last executing test programs: 11m51.188711166s ago: executing program 1 (id=1213): socket$inet(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) syz_open_dev$vim2m(0x0, 0x7, 0x2) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x1}, 0x10) write(r4, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000003f0000000000000800040001000000", 0x24) 11m48.903519721s ago: executing program 1 (id=1216): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={0x0}, 0x18) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) ftruncate(0xffffffffffffffff, 0x2000009) sendfile(r3, 0xffffffffffffffff, 0x0, 0x7ffff004) inotify_init() r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000ec0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)=@newsa={0x154, 0x10, 0x713, 0x0, 0x0, {{@in=@remote, @in=@initdev={0xac, 0x1e, 0x0, 0x0}}, {@in6=@mcast2, 0x0, 0x32}, @in=@local, {0x200000, 0x0, 0xffffffffffff7fff}, {}, {}, 0x0, 0x0, 0x2}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x0, 0x500, @in=@loopback}}]}, 0x154}, 0x1, 0x0, 0x0, 0x24000041}, 0x0) 11m44.743818795s ago: executing program 1 (id=1225): openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'wg0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=@newqdisc={0x50, 0x24, 0x4ee4e6a52ff56645, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xfff3}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x1c, 0x2, [@TCA_FQ_CODEL_LIMIT={0x8}, @TCA_FQ_CODEL_CE_THRESHOLD={0x8, 0x7, 0x4ee}, @TCA_FQ_CODEL_ECN={0x8, 0x4, 0x1}]}}]}, 0x50}, 0x1, 0x0, 0x0, 0x51}, 0x8000) name_to_handle_at(0xffffffffffffff9c, &(0x7f0000000400)='./cgroup.net/cgroup.procs\x00', &(0x7f0000000600)=ANY=[@ANYRESHEX], 0x0, 0x200) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(r2, 0x8982, &(0x7f00000001c0)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, 0x0, 0x0, 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) dup(0xffffffffffffffff) write$sndseq(0xffffffffffffffff, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) r6 = socket$netlink(0x10, 0x3, 0x15) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r7) sendmsg$NLBL_CIPSOV4_C_ADD(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r8, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b80080009fffe000000080009000000000008000a"], 0x184}}, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1f, 0x0, 0x0, 0x1000, 0x0, 0x1}, 0x48) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0, 0x28011, r9, 0x0) syz_usb_connect(0x2, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xdc, 0xfe, 0x4, 0x20, 0xb48, 0x2003, 0x4125, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0xa, [{{0x9, 0x4, 0xe4, 0xf3, 0x2, 0xb9, 0xd3, 0x6f, 0x0, [], [{{0x9, 0x5, 0xa, 0x1, 0x10, 0x8, 0xff, 0xa4}}, {{0x9, 0x5, 0x6, 0x2, 0x40, 0x64, 0x8e, 0x3}}]}}]}}]}}, 0x0) 11m41.123040081s ago: executing program 1 (id=1233): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0xa000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000340)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r0, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, r1, 0x0, 0x0, 0x0, 0x0}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r3, 0x4b67, &(0x7f0000001ec0)={0x1, &(0x7f0000001e80)=[{0x0, 0x1000}]}) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) r5 = syz_io_uring_setup(0x59c5, &(0x7f00000005c0)={0x0, 0xfad6, 0x800, 0x0, 0xcd}, &(0x7f0000000580)=0x0, &(0x7f0000000340)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f00000002c0)=@IORING_OP_RENAMEAT={0x23, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0}) io_uring_enter(r5, 0xdb4, 0x0, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, &(0x7f00000000c0)={0x48, 0x5, r1, 0x0, 0xffffffffffffffff}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000440)={0x48, 0x8, r8, 0x0, 0x5, 0xb7, &(0x7f0000000380)="65a9293b54f60d319c727b3eb6ce8ca8385d53681613328cf781161d0d8889a76fa9417e563c791ab1dac880b130d5414248337d72d72e4fa3a871d693314baeed345ef08cb917be07d436f971fa4769d169037efc62f9f8246b1d71126d7d6fcd6e0f7097056bdde0e93b84f3ecf1df849148412e1882e265017a749616fd558930e33ab68b7b6a4ef5f30ae693fbf0f02a04a85645fc4d83edf18b3131253738fbe6570b26226cea444305a3b45b99e4a97c4ae2941b"}) ioctl$IOMMU_HWPT_ALLOC$TEST(r0, 0x3b89, &(0x7f00000002c0)={0x18, 0x3, r2, r4, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000280)}) syz_open_dev$admmidi(&(0x7f0000000080), 0x3ff, 0x40) r10 = syz_usb_connect$cdc_ncm(0x0, 0x8f, &(0x7f0000000580)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109027d0002010080000904000001020d0000052406000105240000000d240f0103050000fd0000000406241aff072908241c0101090000142413099f33760bf14377323063f9c8a04d113905241510000905810300020800040904010000020d00000904010102020d0000090582020002e1ad00090503020002"], 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r10, 0x0, &(0x7f0000000000)={0xfffffffffffffee0, 0x0, 0x0, 0x0, &(0x7f0000000080)={0x20, 0x80, 0x1c, {0xff, 0x2070, 0x1000, 0x9, 0x4, 0x8000, 0xfffd, 0xec, 0x3906, 0xfffc, 0x3, 0xfb}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r10, 0x0, 0x0) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f0000000180)={0x30, r9, 0x1, 0x0, 0x0, 0x0, 0x1000, 0x0}) syz_usb_control_io(r10, &(0x7f0000000500)={0x2c, &(0x7f0000000640)={0x40, 0xa, 0xff, {0xff, 0x0, "9b04be1b36795cc1751851cf243f2c8de71861f91f9df455e1563a4864d7ad8baa7ad762b8c835bb4a9effc886d66591cb51b5ccc9bef1c32fda969185aad08a81278d0b975a062f490fb0860b683c8402eb14bec0921cc56ee341941db531973bda2a70bcb3949695fca802f3991b1c6b5fb09a53d455c16c6aae6854b98ffefaafa2a7cc73f602db35e93c21bdb5b8cd185c244237b82fed8c4a864d4d02586c910bbcf3645776ee580ca0db768b37bf211ac9968f5a8aaa48c04326fd14dd78985d6390615ab54615defbaeec09a0480387769b6d149ad19ad5f6036e0a202ffc5d287b58b2abdc1565a7eee67b66e3012d3d261704222cf928c6d1"}}, &(0x7f0000000140)={0x0, 0x3, 0xe, @string={0xe, 0x3, "3df19fed8d6fd360a6fffae3"}}, &(0x7f00000001c0)={0x0, 0xf, 0x15, {0x5, 0xf, 0x15, 0x1, [@ssp_cap={0x10, 0x10, 0xa, 0x27, 0x1, 0x1, 0xf00f, 0x7, [0xff3f0f]}]}}, &(0x7f0000000300)={0x20, 0x29, 0xf, {0xf, 0x29, 0x1a, 0x1, 0x6, 0xc, 'B\\1k', "e06f7021"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x3, 0x3, 0x16, 0x0, 0xf4, 0x2, 0x1000}}}, &(0x7f0000000bc0)={0x84, &(0x7f0000000780)={0x0, 0xc, 0x9b, "f12b0b3db17e2f4f04d14a6bf1491cc9183ecbd6daa0e5ccb1e1f9ad43c8c4a1ff28cad91ec2e0fe36ac8af3602f3bf07f1ffc0d5352667784c3b97b3701d8012dd14ad6e992a5cc62ca5d344378d7f3d35727115b7104e569dc240a699f40d3e35746a422e84e08ffeafaed0b2ee78a54e7f6da7a182a92af47e75ce284a4311f1fa583cf9838e2901792172aa6a24c7dd1a5a688f458e1ff7414"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0xfd}, &(0x7f0000000840)={0x0, 0x8, 0x1, 0x4}, &(0x7f0000000880)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f00000008c0)={0x20, 0x0, 0x8, {0x100, 0x20, [0xf0f]}}, &(0x7f0000000900)={0x40, 0x7, 0x2, 0x2}, &(0x7f0000000940)={0x40, 0x9, 0x1, 0xff}, &(0x7f0000000980)={0x40, 0xb, 0x2, "38ac"}, &(0x7f00000009c0)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000a00)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000a40)={0x40, 0x17, 0x6, @broadcast}, &(0x7f0000000a80)={0x40, 0x19, 0x2, "e97b"}, &(0x7f0000000ac0)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000b00)={0x40, 0x1c, 0x1, 0x40}, &(0x7f0000000b40)={0x40, 0x1e, 0x1, 0x80}, &(0x7f0000000b80)={0x40, 0x21, 0x1}}) 11m36.248757642s ago: executing program 1 (id=1251): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_genetlink_get_family_id$ieee802154(0x0, 0xffffffffffffffff) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10120000}, 0xc, &(0x7f00000002c0)={&(0x7f00000001c0)={0x2c, r3, 0x400, 0x70bd26, 0x25dfdbfc, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000010}, 0x8000) r4 = socket$inet6(0xa, 0x3, 0x3c) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, &(0x7f0000002880)=ANY=[@ANYBLOB="61128c000000000061134c0000000000bf2000000000000007000000080000002d0301000000000095000000000000007926000000000000bf670800000000005607000000ff07ad6706000002000000070200000ee60000bf250000000000003d350000000000006507000002000000070700004c0000001f75000000000000bf54000000000000160400000400f9ffad3001000000000084000000000000004500000001f0ffff95000000000000006e8ad524a56601a5585b7351ca1136aef2e9407e5c2501d11900db85604036883647b1fb3f1403b816f511c8c56e56e40b01005505f8a89dae4293b10f3631b25fc9f189084c7fddccff01361d355f6cce8ec2abcdf1bc9040daef2cfa2046e2091e269f4734ffa55eb2d4e8de20b38c8808b365b46bd54c68cd30139a8c3827a7dd6d6e2b5fea3906f8456b0000000000ff07efffffff0047018ae79db613d2aec070f718ab629b4975320dd7a7da532281fd22c7b835005bf52715396669836db6000000005b4f0591ee7c8cd263dd172b28d01c4d8d4fee81e3cdd5daf2cdad3d1a74a2f078aa6402483856a6e494408d0b33047f06aec2cc590df28efc7dbec6857db922195a271af103f03e1155197e067b2ebf4e2dae060959c9639564f000fc3cdd05a1575c91cf5ba8b2db403681ee48f5287123a0d246c0c4c00fe979dbc09ed4db22d7172adc6ae8faa5f9ad188e07000000000000008d88a0b4684559d46cae41db1b914e93f1f8000000000000000000e33de432e488ad0e724c2d14a1e770e116984a5700afb8a1f3d47277ef0e33e7e00ec5f74e10937ba0e321346977b7d1b18013f509675b5b0f352e30dffda780e95c301f4fc7d5a76475ace6b128b02bfd71023daffdf748a6bd356fcba6ec96373d1101000736ac0bbcb5f4836bddfe8bf46308000000ade9e59fcf271bb98bd0b8b5216b858b414c31682f9f3db2e4d8e5898e445fe55ac56c0d642986f8bbc7340bc6393f774318c9fc9b05788de2c6e601b50777e8dff581de1d5ae3d801ead7eba31126e2172fa1eadf5f3bec81004d00000000c8e4692e051c731f9ac766b7fd66278d40f0760f23e8c7d1f47cd8e02504e85e152955ad8acd989c0b2eea71414f533f5685c3904bfe1d0011ffc1ba5398f3d6812467c1a4186edd036f153bf0f5bf847c50f79e1a0ad3d2b5080ecb0148e2b86177869884ae625a14bddcf5b3e72b420c9f1b534e969fce97ffff070000000000dbbfe0ed7c5853a665c0805752dca0e571d75cac5a5d8e4f6e05055b6dec5a9a5696f053a92d81fd9e5f2b9dbbe24f38e745b5a95d45003d0600e413dc623f3e6b096c8b0ad7438c6631388892c55b0671140afbfb83bba415f729fea4c8a8a86189dceedad84cdd17c46bdd847a1f4b0facd3744f5bbb06abb319204fca4bcd4297fe7b4cee75abf43e14fe861224799c0f12702964fc890a176fdafa2c9387280b5693c000c0304cece48642649375dae0b7979b229f708a97349e96e783af9a23cd3980a2c29d3d6287805319cd51bdd224878a0b25edf0e83c930633bd9a0c3e28f359608ea326c77a1aa17318f392a0ec6c188916f452533d4327feccfd68ec8278a90252693fb133c4615801077e1d75420017c03990b855fe481a20b4919bb11c6d737b6545ef140a0fc339bb53953662f1454f9852e7c4e17eb8098f076c659f56d6c7f97a96d6cdf45cfe88b30c170000000001000000effbf33bd1becb0de0a080931f137967de563c29d81aacb3d48226a4e4b6670900000000000000fa68bff3693afc44db223f2be09295e4a8da03d23b48bb38b39a14ffcddd92c38f6b6d86a0e5ed47a82bad5d2a6dce4c4d353261260c9d7a6bd9f2c872c4172a3d2ac80dfb718cc159e6423065624f130000000000000000000000000000000000000000002a37163e8d7ef2f3c58d045f0700000094029acbe333aebd10f2118fbfeda3fa5500d52cd5241588d2b68a332edfef6d701c8936a25d68b841f982511392cc0d3a78616f8ce0f2877d099258bf85866d0ee7f803fa50fd41ef62b028d12028a7b497d92f544523290f520b0d57158dc308c08dc0a8dc99bdfeaff43eb24134e63a5efd08c6c2d51983265b60afcc5effad8f52ec152ab4ed39c2dbd04e3fefd9217a0246660301d5b7d7a9ea72c2cdec5a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x48) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x5000, 0x1, @remote, 0x5}, 0x1c) writev(r4, &(0x7f00000000c0)=[{&(0x7f0000000100)=',', 0xffdf}], 0x1) 11m33.44371561s ago: executing program 1 (id=1261): mkdir(&(0x7f0000000380)='./file1\x00', 0xa) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=']) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0xffffffffffffff61) r0 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000100)) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x2, @mcast1, 0x6}, 0x1c) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100039042abd7000eaffff5daca93a22", @ANYRES32=0x0, @ANYBLOB="03000000c31006003000128008000100736974002400028008000100", @ANYRES32, @ANYBLOB="08000300ac14"], 0x50}, 0x1, 0x0, 0xfd, 0x8000}, 0x4008040) flock(r2, 0x1) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040), 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4a, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0xd, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 11m17.781860038s ago: executing program 32 (id=1261): mkdir(&(0x7f0000000380)='./file1\x00', 0xa) openat$autofs(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=']) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(0xffffffffffffffff, 0xc02c564a, 0x0) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0xffffffffffffff61) r0 = accept$inet6(0xffffffffffffffff, 0x0, &(0x7f0000000100)) connect$inet6(r0, &(0x7f0000000300)={0xa, 0x4e23, 0x2, @mcast1, 0x6}, 0x1c) sched_setaffinity(0x0, 0x8, &(0x7f0000000380)=0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100039042abd7000eaffff5daca93a22", @ANYRES32=0x0, @ANYBLOB="03000000c31006003000128008000100736974002400028008000100", @ANYRES32, @ANYBLOB="08000300ac14"], 0x50}, 0x1, 0x0, 0xfd, 0x8000}, 0x4008040) flock(r2, 0x1) r4 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r4, &(0x7f0000000040), 0x10) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4a, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r5 = syz_open_dev$usbfs(&(0x7f0000000140), 0xd, 0x3501) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) 6m14.332036536s ago: executing program 4 (id=2323): setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f0000000480)={0x1, &(0x7f0000000400)=[{0x6}]}, 0x10) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f00000001c0)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000003c0)={0xa, 0xfffe, 0x3000000, @mcast2, 0x6}, 0x1c) socket$inet_icmp_raw(0x2, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8bf, 0x10008b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x8) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) r1 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_IP_XFRM_POLICY(r1, 0x11, 0x11, &(0x7f0000000380)={{{@in6=@local, @in=@multicast1}}, {{@in=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000340)=0xfffffffffffffe36) socket$phonet_pipe(0x23, 0x5, 0x2) syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x8e82, 0x100, 0x14, 0x2ac}, &(0x7f00000003c0)=0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x1000000000002) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, 0x0, 0x20000000) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) futex(0x0, 0x0, 0x4, 0x0, 0x0, 0xfffffffd) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0x10, &(0x7f0000000580)=@framed={{0x18, 0x5}, [@snprintf={{0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb0ffffff}, {}, {}, {}, {}, {}, {0x7, 0x1, 0xb, 0x4, 0xa, 0x8}, {}, {}, {0x18, 0x3, 0x2, 0x0, r4}, {0x7, 0x0, 0x5, 0x4}, {0x85, 0x0, 0x0, 0x1c}}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @xdp, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001480), 0x42002, 0x0) r6 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDFONTOP_GET(r6, 0x4b72, &(0x7f0000000100)={0x1, 0x1, 0xa, 0x20, 0x138, &(0x7f0000000480)}) r7 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r5, r7, 0x0, 0x20000023892) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)={0x1b, 0x0, 0x0, 0xffff, 0x0, 0x1, 0x9, '\x00', 0x0, r7, 0x1, 0x1}, 0x50) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000240)='bridge0\x00', 0x10) write(r0, &(0x7f00000000c0)="8f2a0a65bd8c2c2b0304000e0580a7b6070d63e286a5cefe", 0x5ac) 6m12.175880252s ago: executing program 4 (id=2327): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x101402, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xa, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000006c0)=@newtfilter={0x3c, 0x2c, 0xd2b, 0x800, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {0x10, 0xfff1}, {}, {0x7, 0xb}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_CLASSID={0x8, 0x1, {0xf, 0xc}}]}}]}, 0x3c}, 0x1, 0x86ddffff}, 0x24044094) 6m11.388624022s ago: executing program 4 (id=2333): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) mount$binderfs(0x0, &(0x7f00000023c0)='./binderfs\x00', &(0x7f0000002400), 0x2004000, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000240)=0x6) r3 = socket$netlink(0x10, 0x3, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB="00003b2b92af3fa0a8aadf8eba6493f752660000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000015, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x4044080}, 0x400000000000000) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000040)='/dev/comedi4\x00', 0x101000, 0x0) ioctl$COMEDI_CMD(r5, 0x80506409, &(0x7f0000000180)={0x0, 0x1, 0x2, 0x6dd, 0x10, 0x200, 0x10, 0x3, 0x20, 0xffffffff, 0x20, 0x7, &(0x7f00000000c0)=[0x4], 0x1, 0x0}) 6m10.479849647s ago: executing program 4 (id=2336): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(r0, 0xd, 0x0, &(0x7f0000000100)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r3 = socket(0x10, 0x3, 0x0) sendmsg$inet(r3, &(0x7f0000000700)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)="1c00000021006bcd210002006e04000081000010000000017aa60864", 0x1c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) socket$nl_route(0x10, 0x3, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000300)={[{@workdir={'workdir', 0x3d, './file0/../file0'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@nfs_export_on}]}) r4 = getpid() r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NETID(r5, &(0x7f0000000280)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x1c, r6, 0x4, 0x70bd2d, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000000) sched_setscheduler(r4, 0x2, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') rmdir(&(0x7f0000000380)='./file0/../file0\x00') mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(0xffffffffffffffff, 0x2, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) 6m9.533746944s ago: executing program 4 (id=2337): r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='.