hci0: command tx timeout [ 649.087301][ T5922] usb 4-1: Using ep0 maxpacket: 32 [ 649.098504][ T5922] usb 4-1: New USB device found, idVendor=041e, idProduct=400b, bcdDevice=3e.e7 [ 649.108411][ T5922] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 649.219166][ T5922] usb 4-1: config 0 descriptor?? [ 649.248669][ T5922] gspca_main: sunplus-2.14.0 probing 041e:400b [ 649.566177][T13586] netlink: zone id is out of range [ 649.582221][T13586] netlink: zone id is out of range [ 649.588830][T13586] netlink: set zone limit has 8 unknown bytes [ 649.974044][ T5922] gspca_sunplus: reg_w_riv err -110 [ 649.987623][ T5922] sunplus 4-1:0.0: probe with driver sunplus failed with error -110 [ 650.365746][T13608] loop9: detected capacity change from 0 to 7 [ 650.385953][ T8939] Dev loop9: unable to read RDB block 7 [ 650.392228][ T8939] loop9: unable to read partition table [ 650.398436][T13610] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2146'. [ 650.408520][ T8939] loop9: partition table beyond EOD, truncated [ 650.424087][T13608] Dev loop9: unable to read RDB block 7 [ 650.439388][T13608] loop9: unable to read partition table [ 650.477597][T13608] loop9: partition table beyond EOD, truncated [ 650.507686][T13608] loop_reread_partitions: partition scan of loop9 (被x ) failed (rc=-5) [ 650.610587][T10863] f81534 6-1:0.12: f81534_set_register: reg: 1002 data: 0 failed: -71 [ 650.620534][T10863] f81534 6-1:0.12: f81534_find_config_idx: read failed: -71 [ 650.636091][T10863] f81534 6-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 650.650103][T10863] f81534 6-1:0.12: probe with driver f81534 failed with error -71 [ 650.697623][T10863] usb 6-1: USB disconnect, device number 61 [ 650.720145][ T5922] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 650.887421][ T5922] usb 5-1: Using ep0 maxpacket: 32 [ 650.901332][ T5922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 650.917946][ T5922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 650.931805][ T5922] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 650.956829][ T5922] usb 5-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 650.977116][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.992089][ T5922] usb 5-1: config 0 descriptor?? [ 651.440845][ T5922] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5011.0022/input/input72 [ 651.469877][T13629] bond1: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 651.499712][T13629] bond1 (unregistering): Released all slaves [ 651.599758][ T5922] input: HID 0458:5011 as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:0458:5011.0022/input/input73 [ 651.710404][ T5922] kye 0003:0458:5011.0022: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.4-1/input0 [ 652.188798][ T5924] usb 4-1: USB disconnect, device number 119 [ 652.508529][ T5922] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 652.532234][ C1] kye 0003:0458:5011.0022: usb_submit_urb(ctrl) failed: -1 [ 652.667463][ T5922] usb 6-1: Using ep0 maxpacket: 16 [ 652.675474][ T5922] usb 6-1: config 7 has an invalid interface number: 247 but max is 0 [ 652.684228][ T5922] usb 6-1: config 7 has no interface number 0 [ 652.690491][ T5922] usb 6-1: config 7 interface 247 altsetting 0 endpoint 0xB has invalid wMaxPacketSize 0 [ 652.700414][ T5922] usb 6-1: config 7 interface 247 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 652.710583][ T5922] usb 6-1: config 7 interface 247 altsetting 0 bulk endpoint 0x9 has invalid maxpacket 0 [ 652.722370][ T5922] usb 6-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=6c.22 [ 652.732018][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=74, SerialNumber=147 [ 652.740391][ T5922] usb 6-1: Product: syz [ 652.744587][ T5922] usb 6-1: Manufacturer: syz [ 652.749452][ T5922] usb 6-1: SerialNumber: syz [ 652.770146][ T5922] ni6501 6-1:7.247: driver 'ni6501' failed to auto-configure device. [ 652.967274][T13639] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2151'. [ 653.006530][ T5922] usb 6-1: USB disconnect, device number 62 [ 653.154317][T13647] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2154'. [ 653.167393][T13647] netlink: 'syz.4.2154': attribute type 18 has an invalid length. [ 653.318246][ T10] usb 5-1: USB disconnect, device number 86 [ 653.645329][T13655] veth1_to_team: entered promiscuous mode [ 653.655469][T13655] bridge0: entered promiscuous mode [ 653.669699][T13655] hsr2: Slave B (bridge0) is not up; please bring it up to get a fully working HSR network [ 653.686162][T13655] hsr2: entered allmulticast mode [ 653.696142][T13655] veth1_to_team: entered allmulticast mode [ 653.702507][T13655] bridge0: entered allmulticast mode [ 653.811513][T13660] tipc: Started in network mode [ 653.816496][T13660] tipc: Node identity 080211000001, cluster identity 4711 [ 653.824834][T13660] tipc: Enabled bearer , priority 0 [ 653.847813][T13663] syzkaller0: entered promiscuous mode [ 653.854123][T13663] syzkaller0: entered allmulticast mode [ 653.978319][T13667] bond2: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 654.063767][T13667] bond2 (unregistering): Released all slaves [ 654.508400][T13680] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2163'. [ 654.797295][T10863] usb 4-1: new full-speed USB device number 120 using dummy_hcd [ 654.867589][ T5922] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 654.928946][T10863] usb 4-1: device descriptor read/64, error -71 [ 654.947277][ T7635] tipc: Node number set to 134418688 [ 655.057361][ T5922] usb 6-1: Using ep0 maxpacket: 32 [ 655.074777][ T5922] usb 6-1: New USB device found, idVendor=174f, idProduct=6a31, bcdDevice=26.3f [ 655.086250][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 655.096331][ T5922] usb 6-1: Product: syz [ 655.103195][ T5922] usb 6-1: Manufacturer: syz [ 655.108315][ T5922] usb 6-1: SerialNumber: syz [ 655.133709][ T5922] usb 6-1: config 0 descriptor?? [ 655.172214][ T5922] gspca_main: stk1135-2.14.0 probing 174f:6a31 [ 655.188258][T10863] usb 4-1: new full-speed USB device number 121 using dummy_hcd [ 655.337342][T10863] usb 4-1: device descriptor read/64, error -71 [ 655.458086][T10863] usb usb4-port1: attempt power cycle [ 655.807263][T10863] usb 4-1: new full-speed USB device number 122 using dummy_hcd [ 655.837330][ T911] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 655.853122][T10863] usb 4-1: device descriptor read/8, error -71 [ 656.017258][ T911] usb 5-1: Using ep0 maxpacket: 16 [ 656.028926][ T911] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 656.056437][ T911] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 656.081291][ T911] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 656.102632][ T911] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 656.111033][T10863] usb 4-1: new full-speed USB device number 123 using dummy_hcd [ 656.125114][ T911] usb 5-1: Product: syz [ 656.135270][ T911] usb 5-1: Manufacturer: syz [ 656.140781][T10863] usb 4-1: device descriptor read/8, error -71 [ 656.152392][ T911] usb 5-1: SerialNumber: syz [ 656.166293][ T911] usb 5-1: config 0 descriptor?? [ 656.194897][ T911] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 656.217249][ T911] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 656.260054][T10863] usb usb4-port1: unable to enumerate USB device [ 656.449985][ T911] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 656.484737][ T911] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 656.511094][ T911] em28xx 5-1:0.0: AC97 chip type couldn't be determined [ 656.536182][ T911] em28xx 5-1:0.0: No AC97 audio processor [ 656.582928][ T911] usb 5-1: USB disconnect, device number 87 [ 656.623754][ T911] em28xx 5-1:0.0: Disconnecting em28xx [ 656.651007][ T911] em28xx 5-1:0.0: Freeing device [ 656.667525][ T5922] gspca_stk1135: reg_w 0xd err -110 [ 656.674767][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.691393][ T5922] gspca_stk1135: Sensor write failed [ 656.705671][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.720308][ T5922] gspca_stk1135: Sensor write failed [ 656.733519][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.746980][ T5922] gspca_stk1135: Sensor read failed [ 656.763173][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.777456][ T5922] gspca_stk1135: Sensor read failed [ 656.789707][ T5922] gspca_stk1135: Detected sensor type unknown (0x0) [ 656.806493][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.821383][ T5922] gspca_stk1135: Sensor read failed [ 656.834918][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.855957][ T5922] gspca_stk1135: Sensor read failed [ 656.869218][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.876175][ T5922] gspca_stk1135: Sensor write failed [ 656.883165][ T5922] gspca_stk1135: serial bus timeout: status=0x00 [ 656.890471][ T5922] gspca_stk1135: Sensor write failed [ 656.896514][ T5922] stk1135 6-1:0.0: probe with driver stk1135 failed with error -110 [ 657.421580][T13706] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.442267][T13706] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.477782][T13706] TCP: request_sock_TCP: Possible SYN flooding on port [::]:20002. Sending cookies. [ 657.553397][T13711] syzkaller0: entered promiscuous mode [ 657.565306][T13711] syzkaller0: entered allmulticast mode [ 657.915911][ T30] kauditd_printk_skb: 30 callbacks suppressed [ 657.915932][ T30] audit: type=1326 audit(1767883933.153:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 657.979547][ T30] audit: type=1326 audit(1767883933.153:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.052587][ T30] audit: type=1326 audit(1767883933.153:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.110055][ T30] audit: type=1326 audit(1767883933.153:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.186979][ T30] audit: type=1326 audit(1767883933.153:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.245190][ T30] audit: type=1326 audit(1767883933.153:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.303213][ T30] audit: type=1326 audit(1767883933.153:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.384921][ T30] audit: type=1326 audit(1767883933.153:692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.520625][ T30] audit: type=1326 audit(1767883933.163:693): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.635590][ T30] audit: type=1326 audit(1767883933.163:694): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13713 comm="syz.3.2173" exe="/root/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 658.658275][T13720] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 658.682719][T13720] bond6 (unregistering): Released all slaves [ 658.691708][ T5922] usb 6-1: USB disconnect, device number 63 [ 658.795105][T13712] input: syz0 as /devices/virtual/input/input74 [ 659.020745][T13733] netlink: 'syz.5.2176': attribute type 1 has an invalid length. [ 659.175799][T13739] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2176'. [ 659.400120][T13740] netlink: 80 bytes leftover after parsing attributes in process `syz.3.2177'. [ 660.089393][T13757] sg_write: data in/out 64380/1 bytes for SCSI command 0x1c-- guessing data in; [ 660.089393][T13757] program syz.3.2181 not setting count and/or reply_len properly [ 660.183245][T13759] kernel profiling enabled (shift: 6) [ 660.251385][T13760] netlink: 'syz.5.2182': attribute type 10 has an invalid length. [ 660.361570][T13761] netlink: 2188 bytes leftover after parsing attributes in process `syz.5.2182'. [ 660.457139][T13758] bond1: (slave lo): Releasing backup interface [ 660.674613][T13758] bond1: (slave lo): last VLAN challenged slave left bond - VLAN blocking is removed [ 660.745324][T13758] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 660.790766][T13760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 660.805488][T13760] team0: Port device bond0 added [ 661.521591][T13761] team0 (unregistering): Port device team_slave_0 removed [ 661.554680][T13761] team0 (unregistering): Port device team_slave_1 removed [ 661.587594][T13761] team0 (unregistering): Port device bond0 removed [ 661.884171][T13772] syzkaller0: entered promiscuous mode [ 661.895073][T13772] syzkaller0: entered allmulticast mode [ 662.031619][ T911] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 662.191189][ T911] usb 5-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 662.200432][ T911] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.240798][ T911] usb 5-1: config 0 descriptor?? [ 662.254572][ T911] cp210x 5-1:0.0: cp210x converter detected [ 663.088522][T13779] could not allocate digest TFM handle sha3-512-generic [ 663.777369][ T7635] usb 6-1: new full-speed USB device number 64 using dummy_hcd [ 663.941907][ T7635] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 663.955133][ T7635] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 663.980629][ T7635] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 65535, setting to 64 [ 664.004937][ T7635] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 5 [ 664.059898][ T7635] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 664.069614][ T7635] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 664.078488][ T7635] usb 6-1: Manufacturer: syz [ 664.101667][ T7635] usb 6-1: config 0 descriptor?? [ 664.467806][ T7635] rc_core: IR keymap rc-hauppauge not found [ 664.474956][ T7635] Registered IR keymap rc-empty [ 664.490458][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.542181][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.580310][ T7635] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 664.679993][ T7635] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input75 [ 664.809504][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.829302][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.848216][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.898113][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.934060][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.958698][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 664.985755][ T911] cp210x 5-1:0.0: failed to get vendor val 0x370c size 13: -71 [ 664.998951][ T911] cp210x 5-1:0.0: GPIO initialisation failed: -71 [ 665.027818][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 665.044934][ T911] usb 5-1: cp210x converter now attached to ttyUSB0 [ 665.052183][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 665.077853][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 665.086392][ T911] usb 5-1: USB disconnect, device number 88 [ 665.112234][ T7635] mceusb 6-1:0.0: Error: mce write urb status = -71 [ 665.149404][ T911] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 665.166310][ T7635] mceusb 6-1:0.0: Registered ܖ with mce emulator interface version 1 [ 665.183102][ T911] cp210x 5-1:0.0: device disconnected [ 665.189909][ T7635] mceusb 6-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 666.037351][ T10] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 666.187374][ T10] usb 5-1: device descriptor read/64, error -71 [ 666.427627][ T10] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 666.521148][ T911] usb 6-1: USB disconnect, device number 64 [ 666.580748][ T10] usb 5-1: device descriptor read/64, error -71 [ 666.699201][ T10] usb usb5-port1: attempt power cycle [ 666.905847][T13789] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 667.077268][ T10] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 667.135981][ T10] usb 5-1: device descriptor read/8, error -71 [ 667.307709][ T5924] usb 6-1: new high-speed USB device number 65 using dummy_hcd [ 667.326886][T13830] tipc: Enabled bearer , priority 0 [ 667.336818][T13830] syzkaller0: entered promiscuous mode [ 667.354452][T13830] syzkaller0: entered allmulticast mode [ 667.407380][ T10] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 667.459117][ T10] usb 5-1: device descriptor read/8, error -71 [ 667.465844][ T5924] usb 6-1: Using ep0 maxpacket: 32 [ 667.485851][ T5924] usb 6-1: config 0 has an invalid interface number: 132 but max is 0 [ 667.494973][ T5924] usb 6-1: config 0 has no interface number 0 [ 667.502213][ T5924] usb 6-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 667.517462][ T5924] usb 6-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 667.527410][ T5924] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.535695][ T5924] usb 6-1: Product: syz [ 667.540020][ T5924] usb 6-1: Manufacturer: syz [ 667.544645][ T5924] usb 6-1: SerialNumber: syz [ 667.553815][ T5924] usb 6-1: config 0 descriptor?? [ 667.563448][ T5924] em28xx 6-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 667.575314][ T5924] em28xx 6-1:0.132: Video interface 132 found: [ 667.590470][ T10] usb usb5-port1: unable to enumerate USB device [ 667.966481][ T5924] em28xx 6-1:0.132: unknown em28xx chip ID (0) [ 668.140283][T13829] tipc: Resetting bearer [ 668.163123][T13829] tipc: Disabling bearer [ 668.380885][ T5924] em28xx 6-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 668.400743][ T5924] em28xx 6-1:0.132: board has no eeprom [ 668.859323][T13845] openvswitch: netlink: IP tunnel dst address not specified [ 668.977338][ T5924] em28xx 6-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 669.003779][ T5924] em28xx 6-1:0.132: analog set to bulk mode. [ 669.013813][ T5922] em28xx 6-1:0.132: Registering V4L2 extension [ 669.037543][ T5924] usb 6-1: USB disconnect, device number 65 [ 669.058492][ T5924] em28xx 6-1:0.132: Disconnecting em28xx [ 669.247450][ T5922] em28xx 6-1:0.132: Config register raw data: 0xffffffed [ 669.292942][ T5922] em28xx 6-1:0.132: AC97 chip type couldn't be determined [ 669.312936][ T5922] em28xx 6-1:0.132: No AC97 audio processor [ 669.360629][ T5922] usb 6-1: Decoder not found [ 669.372858][ T5922] em28xx 6-1:0.132: failed to create media graph [ 669.392473][ T5922] em28xx 6-1:0.132: V4L2 device video103 deregistered [ 669.443515][T13856] bond3: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 669.460617][ T5922] em28xx 6-1:0.132: Remote control support is not available for this card. [ 669.504959][ T5924] em28xx 6-1:0.132: Closing input extension [ 669.505197][T13856] bond3 (unregistering): Released all slaves [ 669.566352][ T5924] em28xx 6-1:0.132: Freeing device [ 669.623669][T13862] syzkaller0: entered promiscuous mode [ 669.631630][T13862] syzkaller0: entered allmulticast mode [ 670.217536][ T5924] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 670.387730][ T5924] usb 5-1: Using ep0 maxpacket: 8 [ 670.414915][ T5924] usb 5-1: New USB device found, idVendor=046d, idProduct=c219, bcdDevice= 0.00 [ 670.445164][ T5924] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.490236][T13879] netlink: 'syz.7.2214': attribute type 10 has an invalid length. [ 670.498993][T13879] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2214'. [ 670.511385][T13879] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 670.514947][ T5924] usb 5-1: config 0 descriptor?? [ 670.518821][T13879] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 670.521740][T13879] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 670.938531][T13888] fuse: Bad value for 'user_id' [ 670.943519][T13888] fuse: Bad value for 'user_id' [ 670.978051][T13888] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2218'. [ 670.987001][T13888] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2218'. [ 671.012815][T13888] 8021q: adding VLAN 0 to HW filter on device bond0 [ 671.025078][ T5924] logitech 0003:046D:C219.0023: hidraw0: USB HID v0.00 Device [HID 046d:c219] on usb-dummy_hcd.4-1/input0 [ 671.028099][T13888] bond1: (slave bond0): Enslaving as an active interface with an up link [ 671.062016][ T5924] logitech 0003:046D:C219.0023: no inputs found [ 671.201526][ T911] usb 5-1: USB disconnect, device number 93 [ 671.231036][T13893] bond3: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 671.242919][T13893] bond3 (unregistering): Released all slaves [ 671.464717][ T30] kauditd_printk_skb: 36 callbacks suppressed [ 671.464736][ T30] audit: type=1326 audit(1767883946.793:731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13900 comm="syz.5.2223" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f23539 code=0x0 [ 672.233894][T13920] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2228'. [ 672.687293][ T5832] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 672.840256][ T5832] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 672.851508][ T5832] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 672.862531][ T5832] usb 6-1: New USB device found, idVendor=046d, idProduct=ca04, bcdDevice= 0.00 [ 672.871975][ T5832] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.883192][ T5832] usb 6-1: config 0 descriptor?? [ 673.333344][T13936] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2231'. [ 673.356858][T13936] vxlan2: entered promiscuous mode [ 673.375192][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.382713][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.392800][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.400171][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.407594][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.415079][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.422686][ T5832] logitech 0003:046D:CA04.0024: unknown main item tag 0x0 [ 673.432165][ T5832] logitech 0003:046D:CA04.0024: hidraw0: USB HID v0.00 Device [HID 046d:ca04] on usb-dummy_hcd.5-1/input0 [ 673.443762][ T5832] logitech 0003:046D:CA04.0024: no inputs found [ 673.636650][ T7635] usb 6-1: USB disconnect, device number 66 [ 674.327987][T13960] netlink: 1 bytes leftover after parsing attributes in process `syz.5.2237'. [ 674.574426][T13970] batadv_slave_0: entered promiscuous mode [ 674.967411][ T9] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 675.089045][T13972] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 675.137331][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 675.149836][T13972] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 675.187986][ T9] usb 6-1: config 0 has an invalid interface number: 233 but max is 0 [ 675.205586][ T9] usb 6-1: config 0 has no interface number 0 [ 675.229920][ T9] usb 6-1: New USB device found, idVendor=1608, idProduct=0302, bcdDevice=d3.4f [ 675.254527][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 675.286575][ T9] usb 6-1: Product: syz [ 675.297314][ T9] usb 6-1: Manufacturer: syz [ 675.322521][ T9] usb 6-1: SerialNumber: syz [ 675.361224][ T9] usb 6-1: config 0 descriptor?? [ 675.385980][ T9] io_ti 6-1:0.233: required endpoints missing [ 675.406421][T13972] tipc: Resetting bearer [ 675.427672][T13972] veth0: left allmulticast mode [ 675.464992][ T79] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.511734][ T79] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.551325][ T79] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.573396][ T79] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 675.613944][ T9] usb 6-1: USB disconnect, device number 67 [ 675.801011][T13989] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2245'. [ 675.811528][T13989] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2245'. [ 675.930084][T13993] netlink: 'syz.5.2246': attribute type 12 has an invalid length. [ 675.957723][T13993] netlink: 'syz.5.2246': attribute type 29 has an invalid length. [ 675.965625][T13993] netlink: 148 bytes leftover after parsing attributes in process `syz.5.2246'. [ 676.009213][T13993] netlink: 59 bytes leftover after parsing attributes in process `syz.5.2246'. [ 676.126170][T13997] fuse: Bad value for 'fd' [ 676.740241][T14024] batadv_slave_0: entered promiscuous mode [ 676.756689][T14024] batadv_slave_0: entered allmulticast mode [ 676.771399][T14024] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 677.538960][T13967] batadv_slave_0: left promiscuous mode [ 677.597400][T10863] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 677.670156][T14042] netlink: 'syz.6.2260': attribute type 1 has an invalid length. [ 677.735336][T14042] 8021q: adding VLAN 0 to HW filter on device bond3 [ 677.757769][T10863] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 677.807431][T10863] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 677.819061][T10863] usb 6-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 677.829755][T10863] usb 6-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 677.987720][T14048] sg_write: data in/out 64380/1 bytes for SCSI command 0x1c-- guessing data in; [ 677.987720][T14048] program syz.4.2258 not setting count and/or reply_len properly [ 678.020240][T14044] bond3: (slave gretap1): making interface the new active one [ 678.025617][T10863] usb 6-1: Manufacturer: syz [ 678.095560][T10863] usb 6-1: config 0 descriptor?? [ 678.169420][T14044] bond3: (slave gretap1): Enslaving as an active interface with an up link [ 678.857396][T14039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.893844][T14039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 