\x00', 0x0, 0x83) (async) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=@newtaction={0xf0, 0x32, 0x205, 0x70bd2d, 0x25dfdbfc, {}, [{0xc9}]}, 0xf0}, 0x1, 0x0, 0x0, 0x85}, 0x8000) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r0, 0x40086602, &(0x7f0000000000)) r1 = socket(0x1, 0x3, 0x0) bind$unix(r1, &(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e) (async, rerun: 64) r2 = fsopen(&(0x7f0000000000)='ocfs2_dlmfs\x00', 0x0) (rerun: 64) fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0) (async) r3 = fsmount(r2, 0x0, 0x0) (async) r4 = socket(0x28, 0x5, 0x0) (async) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f0000000040)={{0x1, 0x1, 0x4}}) (async) ioctl$SNDRV_TIMER_IOCTL_INFO(r5, 0x80e85411, &(0x7f0000000200)) (async) bind$vsock_stream(r4, &(0x7f0000000040), 0x10) (async) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x10000}) (async) listen(r4, 0x5) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x58, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x13101}, [@IFLA_LINKINFO={0x38, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x24, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x14, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x1}]}}}]}, 0x58}}, 0x0) (async) r7 = socket(0x28, 0x5, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000140)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_GET_HW_INFO(r3, 0x3b8a, &(0x7f00000001c0)={0x28, 0x0, r8, 0xa2, &(0x7f0000000240)=""/162}) setrlimit(0x40000000000008, &(0x7f0000000000)) (async) connect$vsock_stream(r7, &(0x7f0000000080), 0x10) sendmsg$nl_route_sched(r7, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000002480)=@deltfilter={0x24, 0x2d, 0x4, 0x70bd2f, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff2}, {0x1, 0x2}, {0x4, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x4004885}, 0x40004) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x5, 0x5, &(0x7f0000000000)) (async) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) ioctl$FBIOPUT_VSCREENINFO(r3, 0x4601, &(0x7f0000000500)={0xa0, 0x0, 0x800, 0x280, 0xe, 0x7, 0xf, 0x1, {0x7f, 0x7}, {0x0, 0xfac2, 0x1}, {0x5, 0xd}, {0x6, 0x7fffffff, 0x1}, 0x2, 0x2, 0x0, 0x101, 0x4d21b23e6c3ac919, 0x4, 0x2, 0x8001, 0x7, 0x6, 0x8, 0x80, 0x10, 0x200, 0x1, 0x8}) (async) setsockopt$sock_linger(r7, 0x1, 0x3c, &(0x7f00000000c0)={0x1, 0x79e}, 0x8) sendmmsg(r3, &(0x7f0000000100)=[{{0x0, 0x35, &(0x7f0000000200)=[{&(0x7f0000000000)="1b", 0x40000}], 0x1}}], 0x1, 0x24008094) (async) mkdirat(r3, &(0x7f0000000380)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) (async) ioctl$IOMMU_TEST_OP_ACCESS_PAGES$syz(r3, 0x3ba0, &(0x7f0000000480)={0x48, 0x7, r3, 0x0, 0x1, 0x0, 0x9, 0x3e1591, 0x1fd192}) 6m9.111527175s ago: executing program 4 (id=2340): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x10) r1 = socket(0x2c, 0x3, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) openat(0xffffffffffffff9c, 0x0, 0x400000, 0x102) r5 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_IO_FLUSHER(0x41, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x25dfdbfc, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {0x0, 0x0, 0xe4}]}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x0, 0x20000000, 0x0, 0xffffffff, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x10}, {0x80000000}, {0x8eb9, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x4, 0x0, 0x4, 0x0, 0x7ee}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {0x9}, {}, {}, {}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0xfffffffc, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4, 0x2}, {}, {}, {}, {}, {}, {0x10000}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {0x7}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x2}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) 5m53.844039965s ago: executing program 33 (id=2340): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x10) r1 = socket(0x2c, 0x3, 0x0) getsockopt$inet_sctp_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) openat(0xffffffffffffff9c, 0x0, 0x400000, 0x102) r5 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SET_IO_FLUSHER(0x41, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x7) sendmsg$nl_route_sched(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001940)=@newtaction={0xe98, 0x30, 0x871a15abc695fa3d, 0xfffffffd, 0x25dfdbfc, {}, [{0xe84, 0x1, [@m_pedit={0xe80, 0x1, 0x0, 0x0, {{0xa}, {0xe54, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{}, 0x97, 0x0, [{}, {0x0, 0x0, 0xe4}]}, [{}, {}, {}, {}, {}, {0x448eade7}, {0x0, 0x0, 0x80000000}, {}, {}, {}, {}, {}, {}, {0x2}, {}, {}, {0x0, 0x20000000, 0x0, 0xffffffff, 0x3}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {0xfffffffc, 0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x4}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, {0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x9}, {}, {}, {}, {}, {}, {}, {0xfffffffe}, {}, {0xd5}, {}, {}, {}, {0x4}, {}, {}, {}, {}, {}, {0x0, 0x10}, {0x80000000}, {0x8eb9, 0x0, 0x800}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, {0x4, 0x0, 0x4, 0x0, 0x7ee}, {}, {}, {}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {0x9}, {}, {}, {}, {}, {0x3}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, {}, {0x0, 0x9, 0xfffffffc, 0x0, 0x0, 0xfffffffd}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}, {}, {}, {}, {0x0, 0x0, 0x0, 0x4, 0x2}, {}, {}, {}, {}, {}, {0x10000}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x8}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xb}], [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {0x7}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {}, {}, {0x2}, {0x2}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x0, 0x1}, {}, {}, {0x3}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4}]}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xe98}}, 0x0) 3m39.393945065s ago: executing program 0 (id=2801): bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x15, 0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="18080000000000000000000000000000181100", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b70600000000000085"], &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 3m37.838837426s ago: executing program 0 (id=2802): socket$kcm(0x10, 0x2, 0x0) r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x0, 0x0, @vifc_lcl_addr=@local, @dev}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)="2e000000110081", 0x7}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0}, 0x18) socket$inet6_udp(0xa, 0x2, 0x0) socket(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000bc00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000400850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{r2, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000300)=r3}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000000)={r4, &(0x7f0000000380)="0099", &(0x7f0000000480)=@udp6=r3, 0x2}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r3, 0x5, 0xe, 0x0, &(0x7f00000003c0)="000000000000000000000001e370", 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000, 0x20}, 0x50) 3m37.572624458s ago: executing program 0 (id=2803): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x4}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_crypto(0x10, 0x3, 0x15) socket$netlink(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000024c0)=@newtaction={0xb4, 0x30, 0x48b, 0x0, 0x0, {}, [{0xa0, 0x1, [@m_ctinfo={0x48, 0x2, 0x0, 0x0, {{0xb}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18, 0x3, {0x80, 0x5, 0x5, 0x1, 0x2}}]}, {0x4}, {0xc}, {0xc}}}, @m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x0, 0x0, 0xe4, 0x0, 0xfffffffd}, @multicast2, @remote}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xb4}, 0x1, 0x0, 0x0, 0x20008000}, 0x8000) r7 = openat$incfs(0xffffffffffffff9c, &(0x7f0000000080)='.log\x00', 0x2, 0x65) getsockopt$inet_sctp_SCTP_INITMSG(r7, 0x84, 0x2, &(0x7f00000000c0), &(0x7f0000000100)=0x8) 3m35.98060633s ago: executing program 0 (id=2808): syz_genetlink_get_family_id$nl80211(&(0x7f0000000480), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x80180, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, &(0x7f0000000000)=ANY=[@ANYBLOB="180600000000000000010100000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xffffff6d) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000080), 0x800, &(0x7f0000000140)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r4}, 0x2c, {[{@access_uid}, {@cache_fscache}]}}) 3m32.185403382s ago: executing program 0 (id=2818): r0 = socket$netlink(0x10, 0x3, 0x0) mq_timedsend(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x6) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) accept4$x25(0xffffffffffffffff, &(0x7f0000000000)={0x9, @remote}, &(0x7f0000000240)=0x12, 0x80000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) openat(0xffffffffffffff9c, 0x0, 0x24c01, 0x0) chdir(0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuset.memory_pressure_enabled\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000040), 0x208e24b) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="440000001800010a2cbd7000fbdbdf250a201000fd00c800002000000c00090008000808", @ANYRES32=0x0, @ANYBLOB="14000500000000000000000000003f000000db17"], 0x44}, 0x1, 0x2}, 0x10) 3m32.059000378s ago: executing program 0 (id=2820): r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff0000000000000000000000000000000000a4ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa0500"/240], 0x610) 3m31.632688895s ago: executing program 34 (id=2820): r0 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f00000001c0)={0x3, {{0xa, 0x4e24, 0x2, @mcast1, 0xff7ffffd}}, {{0xa, 0x4e08, 0x4a3, @local, 0x4f1}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(r0, 0x29, 0x30, &(0x7f0000001a00)=ANY=[@ANYBLOB="03000000000000000a004e2300000010ff010000000000000000000000000001f8ffffff0000000000000000000000000000000000a4ffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000000a004e2000000008fe8000000000000000000000000000aa0500"/240], 0x610) 2m43.964496682s ago: executing program 5 (id=2950): socket$igmp(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r0, 0xc06864a1, &(0x7f0000000240)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000600)={r3, 0x0, 0x0, 0x0, 0x3, [0x0, 0x0, 0x0, 0x0], [0x800000], [0x0, 0x1001000], [0x0, 0x0, 0xe8a6]}) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x81, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r6 = getpid() socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x2, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x10}, 0x50) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x781201, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000600)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2d, 0x0, {{@in6=@loopback, @in=@local, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x1000000000000000, 0x0, 0x0, 0xffffffffffffffff, 0x9}, {0xa81, 0xa00, 0x407ffffffffffe, 0x800000000000002}, 0x0, 0x0, 0x1, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@empty, 0x0, 0x3c}, 0x2, @in=@broadcast, 0x6, 0x4, 0x1, 0x0, 0xf}]}]}, 0xfc}}, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r4, 0x0, 0x0, r5], [0x2b8]}) close_range(r1, r0, 0x0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f00000001c0)=0x14) socket$inet_icmp_raw(0x2, 0x3, 0x1) 2m42.916223662s ago: executing program 5 (id=2954): getsockname$packet(0xffffffffffffffff, 0x0, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000680)={0x6, 0xb, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff02000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000cc000000950000000000000523258d01001c0407b01848321c8ffb40b3328a75c405a727bf1a53fbccdb56105d2d6880d2c739c1e16f48f4a7aaa73dfec6df995e73c292c8264ee1c30d8420aa5106d0ef23de97e1dde467b5cbe93c01ae2e5db074968e212521fa90040b404776de531d0131d73c9ac8f07da311907a1ad3ae8d7f0f1804eecaa7e636902b85adfe13166c4df0bc8e346d16ea9f657d7cd2c2f7b670303149d08ad5ddc235997db9aa29b2ed418c57f8206433a2ba62f45b4a84c35a83edc1382bf4d4d929848e60608ee1cc7c90ec9512", @ANYRESOCT], &(0x7f00000007c0)='GPL\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffff49}, 0x94) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) r1 = msgget$private(0x0, 0x0) msgsnd(r1, &(0x7f0000000340)=ANY=[@ANYRES16], 0x2000, 0x0) msgrcv(r1, &(0x7f0000001080)={0x0, ""/1}, 0x2000, 0x2, 0x3000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x4087}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="05000000040000000800000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x4, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000000)=ANY=[@ANYRESHEX=r5, @ANYRESHEX=r0], &(0x7f0000000380)='syzkaller\x00', 0xcee3, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000140)='sched_switch\x00', r6}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[], 0x0, 0x4e}, 0x28) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_mptcp_buf(r7, 0x11c, 0x1, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) pipe2(0x0, 0x0) syz_usb_connect$uac1(0x0, 0xa4, 0x0, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000180)={0x0}, &(0x7f0000000200)=0xc) sched_setaffinity(r8, 0xffffff64, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) 2m38.954394826s ago: executing program 5 (id=2960): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) keyctl$search(0xa, 0x0, &(0x7f0000000380)='encrypted\x00', &(0x7f0000000480)={'syz', 0x3}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=ANY=[], 0x34}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) getdents64(0xffffffffffffffff, &(0x7f0000002f40)=""/4098, 0x1002) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r4}, 0x18) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x100000000000000) 2m37.914074606s ago: executing program 5 (id=2963): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000022000000180100002020702500000000002020207b0af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0200000004000000020000000c0000000014"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32, @ANYRESDEC=r1], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmsg$nl_route_sched(r2, 0x0, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x6, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x846}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r6, r5, 0x25, 0x0, @void}, 0x10) syz_emit_ethernet(0x11, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaa170180c20009000000aaffd7"], 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000f"], 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, '\x00', r5, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000040)='sched_switch\x00', r7}, 