678.947428][ T30] audit: type=1326 audit(1767883954.273:732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 678.975543][T14039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 678.996511][T14039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 679.021930][T10863] usbhid 6-1:0.0: can't add hid device: -71 [ 679.029142][T10863] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 679.032883][ T30] audit: type=1326 audit(1767883954.303:733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.080137][T10863] usb 6-1: USB disconnect, device number 68 [ 679.184957][ T30] audit: type=1326 audit(1767883954.303:734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.241573][ T30] audit: type=1326 audit(1767883954.303:735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.342619][ T30] audit: type=1326 audit(1767883954.303:736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.376288][T14065] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(12) [ 679.382961][T14065] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 679.406605][ T30] audit: type=1326 audit(1767883954.303:737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.410013][T14065] vhci_hcd vhci_hcd.0: Device attached [ 679.438791][T14070] vhci_hcd vhci_hcd.0: pdev(6) rhport(1) sockfd(15) [ 679.445412][T14070] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 679.462568][T14070] vhci_hcd vhci_hcd.0: Device attached [ 679.478563][ T30] audit: type=1326 audit(1767883954.303:738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.507688][ T30] audit: type=1326 audit(1767883954.303:739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.517279][T14065] vhci_hcd vhci_hcd.0: pdev(6) rhport(2) sockfd(14) [ 679.545748][T14065] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 679.574584][T14065] vhci_hcd vhci_hcd.0: Device attached [ 679.580947][T14070] vhci_hcd vhci_hcd.0: pdev(6) rhport(3) sockfd(19) [ 679.587583][T14070] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 679.611192][ T30] audit: type=1326 audit(1767883954.303:740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.668055][T14070] vhci_hcd vhci_hcd.0: Device attached [ 679.697517][ T5832] usb 45-1: new low-speed USB device number 2 using vhci_hcd [ 679.706937][T14065] vhci_hcd vhci_hcd.0: pdev(6) rhport(4) sockfd(18) [ 679.713613][T14065] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 679.729391][ T30] audit: type=1326 audit(1767883954.303:741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14038 comm="syz.5.2259" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f23539 code=0x7ffc0000 [ 679.755166][T14070] vhci_hcd vhci_hcd.0: pdev(6) rhport(5) sockfd(23) [ 679.761882][T14070] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 679.784960][T14089] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 679.793667][T14070] vhci_hcd vhci_hcd.0: Device attached [ 679.794084][T14065] vhci_hcd vhci_hcd.0: Device attached [ 679.801295][T14070] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 679.823983][T14070] vhci_hcd vhci_hcd.0: port 0 already used [ 679.850009][T14065] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(34) [ 679.856683][T14065] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 679.889468][T14065] vhci_hcd vhci_hcd.0: Device attached [ 679.909170][T14096] netlink: 'syz.5.2268': attribute type 10 has an invalid length. [ 679.999714][T14096] bond0: (slave netdevsim0): Releasing backup interface [ 680.027017][T14082] vhci_hcd: connection closed [ 680.027393][T14078] vhci_hcd: connection closed [ 680.031294][T14086] vhci_hcd: connection closed [ 680.032253][ T4152] vhci_hcd vhci_hcd.6: stop threads [ 680.047712][T14076] vhci_hcd: connection closed [ 680.048088][T14071] vhci_hcd: connection closed [ 680.051424][ T4152] vhci_hcd vhci_hcd.6: release socket [ 680.053049][T14067] vhci_hcd: connection reset by peer [ 680.058528][ T4152] vhci_hcd vhci_hcd.6: disconnect device [ 680.082585][ T4152] vhci_hcd vhci_hcd.6: stop threads [ 680.104411][T14096] batman_adv: batadv0: Adding interface: netdevsim0 [ 680.122660][ T4152] vhci_hcd vhci_hcd.6: release socket [ 680.148225][T14096] batman_adv: batadv0: The MTU of interface netdevsim0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 680.174494][ T4152] vhci_hcd vhci_hcd.6: disconnect device [ 680.187604][ T4152] vhci_hcd vhci_hcd.6: stop threads [ 680.192874][ T4152] vhci_hcd vhci_hcd.6: release socket [ 680.202634][ T4152] vhci_hcd vhci_hcd.6: disconnect device [ 680.221595][T14096] batman_adv: batadv0: Not using interface netdevsim0 (retrying later): interface not active [ 680.241569][ T4152] vhci_hcd vhci_hcd.6: stop threads [ 680.246939][ T4152] vhci_hcd vhci_hcd.6: release socket [ 680.273040][ T4152] vhci_hcd vhci_hcd.6: disconnect device [ 680.317895][ T4152] vhci_hcd vhci_hcd.6: stop threads [ 680.323867][ T4152] vhci_hcd vhci_hcd.6: release socket [ 680.351584][ T4152] vhci_hcd vhci_hcd.6: disconnect device [ 680.357614][ T4152] vhci_hcd vhci_hcd.6: stop threads [ 680.362943][ T4152] vhci_hcd vhci_hcd.6: release socket [ 680.370699][ T4152] vhci_hcd vhci_hcd.6: disconnect device [ 680.471349][T14106] syzkaller1: entered promiscuous mode [ 680.477377][T14106] syzkaller1: entered allmulticast mode [ 680.705627][T14094] vhci_hcd: connection closed [ 680.707681][ T7112] vhci_hcd vhci_hcd.6: stop threads [ 680.719150][ T7112] vhci_hcd vhci_hcd.6: release socket [ 680.754014][ T7112] vhci_hcd vhci_hcd.6: disconnect device [ 680.807420][T10863] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 681.260865][T10863] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 681.279468][T10863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.370302][T10863] usb 5-1: config 0 descriptor?? [ 681.394092][T10863] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 681.825953][T10863] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 682.147673][T14129] macvtap2: entered promiscuous mode [ 682.153049][T14129] hsr0: entered promiscuous mode [ 682.160414][T14129] macvtap2: entered allmulticast mode [ 682.165828][T14129] hsr0: entered allmulticast mode [ 682.171551][T14129] hsr_slave_0: entered allmulticast mode [ 682.177303][T14129] hsr_slave_1: entered allmulticast mode [ 682.184877][T14129] hsr0: left allmulticast mode [ 682.191085][T14129] hsr_slave_0: left allmulticast mode [ 682.196970][T14129] hsr_slave_1: left allmulticast mode [ 682.202573][T14129] hsr0: left promiscuous mode [ 682.220048][ T7635] usb 4-1: new high-speed USB device number 124 using dummy_hcd [ 682.261983][T10863] gspca_cpia1: usb_control_msg 02, error -71 [ 682.269535][T10863] gspca_cpia1: usb_control_msg 05, error -71 [ 682.276685][T10863] cpia1 5-1:0.0: unexpected systemstate: 00 [ 682.285566][T10863] usb 5-1: USB disconnect, device number 94 [ 682.378348][ T7635] usb 4-1: Using ep0 maxpacket: 16 [ 682.399600][ T7635] usb 4-1: config 166 has an invalid interface number: 177 but max is 1 [ 682.416819][ T7635] usb 4-1: config 166 has an invalid interface number: 34 but max is 1 [ 682.428924][ T7635] usb 4-1: config 166 has no interface number 0 [ 682.436376][ T7635] usb 4-1: config 166 has no interface number 1 [ 682.445199][ T7635] usb 4-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 682.459144][ T7635] usb 4-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 682.503622][ T7635] usb 4-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 682.516499][ T7635] usb 4-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 682.533082][ T7635] usb 4-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 682.567981][ T7635] usb 4-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 682.578847][ T7635] usb 4-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 682.595407][ T7635] usb 4-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 682.614173][ T7635] usb 4-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 682.638454][ T7635] usb 4-1: config 166 interface 177 has no altsetting 0 [ 682.647412][ T7635] usb 4-1: config 166 interface 34 has no altsetting 0 [ 682.667128][ T7635] usb 4-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 682.682324][ T7635] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 682.718591][ T7635] usb 4-1: Product: syz [ 682.723005][ T7635] usb 4-1: Manufacturer: syz [ 682.738117][ T7635] usb 4-1: SerialNumber: syz [ 682.992114][ T7635] ums-realtek 4-1:166.177: USB Mass Storage device detected [ 683.066981][ T7635] ums-realtek 4-1:166.34: USB Mass Storage device detected [ 683.143851][ T7635] ums-realtek 4-1:166.34: probe with driver ums-realtek failed with error -5 [ 683.170369][ T7635] uvcvideo 4-1:166.34: Found UVC 0.00 device syz (0bda:0138) [ 683.187561][ T7635] uvcvideo 4-1:166.34: No valid video chain found. [ 683.201350][ T7635] usb 4-1: USB disconnect, device number 124 [ 683.237702][T10863] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 683.397287][T10863] usb 6-1: Using ep0 maxpacket: 16 [ 683.408537][T10863] usb 6-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 683.418222][T10863] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 683.426251][T10863] usb 6-1: Product: syz [ 683.431226][T10863] usb 6-1: Manufacturer: syz [ 683.435854][T10863] usb 6-1: SerialNumber: syz [ 683.447886][T10863] usb 6-1: config 0 descriptor?? [ 683.464816][T10863] safe_serial 6-1:0.0: safe_serial converter detected [ 683.476626][T10863] usb 6-1: safe_serial converter now attached to ttyUSB0 [ 683.819379][T14169] tipc: Enabled bearer , priority 0 [ 683.827009][T14169] syzkaller0: entered promiscuous mode [ 683.833802][T14169] syzkaller0: entered allmulticast mode [ 683.911667][T14175] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2287'. [ 683.922032][T14174] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2287'. [ 683.937699][T14174] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2287'. [ 683.950102][T14174] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2287'. [ 684.020215][T14176] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2290'. [ 684.032563][T14169] tipc: Resetting bearer [ 684.093434][T14169] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2290'. [ 684.265358][T14167] tipc: Resetting bearer [ 684.384019][T14167] tipc: Disabling bearer [ 684.897322][ T5832] vhci_hcd vhci_hcd.6: vhci_device speed not set [ 685.057331][T10863] usb 4-1: new high-speed USB device number 125 using dummy_hcd [ 685.233491][T10863] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 685.251959][T10863] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 685.263261][T10863] usb 4-1: New USB device found, idVendor=0d8c, idProduct=0022, bcdDevice= 0.00 [ 685.272859][T10863] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 685.296867][T10863] usb 4-1: config 0 descriptor?? [ 685.673189][T14200] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2298'. [ 685.736350][T14191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 685.747672][T14191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 685.762182][T14191] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 685.773817][T14191] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 685.791944][T10863] cm6533_jd 0003:0D8C:0022.0025: unknown main item tag 0x0 [ 685.847670][T10863] cm6533_jd 0003:0D8C:0022.0025: unknown main item tag 0x0 [ 685.872726][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.884929][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.906563][T10863] input: HID 0d8c:0022 as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:0D8C:0022.0025/input/input76 [ 685.979548][T10863] cm6533_jd 0003:0D8C:0022.0025: input,hiddev0,hidraw0: USB HID v0.00 Device [HID 0d8c:0022] on usb-dummy_hcd.3-1/input0 [ 686.134002][ T10] usb 6-1: USB disconnect, device number 69 [ 686.156237][ T10] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 686.181604][T14209] netlink: 'syz.4.2299': attribute type 4 has an invalid length. [ 686.200736][ T9] usb usb46-port1: attempt power cycle [ 686.212001][ T10] safe_serial 6-1:0.0: device disconnected [ 686.282011][T14205] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 686.311446][T14212] netlink: 'syz.4.2299': attribute type 4 has an invalid length. [ 686.343570][T14205] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 686.660119][ T5922] usb 4-1: USB disconnect, device number 125 [ 686.888757][T14218] netlink: 'syz.3.2303': attribute type 1 has an invalid length. [ 686.938646][ T9] usb usb46-port1: unable to enumerate USB device [ 687.247329][ T5980] usb 4-1: new high-speed USB device number 126 using dummy_hcd [ 687.400051][ T5980] usb 4-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.32 [ 687.419521][ T5980] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.448193][ T5980] usb 4-1: config 0 descriptor?? [ 687.466237][ T5980] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 687.617325][ T5922] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 687.670460][ T5980] gp8psk: usb in 128 operation failed. [ 687.692612][ T5980] gp8psk: usb in 137 operation failed. [ 687.700123][ T5980] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 687.714595][ T5980] dvbdev: DVB: registering new adapter (Genpix SkyWalker-1 DVB-S receiver) [ 687.729915][ T5980] usb 4-1: media controller created [ 687.761591][ T5980] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 687.787412][ T5922] usb 5-1: Using ep0 maxpacket: 8 [ 687.796725][ T5922] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 687.824081][ T5922] usb 5-1: can't read configurations, error -61 [ 687.852133][ T5980] gp8psk_fe: Frontend attached [ 687.870815][ T5980] usb 4-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 687.890357][ T5980] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 687.977645][ T5922] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 688.060243][ T5980] gp8psk: usb in 138 operation failed. [ 688.078475][ T5980] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully initialized and connected. [ 688.100757][ T5980] gp8psk: found Genpix USB device pID = 203 (hex) [ 688.136600][ T5980] usb 4-1: USB disconnect, device number 126 [ 688.147253][ T5922] usb 5-1: Using ep0 maxpacket: 8 [ 688.165769][ T5922] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 688.184244][ T5922] usb 5-1: can't read configurations, error -61 [ 688.223333][ T5922] usb usb5-port1: attempt power cycle [ 688.288793][T14241] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2309'. [ 688.370609][ T5980] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully deinitialized and disconnected. [ 688.492960][T14245] syzkaller0: entered promiscuous mode [ 688.499636][T14245] syzkaller0: entered allmulticast mode [ 688.509977][T14247] netlink: 88 bytes leftover after parsing attributes in process `syz.5.2313'. [ 688.587329][ T5922] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 688.617952][ T5922] usb 5-1: Using ep0 maxpacket: 8 [ 688.628990][ T5922] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 688.642344][ T5922] usb 5-1: can't read configurations, error -61 [ 688.780443][ T5922] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 688.808122][ T5922] usb 5-1: Using ep0 maxpacket: 8 [ 688.816750][ T5922] usb 5-1: unable to read config index 0 descriptor/start: -61 [ 688.825081][ T5922] usb 5-1: can't read configurations, error -61 [ 688.833364][ T5922] usb usb5-port1: unable to enumerate USB device [ 688.924622][T14262] 8021q: adding VLAN 0 to HW filter on device bond5 [ 689.093862][T14266] syzkaller0: entered promiscuous mode [ 689.100501][T14266] syzkaller0: entered allmulticast mode [ 689.408962][T14273] tipc: Started in network mode [ 689.415887][T14273] tipc: Node identity 1aabecc4fe52, cluster identity 4711 [ 689.424987][T14273] tipc: Enabled bearer , priority 0 [ 689.434564][T14273] syzkaller0: entered promiscuous mode [ 689.441859][T14273] syzkaller0: entered allmulticast mode [ 689.508500][T14273] netlink: 'syz.7.2321': attribute type 12 has an invalid length. [ 689.516632][T14273] netlink: 'syz.7.2321': attribute type 29 has an invalid length. [ 689.524835][T14273] netlink: 148 bytes leftover after parsing attributes in process `syz.7.2321'. [ 689.534433][T14273] netlink: 'syz.7.2321': attribute type 1 has an invalid length. [ 689.565146][T14273] tipc: Resetting bearer [ 689.579812][T14272] tipc: Resetting bearer [ 689.601358][T14272] tipc: Disabling bearer [ 689.698820][ T911] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 689.819118][T14281] syzkaller0: entered promiscuous mode [ 689.825822][T14281] syzkaller0: entered allmulticast mode [ 689.867698][ T911] usb 6-1: Using ep0 maxpacket: 16 [ 