0x10) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x3d0, 0x210, 0x940c, 0x3002, 0x210, 0x2c0, 0x300, 0x3d8, 0x3d8, 0x300, 0x3d8, 0x3, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x5, 0x0}, @private2, [0xff000000, 0xff000000, 0xff000000, 0xff000000], [0xff, 0xff000000, 0xffffffff, 0xff], 'veth1_to_team\x00', 'macsec0\x00', {}, {}, 0x62, 0x61, 0x0, 0x8}, 0x0, 0x1c8, 0x210, 0x0, {}, [@common=@inet=@recent0={{0xf8}, {0x1ffffc, 0x0, 0x1, 0x0, 'syz1\x00'}}, @common=@unspec=@addrtype1={{0x28}, {0x2, 0x140, 0xc}}]}, @common=@unspec=@LED={0x48, 'LED\x00', 0x0, {'syz0\x00', 0x1, 0x916, {0x7c7a1f6d}}}}, {{@ipv6={@mcast1, @remote, [0xff000000, 0x0, 0xffffffff, 0xffffffff], [0xffffff00, 0x0, 0xff000000, 0xffffff00], 'syzkaller0\x00', 'pimreg0\x00', {0xff}, {0xff}, 0x33, 0x9, 0x4, 0x10}, 0x0, 0xd0, 0xf0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x430) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 2m35.649442898s ago: executing program 5 (id=2971): r0 = syz_open_dev$vbi(&(0x7f0000000180), 0x1, 0x2) r1 = fcntl$dupfd(r0, 0x0, r0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="5c00000002060102b8020000000000000c00000015000300686173683a69702c706f72742c6e3117674bdf12389ba844aa4f14ed486574000000000500010006000000050005000a000500040000000000090b020073797a31000000dd10"], 0x5c}}, 0x0) write$binfmt_script(r1, &(0x7f0000000000)={'#! ', './file0'}, 0xb) write$binfmt_script(r1, &(0x7f0000001b00), 0xfffffd9d) io_setup(0x9, &(0x7f00000000c0)) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/sync_on_suspend', 0x20001, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101302, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r7, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r8, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x2, &(0x7f0000000180)=0x6}) 2m32.968843572s ago: executing program 5 (id=2975): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x6, 0xffffffff, &(0x7f0000000480)}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x24, r4, 0x201, 0x400400, 0x0, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x48041}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@mpls_delroute={0x1c, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000340)={&(0x7f0000000480)=[{0x1ff, 0x4000, 0x805, &(0x7f00000016c0)="244b1b49f7f6cffbc74f9d4d4657c57b9e531202208522f1a0203478b5d32c84d04471162473fc2eff9ad0af063db784f7719154803afac650e02b3ac03aba9546c180f4307574d66142051e00b9272d3f812476c5b0fdeae6e43b7f59c0b1d8272dd0c67632a09cd028e11f5f653c31f45a30366349f4960cb86ea4035b48352ed0bbb8da9de06c411372e73e582abfad9a23145f0b709266115e7f5dd9a09c0804cf54b99d157ea4f5c353fc08f7ea51296299ac6923b7a0d167d0ab4124f0cddf3726f0f3a7d793e0dce487eec41e4cab84dd4cb5c58a93d6eed1f793fff1a47201be24e245467b86f68f57c1514d0b01630b2f77f68c2365fcde056fa578db0115ea792bacba01ba292ea0b8b87e0a15f14ea9b83116a2981d02b5615ebda9dd987a44ae771b289579a549c6a6f710e92d58ea34abfcdd1cc462aaccb071cbdd16f3533b0c7469605fbb342f8d881a33befbd9bf90881f4fcba162b83a828b7a5898a4459816d974b947051ede4db5bad7a4554598b68980f6f036172d312cf9ec326956c7eba7c7091302ea93e660b1074297716902938903ae856ab0c996f377af58838822a8bc34621d7f3eee5ae1324f19a41ca492e303db42669bebc161e09db222e7b934678b9590e49fc280370f6b31b1714551798ec786891fdc3a9fff15549948d710471a39234b077e39a3b09029c6359dd1d4478aee9f400a09a7e6af02be79de0674327000a1cd8a2636118875d726a8179d320ace32dc5f20e7b1402b8a1947600423bda9809453d7690a4f97b83505f4955510553eaa8acf4b37b7458a77db2ef02744ec3477892b971fd03e0d36dd826c6683e4a898b1d3357db6f2a9bb58d7bd9d12f82734d9d59d7c781dc73738360eec6e1a31a2ae9227d0fb18527498515a30fc2eed9c24a3be4e6d6d641c17cbd301ca4ebd7fd9a8e0a538b80c47ca4598a80467ad97f04bbb6a3c60566e6e07e43b8d23cf58661b2aa8a982ba40edcd740362417f989045f29844e6a7b8f471a30c8ef0d91ace923cefe909111eb358c460cd20b048cc775db35f20c42caee96fc67713c4e7108208f7692d3e45d99294274392e68991336b409318267519af6e44deb124929a695e5c027c1caeb989f481b9f99351290ba4c5fef6f114ac1e4fd61a50a97238c6d8282f32dcfeb08beb24add1a78bb58b3256662f3b179a402ace2cb391ad538a408299fceac83898ac9a073c9d27a3c6c584266f23bf5df0f5bf537356e4deb76e18c12794e25fcdb0b43635c029b397bf80bb2fc34e52b415bcdbc9de5f6702bab1a2a879d985782b8e36f9db459a0d67db7ff74894671a10390abda22f226aa3540e81f86c48e3c02b40ab011d0e20f2cffdef1b70ca6ec36539796eb1c4893224029aad935fbb7bb70e7983c07a7f9a7e875a7314b13d5c72e637d07adfc0ee0d0be2a8e7d56b1dd1e4f751b241f2b558110d4ae3d8bd96706aaa2ed14bf31408f3b500e0aa813a03d5c351e612d178ca8eb4ee61003218bc0742186f8bc80bb919983ec925f43888fa655827acdc766951f6677acf85d375134c11b1945d72e15925a8191e0e739bcfcd801cd4899cc8f7712393e0d6cab7693918fd478b7805afb1896b1f6113b269d408aabb47c1beb0795c9ad7f423c00a74df4bf8fecf77c546a69f7d43dc59a90f40688aff228bf0afdf565cf1deaf73df918c19d08a1dce28b3a06c24b7223132f17b05c0e71b71d5b830a357cf2f46724eb0af35f1eee85064b3c2249ec0932716935482d89f9167b6c55e32bd4605cbf85d685b25d23693a13d5a49e561d994cfc0c59b2b2b6d625117eeb9a7aaf4b350b8ce6c9a5edacb4e38b04dc0f8b1e942be173d8b58ee9a6df4524e8dc9f4aedd1f794fc161d39fd2a2bac493e5dcb88be5e7e87b6adaddc5edb294bbaf9cbe4c69a9b4d4e097903b400d64ac1708f9d6a3e4ff9d05fa7f9ac2c98d52524cf35f1b8532e69e45141fdd1dd45783b0fc8a4109eb5077fca0c636896e372e03124640709470f0f08d780d25c319d092b10095d72a5535a6005d41e0a812080d3bbd93f2ca81bb87db7817ee088ce5eb11063553de54b08df1e8109061e40b968816cf3374d8a84306b818fe530b0664069b01476eb5ac1dab9eb668d7e1798971867e950e347a470a403c3d8ac1f33fe011936acf37a5ca7f2709586a83f01e7cc3f12b68ef39ad66ce9afaafe5e856f6d05ed8c13c984df53c19a674b2fa721f9b074849618ef29c2eccb0cd059c42776e579f13cd49bb47b483df1737791cad326aa6d6f5874d83c49a59cf669fa7ee718e5b5f0ce6eee17314fea3d416c137cb2196f80890bafa604544049028159eda72edfefd75523375201035915fc6c96c160a14a5690f3b69eb2ac1f731935c39f21de7fdc1e657074792f9382c1ca46294f24a0cae5a4f1a7c4f5443e1d68e57911d8f93792caa6e58eeb9bff51f040e4ec0cce40361165d0871a4144ddf9e32d217f43288229fa08f0d2214167a4452930017e57af2c44a1bf944318a89cad9117db79a242a26619d2e1c3a35d2d16d2a63f4ed05cd7d20942d108cb42210f8c9b21284600f669771f1cade2b5aa4a67f93c9af24e8b2a9fe3d4434452289b3ef8920e9f3f5a9618dff6d130b683bd5d6b3c4e604dc5d850ecdc478110dec6ef806d10163e99e9ab35400795b53f7a63ffbf5bde7b13d1a2461bf9c860004f5e25e2151f62b28eeb293d1cd85d6f3be53c1af5fd01525d530e5a31a6e1851ae53fe867e7f47d4291c80e57193f0e0c5e3a7f1c89452229814ac3e104126f2474794904f062ef511e309a2a690d436a9dcc3042ed88d4c878c2d463c70f2aa4618391044e0a4274ce676a9d2186026dfa36687e522169a"}], 0x1}) 2m17.714458775s ago: executing program 35 (id=2975): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$GIO_UNIMAP(r0, 0x4b66, &(0x7f0000000040)={0x0, 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="120100004b41460860163209ea800102030109021e0001000000000904"], 0x0) r1 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301) ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000040)=@usbdevfs_driver={0x6, 0xffffffff, &(0x7f0000000480)}) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x24, r4, 0x201, 0x400400, 0x0, {{}, {}, {0x8}}}, 0x24}, 0x1, 0x0, 0x0, 0x48041}, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=@mpls_delroute={0x1c, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x0) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000340)={&(0x7f0000000480)=[{0x1ff, 0x4000, 0x805, &(0x7f00000016c0)="244b1b49f7f6cffbc74f9d4d4657c57b9e531202208522f1a0203478b5d32c84d04471162473fc2eff9ad0af063db784f7719154803afac650e02b3ac03aba9546c180f4307574d66142051e00b9272d3f812476c5b0fdeae6e43b7f59c0b1d8272dd0c67632a09cd028e11f5f653c31f45a30366349f4960cb86ea4035b48352ed0bbb8da9de06c411372e73e582abfad9a23145f0b709266115e7f5dd9a09c0804cf54b99d157ea4f5c353fc08f7ea51296299ac6923b7a0d167d0ab4124f0cddf3726f0f3a7d793e0dce487eec41e4cab84dd4cb5c58a93d6eed1f793fff1a47201be24e245467b86f68f57c1514d0b01630b2f77f68c2365fcde056fa578db0115ea792bacba01ba292ea0b8b87e0a15f14ea9b83116a2981d02b5615ebda9dd987a44ae771b289579a549c6a6f710e92d58ea34abfcdd1cc462aaccb071cbdd16f3533b0c7469605fbb342f8d881a33befbd9bf90881f4fcba162b83a828b7a5898a4459816d974b947051ede4db5bad7a4554598b68980f6f036172d312cf9ec326956c7eba7c7091302ea93e660b1074297716902938903ae856ab0c996f377af58838822a8bc34621d7f3eee5ae1324f19a41ca492e303db42669bebc161e09db222e7b934678b9590e49fc280370f6b31b1714551798ec786891fdc3a9fff15549948d710471a39234b077e39a3b09029c6359dd1d4478aee9f400a09a7e6af02be79de0674327000a1cd8a2636118875d726a8179d320ace32dc5f20e7b1402b8a1947600423bda9809453d7690a4f97b83505f4955510553eaa8acf4b37b7458a77db2ef02744ec3477892b971fd03e0d36dd826c6683e4a898b1d3357db6f2a9bb58d7bd9d12f82734d9d59d7c781dc73738360eec6e1a31a2ae9227d0fb18527498515a30fc2eed9c24a3be4e6d6d641c17cbd301ca4ebd7fd9a8e0a538b80c47ca4598a80467ad97f04bbb6a3c60566e6e07e43b8d23cf58661b2aa8a982ba40edcd740362417f989045f29844e6a7b8f471a30c8ef0d91ace923cefe909111eb358c460cd20b048cc775db35f20c42caee96fc67713c4e7108208f7692d3e45d99294274392e68991336b409318267519af6e44deb124929a695e5c027c1caeb989f481b9f99351290ba4c5fef6f114ac1e4fd61a50a97238c6d8282f32dcfeb08beb24add1a78bb58b3256662f3b179a402ace2cb391ad538a408299fceac83898ac9a073c9d27a3c6c584266f23bf5df0f5bf537356e4deb76e18c12794e25fcdb0b43635c029b397bf80bb2fc34e52b415bcdbc9de5f6702bab1a2a879d985782b8e36f9db459a0d67db7ff74894671a10390abda22f226aa3540e81f86c48e3c02b40ab011d0e20f2cffdef1b70ca6ec36539796eb1c4893224029aad935fbb7bb70e7983c07a7f9a7e875a7314b13d5c72e637d07adfc0ee0d0be2a8e7d56b1dd1e4f751b241f2b558110d4ae3d8bd96706aaa2ed14bf31408f3b500e0aa813a03d5c351e612d178ca8eb4ee61003218bc0742186f8bc80bb919983ec925f43888fa655827acdc766951f6677acf85d375134c11b1945d72e15925a8191e0e739bcfcd801cd4899cc8f7712393e0d6cab7693918fd478b7805afb1896b1f6113b269d408aabb47c1beb0795c9ad7f423c00a74df4bf8fecf77c546a69f7d43dc59a90f40688aff228bf0afdf565cf1deaf73df918c19d08a1dce28b3a06c24b7223132f17b05c0e71b71d5b830a357cf2f46724eb0af35f1eee85064b3c2249ec0932716935482d89f9167b6c55e32bd4605cbf85d685b25d23693a13d5a49e561d994cfc0c59b2b2b6d625117eeb9a7aaf4b350b8ce6c9a5edacb4e38b04dc0f8b1e942be173d8b58ee9a6df4524e8dc9f4aedd1f794fc161d39fd2a2bac493e5dcb88be5e7e87b6adaddc5edb294bbaf9cbe4c69a9b4d4e097903b400d64ac1708f9d6a3e4ff9d05fa7f9ac2c98d52524cf35f1b8532e69e45141fdd1dd45783b0fc8a4109eb5077fca0c636896e372e03124640709470f0f08d780d25c319d092b10095d72a5535a6005d41e0a812080d3bbd93f2ca81bb87db7817ee088ce5eb11063553de54b08df1e8109061e40b968816cf3374d8a84306b818fe530b0664069b01476eb5ac1dab9eb668d7e1798971867e950e347a470a403c3d8ac1f33fe011936acf37a5ca7f2709586a83f01e7cc3f12b68ef39ad66ce9afaafe5e856f6d05ed8c13c984df53c19a674b2fa721f9b074849618ef29c2eccb0cd059c42776e579f13cd49bb47b483df1737791cad326aa6d6f5874d83c49a59cf669fa7ee718e5b5f0ce6eee17314fea3d416c137cb2196f80890bafa604544049028159eda72edfefd75523375201035915fc6c96c160a14a5690f3b69eb2ac1f731935c39f21de7fdc1e657074792f9382c1ca46294f24a0cae5a4f1a7c4f5443e1d68e57911d8f93792caa6e58eeb9bff51f040e4ec0cce40361165d0871a4144ddf9e32d217f43288229fa08f0d2214167a4452930017e57af2c44a1bf944318a89cad9117db79a242a26619d2e1c3a35d2d16d2a63f4ed05cd7d20942d108cb42210f8c9b21284600f669771f1cade2b5aa4a67f93c9af24e8b2a9fe3d4434452289b3ef8920e9f3f5a9618dff6d130b683bd5d6b3c4e604dc5d850ecdc478110dec6ef806d10163e99e9ab35400795b53f7a63ffbf5bde7b13d1a2461bf9c860004f5e25e2151f62b28eeb293d1cd85d6f3be53c1af5fd01525d530e5a31a6e1851ae53fe867e7f47d4291c80e57193f0e0c5e3a7f1c89452229814ac3e104126f2474794904f062ef511e309a2a690d436a9dcc3042ed88d4c878c2d463c70f2aa4618391044e0a4274ce676a9d2186026dfa36687e522169a"}], 0x1}) 10.365897954s ago: executing program 7 (id=3418): syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x142ba3) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82803, 0x8e) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000200)='/sys/power/pm_async', 0x20001, 0x82) write(r0, &(0x7f00000002c0)="cb48a537", 0x4) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x70) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r7}, 0x10) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f00000005c0)=ANY=[@ANYBLOB="660a000000000000611160000000000a5800000000000000000000010000000095000000705afc108116bfe0c53bfd8f138c2d53f8e52ee1f21137f5b5e89612c8264459ef6f0e215245c792518d4d432dfcd0bd0ea84eece68c27081709b0146b051a62409c16df768792f26929e916dc6d6ad60cf61d4f6c93f18cd0333484cf82d8f70a157189fb81c3eb9983f25587b04a12026e09a66aa40fa4c5922c2728738947395c85cce7ce9acc2ba75591d9c9d10abfd017e00aeb7dcb0f71c23e0645a6a86da92d2e1dd9ffaf253678978d40"], &(0x7f0000000000)='GPL\x00'}, 0x80) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfe, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdc01, {0x0, 0x0, 0x0, r8, {0x0, 0xd}, {0xffff, 0xb}, {0xd, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4008000) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x30, 0x40, 0x107, 0xfffffefe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x14, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x6, 0xb, 0x0, 0x0, @str='\x80\n'}]}, @nested={0x4, 0x2}]}, 0x30}, 0x1, 0x0, 0x0, 0x48815}, 0xc000) openat$rtc(0xffffffffffffff9c, &(0x7f00000001c0), 0x1, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) 10.038770251s ago: executing program 2 (id=3421): bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000001200)={0xffffffffffffffff, 0x20, &(0x7f00000011c0)={&(0x7f0000000140)=""/94, 0x5e, 0x0, &(0x7f00000001c0)=""/4096, 0x1000}}, 0x10) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000001500)={0x1d, 0x30, &(0x7f0000001240)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8001}, {}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0xb7}}, @printk={@s, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0xa}}, @initr0={0x18, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xcecb}, @map_fd={0x18, 0x6, 0x1, 0x0, 0x1}, @map_val={0x18, 0x5, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x2}, @ldst={0x1, 0x2, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff}, @cb_func={0x18, 0x6, 0x4, 0x0, 0x8}, @ldst={0x3, 0x0, 0x6, 0x2, 0x3, 0x40, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000013c0)='syzkaller\x00', 0x9, 0x4, &(0x7f0000001400)=""/4, 0x61980, 0x2, '\x00', 0x0, @lsm=0x1b, 0xffffffffffffffff, 0x8, &(0x7f0000001440)={0x6, 0x5}, 0x8, 0x10, &(0x7f0000001480)={0x4, 0xb, 0xffffffc5, 0x65a7}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, &(0x7f00000014c0)=[0x1], 0x0, 0x10, 0x4}, 0x94) r2 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001600)=@o_path={&(0x7f00000015c0)='./file0\x00'}, 0x18) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f00000016c0)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f0000001640), &(0x7f0000001680)='%pK \x00'}, 0x20) r4 = syz_open_dev$vcsn(&(0x7f0000001700), 0x8000000000000001, 0x100) r5 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000001780)=@o_path={&(0x7f0000001740)='./file0\x00', 0x0, 0x4000}, 0x18) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000001880)={0xf, 0x8, &(0x7f0000000000)=@framed={{0x18, 0x0, 0x0, 0x0, 0xb30d, 0x0, 0x0, 0x0, 0x9}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x5}, @map_val={0x18, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0xa}, @call={0x85, 0x0, 0x0, 0x8a}]}, &(0x7f0000000040)='syzkaller\x00', 0xf9a9, 0x66, &(0x7f0000000080)=""/102, 0x41000, 0x30, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x8, &(0x7f0000000100)={0x0, 0x4}, 0x8, 0x10, 0x0, 0x0, r0, r1, 0x7, &(0x7f00000017c0)=[r2, r3, r4, r5, 0xffffffffffffffff], &(0x7f0000001800)=[{0x5, 0x1, 0x4, 0xb}, {0x0, 0x5, 0x4}, {0x3, 0x5, 0x1, 0x4}, {0x5, 0x1, 0xb, 0x5}, {0x1, 0x1, 0x4, 0xf}, {0x6, 0x4, 0x0, 0x3}, {0x3, 0x5, 0x3, 0xb}], 0x10, 0x1ff}, 0x94) write$cgroup_devices(r4, &(0x7f0000001940)={'a', ' *:* ', 'wm\x00'}, 0x9) sendmmsg$sock(r4, &(0x7f0000002000)=[{{&(0x7f0000001980)=@nl=@proc={0x10, 0x0, 0x25dfdbfe, 0x20}, 0x80, &(0x7f0000001ec0)=[{&(0x7f0000001a00)="9af234b6c54f5775195523b96d29d603", 0x10}, {&(0x7f0000001a40)="38ad720a84cdfba4f6f34d7b42ef27aab815bc363e1212e8f0986f5ab7d708b8c2a2e5bdc4678cfea8ce48a4143913d83d2154964e70329b483575a0c77f076cac43114b6435970df49ab49405ec1a1fe33dd243fbb24c61d0729744016625e1709f39cb9d75010ede29ae92633a7734edcbb81cc39196c08f4097b826b7900e3bf02bf8e0bdb4d3f21d49ef15afad522ff4401f", 0x94}, {&(0x7f0000001b00)="1491bf30dea94bcc490e44b8e6eb3e5dfaf1d796bfade314a9a30d0abc114aab4bc0769eb6ae53d63c78e35e2ea9ee69ab2b5733", 0x34}, {&(0x7f0000001b40)="7f84e44a3a1f5bfe1bb43e392c03b13842710bdd3a1a1e841ed08e233901225999e6182db37f8116c6ecd630da0c899f35d76a734f6b192714a191095985ff9dab4f2f11afb091fabcc3f208a361fe8f91e64772810c30d2a5c240a26ce4ca857a7168d30f720f74570690ed8c38da342113a18d0f1e0aafca2204b169c3facd48458cd238bf8abf92314c3bbc5667ca4fe4c42b578d02861bf7c7382f3715399cc65d60871b6d1c2839e9b09f104cb5edecfeb8edf356f2af8ba8be6617b9c8252c816f5f71814e0a904a0d9e2e4d3492818bb22052193b9d3323a3d2aa75528f1c86", 0xe3}, {&(0x7f0000001c40)="c8d428504dec0c5950d163857c71dd738a3b89ae67332ab7ded28367f012af1cde43862e5d8706ea387cbbaa2a479073a8dcba44eed86013d577a6cc595fadc8a78dc95111b395c7adb75c868c3d3cd4b78e1ae03eab2bb1360dee4424cb49652e4d3d827efba15d6d5fd67915b38308ded34e33c78b792136676973584a55e59f38221aaf9480a6e5539833efb8", 0x8e}, {&(0x7f0000001d00)="aee1d295f8e39cd2cd68d8d8f0e5853860d383902e886d11546181f3ffdcbd8c866489249ab7fe458f7407fa816295a0146f0c903693e70e1df15e69431e4b83fa1ad0073155b3495f8e2b0d534f3c63898df8c11e5f2d97c135d17093bac4a7195bff2bffa1a31b685376be5df51b05659d6da6bbe7d4109a3300bbc0871103cae20679fb7e7093c7065151348da00521fc18eefeeb506f6ee0bf571c0b90d99316794ca7761b99e5cfeb9e6b669934ddf14b031fb70a5ea1c0b411124598070587ba28a77343abc260009397f94d1e63d9da56dc61d9050c49672782f9f25497f868d9b294cd40ede4bac34fd3de07fa878d6df38e2a5979d8", 0xfa}, {&(0x7f0000001e00)="64736abd09b03de996a3ff7e3ab060a337bd26c19ab8026f056d3b07a4d34c285cfead4d02648de9b3870abca49192a3af6eb749495791c7fbb68ed775bb7a7c8d936746d7b0aefc1a5e6d888e5a3178b62dc0da01abbe93692fe86b722fb81d7159ec2dac91a92ae159fbdf07c1a4a85245843a4aa83be755096d6b4d18a215ebf8a2205d64a6d6f2fc0dac60916143dbf52e", 0x93}], 0x7, &(0x7f0000001f40)=[@txtime={{0x18, 0x1, 0x3d, 0x3}}, @txtime={{0x18, 0x1, 0x3d, 0xe}}, @timestamping={{0x14, 0x1, 0x25, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x5}}, @mark={{0x14, 0x1, 0x24, 0x7}}, @timestamping={{0x14, 0x1, 0x25, 0x7}}], 0x90}}], 0x1, 0x800) ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f0000002040)) lstat(&(0x7f0000002100)='./file0\x00', &(0x7f0000002140)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f00000021c0)='./file0\x00', &(0x7f0000002200)={0x0, 0x0, 0x0, 0x0, 0x0}) mount$cgroup2(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x2, &(0x7f0000002280)={[{@favordynmods}, {@memory_hugetlb_accounting}, {@pids_localevents}, {@memory_hugetlb_accounting}, {@pids_localevents}], [{@defcontext={'defcontext', 0x3d, 'root'}}, {@measure}, {@uid_eq={'uid', 0x3d, r7}}, {@subj_type={'subj_type', 0x3d, 'a'}}, {@obj_role={'obj_role', 0x3d, 'a'}}, {@euid_eq={'euid', 0x3d, r8}}]}) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0286405, &(0x7f0000002380)={0x79d, 0x0, {0x0}, {r8}, 0x9, 0x3}) sched_setaffinity(r9, 0x8, &(0x7f00000023c0)=0x2) bpf$BPF_MAP_FREEZE(0x16, &(0x7f0000002400)=r5, 0x4) setitimer(0x2, &(0x7f0000002440)={{}, {0x77359400}}, &(0x7f0000002480)) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000003540)={r6, &(0x7f00000024c0)="c36f42f2e69b99e273479904ab8c0c122ced9a3abd001aff0acad5808f5eef48fc0bfd0ccc552bb4abc258587a8c6e1fad6ec23683ad664e660bf5e97c35a63ae24e61288ef12da4a225b793dac3e5723fb6d0d6abd9c790ee7a07f797a4d84f36cfcf26a5948b1c609912ff1110a585c00140f9d203ae8c48cb568568786c4d5412fe67fc36b21ae7367968edf758ac0d41951cd8650662b457451a97631188ee37c2d7175c06bc5d975ee7ea9652261af7b5c4072648c392734a9988e2214553a932f5fc870dcb9bf90918f5b287ca93e904713642aaf66d9c616b43cbead53b9e70dbd3a37decb51c22492bae72775ab006a80e6b43a02591747c9c50f7bc253e2673b9a1af53edf29e6ff01d28164055373da875720e9eedc3269713d2e3c2dbe9b4982a89a8593c428cae4f39f1f3bb9e663cb5c19ee364dfc9b267b91bb15698a4907e8c6d100bb3482e0070f0e21e36b632fc5c7abc453ba38b7de342d7e68cc2d3b986282250bde3edc5d0dc1aede8dbf1cb153f216ad73ae3a3c6522a9756569feb9849ee7783e412465c8fafdbfdd42c4c62197485f537e8c2c968c1fc185e493453c4a925dce5280493675c956cc39b2d6b4e99cf08696b743e646728794904b3afbcfd0c4be971bfbde89b448acfc24783a5d99d4dcb93b073c540f9b70bd6d842f029419bbe7744fef8f0a07221202e0081b3a2b9993877ee1350bdde28e488968f69c4270306e83bc73c856c6c94a182e50c320949fd3224a5272261206fc66dbddca4bd2453649e336b070b8db44a2f45276caacb3d8af2e688975ccea3390605ea030283746c276a5871892f973edaed68d08c1927fbe9336025101c51cbdfcfc2564ae62f988f1030712149c3edb891f2f8d04c42dc0ecde717fab5301c7fc10279c252c652c373c0edced903063afe54e461ff19b8813fde10048cc659f1053e2c19d0facd34091f91d2c33810c5413eb11d74890153c9372cbc12572649cbe7abce197a11f9fe65a7224b4db240f8875392b461de0c11fa9aab860574616bdc53063ac3ec5d8007d6158f70dc3bf6486e5b332289cced2fb2778a7e26ea5d191189a3308b9d090b0582e54e2c4c2903b35db0e5282d8e716f7a69f4a26c1ede154afefc85fdb88f2c9497621abddb5a3e0f00f03d39d9d1dbe2de303237e46249b5d579b0014c968f406b3ae6d92b965e809ed36b284ca87ee543d14792c8e007407c37501129899763b991c4da7dbd857de2fa017c51ec1a26ba744d9612ce35847e9c7bce0288867e366af1bb6326e24375b9806d74ca59915e5890744a09082c8f0089a9645d15c6368822d4ad4a7acfa54ede100befab53a67cbf39e891fc940a3959de6eb72007adde6d666a35bfe5b2bd40642396bcfec236e5fc2f700b38a4fabd6dbbecf86ed8d3688ed6f0d18aeefc8c551e7d1f355ec4c3a1e51b24538438b5f129839c7513b7ea75832c227bf5176ef00532844f8799fee84a354f9dcf6fa211c9d2fb3e3cb0774746bb2be1deaf704b3db147376a70a40be61df6fd8744ee36297944fd030d30b3ea871be3ee4d68c3520974b724f4d17643f0be6186860e3365d115eb79e4542c9efbe9503eaf5cf6384ceab7d380ff81b7217aaad0469834e759f8a7db04a392be7e7800c2088e625699e455216f71f7a5662865b7e2e0ebc5e65389299d337ddd1a9621548ae9bd09896d31180268f297039560ff3dddef407d11f5179335502be06149d6e74826c686b1d538ca5e2e68e3f812ac0480b42510659601c871e45013d10a515d7cfd4ccbf0843432c46dcd0309a285bb309574af4fe26e6f8a05e0963998dd868c7f29553faecd3900b65d2ffa3cf607116d56ad55cf9c39daf7709ec803ffad7cb40b637e8144b112e32499c266a5ca0cf15214c7d7a846ab9b535479291f1111dc65dcf1ce7c2af78ecdfb11bf147aeb72cf578c5a065140fa7af74e6e47afb49da4d54c7fdf1b50720bb445e74dc3ac148664e0821aed3ddadcf6317b9a0e7f7106c33cd7d80d3c88f407344e7a730adbf9e6da4f9008499d8e04e6c739230b2d9443cb965b702ffb5de45b1359a49c1247a0ed27c3dcdde5b01d80775b00ba2fdc5aa4cb696429471e6165e0e652b54aaf4c05e73f2a86c1554a276ecb2c72f57e7ea2c4ee913cbbed5840610adb06e05a6192270d570771b847d3aef064cc3c851f03f65f2da97396dc2a43d23764fb36495ded8d3aa06bec1d15adfa376b350412ab1706823509677bd66cfebd1b37a003d15654ac40e8d3f624b062311f2b6e7249269c6ce891b678a8fd62d5033a5f02510485669f7bbaf07706d7826af1a454a713f4053a8b30ca941ddeeac07d70a014892f5763962e36962496bd0eeac6ce9c4af3bef924f8d2f3b9c08944a9eb4bc03fe409c1261010eb229be3375ce56e9efe43627f8c8d4c656d4e485670ffa92f447aaf9ccef6463499c3b59bd45f3258c0a7c35e94072bc751bdf335a188d5017fd00df7e8c5976128e874b50ce493a22757b1222b287eb0de50ac1837dbd208cb62210f19d6847a94ecf4990f6ac893aa2a754a9e754da8d2ecce540cba96151b89947ed453f826012a1a5e2a82e81f96b8eb69084fe42fc1b27aeb904669a8addf7766861d388628c97bba680391880688191a0eecdd98aa6c93c794dbbe55b8952671c827f0118684ef542d8f9fb11e3e861cfdaab52d6d0ee8f0c09ef923444dcefcaa29f8ce93cb5a9ecce0ee22583b423a8730f09d3befa3ae61ff8da544919f594d7971fc12cbd165aa85dd193d69dc978e2221cfff9c865506b471c9a44f845cfa83dbbbad1d02e5fa454b290e60cb21a7833c2e815d6fca22393fb472ade59e3a8a38a662603d653c65c4acda8c0c96ebf0fae5dc9cf350aef3bee33230a04eb02f0f45e9015bd9ac7ba769633c921d6cfd3197d4398807e0b057ef5787075afabbf6c403d3a7fe30665e617f7fb3db9d36b9d90c53e0650d7787d05fc03eacbe537653faee246f6a0fe92d973f1c3354df5d999104d05c14c995b8955e8f8ad255bf8c890e38d04cb3deb4b4e53e9908a45233e3bde8ea8b76ed8c3e59def1081ac06327a4791ef4d34a112ac683d76326ff65cd50e6913fd0b24577057b2b0e7d54a0ff6c0ece1cd449b341b0793010c5216e5ee7cf0bc5acd6e29fa30958527f9928a6820778fa5a5c85bdaa890f8dc517f99997de7f569b5ad55865c4614fde1960c53f6c5a91f0d58aa731a709960c7df267eba4e65087260391e34d32a6fbdb1c80bfd350351c91bd2794b02ddcfd957c943158ccd855aaece412d96014b332cb5a8ad55d66120918971ae59b6126834782f60849860568de318d769ba13497e2c18108ed4aa11aaf2710e369d53d0355a4a7065c4b3d17b58fb94e360ad859f285859ddfc6dc5d40e20aa82e0020fe91795863448ae2c9fa3d496313ed01cb535efe1b136c7496834529c3e741ed498115a1900a645d7cf7f1a22c09f59cac272f480a4e95d058b9ce901f8a17eb16fe0c9233a2a9da2901496822425701d6a8f24d3cfc9b655ef52126bf060307ac07368f72c716f47ea0d28ba634388593abc4f435aa6044bdb2109ba04c913f7b544f68edcd591e951a1b468bf482070890be38514f6b2ea0636d6d7adc54c8cbdbb90715da04a7e5360cacf1aab0b8b9429a96175212247eb94caf3480e350e1b428ca54f796a5c77cc57db820259acce5a7bf5c44ae4bb2426a3d23628b9b19747eb5d1b7e008844cdfc85f9499e482ed57ff80b2d7f2a67af122d6bb343b702e2b0d8d7e901eccb4c7e965a3eaf6e50264205693abe8444879f1250049a7dad7a73e64298bf444f54483d6813bb740446f3911fa194d8b13360dd681e853353d2bffa41f182a88ee175d1af1e0d678a00d44628056888fdde688022ae7aa34ba65db38c87388f19c4e0018c720c36ad3abafad679a6005a96656630a5a38eb61fbab86747a128a34b78cc6aecae6e07bc15e370aa1a2d2d7cb95779cbaa47667788d4417fc4210400676c6cc5beef0715ec07f0f34602ca3e096bc7e70c8b153da78166eee6cf9d71f1111845ffdb1a7f39425e6e76c2f6fad6d864e2ca38d33d14ca5accbd44f4326b870ca5e67b89934520506d471c5ace18ff53b912e61171fafcc590882de8b8dca82ea6e6707cab8006bf3919a3664cead85c7c96d3e67f96d69dc9914c675d6f08cc635e18a9b58b02baecaa5a36b0527edabbf3e0de4ec76955d3830021bcc8544e0594245bbc3c9df6bfb756b6bf8bf8c1b12de68f2f87089ed622082cc274a9cf02bb2fe93b981efa53c090b36c511e759b56a4480753cba11c51658f64b936058a6065f1aa906f91b45d3cc58c4d616dd9ae0e5ed0ef501e1e5caa41c40edd7cf9d914c69b5b589df7c5a383266c67cc9d408f52600d0889604b300ff2e86cbf50403747547102377b2ab1f0a73bf5da3c4db510110e1627f047d874bb63861095635344b6c239c11db6c37bcb1a095c592294272a1492c09aebaa7d259d33aa6f34b71fbae3702de7d873b2b3bc14b663b501b30950df701995916fce187ceab619653e62655b118284c5731b3f95218624e56085129670cb74ff2823364bb868f412c64e46d286d4fdeabf43da340781cc97070c850476f8ac82932555e637612f7e0cc124e0435d5a769fcbe4c4be6980589a5d21dab7a9980fe50ba9c932210f5afb4b98737d35f502a8e04211448abdc448a1a4e251246cdc1e3b6dfc8f6b31381f2327075586974a88aa54317be79d24bb244ed7dfc686ef787327e8e9d8c3fdba1d6ad3823f6095c67559191252df0646f20cd849d8a3ddfd796396d288aa456136047eb0422d75552e12dd51badcc9cacd8b03b9954ebac3e32786df1b3839aa1332059616ada5d88691552aa6ea49e4b74c4a5f04a775f5a3c4c46ab63edf70fc4baf3df6ec9c8c36a68d6fa4fefca2533cc027dec77907dea24c4b07f1be88a5a56303b7d7cfbd31228a04db5f1594b13b0c630f02e6a38bec08eafe0239429713444d90ac12cf7e0da252de3505eda3a7c2b9e4a9c1d3fec4b1380c822a1e155fecb751f3dec0477a74852611dda9b2a4fe46f04626cf61349026e8bf0970853f9b92187b139baa342fadbd51b057963bb5ed778ec41cfd541334370776505333393b90574a5bd9919d74308d1bf50dd90bffd3a4e00a8fab5e9372c8c0a0e761ae8ca715695a4aead1607086f9164086128d1cfc6f4953fb8fc72acfa3552616190b7f38c1e1304af4142f9a9aa9b72bcb75d146bda8b0f340a57aee21ae55b973b589b6a81d21a9af00a86b5ee07f12739f85cf5147efccb712c30833a3748cfddddea2433411e7fe957dac28e89d48760def6254f55a74ccf939826ec0782168f44b82b59a5fa0a27c9fffc5329366935dd3220bd0e7eae8687c33737852fec9453eaa1ced0383f6376cf1e2bf20bbd0a82c411bf2068332ed7948d82be0853bc334eaf56aa9a54c21e37fc6160589b6944e9b0e38e1806b80cd2b6e818c767f1337fe1e8ff1c2128cc48f91d3722deae2c3a03c45f592d3ce839b78679d714641f4e65dd05ca0efe95137117245c9b2c2e9732394b8376a3ca1b8a61c3d57dba9245785199d957777644f8ac7a40df5df826ea135092924dce81d44a8149aadfad6771d22f1da05a384713523bb3e035c6957b41170b87c27aafddc84e4fdd2b5bcfb148f5acd1e71ff9cd2f13e7836831c9976266b98b709cdb7564c1aa2de8cbb953", &(0x7f00000034c0)=""/106}, 0x20) r10 = syz_kvm_add_vcpu$x86(0x0, &(0x7f00000037c0)={0x0, &(0x7f0000003580)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @ro_nat=0x6400, 0x1, 0x10000, 0x9}}, @nested_create_vm={0x12d, 0x18}, @code={0xa, 0x4b, {"66b845008ee8f366df08460f01f8430fc7360f20d835200000000f22d88fc978d6982100000066bad004b0e9ee0fc7370fbeb3b100000044d9f9"}}, @code={0xa, 0x64, {"66baa10066ed66b8cb008ec03e450f01c5c4037916ea86f2edc74424000e000080c744240200000000c7442406000000000f011c24b9dd0a0000b8ac180000ba000000000f300fc71e2ef3420f093e420fc71b"}}, @cpuid={0x64, 0x18, {0x0, 0x2}}, @cpuid={0x64, 0x18, {0x200, 0x683}}, @wrmsr={0x65, 0x20, {0x973, 0x8000000000000001}}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @code={0xa, 0x7f, {"36263667f2ad66baf80cb82c00e983ef66bafc0cec0f01c5430f01ca8fa928016a0e673666480f7e2d1a000000b805000000b9005000000f01d948b80b000000000000000f23d00f21f8353000000c0f23f848b800000000008000000f23c80f21f8350c00e0000f23f84c0f6ed7"}}, @enable_nested={0x12c, 0x18}, @cpuid={0x64, 0x18, {0x6, 0x7d09}}, @wr_crn={0x67, 0x20, {0x8, 0x314}}], 0x236}) ioctl$KVM_DIRTY_TLB(r10, 0x4010aeaa, &(0x7f0000003800)={0x9d, 0x80}) setxattr$trusted_overlay_redirect(&(0x7f0000003840)='./file0/file0\x00', &(0x7f0000003880), &(0x7f00000038c0)='./file0\x00', 0x8, 0x3) fcntl$lock(r5, 0x5, &(0x7f0000003900)={0x1, 0x1, 0x3, 0x0, r9}) pselect6(0x40, &(0x7f0000003940)={0x8, 0x0, 0x4, 0x2, 0x0, 0xff, 0xffff, 0x8}, &(0x7f0000003980)={0x4, 0x8, 0x2, 0xffff, 0xfffffffffffffc69, 0x6, 0xec}, &(0x7f00000039c0)={0x800, 0xffffffffffffff7f, 0x9, 0x5, 0x81, 0x9, 0x200, 0x9}, &(0x7f0000003a00)={0x0, 0x3938700}, &(0x7f0000003a80)={&(0x7f0000003a40)={[0x10]}, 0x8}) syz_open_dev$I2C(&(0x7f0000003ac0), 0x1, 0x100) ioctl$HCIINQUIRY(r4, 0x800448f0, &(0x7f0000003b00)={0x2, 0x1, "9f6e7b", 0x7f, 0xff}) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r4, 0xc0189372, &(0x7f0000003b40)={{0x1, 0x1, 0x18, r2, {0x19}}, './file0/file0\x00'}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000003c00)={r5, &(0x7f0000003b80)="c5320221b8e1d3cb5810844ba39d8a7bba9938", &(0x7f0000003bc0)=""/13}, 0x20) r12 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x200000e, 0x4010, r4, 0x0) r13 = mmap$IORING_OFF_SQES(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000d, 0x80010, r4, 0x10000000) syz_io_uring_submit(r12, r13, &(0x7f00000042c0)=@IORING_OP_WRITEV={0x2, 0x3c, 0x6000, @fd=r11, 0x70ca, &(0x7f0000004240)=[{&(0x7f0000003c40)="238e22e034fbb9080eb57d0c7e01f703248ad6dd8f507f385a03e1a9a2ae577f2c099341dfdb681c6e72e1f6bddc08a994f78315d111cb9c0cf50aa2434f1defc79a6f73ca1549addc10a204233df5b378b2f2011ee13b065dee1714ab65b332dd9c0c58f05748f9e0c5914b61f6908b1cf8e6c86cb18ca020c64f6259a066369aad40b4dfdb82036214934272290fd37dd70d14bd4a85ee7ffde752268a0b94c647f0f6d36bdc3ce84f51bcaa60bd5b2a60b5281e743fa27074eab63cf63c961671a260312875916b296842488257729c7feb8c420ab98a779da6b1f8fddc98d6b959729f0536bc", 0xe8}, {&(0x7f0000003d40)="3953e2a2450e5bcfc970d930fdeb599e0eb8e37c190e186a5e3808e37fb846fb6f52917ad809c5060d7bb0177e4493e57c146f7ba21491872d3fe754126f82bc81cfc4", 0x43}, {&(0x7f0000003dc0)="07cf8ed158cb815e7077ff38e8653afa1ef872e4f05b7ec88ea2c441b1cb184f83a7f73d0e2c2b9632cf94d2e171a2ebe8e82fd2b1ca2fce2aab952bba79dd9cd70b788b93b18e52042669ce1ab86f36cdd4b2831e0afac3b73898f8eec29ce1ae7272b7019364d62d6da4c7bdcdad5df891a74cebc492fbb2888da959944170f3376e977a3c94a679b30bd50d88366885e88bd122a90e155c4f269aa84f118055ad177a48e034d9a88443e6100bbc0d521d56ec110029ab2065c1ea1c62dcb7954fcaeb129d487d925d24999f1994f2757de7c065b2ec7413c5e71d80e5d1361a556ae06c78f4dd0640a25c4b3aa4e1e5", 0xf1}, {&(0x7f0000003ec0)="fdad0e9d32debab54c6e48f322bac2bb8093224ac7eaf32e9f00f094b1f721a9796ed4a45668d8ca7a272a450707dc804600a7ce8a05acbbab9aeea67263dcf2f7163ae1143f4e96c9e5962cc1c6787f52ea2533afd34d43833aa6e72f18ea53f3b0200033fbe345d6c34c67b9e2a5c44eba16efcd597be815de893750223d8800af7074793291e2bd71465f50fab08888f1228012c634f35c8c71dd7d4b27c6df731d5937c414026599a52e4f4d553d5dc3cad565bea8c700deeabec1098df3fd4c42496debf76df6e389931b66dba071ff7f2793728b4bf6b12823a78b2235c74e8598cf4f088556fb43", 0xeb}, {&(0x7f0000003fc0)="9b5bff0822605ec902de5a17fc42d97b869356fde41e45488924b3bdd623cd722367a58824ac43e3d6b892e444014c945ac8f23c70308e003ed5d0e50f4c647b67fbda77592d426420bb47933642b06640e564c5b8eec9fa583d3684a4b4ac80df8c0a765bcdc79053bd116cfa27b3ee065fd4645aa7ef30a3121ba32badb6beea421f750e91773333ccab11be6b602cc7961fcd83a591929b2cb42e2e0c", 0x9e}, {&(0x7f0000004080)="4bb42b45a3440d0473535f5c2f487fcc6153b7bf4c2ba8f2ee6c3a2848e8f5d7bb786ec62180a0932ebad5cf720201d173475786820dfdb796899cc0983133c08f87612370b711b2b53ba3418225c2b3c66503fb31b0201be5e037221b5a1623", 0x60}, {&(0x7f0000004100)="f5ff4bda25150d8d64c9dd336fbe050e1e7faf8563aa2d6b9851f0f0f6cf738bd78da3892f99306fca2941245e3568cf33451104cef31a6e9bda5117806c663aba028eb299deef64d884c94b3ccdadc6eb6df32982a1a118ca5098", 