689.881915][ T911] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 689.901739][ T911] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 689.932113][ T911] usb 6-1: Product: syz [ 689.969880][ T911] usb 6-1: Manufacturer: syz [ 689.974514][ T911] usb 6-1: SerialNumber: syz [ 690.077026][ T911] usb 6-1: config 0 descriptor?? [ 690.495328][ T911] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 690.510054][ T911] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 690.523244][ T911] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 690.531355][ T911] usb 6-1: media controller created [ 690.544830][ T911] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 690.707754][ T7635] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 690.727840][ T911] zl10353_read_register: readreg error (reg=127, ret==0) [ 690.734997][ T911] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 690.767551][ T911] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 690.781096][ T911] usb 6-1: USB disconnect, device number 70 [ 690.836399][ T911] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 690.842203][T14297] bond6: option arp_validate: mode dependency failed, not supported in mode 802.3ad(4) [ 690.870113][T14297] bond6 (unregistering): Released all slaves [ 690.879584][ T7635] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 690.890987][ T7635] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 690.917304][ T7635] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 690.944401][ T7635] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 690.955687][ T7635] usb 5-1: config 0 descriptor?? [ 692.024613][ T7635] pyra 0003:1E7D:2CF6.0026: unknown main item tag 0x0 [ 692.037553][ T7635] pyra 0003:1E7D:2CF6.0026: unknown main item tag 0x0 [ 692.042555][ T5922] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 692.055513][ T5922] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 692.090271][ T7635] pyra 0003:1E7D:2CF6.0026: unknown main item tag 0x0 [ 692.090280][ T5922] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 692.090314][ T5922] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 692.098047][ T7635] pyra 0003:1E7D:2CF6.0026: unknown main item tag 0x0 [ 692.145585][ T7635] pyra 0003:1E7D:2CF6.0026: unknown main item tag 0x0 [ 692.147484][ T5922] hid-generic 0000:0000:0000.0027: unknown main item tag 0x0 [ 692.193386][ T7635] pyra 0003:1E7D:2CF6.0026: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.4-1/input0 [ 692.231902][ T5922] hid-generic 0000:0000:0000.0027: hidraw1: HID v0.03 Device [syz1] on syz1 [ 692.450667][T14321] fido_id[14321]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 692.615761][T14328] syzkaller0: entered promiscuous mode [ 692.642416][T14328] syzkaller0: entered allmulticast mode [ 693.321014][ T7635] pyra 0003:1E7D:2CF6.0026: couldn't init struct pyra_device [ 693.330263][ T7635] pyra 0003:1E7D:2CF6.0026: couldn't install mouse [ 693.341538][ T7635] pyra 0003:1E7D:2CF6.0026: probe with driver pyra failed with error -71 [ 693.352863][ T7635] usb 5-1: USB disconnect, device number 99 [ 694.532342][T14366] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 694.539673][T14366] IPv6: NLM_F_CREATE should be set when creating new route [ 694.546906][T14366] IPv6: NLM_F_CREATE should be set when creating new route [ 694.617719][ T5980] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 694.858918][T14366] netlink: 52 bytes leftover after parsing attributes in process `syz.6.2344'. [ 694.893937][T14366] bridge0: port 2(bridge_slave_1) entered disabled state [ 694.901639][T14366] bridge0: port 1(bridge_slave_0) entered disabled state [ 694.909624][ T5980] usb 5-1: Using ep0 maxpacket: 8 [ 694.955317][ T5980] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 695.050656][ T5980] usb 5-1: config 0 interface 0 has no altsetting 0 [ 695.093753][ T5980] usb 5-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=bc.76 [ 695.124814][ T5980] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 695.165479][ T5980] usb 5-1: Product: syz [ 695.179560][ T5980] usb 5-1: Manufacturer: syz [ 695.197870][ T5980] usb 5-1: SerialNumber: syz [ 695.220885][ T5980] usb 5-1: config 0 descriptor?? [ 695.259647][ T5980] snd_usb_toneport 5-1:0.0: Line 6 TonePort UX2 found [ 695.482837][ T5980] snd_usb_toneport 5-1:0.0: cannot get proper max packet size [ 695.492082][ T5980] snd_usb_toneport 5-1:0.0: Line 6 TonePort UX2 now disconnected [ 695.510040][ T5980] snd_usb_toneport 5-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 695.653543][T14371] 8021q: VLANs not supported on gre0 [ 697.629443][ T5832] usb 5-1: USB disconnect, device number 100 [ 697.656813][T14397] program syz.5.2352 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 697.850329][T14404] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2353'. [ 697.938026][T10863] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 698.010606][T14407] netlink: 2196 bytes leftover after parsing attributes in process `syz.7.2354'. [ 698.177256][ T5832] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 698.212895][T14417] tipc: MTU too low for tipc bearer [ 698.317461][ T5832] usb 5-1: device descriptor read/64, error -71 [ 698.559025][ T5832] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 698.591761][T14420] netlink: 76 bytes leftover after parsing attributes in process `syz.3.2357'. [ 698.698836][ T5832] usb 5-1: device descriptor read/64, error -71 [ 698.807766][ T5832] usb usb5-port1: attempt power cycle [ 699.082302][T14430] PKCS7: Unknown OID: [5] (bad) [ 699.088028][T14430] PKCS7: Only support pkcs7_signedData type [ 699.197968][ T5832] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 699.240199][ T5832] usb 5-1: device descriptor read/8, error -71 [ 699.517506][ T5832] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 699.555182][ T5832] usb 5-1: device descriptor read/8, error -71 [ 699.668137][ T5832] usb usb5-port1: unable to enumerate USB device [ 699.791699][ T30] kauditd_printk_skb: 72 callbacks suppressed [ 699.791719][ T30] audit: type=1326 audit(1767883975.123:814): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14441 comm="syz.5.2364" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f23539 code=0x0 [ 700.501579][ T30] audit: type=1326 audit(1767883975.833:815): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.564410][ T30] audit: type=1326 audit(1767883975.833:816): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.595538][ T30] audit: type=1326 audit(1767883975.833:817): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=430 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.623283][ T30] audit: type=1326 audit(1767883975.833:818): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.646722][ T30] audit: type=1326 audit(1767883975.833:819): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.669213][ T30] audit: type=1326 audit(1767883975.873:820): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=55 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.692181][ T30] audit: type=1326 audit(1767883975.873:821): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.734621][ T30] audit: type=1326 audit(1767883975.873:822): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.758760][ T30] audit: type=1326 audit(1767883975.873:823): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14450 comm="syz.3.2366" exe="/root/syz-executor" sig=0 arch=40000003 syscall=431 compat=1 ip=0xf704d539 code=0x7ffc0000 [ 700.833100][ T5980] usb 4-1: new high-speed USB device number 127 using dummy_hcd [ 701.020024][ T5980] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 701.044956][ T5980] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 701.061241][ T5980] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 701.082184][ T5980] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 701.092787][ T5980] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 701.101203][ T5980] usb 4-1: Product: syz [ 701.105472][ T5980] usb 4-1: Manufacturer: syz [ 701.110191][ T5980] usb 4-1: SerialNumber: syz [ 701.116978][ T5980] usb 4-1: config 0 descriptor?? [ 701.125202][T14451] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 701.132859][T14451] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 701.141830][ T5980] usb 4-1: ucan: probing