0x5b}, {&(0x7f0000004180)="5e59a3be2e6c56a477da6589950a6bdc3919138dac8146a02b5a5f1ce176aa86f3f7af2192e25f43120b37dda4d76763b1f31964f950fdaef4d557c5723dac0d96c79b0eab3d4e46c7a3d4a070ba3b5762ee0c59e293a4cd59e98c1df5c0ff1f4c78ea6f2079eb752812215761d249ca6b986ef91c64e66af2073c8954a8c61f2e5e4754dc88e5cc7512d311bb6fbbc03ef7d69ca249f36f268103917cd54b3bb788840df8e414787151149f", 0xac}], 0x8, 0x7, 0x1, {0x2}}) 10.028859404s ago: executing program 8 (id=3422): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) getdents64(0xffffffffffffffff, &(0x7f0000002f40)=""/4098, 0x1002) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f0000000380)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r2}, 0x18) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x100000000000000) 9.090505291s ago: executing program 8 (id=3423): syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = gettid() r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000020000000000000000000000850000000f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x7, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x28, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r3 = syz_open_dev$sndctrl(&(0x7f00000002c0), 0x9, 0x400) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r3, 0xc1105511, &(0x7f0000000680)={{0x4, 0x2, 0x6, 0xc3b, 'syz1\x00', 0x8}, 0x4, 0x100, 0x7f, r1, 0x4, 0x3, 'syz1\x00', &(0x7f0000000300)=['\x00', '\x00', 'system.posix_acl_access\x00', 'system.posix_acl_access\x00'], 0x32}) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_mreqn(r5, 0x0, 0x20, 0x0, 0x300) r6 = socket$kcm(0x10, 0x2, 0x0) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000a40), 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@ipv6_getnexthop={0x24, 0x6a, 0x601, 0x70bd25, 0x25dfdbfb, {}, [@NHA_MASTER={0x8, 0xa, 0x5}, @NHA_FDB={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0xb52b9c7732f7d2c0}, 0x24014844) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0x1c, 0x3, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) setxattr$system_posix_acl(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000600)=ANY=[], 0x64, 0x2) recvmsg(r6, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x40002103) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) 9.012206583s ago: executing program 2 (id=3425): syz_open_procfs(0x0, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r4 = socket$inet6(0xa, 0x3, 0x26) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in=@empty, @in6=@remote, 0x4e20, 0x0, 0x4e20, 0x0, 0xa}, {0x9, 0x0, 0x0, 0x200000000002f1b, 0xfffffffffffffffe, 0x0, 0x0, 0x24}, {0x0, 0x4}, 0x0, 0x0, 0x1, 0x0, 0x5, 0x3}, {{@in=@empty, 0x800, 0x33}, 0xa, @in6=@empty, 0x0, 0x0, 0xb7f67fd50278d396, 0x4, 0xfffffffc, 0x14, 0x401}}, 0xe8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f000001b700)=""/102392, 0x18ff8) sendmmsg(r1, 0x0, 0x0, 0x2400009c) writev(r3, &(0x7f0000000840), 0x0) socket$caif_stream(0x25, 0x1, 0x3) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r7 = dup(r6) r8 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000340)={0x3, 0x0, 0x0, &(0x7f0000000180)=""/229, 0x0, 0x2000}) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000080)={0x0, r7}) 8.264985889s ago: executing program 7 (id=3427): socket$vsock_stream(0x28, 0x1, 0x0) (async) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000040}, 0x814) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x19, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="07df6ba20cff65b28fe6e7de3697b96774e3b80304"], 0x0, 0x9, 0x0, 0x0, 0x100, 0x60, '\x00', 0x0, @cgroup_sockopt=0x15, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000100)={r0, 0x0, 0x30, 0x0, @void}, 0x10) (async) accept$packet(0xffffffffffffffff, &(0x7f00000002c0), &(0x7f0000000340)=0x14) (async) r1 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x4c}}, 0x0) ioctl$KVM_X86_SETUP_MCE(0xffffffffffffffff, 0x4008ae9c, 0x0) (async) r2 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_DEL_MIF(r2, 0x29, 0xc8, 0x0, 0xc000000) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) (async) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000480)=0x7) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000040)='sched_switch\x00'}, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'lo\x00'}) syz_clone3(&(0x7f0000000080)={0x801400, &(0x7f0000000040), 0x0, 0x0, {0x29}, 0x0, 0x0, 0x0, 0x0}, 0x58) (async) r7 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) close(r7) (async) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) 8.202684283s ago: executing program 8 (id=3428): r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000b00)="89000000120081ae08060cdc030000017f03e3f7000000006ee2ffca1b1f00ff0f00000000000050375ed08a56331dbf9ed78105001ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00120c0001000a080c00bdad01409bbc7a46e39a54cbbda812176679df069163ce955fed0009d78f0a947ee2b49e33538afaeb2713f450ebd010a20ff27f", 0x88}], 0x1, 0x0, 0x0, 0x7}, 0x0) 8.011156347s ago: executing program 8 (id=3429): openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0x600) socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = add_key$keyring(&(0x7f0000000300), &(0x7f0000000340)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffb) add_key$user(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x1}, &(0x7f0000000240)="3c783153464f12427e1ffe786fddf9dc8b658d9414650b01cbb232127fec4938b0193c9cec7410f96844d98c9a526012c61e0010251c604ad33ea0cdce5b69e09e4689a52e5b5b3d086eb3bed59f0134d9566bea865fe322b1799d1ad6755f4d1f797df610a625f07e069985165c8b3b1b8076855775ce8757fa1a8ecdbe0b85597d40699bf7305fe23ffb15e074dab5ab4a060f04260c6d266e37a6", 0x9c, r2) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) prctl$PR_SET_VMA(0x23, 0x0, &(0x7f0000ffa000/0x3000)=nil, 0x3000, &(0x7f0000000040)='#\':-:)*!/^\xbb\x17(])}\x00') sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=@mpls_delroute={0x1c, 0x18, 0x9, 0x0, 0x0, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x0, 0x0, 0x1}}, 0x1c}}, 0x4) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000880)={'ip6gretap0\x00'}) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setsockopt(0xffffffffffffffff, 0x86, 0x400209, &(0x7f0000000640)="1a00000002", 0x5) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f0000000000)={[0x38, 0xfff, 0x0, 0x180, 0x4, 0xff, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x4005, 0x8, 0x0, 0x45, 0x1, 0xbdb], 0xdddd0000, 0x1c4213}) bind$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @broadcast}, 0x10) ioctl$KVM_RUN(r7, 0xae80, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r8, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_RUN(r8, 0xae80, 0x0) 7.975372903s ago: executing program 7 (id=3430): ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(0xffffffffffffffff, 0x4040534e, 0x0) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_TIMER(0xffffffffffffffff, 0xc0605345, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socketpair(0x2, 0x0, 0x0, &(0x7f0000000080)) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000200)={0xa, 0x0, 0x5, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000140)=@gcm_128={{0x303}, "87ee8ac6c46dad33", "2607080d7f4fcf00fd4ef2dece6c7c58", '\x00', '#\x00'}, 0x28) writev(r1, &(0x7f0000000740)=[{&(0x7f0000000280)="581a17919cc77431510e7fc4ed9fb860505f1495ff92f16a44f8a13d58751d926def1f80b315bdc726cdd8b5d1a91f485854af8fc854b0da7a02522fe7b2c21db7a46c48473099d4a4654cfd97a67c9e79afc0d444e6c78b0216d2201b128df9d4ed5b4dbe676fe56a6354f819d997a6acb8595633cff6f77473b2b3abcc65b51cb3d3a30bf9b0b2ce59d568d3a89b49331904da2a37c89ea236f5d5640c32665445afbde1a62c560cb63836552f881c8a8305d2a13d838a5160a6c06c63decc865a92e9539f3513af3a1e6f78608890f912f087214dac06387a94d5e1b31c35be117ee540dc4560aa500269b81a0b", 0xef}, {&(0x7f0000000100)="1f4ac370cf8c47025bd7a6546c8bd20f39915962fcd1abdb722fa696eff3a7dd24025bb6d27003d3ac1f1cd700b46aaa2820184d7c96", 0x36}, {&(0x7f0000000380)="88e584aac45d6d83e6c2e7857149eb55d2c259a747dbdfc0787e87150d7e40953e657417f2c201284dd4714eb14ce94fb9be03e73d06a982f5502b3ae3a800c03902057e1ec6", 0x46}, {&(0x7f0000002300)="d21e96a9f6be3d72e3f91fa2db455d6b88df49377d7988389bd1ecc97042b565d013ec3fcee93a43afdf71b3751d0f53e4ca87fd4b71713fcc3b729c601778385e68ae4e55370c965ca8189dcf4f4e8c70fc343965f9c540163a19215f1d988f1bf6b6f57ce74575d0a1223da74c72adeed27d968bfdcd14597ebe90fc5167cbc1f5856d6b387bc5c419db52f682bcf13ce9e1d6110291bce66848b7392445ffb232c6b70bff2783564b2a62fa6cf3783f6cf6e84c90162b7cbf0192971f05c597dc20b3c879bd342e9e29e93c8240e8dbb137d3d8fcc8f49b37938a52ef12f7d963ff76b91f1473369d06d500d9b88c4f0e0b0ca9049d6b2f3c1886ff41404fab2855eaf1310fa65425a3e9513e33cee970a08de795368e9fe8055fdc5786010c764b3d3ccebec687d242267e932df33cf50c665ea82f1dcf1af952b0e4bf2e35d3c1bdead12e22b371543769fc19a0d893ebb9d71c4da000e2d18a572fdf7c23d921d959caebfbe3ab9157fc9ab6e3dcb88eaa5a5a8af223d7a25a8f198b10dedf68b6d2759a806b6a5bcf3693734ceebeea16b995304511db8d97b62f548213c614bc2dd9b843450eb575c8a8f290af70331a269f1cab6fd6e1f9ef687d80952ba7f14da8cf892d0a5b16dd181d8a7b780055d3b79782a2f4c29c6b9c64bdcde1175ef26c75d0bca19e2be27acb3fdf22a7cff8a659899de59fb2d3e4920881a0900958685263b3fb8dafa6402f5812f16de9e53eda3c86520d5267df729d2add8724d7541b60a3e9a4b70b5f1af83e81071d7e3eb6a9817383632008fbfff89f1c1ab39d9d898d555a0190fa11c8bdfd2d1b49d06fc56acdc426568ccbebbf6f3ce278148f319a1f84adcfb49a675c6d119f52e10386cdd0740199b20087f7c8f75d93959e39d2948a17789f6c6fda65dcb42743b466bcdd06bbe7afccd2b59c0c3f4dc62b8cee2a785ce704bbc47f480079b5f21ace7e5f2f149360370e866565af026b14ec4d9214884661156b5313c233ef1abd2807eb9b586845e3df8001e56b8d4f7c5c9b7e46b81e278ea0a7afb8286183285c390558d750277a7d72a6dab2cf1f29b0d4c847991ec65dd1757889dc9a6e94ce22b58e25cfac06c73532a53663a27208daaf3b4ad5a8c74e4e62b160219f49b6983674f7a71e56f45c3df8c13c93b2ed468749843dd8954a0d03acc61e5008ccc5a5db5a42d04abdf112e71e4d5876c3ea0db715648a5bb55b5ffd2377aea32f19a07e610456b5a6dda7ab4e6d11a88a5910f7f394c7a53d7c032e5506c3b26d54cbe73bfb37cda2439b23c785566668d8111570b7004fa565a156e45c9b672c6ebfb4d08bc681de9ea0215a43a1eefe7a0fb72caf494414c61510c00a8c5e37c4efeca3a1d171f44abbca94a9899b299363bbd1ecdc91d19d6a179f00bd958e372916fde873aaa167bb6be50219c76e6bee7a207f43b729eea5c00052eccb9986b6c137019c47f3fc1d69d68569f8c1d97ecc6b3dec37813f358778edfa2515fd9c4ca7e73966942f65c1a3cc9770065836625671725e3617030df067961c50d2e53a1c69d0e116eb9e0c052e71b3bcc85354829b71295cae5ffbcd5c2794fd16f8601ff5d7278693e384d477920e4619be578ac11f4ef327e5c5298d24ba29fddc7317fc90c69ddc991ee2f3a34c40c2afcd77350c008b9f70b76c97f51bd1359d376cfc83ec0f14a183cef8eccc014bf36d8384262edd4bb03f743c4628bccfef1050deafd13bdcbd73a356a8c630cc4f0665420d414c59276ff1d85ef058069a1ea280b9ae476ea9aa64652c4a83b9b086fd02a3372ae9683521d81ce846ce9b030e81b7523e8f5355c26c66d9182b9b3e089917089a07bf5159f1439200ad74d735b020ccb78225a015c76a57c19344556bce75da0d44e88e2227f5f4a90bb00eb27decf0d0dcf1b6dd0f9146f0191a7f58e3c6a1568e747ba674c33fd6715678232ea1385e8e54955e70ce306fad514235c8bc2576e84444a674c149a67d8db5fea81813aa311fa701bc401101b14661b0f091dad3a1895f3d32fc7012e59e090f487fc9f19e878e04c40eb906deedb29cf65839486f11c4fb7d9c1be6a1c95471d939cc0c85f6fead85e4d081ccc6e2a51784ec4d3f0b13796609161bfcb38a029c10b084e87ceff5483ec6c9691b0ad6a3d05e13e8c48d0700cc58b9436d8011c48381d6ca0ac279c3c71a625585c8b257c54fcb9e9d07183ee0d90b0b5255d153fae38c6c25636846c31142f269229ac4a1d35df88eeaa9413dde791642c9b0ce903cef64609886d18df63515de769df208c9db2acda7db5181f52bb99e74f84b01106c8419543ec2b5106623789316cd825995e42d0cf9f8296f2e5155dbaae8113de5c7a1dddfe42770064e2aae3f000000000000040163ca80d1a8c672ae8e8eaee5b838653a20a58171dc78509a55ea2c590bcffe3f0ca7731edecc2cf3e63c8e8ce335a4f9541691282df4f24a208cd1400dce5e40ddde35dd22c9e75ded061cb349d8cbc92bc00f9c9c4ff49fe887ea630ffc66a087065a90e072b56c9386f3cccda4acb0f10538f361cd860a7efec0eb83ea5165d6a6612800a8d6c7426b0916fc6aec0e7d81ee1a57657ac5c32b58d4e573bf820bc67cc0896012ccff2ace1de0b13f70a744e116a300aaffd1a6ad24513532fb9b9452454874a432cb5f5f6fa2f35668e6e3eb98fdc5c15dc5513c44a26d318d2b7372d6dc1da69d342b95ecb05777716264c79f4a3b953d6acc1006318fd352eb92621360d62b1c651c1fa0dec9a9fe674347902228373bed540251eebb2a8ede5e4f47bacf6acde6f8c5b95dc8b8214175d5649994c710709a5bfdd73360c35af7fc2ea4d35f14994bdccce242be14bff1ce7010b1c353479a1f038dc52e76d5d97340d98e3ad783a4ad95a469eee9193c7e5f93d84f847a6710230fb26f6e0122cb3f0400e7c485b704e3916c4fb0340bed2b4e7640b3ea40a9741f32f81e761119919e9e3fe56aba0b691e9d4e8fc959ae97dad37225a0d3fff627d6241fc0826cc863ec6e0a6c78956dc8878bb8c34dec173161c844462baf2a0d40fb6ea7c6bcf6a4501b92b1bf35c9b1c7d09ad3ee84b5c846404062d6fef2e53f4121b3a04341b58c05460bfa09ff6b92275923798897293e4cc80e6ee6facbab718550e838724ac19c2f86ee656fd607106951936eb56a3263819a69525b9d8bd4b1196ae503b6ee7071f881d740c5781040a78168037ccf819e24a9e3b55dc629aa788972a018d72371e2d64905bcc52b68977a5be41c52dfd42c6dd106a073682ef6c1b09c3d6004436bb6f59c06445768c217b3f36cf8f231e5128944f15fca908e1340cb4d175e9da1f15d5cbdf8fdc2493620b62dee93dfcaf1a56f781b04", 0x973}], 0x4) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)}) r2 = syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_STREAMOFF(r2, 0x40045613, 0x0) openat$drirender128(0xffffffffffffff9c, 0x0, 0x200000, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_aout(r3, &(0x7f0000000780)={{0x10b, 0xfa, 0x8, 0x1aa, 0x1a6, 0xff, 0x2fa, 0x7}, "b5890f659eaaa1d2cec9bfd04554144609be7fa8711bc8a4238511efdf44280034fc2730116c906aa5b0e07a7671e12a454d106abca0ee34f229d6352ca32ea2f2717f1875aa538eb7be286a9c368b12efb1a8e2acbdb2ecda69548c4db569024a5d6b823c78fbee8ec9a728cfa3d95cf1a72be8d2dd5373edd1ac6690fc3ffc068c559835b7c92bf439e69095d32bc888d548f150c93db0d29f215aca34084f222114a754edfa74a139bebb57af4d0098401d5bd68a77104df1c8436eef8a69cb83ea01386ea826783710ee77b79e0e5e7863708dcd8bde838ebc7d96dc43c78b0adedf5864", ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}, 0x906) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io$cdc_ecm(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) 7.97215461s ago: executing program 2 (id=3432): syz_usb_connect(0x5, 0x24, &(0x7f0000001280)=ANY=[@ANYBLOB="12010003001f66088f0510660548020003010902120001049570810904008100ffffff02"], &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x1, 0x40, 0x6, 0x8}, 0x48) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') (async) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo/3\x00') preadv(r1, &(0x7f0000000640)=[{&(0x7f0000000140)=""/134, 0x86}], 0x1, 0x0, 0x0) ioctl$I2C_TENBIT(r0, 0x704, 0x0) (async) ioctl$I2C_TENBIT(r0, 0x704, 0x0) 5.50648958s ago: executing program 7 (id=3434): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x19, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r1 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x102b23) openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/fscaps', 0x8a883, 0x99) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, 0x0) syz_open_dev$loop(&(0x7f0000000140), 0x75f, 0xa382) ioctl$BLKRRPART(r1, 0x125f, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x515f3155, 0x0, "78e114100985029874342a70e1133439720d6a"}) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000240)={r0, &(0x7f0000000140), 0x0, 0x2}, 0x20) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x4) ioctl$KVM_SET_CPUID2(r6, 0x4048aecb, &(0x7f00000000c0)=ANY=[@ANYBLOB="070000000000000007000000ffffffff"]) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)={0x14, 0x0, 0x800, 0x70bd2b, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x11}, 0x4) r8 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r7) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000800)=ANY=[@ANYBLOB="84010000", @ANYRES16=r8, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088058010c8054000b80080009fffe000000080009"], 0x184}}, 0x0) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000009c0)=ANY=[@ANYBLOB="cc01000016000100000000000000000000000000000000000000000060000000fc0200000000000000000000000000004e200000000000010000000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="fe8000000000000000000000000000aa0000000033000000ffffffff00000000000000000000000005000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000000000000000000000000000010000000000000000000000000000000a000000000000000000000005000000050000000c000f0000000100000000002c001300fe8000000000000000000000000000bbac1414bb00000000000000000000000000000000000000009b0003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000980200003c0341649a63368b2c7d951d4c9d4d838e14fb146a6579800c75fc8a1d1c5cb1c378c355d3ebf3b458d2c6026c019f9df8d998af143622d3a62828128cb0627ed9b7d096eb49c972d31a7b8551094f4ad35c2700"], 0x1cc}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) r9 = socket$packet(0x11, 0x2, 0x300) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={0xffffffffffffffff, 0xe0, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000040)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x6, &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x98, &(0x7f0000000100)=[{}, {}, {}, {}], 0x20, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0xe3, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) sendto$packet(r9, &(0x7f0000000000)="f927902438e66214a9b69d79de799718770c1ad342c433e36a0b443d8b55", 0x1e, 0x4000000, &(0x7f0000000380)={0x11, 0x8, r10, 0x1, 0x4, 0x6, @local}, 0x14) 5.004075454s ago: executing program 8 (id=3437): openat$cuse(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) io_setup(0x6, &(0x7f0000000540)=0x0) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') io_submit(r0, 0x1, &(0x7f0000000880)=[&(0x7f00000000c0)={0x0, 0x300, 0x0, 0x5, 0x0, r1, 0x0}]) r2 = syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) mount(&(0x7f00000001c0)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000180)='qnx4\x00', 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000d40)=ANY=[@ANYBLOB="12010000000000104c05f20d00002000000109022400010000000c09040000020300000009210900710122050009058103"], 0x0) syz_usb_control_io$hid(r3, 0x0, 0x0) syz_usb_control_io(r3, &(0x7f0000000240)={0x2c, &(0x7f00000002c0)=ANY=[@ANYBLOB="2a10070000003c0aa18265cc32fff10d8925af3d1763b07769231f4de711a8a733b6552037040a22771cea14af32e8a00fbb6132ea62189182ad"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r3, 0x0, &(0x7f0000000380)={0x84, &(0x7f0000000780)=ANY=[@ANYBLOB="401714000000006ff5266bb41e28f05c102c32fe4e6da786bd7e"], 0x0, &(0x7f00000008c0)={0x0, 0x8, 0x1, 0x3}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_IOCTL(r2, 0xc0105512, &(0x7f0000000200)) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) ioctl$USBDEVFS_SETCONFIGURATION(r2, 0x80045505, &(0x7f0000000000)=0x8001) r4 = socket$inet_sctp(0x2, 0x1, 0x84) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000000c0)={{0x1, 0x1, 0x18, r4}, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00'}) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000280)=[@in={0x2, 0x4e21, @loopback}], 0x10) sendmsg$inet_sctp(r4, &(0x7f0000000700)={&(0x7f0000000440)=@in={0x2, 0x4e22, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000480)="fdf7dc4d249bee9bc9f6525ddef60513e591e9b17388a3711dfbd2770e1707b68522a9d164e8481cf664510f09df799930930730dd61798c3536b91c120738a76b677acedcfbb1ba0d152814c4bd9b02714db4b2fdd76eea470d40ae530af4d07d844969d2c318f113edefde1e46d70d1b0e68df1bd1c0feee65476f2674234903dc3b78adf243a7394ba8f08ea4dec0880ea75ec988d51a5d1cc52b445353ce3a9739bcb4d14fc2179c38f906d393e9319331e3f8e1aafc53779c4232b486", 0xbf}], 0x1, 0x0, 0x0, 0x800c840}, 0x881) r6 = dup(r4) r7 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r7, 0xab00, r8) r9 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r9, &(0x7f0000000400)={0x18, 0x0, {0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 'lo\x00'}}, 0x1e) ioctl$PPPIOCGCHAN(r9, 0x80047437, &(0x7f0000001f00)) r10 = dup(r9) write$char_usb(r10, &(0x7f0000000300)="90fabe65", 0x4) ioctl$NBD_CLEAR_SOCK(r7, 0xab04) ioctl$NBD_CLEAR_SOCK(r7, 0xab04) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r6, 0x84, 0xa, &(0x7f0000000300)={0x8, 0xa, 0x1, 0x2, 0x1, 0x6, 0x2aeb, 0x3}, 0x20) ioctl$USBDEVFS_REAPURBNDELAY(r6, 0x4008550d, &(0x7f0000000040)) 4.881246469s ago: executing program 7 (id=3439): syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000001c0)={0x38, 0x5, 0x8, 0x40, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000000) r2 = syz_open_dev$vim2m(&(0x7f0000000180), 0x0, 0x2) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f00000063c0)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000c40)="97b5ee06edbce480b6bdc020061952fd2661e171449c341cf2c2c9b0e932aaba", 0x20}], 0x1, &(0x7f00000003c0)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18, 0x14}], 0x1, 0x800) recvmsg$can_raw(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000c00)=[{&(0x7f0000000080)=""/30, 0x1e}, {&(0x7f00000009c0)=""/170, 0xaa}], 0x2}, 0x10081) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, 0x0) r5 = socket(0x1d, 0x2, 0x6) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0x40045532, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) ioctl$VHOST_SET_OWNER(0xffffffffffffffff, 0xaf01, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @private=0xa010104}, 0x10) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001480)=ANY=[@ANYBLOB="14000000360007050300000000000000017c0000"], 0x14}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000c40), 0x0, 0xc0) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='net/tcp\x00') pread64(r8, &(0x7f00000000c0)=""/105, 0x69, 0xfff) ioctl$HIDIOCGDEVINFO(r0, 0x801c4803, &(0x7f00000000c0)=""/43) ioctl$sock_kcm_SIOCKCMUNATTACH(r5, 0x89e1, &(0x7f0000000140)={r6}) 4.788353464s ago: executing program 3 (id=3440): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x4bcd00, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000240)={0xc}) ioctl$IOMMU_IOAS_MAP$PAGES(0xffffffffffffffff, 0x3b85, &(0x7f0000000300)={0x28, 0x7, 0x0, 0x0, &(0x7f0000579000/0x2000)=nil, 0x2000, 0x4}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, 0x0, &(0x7f0000000200)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x6, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$alg(0x26, 0x5, 0x0) r6 = accept$alg(r5, 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r8, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000041b00010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc08000309000000000000004000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x40088c0}, 0x40) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4451099e661a63b1}, 0x0) sendmmsg$alg(r6, &(0x7f0000001900), 0x64, 0x0) recvmmsg(r4, &(0x7f00000087c0)=[{{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000c40)=""/80, 0x50}], 0x1, 0x0, 0xffffffffffffff60}, 0x6}], 0x1, 0x2160, 0x0) 4.00270684s ago: executing program 2 (id=3442): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1f, 0x11, &(0x7f0000000200)=ANY=[@ANYBLOB="18000000ffffffff000000000000000085000000a8000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b705000000000000850000007100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1f, 0x11, &(0x7f0000000200)=ANY=[], &(0x7f0000000b00)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x4, &(0x7f0000006680)) capset(0x0, 0x0) unshare(0x62040200) munlock(&(0x7f0000219000/0x2000)=nil, 0x2000) 3.796439025s ago: executing program 3 (id=3443): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="05000000050000000009000085"], 0x50) bpf$MAP_LOOKUP_BATCH(0x19, &(0x7f0000000800)={0x0, 0x0, 0x0, 0x0, 0x6c, r1, 0x20}, 0x38) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x1, 0x40, 0x40, 0x41}, 0x48) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r2, &(0x7f0000000780), &(0x7f0000000180)=@tcp, 0x2}, 0x20) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) mmap(&(0x7f0000ff4000/0xc000)=nil, 0xc000, 0x0, 0x20031, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x80801) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x100}) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r4, 0xc020aa04, &(0x7f00000001c0)={{&(0x7f0000ffc000/0x4000)=nil, 0x4000}, 0x1}) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x9, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x1c, 0x2e, 0x1, 0xf0bd26, 0x25dfdbfc, {0x4}, [@typed={0x8, 0xc, 0x0, 0x0, @uid}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 3.721088253s ago: executing program 2 (id=3444): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x0, 0x18, 0x70, 0xfd}}]}}]}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = add_key$keyring(&(0x7f0000000100), &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$get_persistent(0x16, 0xffffffffffffffff, r4) keyctl$clear(0x7, r4) syz_usb_control_io$printer(r0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x2, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b70000001c000000bca30000fffff0002403000020feffff620af0fff8ffffff71a4f2ff000000001f03000000000000e5000500000000002604fdffff02000015010000033800001d13fcff000000007a0af0ff0090001f0f14000000000000b503f7fff80000009500000000000000033bc065b78111c6dfa041b63af4a3912435f1a864a7aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168e5181554a090f300020000fe275daf51efd601b6bf01c8e8b1b526375ee4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e65440000000000000000028610643a98d9ec21ead2ed51b104d4d91af25b845b9f7d08d123deda88c658d42ecbf28bf7076c15b463bebc72f526dd70252e79166d858fcd0e06dd31af9612fa402d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff61623604000000000000006a89adaf17b0a6041bdeebdfd1f5089048ddff6da40f9411fe7226a40409d6e37c4f46756d31cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564163427afea62d84f3a10076443d643649393bf52d2105bd901128c7e0ec82701c8204a1deeed4155617572652d950ad31928b0b036dc2869f478341d02d0f5ad94b081fcd507acb4b9c67382f13d000000225d85ae49cee383dc5049076b98fb6853ab39a21514da60d2ae20cfb91d6a49964757cdf538f9ce2bdbb9893a5de817101a3062cd54f9ff51d355d84ce97bb0c6b6a595e487a2cc47c0efbb2d71cde2c10f0bc6980fe78683ac5c0c31032599dd273863be9261eee52216d009f4c52048ef8c126aeef5f510a8f1aded94a129e4aec6e8d9ab06faffc3a15d91c2ea3e2e04cfe031b287539d0540059fe6c7fe7cd8697502c7596566d674e425da5e7f009602a9f61d3804b3e0a1053abdc31282dfb15eb6841bb64a1b3045024a982f3c48153baae244e7bf573eac34b781337ad5905c6bbf1137548c7f1a4cad2422ee965a38f7defbd2960242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a90144022a579dfc0229cc0dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc48899b212c55318294270a1ad10c80fef7c24d47afcc829ba0f85da6d888f18ea40ab959f6074ab2a40d85d1501783a7ab540b8d7b4ead35a385e0b4a26b702396df7e0c1e02b88c114f244a9bf93f04bf072f0861f5c0b000000000000eedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba3401e6a52acb11883ad2a3b1832371fe5bc621426d1ed01b389708165b9cdbae2ed9dc7358f0ebadde0b727f27feeb7464dcd857ab15e355713767c536cbae2f5c7d951680f6f2f9a6a8346962a350845ffa0d82884f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010ae20e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa19faf67256b56a41fd355b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ced301efeb6dc5f6a9037d2283c42efc54fa84323afc4c10eff462c8843187f1dd48ef0981000000000000ff0f40b1888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538c6ee6ba65893ff1f908ba7554ba583ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738612e4fee18a22da19fc08001011e32f80fb60e14b9eee094277bbc170882c8890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e3f753b639a924599c1f69219927ea5301fff0a6063d427180d61542c2571f983e96635600000554f327a3535e7c7542799493c31ac05a7b57f03ca91a01ba2a30ca99e969d6fd09dc28ebc15edb4d91675767999d146aef7799738b292fd64bb25b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a794963342aece449a0d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b6ef9d12096833d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec035d232f89fe0120f64c62e8e3ed8bcb45202c204bbec8d722824c0ebca8db1ea4a05e41f6016ab5bbe4fe7ff5d785d0128171c90d9900ca2532b0f9d01c4b45294fbba468df3e1b393cb4e62e753b4172ba7ac1f2b51c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a881192292ffff5392ab3d1311b82432662806add87047f601fa888400000000000000000000000000006acc19808d7cf29bc974b0ea92499a41b9b9a7c2bca311a28ee4952f2d325a56397c78f12205db653a536f9f3322405d1efd78e578dc6b3fb84f3738a4b6caa800000087efa51c5d95ecba4e50e529d1e8c89600e809dc3d0a2f65579e23457949a50f2d0455cf79a43746979f99f6a1527f004f1e37a3926937e84fb478199dc1020f4beb98b8074bf7df8b5e783637da740800000000000000c55a4385e9a617aa6c8e10d4202c5afeb06e2f9115558ea12f92d7ae633d44086b3f03b20d546fa66a72e38207c9d20035abc46271a30f1240de52536941242d23896ab74a3c6670fdc49c14f34fc4eadd6db8d80eba439772bf60a1db18c472dafc5569adc282928d2a1ffe29f1a57d3f18f4edaeb5d37918e6fddcd821da67a0785585a4443440dc65600e64a6a2740000000000000000000000000000000000000000000a0009dd14b38f2f4426d7cf5075047c31f6ce6adddfe3ac649c0643c8bfbeb14ba1fd7a485aa893915cf81e29aaf375e904bbe52691a4100260ffcd8f1d04166d291ebcef893e1b9ccb6797d0646fe0e7274434f28efb43e06e64f0698caca42f4e6018a455736c482a017e2b13dac4a90faa109f0e87cc94e3efb649692456463ca74aa6ad4bf50c1acb0000000000000005375e528285544d0064b98646f3109e9a4942ce42c6e7ec84b664f6c2770803f10baa804a707f0a1fcbfc309381aeba191950bae71f37f1eb7ceeffb3c0547ac6571603adbfde4c8b5f8d7f4b854441613633b48865b65bdc415e1e0dcf672d68cf4cebf04f4bc1eebf560a26d34d3757b1450fdb0a9a69f432e277f3a0386eb2bd3305c821c64757f786b79fef54dbe64c67d73934bc80b2133fb3c04cc7ea48bf97a6243c9f95dcbddecf45f008f1822c7868e1ff5a3cff5d6b6898335792749df7b1f51e91f8c1c3b1b93b33aaa3fab69cef08a9f6f6cf39dea3d878b2ed42545421970cc426e644332bc956d1c6adefdf0ede2c5c94aa632646ae225accdf031f611d01622921f1b922a5ac887cca3136133dce8d9f5f4da7bed2ea5d94362200000000000000000000f296b0c1484e5f781ad26bff696b05ff0a5e2270e07618b04273bd4075ea38ab463bfa6a38e7c537498ba3e4df8dfc9e040000003c3ffad44d2a376def42e41e9fc31678257e040fa7cf32c221aaac08000000000000001a00000000000000000000173570f0c11ae694b0f7a4f9c2f6790044a357e785af6e153d5f1ea460af92c7cbbd6295afe740f5e154346d483e0d641ef02e4d5295d756e110522a7a945b93fb705b95b6aae27a8fb33732ce1da1c0b1af8eb9222a06e984ab1e6984c8bdc12360627137ab67b6b68ab08acb29a74dc36b51209cfbc87f61182bbeb2772e9d5a1ffc477179be481efe46a4ce86be0b1d8eee42a611a3d44ca450b14586ed63dd92005c79e4a8ab8a94f0c6cb4bed8594a39bd76d3ef8a7ab014e787596db796bd93a36c2880423291e3bccc86f66ba792ff4d87b3f80e5908779e51c5e9055fc5b23605cd000c723187ef09dcf4b07b06a9342f3f62ee7acddff292082c1f4d8eb9561f80873a09a1ae0c9af1121175e5600f43a1179484502009759264a5729f07c2b218fa36ba2316a99aaad0130df83d0bda1e711290f78c143ea143967b00adcd77e6ad5e48d839ea61aadb83e4d071c54691924a3830d3e7b5c198bb0ed623153590000000000000000004b985ea1702f34f2f85b168c083e810ed567e3f1979b9ed1a4bf6a10dac825c96a0828b335de445a4880bb6474157efd1a72ca46ae4cbe3ab648c9bc4867a5a4cb87d7d6d55475b34b3cb6aa9e2337d4e04a37e35109752522ac9b186ddd80c47da6a2f4ef7bb909c975520000000000000000000000219cf5c1376ab33786f6b856d354e90a2733f78f2d188057cead3480eade49d55b770fad7fa000d23da6275768810b6b2df91d3a991ea98d929d271696c258d5b735d5db11df434e7dd1b7c1ca05cea3977df564115f4ec6ffab1d2ff8a642ca50934b3fbe44b0abeba9df209566984a29dfc0466e439a94e177b3c4d5f6e92b8176b9d6ddeeeb196fa964217f88e1acc180aaa4"], &(0x7f00000001c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x0, 0x2}, 0xffffffffffffff97, 0x10, &(0x7f00000000c0), 0xfffffffffffffd27, 0x0, 0xffffffffffffffff, 0x4b}, 0x48) 3.413072727s ago: executing program 6 (id=3445): syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = gettid() r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="18020000020000000000000000000000850000000f00000095"], &(0x7f0000000000)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x7, '\x00', 0x0, @fallback=0x5, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x0, 0x28, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f86dd", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x10000000001, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r3 = syz_open_dev$sndctrl(&(0x7f00000002c0), 0x9, 0x400) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r3, 0xc1105511, &(0x7f0000000680)={{0x4, 0x2, 0x6, 0xc3b, 'syz1\x00', 0x8}, 0x4, 0x100, 0x7f, r1, 0x4, 0x3, 'syz1\x00', &(0x7f0000000300)=['\x00', '\x00', 'system.posix_acl_access\x00', 'system.posix_acl_access\x00'], 0x32}) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r4, &(0x7f0000002700)=""/102392, 0x18ff8) r5 = socket$inet(0x2, 0x2, 0x1) setsockopt$inet_mreqn(r5, 0x0, 0x20, 0x0, 0x300) r6 = socket$kcm(0x10, 0x2, 0x0) mmap(&(0x7f0000fa2000/0x3000)=nil, 