device on interface #0 [ 701.199840][T10863] usb 5-1: new high-speed USB device number 105 using dummy_hcd [ 701.287551][ T7635] usb 6-1: new low-speed USB device number 72 using dummy_hcd [ 701.359253][T10863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 701.369703][T10863] usb 5-1: New USB device found, idVendor=04b4, idProduct=de61, bcdDevice= 0.00 [ 701.379111][T10863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 701.390365][T10863] usb 5-1: config 0 descriptor?? [ 701.418951][ T7635] usb 6-1: device descriptor read/64, error -71 [ 701.547056][ T5980] usb 4-1: ucan: device reported invalid tx-fifo size [ 701.554737][ T5980] usb 4-1: ucan: probe failed; try to update the device firmware [ 701.687339][ T7635] usb 6-1: new low-speed USB device number 73 using dummy_hcd [ 701.809285][T10863] hid_parser_main: 80 callbacks suppressed [ 701.809311][T10863] cypress 0003:04B4:DE61.0028: unknown main item tag 0x0 [ 701.823271][ T7635] usb 6-1: device descriptor read/64, error -71 [ 701.831162][T10863] cypress 0003:04B4:DE61.0028: unknown main item tag 0x0 [ 701.839907][T10863] cypress 0003:04B4:DE61.0028: unknown main item tag 0x0 [ 701.848086][T10863] cypress 0003:04B4:DE61.0028: unknown main item tag 0x0 [ 701.855338][T10863] cypress 0003:04B4:DE61.0028: unknown main item tag 0x0 [ 701.876457][T10863] cypress 0003:04B4:DE61.0028: unknown main item tag 0x0 [ 701.888897][T10863] cypress 0003:04B4:DE61.0028: item fetching failed at offset 6/7 [ 701.926254][T10863] cypress 0003:04B4:DE61.0028: parse failed [ 701.946097][T10863] cypress 0003:04B4:DE61.0028: probe with driver cypress failed with error -22 [ 701.960253][ T7635] usb usb6-port1: attempt power cycle [ 702.005187][T10863] usb 5-1: USB disconnect, device number 105 [ 702.098354][ T5902] usb 4-1: USB disconnect, device number 127 [ 702.317370][ T7635] usb 6-1: new low-speed USB device number 74 using dummy_hcd [ 702.327350][T10863] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 702.337931][ T7635] usb 6-1: device descriptor read/8, error -71 [ 702.479019][T10863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 702.490301][T10863] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 702.500599][T10863] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 702.514240][T10863] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 702.523530][T10863] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.534888][T10863] usb 5-1: config 0 descriptor?? [ 702.607272][ T7635] usb 6-1: new low-speed USB device number 75 using dummy_hcd [ 702.638335][ T7635] usb 6-1: device descriptor read/8, error -71 [ 702.753914][ T7635] usb usb6-port1: unable to enumerate USB device [ 702.837686][T10863] usbhid 5-1:0.0: can't add hid device: -71 [ 702.870076][T10863] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 702.903403][T10863] usb 5-1: USB disconnect, device number 106 [ 747.310588][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.317028][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 764.748013][ T5843] Bluetooth: hci0: command 0x0406 tx timeout [ 808.752086][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 808.758877][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 813.869919][ T5915] kworker/0:4 (5915) used greatest stack depth: 14936 bytes left [ 859.947967][ T31] INFO: task kworker/0:8:5963 blocked for more than 143 seconds. [ 859.956553][ T31] Tainted: G L syzkaller #0 [ 859.963297][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 859.972176][ T31] task:kworker/0:8 state:D stack:21624 pid:5963 tgid:5963 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 859.984997][ T31] Workqueue: usb_hub_wq hub_event [ 859.990328][ T31] Call Trace: [ 859.993725][ T31] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=-1 (errno 104: Connection reset by peer) [ 859.996777][ T31] __schedule+0x149b/0x4fd0 [ 860.001554][ T31] ? wq_worker_sleeping+0xfe/0x250 [ 860.006867][ T31] ? __pfx___schedule+0x10/0x10 [ 860.011884][ T31] ? schedule+0x91/0x360 [ 860.016203][ T31] schedule+0x165/0x360 [ 860.047176][ T31] usb_kill_urb+0x1be/0x2d0 [ 860.052822][ T31] ? __pfx_usb_kill_urb+0x10/0x10 [ 860.114751][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 860.147487][ T31] usb_start_wait_urb+0x1e3/0x4f0 [ 860.157676][ T31] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 860.163313][ T31] usb_control_msg+0x232/0x3e0 [ 860.217267][ T31] hub_port_init+0xb1d/0x28e0 [ 860.222172][ T31] hub_event+0x2573/0x4ef0 [ 860.226672][ T31] ? __pfx_hub_event+0x10/0x10 [ 860.257568][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 860.263378][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 860.293835][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 860.317132][ T31] process_scheduled_works+0xad1/0x1770 [ 860.323552][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 860.337286][ T31] ? do_raw_spin_lock+0x121/0x290 [ 860.342438][ T31] worker_thread+0x8a0/0xda0 [ 860.364312][ T31] ? __kthread_parkme+0x7b/0x200 [ 860.377200][ T31] kthread+0x711/0x8a0 [ 860.381356][ T31] ? __pfx_worker_thread+0x10/0x10 [ 860.386598][ T31] ? __pfx_kthread+0x10/0x10 [ 860.407129][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 860.412404][ T31] ? __pfx_kthread+0x10/0x10 [ 860.417028][ T31] ret_from_fork+0x510/0xa50 [ 860.447230][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 860.452420][ T31] ? __switch_to+0xc9e/0x1480 [ 860.467128][ T31] ? __pfx_kthread+0x10/0x10 [ 860.471795][ T31] ret_from_fork_asm+0x1a/0x30 [ 860.476620][ T31] [ 860.479902][ T31] [ 860.479902][ T31] Showing all locks held in the system: [ 860.487937][ T31] 1 lock held by khungtaskd/31: [ 860.493167][ T31] #0: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 860.503329][ T31] 4 locks held by klogd/5188: [ 860.525867][ T31] #0: ffff8880b863a918 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 860.538273][ T31] #1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_switch+0x53/0x880 [ 860.547434][ T31] #2: ffff88807d51c768 (&p->pi_lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 860.557629][ T31] #3: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: psi_task_change+0xd9/0x340 [ 860.566645][ T31] 2 locks held by getty/5589: [ 860.571462][ T31] #0: ffff88802fb7b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 860.581714][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 [ 860.601609][ T31] 5 locks held by kworker/0:8/5963: [ 860.606861][ T31] #0: ffff888141eb3948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 860.620711][ T31] #1: ffffc9000487fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 860.633843][ T31] #2: ffff88814531b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4ef0 [ 860.643017][ T31] #3: ffff88814531e518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x215a/0x4ef0 [ 860.653068][ T31] #4: ffff888028a20a68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2182/0x4ef0 [ 860.662903][ T31] 3 locks held by kworker/0:9/5980: [ 860.668254][ T31] #0: ffff8880b863a918 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 860.687155][ T31] #1: ffff8880b8624588 (psi_seq){-.-.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 860.698564][ T31] #2: ffffe8ffffc88cd8 (&ACCESS_PRIVATE(sdp, lock)){....}-{3:3}, at: srcu_invoke_callbacks+0x311/0x450 [ 860.709916][ T31] 4 locks held by syz-executor/10981: [ 860.715409][ T31] #0: ffff888056c58ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5b0 [ 860.725609][ T31] #1: ffff888056c580c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100 [ 860.735495][ T31] #2: ffffffff8f4839c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 860.745998][ T31] #3: ffff888079d85338 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x7b/0x5b0 [ 860.755570][ T31] 1 lock held by syz-executor/10991: [ 860.761090][ T31] #0: ffffffff8df475f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x36e/0x6e0 [ 860.772174][ T31] 3 locks held by kworker/u8:5/11116: [ 860.777929][ T31] #0: ffff88813ff29948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 860.790084][ T31] #1: ffffc9000c7b7bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 860.801501][ T31] #2: ffffffff8f311e08 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 860.810576][ T31] 5 locks held by kworker/u8:6/12141: [ 860.815978][ T31] #0: ffff88801aa9f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 860.827767][ T31] #1: ffffc90003347bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 860.838560][ T31] #2: ffffffff8f304d50 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x7a0 [ 860.848066][ T31] #3: ffffffff8f311e08 (rtnl_mutex){+.+.}-{4:4}, at: wg_netns_pre_exit+0x1c/0x200 [ 860.857588][ T31] #4: ffff8880335e14e8 (&wg->device_update_lock){+.+.}-{4:4}, at: wg_netns_pre_exit+0xb0/0x200 [ 860.868169][ T31] 3 locks held by syz-executor/13440: [ 860.873552][ T31] #0: ffff888067820ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_unregister_dev+0x212/0x5b0 [ 860.883550][ T31] #1: ffff8880678200c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x640/0x1100 [ 860.893351][ T31] #2: ffffffff8f4839c8 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xa1/0x260 [ 860.904138][ T31] 1 lock held by syz-executor/13450: [ 860.909603][ T31] #0: ffffffff8f311e08 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 860.918803][ T31] [ 860.967188][ T31] ============================================= [ 860.967188][ T31] [ 860.975670][ T31] NMI backtrace for cpu 1 [ 860.975694][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 860.975723][ T31] Tainted: [L]=SOFTLOCKUP [ 860.975731][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 860.975742][ T31] Call Trace: [ 860.975752][ T31] [ 860.975760][ T31] dump_stack_lvl+0xe8/0x150 [ 860.975792][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 860.975820][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 860.975854][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 860.975884][ T31] sys_info+0x135/0x170 [ 860.975907][ T31] watchdog+0xf95/0xfe0 [ 860.975938][ T31] ? watchdog+0x20a/0xfe0 [ 860.975972][ T31] kthread+0x711/0x8a0 [ 860.976000][ T31] ? __pfx_watchdog+0x10/0x10 [ 860.976025][ T31] ? __pfx_kthread+0x10/0x10 [ 860.976054][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 860.976081][ T31] ? __pfx_kthread+0x10/0x10 [ 860.976116][ T31] ret_from_fork+0x510/0xa50 [ 860.976137][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 860.976154][ T31] ? __switch_to+0xc9e/0x1480 [ 860.976186][ T31] ? __pfx_kthread+0x10/0x10 [ 860.976212][ T31] ret_from_fork_asm+0x1a/0x30 [ 860.976255][ T31] [ 860.976264][ T31] Sending NMI from CPU 1 to CPUs 0: [ 861.103131][ C0] NMI backtrace for cpu 0 [ 861.103152][ C0] CPU: 0 UID: 0 PID: 8185 Comm: syz.3.684 Tainted: G L syzkaller #0 PREEMPT(full) [ 861.103176][ C0] Tainted: [L]=SOFTLOCKUP [ 861.103182][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 861.103192][ C0] RIP: 0010:lock_release+0x3c/0x3b0 [ 861.103214][ C0] Code: 49 89 f5 49 89 fe 65 48 8b 05 20 f1 e1 10 48 89 44 24 28 0f 1f 44 00 00 65 8b 05 23 f1 e1 10 83 f8 08 0f 83 57 02 00 00 89 c0 <48> 0f a3 05 4c 04 e4 0d 73 0d e8 a5 dd 08 00 84 c0 0f 84 95 02 00 [ 861.103228][ C0] RSP: 0018:ffffc9000c047518 EFLAGS: 00000293 [ 861.103244][ C0] RAX: 0000000000000000 RBX: ffffffff81ab6b1d RCX: 0000000080000001 [ 861.103257][ C0] RDX: 000000005a44979c RSI: ffffffff81ab6b1d RDI: ffffffff8df41aa0 [ 861.103269][ C0] RBP: 0000000000000000 R08: ffffffff81ab6b1d R09: ffffffff8df41aa0 [ 861.103280][ C0] R10: ffffc9000c047658 R11: ffffffff81acf3d0 R12: ffff88802ea29e80 [ 861.103292][ C0] R13: ffffffff81ab6b1d R14: ffffffff8df41aa0 R15: 1ffff92001808eca [ 861.103304][ C0] FS: 0000000000000000(0000) GS:ffff888125e1f000(0000) knlGS:0000000000000000 [ 861.103318][ C0] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 861.103330][ C0] CR2: 00005610bebeb000 CR3: 000000000dd3a000 CR4: 00000000003526f0 [ 861.103354][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 861.103364][ C0] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 861.103374][ C0] Call Trace: [ 861.103382][ C0] [ 861.103389][ C0] ? unwind_next_frame+0xa5/0x23d0 [ 861.103408][ C0] ? unwind_next_frame+0x1ab6/0x23d0 [ 861.103425][ C0] ? is_module_text_address+0x1d/0x1e0 [ 861.103440][ C0] ? is_module_text_address+0x1d/0x1e0 [ 861.103455][ C0] is_module_text_address+0x18b/0x1e0 [ 861.103472][ C0] kernel_text_address+0x94/0xe0 [ 861.103494][ C0] __kernel_text_address+0xd/0x40 [ 861.103514][ C0] unwind_get_return_address+0x4d/0x90 [ 861.103533][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 861.103556][ C0] arch_stack_walk+0xfc/0x150 [ 861.103579][ C0] stack_trace_save+0x9c/0xe0 [ 861.103600][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 861.103626][ C0] save_stack+0xf5/0x1f0 [ 861.103642][ C0] ? __pfx_save_stack+0x10/0x10 [ 861.103657][ C0] ? __free_frozen_pages+0xbc8/0xd30 [ 861.103672][ C0] ? vfree+0x25a/0x400 [ 861.103693][ C0] ? kcov_close+0x28/0x50 [ 861.103712][ C0] ? __fput+0x44c/0xa70 [ 861.103730][ C0] ? task_work_run+0x1d4/0x260 [ 861.103749][ C0] ? do_exit+0x694/0x22f0 [ 861.103767][ C0] ? do_group_exit+0x21c/0x2d0 [ 861.103786][ C0] ? get_signal+0x1285/0x1340 [ 861.103800][ C0] ? arch_do_signal_or_restart+0x9a/0x7a0 [ 861.103821][ C0] ? exit_to_user_mode_loop+0x87/0x4e0 [ 861.103836][ C0] ? __do_fast_syscall_32+0x398/0x570 [ 861.103854][ C0] ? do_fast_syscall_32+0x34/0x80 [ 861.103870][ C0] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 861.103894][ C0] __reset_page_owner+0x71/0x1f0 [ 861.103911][ C0] __free_frozen_pages+0xbc8/0xd30 [ 861.103931][ C0] vfree+0x25a/0x400 [ 861.103952][ C0] ? __pfx_kcov_close+0x10/0x10 [ 861.103972][ C0] kcov_close+0x28/0x50 [ 861.103991][ C0] __fput+0x44c/0xa70 [ 861.104015][ C0] task_work_run+0x1d4/0x260 [ 861.104037][ C0] ? __pfx_task_work_run+0x10/0x10 [ 861.104057][ C0] ? kmem_cache_free+0x197/0x620 [ 861.104073][ C0] ? do_exit+0x68f/0x22f0 [ 861.104094][ C0] do_exit+0x694/0x22f0 [ 861.104117][ C0] ? __pfx_do_exit+0x10/0x10 [ 861.104143][ C0] do_group_exit+0x21c/0x2d0 [ 861.104163][ C0] ? _raw_spin_unlock_irq+0x23/0x50 [ 861.104187][ C0] get_signal+0x1285/0x1340 [ 861.104210][ C0] arch_do_signal_or_restart+0x9a/0x7a0 [ 861.104231][ C0] ? __pfx_get_old_timespec32+0x10/0x10 [ 861.104249][ C0] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 861.104273][ C0] ? __se_sys_clock_nanosleep_time32+0x33b/0x390 [ 861.104298][ C0] exit_to_user_mode_loop+0x87/0x4e0 [ 861.104314][ C0] ? rcu_is_watching+0x15/0xb0 [ 861.104333][ C0] __do_fast_syscall_32+0x398/0x570 [ 861.104387][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 861.104402][ C0] ? do_fast_syscall_32+0x34/0x80 [ 861.104419][ C0] ? irqentry_exit+0x10f/0x670 [ 861.104436][ C0] do_fast_syscall_32+0x34/0x80 [ 861.104454][ C0] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 861.104472][ C0] RIP: 0023:0xf704d539 [ 861.104485][ C0] Code: Unable to access opcode bytes at 0xf704d50f. [ 861.104493][ C0] RSP: 002b:00000000f543d460 EFLAGS: 00000206 ORIG_RAX: 000000000000010b [ 861.104510][ C0] RAX: fffffffffffffdfc RBX: 0000000000000000 RCX: 0000000000000000 [ 861.104521][ C0] RDX: 00000000f543d494 RSI: 00000000f543d48c RDI: 00000000f543d494 [ 861.104532][ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 861.104541][ C0] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 861.104551][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 861.104569][ C0] [ 861.706417][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 861.713357][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 861.724166][ T31] Tainted: [L]=SOFTLOCKUP [ 861.728529][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 861.738615][ T31] Call Trace: [ 861.741920][ T31] [ 861.744942][ T31] vpanic+0x1e0/0x670 [ 861.748950][ T31] panic+0xb9/0xc0 [ 861.752681][ T31] ? __pfx_panic+0x10/0x10 [ 861.757110][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 861.762502][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 861.768669][ T31] watchdog+0xfdf/0xfe0 [ 861.772845][ T31] ? watchdog+0x20a/0xfe0 [ 861.777189][ T31] kthread+0x711/0x8a0 [ 861.781360][ T31] ? __pfx_watchdog+0x10/0x10 [ 861.786118][ T31] ? __pfx_kthread+0x10/0x10 [ 861.790725][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 861.795937][ T31] ? __pfx_kthread+0x10/0x10 [ 861.800539][ T31] ret_from_fork+0x510/0xa50 [ 861.805137][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 861.810336][ T31] ? __switch_to+0xc9e/0x1480 [ 861.815042][ T31] ? __pfx_kthread+0x10/0x10 [ 861.819661][ T31] ret_from_fork_asm+0x1a/0x30 [ 861.824477][ T31] [ 861.828034][ T31] Kernel Offset: disabled [ 861.832417][ T31] Rebooting in 86400 seconds..