0x3000, 0x3, 0x13, 0xffffffffffffffff, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000a40), 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@ipv6_getnexthop={0x24, 0x6a, 0x601, 0x70bd25, 0x25dfdbfb, {}, [@NHA_MASTER={0x8, 0xa, 0x5}, @NHA_FDB={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0xb52b9c7732f7d2c0}, 0x24014844) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="6000000002060103000000000000000000000004050001000700000013000300686173683a6e65742c696661636500000900020073797a30000000000500040000000000050005000a00000014000780050015000000000008001240"], 0x60}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) sendmsg$IPSET_CMD_DESTROY(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)={0x1c, 0x3, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) setxattr$system_posix_acl(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='system.posix_acl_access\x00', &(0x7f0000000600)=ANY=[], 0x64, 0x2) recvmsg(r6, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x40002103) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="364000002600913e"], 0xfe33) 3.409100979s ago: executing program 3 (id=3446): socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) keyctl$search(0xa, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) getdents64(0xffffffffffffffff, &(0x7f0000002f40)=""/4098, 0x1002) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_RUN(r1, 0xae80, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f0000000380)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r2}, 0x18) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x100000000000000) 3.263206173s ago: executing program 3 (id=3447): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0xc000) getdents64(0xffffffffffffffff, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0xb, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000000)='mmap_lock_acquire_returned\x00', r4}, 0x18) move_pages(0x0, 0x1efe, &(0x7f0000000080), 0x0, &(0x7f0000000040), 0x100000000000000) 2.713776375s ago: executing program 7 (id=3448): syz_usb_connect(0x5, 0x24, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xfc, 0xee, 0x33, 0x40, 0x203e, 0x8888, 0xa871, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x85, 0x0, 0x0, 0x8, 0x3}}]}}]}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'vcan0\x00'}) socket$nl_route(0x10, 0x3, 0x0) socket(0x2a, 0x5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x2000c0d0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f000001e580)=""/102392, 0x18ff8) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000340)=ANY=[@ANYBLOB="38000000180001000000000000000000020000000000000900000000060015000200000014001680040008800c000280"], 0x38}, 0x1, 0x0, 0x0, 0xa000000}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={0x0, 0x5c}}, 0x0) sendmsg$IPSET_CMD_ADD(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8000}, 0x44000) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000280)=ANY=[@ANYBLOB="28000000030605000000000000000000000000000500010007"], 0x28}, 0x1, 0x0, 0x0, 0x80}, 0x20000010) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r4, 0x0, 0x40, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) rename(&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='./file1\x00') r5 = openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0, 0xff2b}], 0x2) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) 2.640164494s ago: executing program 6 (id=3449): syz_open_procfs(0x0, 0x0) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r1 = openat$dlm_plock(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r4 = socket$inet6(0xa, 0x3, 0x26) connect$inet6(r4, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in=@empty, @in6=@remote, 0x4e20, 0x0, 0x4e20, 0x0, 0xa}, {0x9, 0x0, 0x0, 0x200000000002f1b, 0xfffffffffffffffe, 0x0, 0x0, 0x24}, {0x0, 0x4}, 0x0, 0x0, 0x1, 0x0, 0x5, 0x3}, {{@in=@empty, 0x800, 0x33}, 0xa, @in6=@empty, 0x0, 0x0, 0xb7f67fd50278d396, 0x4, 0xfffffffc, 0x14, 0x401}}, 0xe8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f000001b700)=""/102392, 0x18ff8) sendmmsg(r1, 0x0, 0x0, 0x2400009c) writev(r3, &(0x7f0000000840), 0x0) socket$caif_stream(0x25, 0x1, 0x3) close_range(r2, 0xffffffffffffffff, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000b80)) r7 = dup(r6) r8 = fcntl$dupfd(r0, 0x406, 0xffffffffffffffff) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, 0x0) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000080)={0x0, r7}) 2.156248545s ago: executing program 6 (id=3450): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x100000a, 0x4082172, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0xfffffffffffffc22, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) mkdir(0x0, 0x0) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) connect$inet6(r0, 0x0, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x100) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f000001b700)=ANY=[@ANYBLOB='fd=', @ANYBLOB="90091a929177924111285c5f144b14f45d48d0c0d136a425f234d11b01c01a010eca602e29ea59ea5feccfa437d8dd095ef578daa6007864f6fa33e36f87d6e2a3ba49d972791e908a7851e275ba2522158fad0e7421fdcf8a569d7f4c3760f65ec3589f81c08b5aceb1f13e92e50fd9aafa22c03d194257e0ce404a0474af992cad34513aa8bc8d8f517e61cfdd024d1a609523be9fd2fe3b0d8ba6270c4e1aebfb8cfd8c79a763bd5284b95cd406438e96ad96a8908ae04a536bce4d06a92f93406c3c3100b751d79a1ca702ed6eb60e337244805d96c00caee10eacc3ee70c840265f8fb3fd01394c0b44060172e5fa808b959bc688fa6daf135a8f43e57e605d3cc6d3cc087d20c2a8def8ae4cd42e96c6d6ef69f77b9f0b8bd5f50c8944559636fe2f4607e8f11dab3e6ffb244c8befc99473825be672002de6f39128187fa8e4f8aef43f8003a71c307c344b517d97ccc1b3c749d6f132f5653bb6c50c3ed66d1657858cc3e879486fc3658b9fcdb2450f775b636ac93d507ae61a7e0ce45de89384242673f4a1a7f453d278e4e1fa93f13d7ac39398e607e03b32598b4a4d7402d892bd11c6acb67be0ef60c877177dd07f7002aab8fbdfe89d220ab488cc987b1cbda927ce1ac2aeb16b9080ee9e1c71d9ec9bd16a8045a515dfd589ecdc854260eea3df7ecbd63c913875f7cb94ccfe3da5e0d5bb49b34d011520e66f2bae5f3464c7d5d503bd20a2a72a64c0be37051996509e707ec80ff3528815a6b33da3367b8279fc86e1fb6551ae97522573aac954d6265f6adc2eb9e4ac5296900aab1e9b8c4ea2346f77abbc3426a76749807bf543b02a48f22dcf6090dc5b97295d3846095aff4e910ab050aa23550e973e4cfcab7ef8ba954a2fde6799692de16ff9d146c25698e18752c324dc015c388e93fc891c6e2884177c2ab51b9e2ad3056a5b0a4d0ceac87d9a61546e1bf85be824d6624867642b03b340e6bf8cd0b6fe900bcbd05caa3a71ceacfcb4aeaa8cd5955e1589f60e65c6236005bd2e22ef571a957a2b23e8e21482182defea82ff43e133ecdfec0971fe49df5360f257925878e5089e28400210220858af7d1cc257f0bf44122941d20b264bd7bea52cfb6906d0e728398d25cbfd6108974819f8be01cc3b8f28dd948dbf53c176d77884035dc6550f726bafe3302cc9a6d32125a671a696fafeb58fffba913a9584e42d1c4d83736373d226eadc1c34bf73216e18c730c2a8658a2387173a9400b98c0dc68453e49d9ca4f90545532bf28833c255f155b7b8c3847fd5187bdca385e555e683d27d8cc48a58004bc77b32b26beb87cdb332fc7f024f0433606e9345880eb36eb1994ac2b0d3ef683edfb471d1df2d5af475950ead24208c4cb8e012963d10fabcd20a2b9d03b9999b45e7b8c1132cd1dd2912122bc91d47dba4783c5f84d7d69f44b38ba38452eea9a8ca77702811c97a90c19a08289f332dbde17b1598de1499e6122cebf08377b7ccc55cc19ed456a2a252a87e323babd2ebf573cd5c58aca4acba5afe1a26c6344b8d0ba477c1a93e9c115926b9b1f8501338d281815a0a397c6cfebcd632a6e5f6fb53bbe946b29e21e4e13ce1193d6531db72b0c4a49449aabe2f478689d8c6d1e6252c36d71b5a79440779d2b3e9f2a6c18293dee1f07ea459ed33fb2b924da2830bce66d0dcc683a7d4b6b82861dca4d7cadcc924ced60e314b110cff55dd83c4a2dcc65aaf1a2f920557fa02cdcfd849e25341d9fea0b6cc2eef3476e4b128ba3d4a25d10d83d94032afb57fe34eb7e4118bc77d88dc2a35fcdba8637f9c49bf719848a8ae38e8ac17b6a63893d468349b2e6fb91d954bec6bd47af74c2fe26b8b07ea2d3d2923dc2092b113e47d75fae74c18b86ad0cdc63b8a92b454d8c2d67873113d8c998399c3ccfc630619953ee59dfcf0a6b2dcc5515b36dcb95100905594d971194e4ba5add0c8fd7d7da49b274f25f0179ac65a710707df7b46fc79f46b6ec571d0d8d29bc4d445dd9a3da95fa930949e706aecb0b65c02e0b29879e3a73950888778a20f7c32b6bccce2266739ebb4544f29f77afaa19444969b17f838f59054907f74bc6e98243ae9dd3c50b0a34aae94b7cc36fe5c4055f9c1617da5a8332fb6597a50adc54df1c055ada09230a9a48b0f9dca8bb000465f806a4ffd139431bbd9a9374cdfdbc4ee2f8f47804cb6594783aa5ceba60e777389da067b5cc9ad922a59998ff507430410f402c918e4e910344e7a244b4baf2a642dbcfb79ea9593e3e0f104a8d98ff851ff35fc4ae7ddd04c0f3c481fea0caee40dae0dafc66b377376ce7afb690976337ba5ed73ee0bff6178909e543fb44a43015dc6237b93baed6ed9a342b2b2673c6f4750c31b6a1e8a33d1b6ea9a7a2827484dd66bd9d33b81c41269675553f3ea6afb6401448904f3775ee6aed89cb2c736e251809e5276330b345c14def975710ec7bddd89dafe4faebb42f770ea0cd003698787bea527d9be4508b24532fcba44f55b8699b1d31046ad4cd8579b9444607c06630c6f2832e35383b311dceb364b461821e26b3fed24ba444c35b948b2d26c0edafcd089d9880257ed73de4fbc6b2d47555b69645f5849ce06dab86cbf4d3e289a2568c25066fe2fa32e99660e76b9837901c6c0c8e0bb99682876d9b7c2987da5f91fc57d64c6e280b2bf75e37f3b1dc6cc5bb623df4b48714799ebe2be83901bb1182edc820a42b139bd29442a4d757f8e4b608028f96b57968b743db4e2598e50b4eeb74d00cd19f0b30f660de64ac7128baf00d31f494521a6538440ffd4d61a92d5a9a14826e32c56414eef850742973918d1a4123b3b8f25f5ef667936834f5ab3d0ea738f87d50b27b52fac9a1c252f10148975a10a92f8ca759eeb2fac0e212a7520c3df0294247dbaab9a67bab75c991facdef417f7a777022f843ca97572ebb3a9935368861e978403820f59899088550f875f97436d9fb13910d67a8411c3deaf050e1bf89b0e195fdf6fd13fb177601bf1ae30ea8d1ad05d73cc18aabda06a002c9b752d16a568ff43e434ff40a270d94f6cf1f7254850eafb97e6735f8510bd6e414fb44ca9dfe5889b7505c14c7c56a6558d606322570125c75f15212f41712da245e78fdd7472b02d406c2100fdf4961fb8269f981c141a96103249ff26ce4d1bb34f97dacf2a2e72c2e21af44e393f9c6697769942abb6a982d5522687aa4855eeedf7616537b73d51ee6de4e6a1a15d2a01fd327003061873ef60b1d427f3ddf65d85e2357102ed73361214a1d40672b89f47ecb39cfd1a060d2d8fa55308f2d3116d1986c9ec62c68374c19a6eeb8bc35292ef9aee8b0acefeb16a469b1839a5ca3f28e4a695976f2c5721098cfbde66b68cdf6f9665427c4167e35bb39ea4c00cd5c365177694ae84eaaac4254478d02f75c878d50d1ee105881a2b73303ce0cf47e2b47e3150f250d7bede598b751b08200bf71e0d23c1ddc811b27a86498326c7719910859ec926d5ea0ffc0b96cabbc146a00cf0562660329e65c3d716d1789c83175732e1636ce86dde7117be624c3a7a9952ba4923da10f776587bf1d524c1bbc490213537ce36d24f8116a0ec7a6234154890458d05dc2532e76fba4ede116440564ecd2aff9f6184f47039fe9db10a233445d908060cbbb6e9fae99e0ee096db39a43fb23f26fe34b78f4482f8065d7fff0070b1203745ac0dfe7360ce79481f4788a72ffd0fc5f3bc3d22cb9d95b5c6cfd641a59056cd41cc6bfe728a34478b09fe20fad8db879039a8b69c6884d7f2ea531f0a216f9e535778acfeefc6faccfae466a7718dde2ab2d2c8804d6ff81cc554acd50413b66ee468a76db7163a6bd78ddf627255282da329b633114097cf0cdd9d4986c63fea3b9881c3e0612946e3f024556703a377b42fc80ef7c1ec6d13ef1855c3f2f82a4db26673aff61a5f21ee304ee4268d4e1cae0952384618bde957804a59fd77447c235b877b58d6a7c676d1b2ae06d91ac80628e0ee762d795aed5f0074ffc530d10f23889677803451a708bb23fa5af5f686618015a8234191e326140465ada87c0d7e3279596c94363d515e1f051ee74d6a28755e01e94b2660fc9790aee3ece79933805180ca26c9bd4978b7a5f8a1473f249dba76e8e38823042e276780da992b7cc70a810ba1df4c1aa37fe3090d3fe23cfe91df61e85704b36558dcd37a42ec7892bf75539fb25cc4d82d251d4269c2ce5ef99685d1d11a0921c956b0dccb48eac308d4a6af46a18b2233308b642eb469b038a8d9ff5301d129dd822e16a8f1109855d9756a9e64e2692c82d052b5c3ce6f93bbed386d44af0d17f6d908d465322f19aadf28428820a71f430d745012ed1748c2f8e2971c9d31e44d6b9df1dfd8a17c718e85ab3c51cbe8e1de3747907270c31010d3ee9acae3cc1a70b371e75b8542d16cb362c71bf54ad7b52ebf1cf9f994ae6fb4257cca563a4437055608b90786c2414099f38afb36f232d85c2098d1315ba3ff6ca2c55084735ce29c30dd337e50522288c8d54354269b386adead74cd67010aa14ffd3adbc490160bb2430b78d9fea971ff34b0741dcf90b765b81627753b2376f401552efa67eaae6834599241228fcff214e2fc50e7ea8581e45248e0c6900366acad91d184e2dddab358773274d4e3baa843b6bcace1e970715d074ef63abf4a39e67de3f0b4ba5d308585ce26c4c64ca622633f237c328b984370b07aec05dfd2a66e5f2e490cd1d6cd797208dcd3bc72053587c41fcdb9eed06269dea175c39114bde10b2beaae032266dd7032c11fe9af0a59688c617a3994cc5a8e560ae31174f3c11c31511aa475516b55362bf62e795d145e000c7fe8a77db33b9c2ef8f3fffbfc2204e880a92f49b28ff5a6745ee94ade695268feb1f3dba192e405aedcdaa902cf1845e81027ce3afc3747f2ad1c3ff9abde813427a10c612524096d96c55e580ab729ebe50996f19b04e0c06cb9fb279caf29d206efd07b25abb2d4203c497c2b81160148eed45381a6dc1d0a2b909bdec3c519d94437d81bccd9961f011f8a36eece610231d35aeea8978423660c9a255a7688bb2a1c0b9ff8ded06d7078141befc41c4fa117175fc08e910206d7f9c45cfd76820e7653715cdda5e54f87649e6c10dd5144aad8d47d05572dbd968e33c1efb81d97dd5416dd76702d00a5e3623df294aa533fac82d0df2b8b31b800356c443f32ed37494eed53c82813c6c8b150dfe42065180b39e6d87fc4dce0d9336a945af06d3f5a857e9071582a03bb91da3ac484f3c44755f4ab20a426b15e318e353ee1a5d53eef22b31249e86177fe02e63a3bae634ea2be189469cdb7913167d8c2bd17653af107a7a610f02d570939e006068440229dad7388187562e5b4955fc4761656d55e22f5da58e5ef21b2ea760824511e36828ccb0d47941fef1aee54867829a60f7e649c98d951617384d4c2abe24e6b3e9b6feaf3b26ac160fea171a96e9781dea762273a3e93d75bdba137b0cef940eb27551686e99c0c334687dc823b5992a01393c83e3daaa18643ee1f1f3ea3650419dd2a1d939040c95f94c88ad71b03ba9988b0b1d2f990e649423e1a0cab603f2521aac5cd5d9b8be77f0acdb482cff7adaeaa699381beec051d18977c574ab08c469d7a2062846b48f3557459504d539d60d8bd9597e8cd9083a9d9b333102a741a19e28ba6fdc0770a81cfe1b8629febd0b70c9365c9da9519e781f106c9f52f977c", @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC, @ANYRESHEX=r2, @ANYRES64=r1]) read$FUSE(r3, &(0x7f0000002140)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r3, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ffccfaf3308d9671b01f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9464a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a31ff554a458c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992bb9f0b0027c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d80762ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5fe0500c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5750070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x90, 0x0, 0xffffffffffffffff, {0xffffffffffffffff, 0x0, 0x101, 0x0, 0x100, 0x10000000, {0x40, 0xd08, 0x0, 0x101, 0xfffffffffffffffd, 0x0, 0x7, 0x0, 0x7, 0x6000, 0x10000, 0x0, r5, 0x902}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r3, &(0x7f0000000440)={0x50, 0x0, r4, {0x7, 0x29, 0x0, 0xffffffffd9a08400, 0xfffc, 0x2, 0x40006b, 0x2, 0x0, 0x0, 0x0, 0x933}}, 0x50) r6 = openat(0xffffffffffffff9c, &(0x7f0000000a80)='./file0/file0\x00', 0x0, 0x3) ioctl$TIOCGPTPEER(r6, 0x4004092b, 0x200000000005) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) openat$ttyprintk(0xffffffffffffff9c, 0x0, 0x40601, 0x0) r7 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r7, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r7, &(0x7f0000000080)={0x2, 0x4e21, 0x0, @rand_addr=' \x01\x00'}, 0x1c) r8 = socket$netlink(0x10, 0x3, 0x8000000004) connect$inet6(r7, &(0x7f00000000c0)={0xa, 0x4e23, 0xc, @mcast2, 0x8f}, 0x1c) writev(r8, &(0x7f0000000000)=[{&(0x7f00000001c0)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080007f000001e809000000ff0000f03ac7108f000000ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 993.430659ms ago: executing program 6 (id=3451): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000140), 0xffffffffffffffff) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r0) sendmsg$NFC_CMD_GET_SE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)={0x14, r1, 0x325, 0x70bd28, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x0) 912.055137ms ago: executing program 6 (id=3452): ioctl$DRM_IOCTL_MODE_GET_LEASE(0xffffffffffffffff, 0xc01064c8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)}) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="020000000400000008000000010000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00G\x00'/19, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) syz_open_dev$dri(0x0, 0xaab8, 0x109100) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00') openat$fuse(0xffffffffffffff9c, &(0x7f00000005c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000280)='./file0\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x1c, &(0x7f0000000d80)=ANY=[@ANYBLOB="1808000070000000004000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf0900000000000035090100000000009500000000070000b7020000000000007b9a00fe00000000b609000000000000dbaaf0ff50000000bf8600000000000007080000f8ffffffbfa400000000000007040000f0ffffff570000000800000018220000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7050000080000004608f0ff760000004d9800000000000056080000000000008500000007000000b7000000000000009580000000000000"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$DRM_IOCTL_MODE_GETPROPERTY(0xffffffffffffffff, 0xc04064aa, &(0x7f0000000340)={0x0, 0x0}) 370.498359ms ago: executing program 2 (id=3453): r0 = socket(0x2a, 0x2, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xd}}}, 0x24}}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000000300)=""/102392, 0x18ff8) open_tree(0xffffffffffffffff, 0x0, 0x0) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f00000003c0), 0x0, 0x0) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000f40)={0x8, "b546baa5cc590d3033de259c2996817bb959ebab028deda525e19bdeffafde25", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000780)={"d1ed39d88b014076ab94c1fb10628c46d2e681cdb9e581a38ebb0ddd5f307e56", r7, 0xffffffffffffffff}) close_range(r4, r5, 0x0) ioctl$SYNC_IOC_FILE_INFO(r8, 0xc0383e04, &(0x7f00000000c0)={""/32, 0x0, 0x0, 0x0, 0x0, 0x0}) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_RINGS_SET(r9, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000100000001800018014000200776c616e30000000000000000000000b08000700e80700000800070001000000080009007f00000008000700090000000800080008000000080006"], 0x5c}, 0x1, 0x0, 0x0, 0x4084}, 0x0) getsockopt$PNPIPE_IFINDEX(r0, 0x113, 0x2, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x4) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) r13 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r13, 0x8933, &(0x7f00000004c0)={'ipvlan1\x00', 0x0}) sendmsg$ETHTOOL_MSG_DEBUG_SET(r11, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="00010000", @ANYRES16=r12, @ANYBLOB="010028bd7000ffdbdf25080000000c00018008000100", @ANYRES32=r14, @ANYBLOB="e0000280"], 0x100}, 0x1, 0x0, 0x0, 0x802}, 0x0) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000001c0)={0x1, 0x58, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$ETHTOOL_MSG_PRIVFLAGS_GET(r0, &(0x7f0000000e80)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000c80)={0x200, r2, 0x800, 0x70bd25, 0x25dfdbfd, {}, [@HEADER={0x54, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6_vti0\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}]}, @HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vxcan1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r14}]}, @HEADER={0x60, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wg2\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r15}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x44, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'gre0\x00'}]}, @HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r1}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_virt_wifi\x00'}]}]}, 0x200}, 0x1, 0x0, 0x0, 0x8000800}, 0x10000001) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) 365.824992ms ago: executing program 8 (id=3454): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000003c0)={'bond0\x00', 0x0}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000200)={'batadv0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newlink={0x48, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21}, [@IFLA_MASTER={0x8, 0xa, r2}, @IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @hsr={{0x8}, {0x14, 0x2, 0x0, 0x1, [@IFLA_HSR_SLAVE1={0x8, 0x1, r1}, @IFLA_HSR_SLAVE2={0x8, 0x2, r2}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x20040000}, 0x0) (async) r3 = fsopen(&(0x7f00000000c0)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) (async) r4 = fsmount(r3, 0x0, 0x0) fchdir(r4) accept4(r4, 0x0, &(0x7f0000000000), 0x80000) 180.554924ms ago: executing program 6 (id=3455): r0 = syz_usb_connect(0x0, 0x3f, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a00000709000100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a010100000000000000000a00000609000200730900010073797a310000000014000380100000800c00018006000100582e0000140000001100010000000000000000000300000a00000000000000"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) mount$overlay(0x0, &(0x7f0000000040)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) rename(&(0x7f0000000340)='./file0\x00', &(0x7f0000000380)='./bus\x00') ioctl$FS_IOC_GETVERSION(r1, 0xc0145b0d, &(0x7f0000000040)) 58.861648ms ago: executing program 3 (id=3456): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmmsg$inet6(r0, &(0x7f0000000ac0)=[{{&(0x7f0000000000)={0xa, 0x4e23, 0x8, @loopback}, 0x1c, 0x0}}, {{&(0x7f0000000240)={0xa, 0x4e24, 0xffffca97, @loopback, 0x2}, 0x1c, 0x0, 0x0, &(0x7f0000000b40)=ANY=[@ANYBLOB="14fffffff500000029efffff0a00000000000006000000001400000000000000290000004300000000000000803f00000b62"], 0x48}}], 0x2, 0x40000) 0s ago: executing program 3 (id=3457): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_SET_CHANNEL(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0xc004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102392, 0x18ff8) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x800, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000b00)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) socketpair(0x28, 0x20000000000001, 0x0, &(0x7f0000000100)) close_range(0xffffffffffffffff, r2, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000002010000850000004300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x18, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0xfff3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000180)='sys_enter\x00', r4}, 0x10) getrusage(0x0, &(0x7f0000000900)) syz_genetlink_get_family_id$nl802154(&(0x7f0000000200), 0xffffffffffffffff) socket(0x8, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000180)={'wpan1\x00'}) getpid() mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r0, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) kernel console output (not intermixed with test programs): [ T24] dvb-usb: bulk message failed: -22 (2/0) [ 926.210230][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 926.220852][ T7768] usb 3-1: SerialNumber: syz [ 926.228713][ T24] (NULL device *): no alternate interface [ 926.245167][ T7768] usb 3-1: config 0 descriptor?? [ 926.268165][T16518] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 926.276120][T16518] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 926.287788][ T7768] usb 3-1: ucan: probing device on interface #0 [ 926.310911][ T24] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 926.325523][ T24] usb 6-1: USB disconnect, device number 30 [ 926.492773][ T7768] usb 3-1: ucan: could not read protocol version, ret=0 [ 926.500020][ T7768] usb 3-1: ucan: probe failed; try to update the device firmware [ 926.619655][ T6909] bond1 (unregistering): (slave bridge5): Releasing active interface [ 926.686751][ T7767] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 926.880355][ T7767] usb 4-1: Using ep0 maxpacket: 8 [ 926.950280][ T7767] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 926.979309][ T7767] usb 4-1: New USB device found, idVendor=1b1c, idProduct=1b09, bcdDevice= 0.00 [ 927.006649][ T7767] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 927.047578][ T7767] usb 4-1: config 0 descriptor?? [ 927.235501][ T5828] usb 3-1: USB disconnect, device number 83 [ 927.337222][ T6909] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 927.347753][ T6909] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 927.357914][ T6909] bond0 (unregistering): (slave team0): Releasing backup interface [ 927.368537][ T6909] bond0 (unregistering): Released all slaves [ 927.385377][ T6909] bond1 (unregistering): Released all slaves [ 927.570104][T16527] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2835'. [ 927.606603][ T7767] corsair 0003:1B1C:1B09.0012: hidraw0: USB HID v0.00 Device [HID 1b1c:1b09] on usb-dummy_hcd.3-1/input0 [ 928.104166][ T6909] : left promiscuous mode [ 928.192851][ T7767] usb 4-1: USB disconnect, device number 75 [ 928.257016][ T53] Bluetooth: hci0: command tx timeout [ 928.304233][ T6909] tipc: Left network mode [ 928.781587][ T6909] IPVS: stopping backup sync thread 7071 ... [ 928.912123][T16489] chnl_net:caif_netlink_parms(): no params data found [ 929.718482][T16489] bridge0: port 1(bridge_slave_0) entered blocking state [ 929.744972][T16489] bridge0: port 1(bridge_slave_0) entered disabled state [ 929.772108][T16489] bridge_slave_0: entered allmulticast mode [ 929.795956][T16489] bridge_slave_0: entered promiscuous mode [ 930.298702][T16489] bridge0: port 2(bridge_slave_1) entered blocking state [ 930.322074][T16489] bridge0: port 2(bridge_slave_1) entered disabled state [ 930.333325][T16489] bridge_slave_1: entered allmulticast mode [ 930.347960][ T53] Bluetooth: hci0: command tx timeout [ 930.381945][T16489] bridge_slave_1: entered promiscuous mode [ 930.460271][ T30] audit: type=1400 audit(1764021241.774:1423): avc: denied { shutdown } for pid=16575 comm="syz.3.2843" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 930.491661][T16586] overlayfs: missing 'lowerdir' [ 931.540837][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.112638][ T30] audit: type=1400 audit(1764021243.244:1424): avc: denied { append } for pid=16588 comm="syz.6.2845" name="sg0" dev="devtmpfs" ino=791 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 932.148000][T16489] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 932.187764][T16587] bridge8: entered promiscuous mode [ 932.486718][ T53] Bluetooth: hci0: command tx timeout [ 933.012094][T16489] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 933.213341][T16489] team0: Port device team_slave_0 added [ 933.284308][ T6909] hsr_slave_0: left promiscuous mode [ 933.303295][ T6909] hsr_slave_1: left promiscuous mode [ 933.400264][ T24] usb 3-1: new high-speed USB device number 84 using dummy_hcd [ 933.400873][ T6909] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 933.437135][ T6909] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 933.466127][ T7767] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 933.585098][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 933.596950][ T24] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 933.613161][ T24] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 933.640043][ T24] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 933.654770][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 933.669155][ T7767] usb 4-1: unable to get BOS descriptor or descriptor too short [ 933.687688][ T24] usb 3-1: Product: syz [ 933.688232][ T7767] usb 4-1: config 129 has an invalid interface number: 135 but max is 0 [ 933.735042][ T24] usb 3-1: Manufacturer: syz [ 933.743644][ T24] usb 3-1: SerialNumber: syz [ 933.763775][ T7767] usb 4-1: config 129 has an invalid interface number: 5 but max is 0 [ 933.804327][ T24] usb 3-1: config 0 descriptor?? [ 933.809763][ T7767] usb 4-1: config 129 has an invalid descriptor of length 0, skipping remainder of the config [ 933.825696][ T7767] usb 4-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 933.835870][T16608] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 933.843408][T16608] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 933.851994][ T24] usb 3-1: ucan: probing device on interface #0 [ 933.866942][ T7767] usb 4-1: config 129 has no interface number 0 [ 933.883857][ T7767] usb 4-1: config 129 has no interface number 1 [ 933.896947][ T7767] usb 4-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 933.939168][ T7767] usb 4-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 933.974493][ T7767] usb 4-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 933.994327][ T7767] usb 4-1: config 129 interface 135 has no altsetting 0 [ 934.004037][ T7767] usb 4-1: config 129 interface 5 has no altsetting 0 [ 934.020608][ T7767] usb 4-1: string descriptor 0 read error: -22 [ 934.027383][ T7767] usb 4-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.62 [ 934.040200][ T7767] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.054510][ T24] usb 3-1: ucan: could not read protocol version, ret=0 [ 934.062406][ T24] usb 3-1: ucan: probe failed; try to update the device firmware [ 934.083790][ T7767] usb 4-1: Quirk or no altset; falling back to MIDI 1.0 [ 934.101989][ T7767] usb 4-1: MIDIStreaming interface descriptor not found [ 934.275848][ T5973] usb 7-1: new high-speed USB device number 9 using dummy_hcd [ 934.616642][ T5973] usb 7-1: Using ep0 maxpacket: 16 [ 934.636618][ T5973] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 934.694860][ T5975] usb 3-1: USB disconnect, device number 84 [ 934.704915][ T5973] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 934.730813][ T5973] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 934.746737][ T5973] usb 7-1: Product: syz [ 934.754236][ T5973] usb 7-1: Manufacturer: syz [ 934.760583][ T5973] usb 7-1: SerialNumber: syz [ 934.776112][ T5973] usb 7-1: config 0 descriptor?? [ 934.789613][ T5973] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 934.801054][ T5973] em28xx 7-1:0.0: DVB interface 0 found: bulk [ 935.002014][T16632] netlink: 4 bytes leftover after parsing attributes in process `syz.3.2850'. [ 935.129347][ T6909] team0 (unregistering): Port device team_slave_1 removed [ 935.209819][ T6909] team0 (unregistering): Port device team_slave_0 removed [ 935.474088][T16637] overlayfs: missing 'lowerdir' [ 936.076980][ T5973] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 936.320499][ T5973] em28xx 7-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 936.341029][ T5973] em28xx 7-1:0.0: board has no eeprom [ 936.410277][ T5973] em28xx 7-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 936.419970][ T5973] em28xx 7-1:0.0: dvb set to bulk mode. [ 936.433953][ T5975] em28xx 7-1:0.0: Binding DVB extension [ 936.572270][ T5975] em28xx 7-1:0.0: Registering input extension [ 936.713998][ T6909] team0 (unregistering): Port device dummy0 removed [ 936.926712][ T6909] lo (unregistering): left allmulticast mode [ 936.943167][T16489] team0: Port device team_slave_1 added [ 936.963000][T16614] netlink: 28 bytes leftover after parsing attributes in process `syz.3.2850'. [ 936.975944][T16631] hsr0: entered promiscuous mode [ 936.982606][T16632] hsr_slave_0: left promiscuous mode [ 936.989549][T16632] hsr_slave_1: left promiscuous mode [ 937.017182][T16632] hsr0 (unregistering): left promiscuous mode [ 937.059175][T16637] bridge9: entered promiscuous mode [ 937.069168][ T5975] usb 7-1: USB disconnect, device number 9 [ 937.075734][ T5975] em28xx 7-1:0.0: Disconnecting em28xx [ 937.109410][ T5975] em28xx 7-1:0.0: Closing input extension [ 937.149771][ T7767] usb 4-1: USB disconnect, device number 76 [ 937.225776][T16489] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 937.232985][ T5975] em28xx 7-1:0.0: Freeing device [ 937.329857][T16489] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 937.669926][T16648] netlink: 408 bytes leftover after parsing attributes in process `syz.2.2856'. [ 937.684907][T16489] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 937.757690][T16489] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 937.768343][T16489] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 937.797777][ C0] vkms_vblank_simulate: vblank timer overrun [ 937.801509][ T30] audit: type=1326 audit(1764021249.174:1425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f072258f749 code=0x7ffc0000 [ 938.162740][T16489] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 938.202106][ T30] audit: type=1326 audit(1764021249.174:1426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f072258f749 code=0x7ffc0000 [ 938.369862][ T30] audit: type=1326 audit(1764021249.534:1427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f072258df90 code=0x7ffc0000 [ 938.442046][ T30] audit: type=1326 audit(1764021249.534:1428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f0722590f77 code=0x7ffc0000 [ 938.501930][ T30] audit: type=1326 audit(1764021249.534:1429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f072258f749 code=0x7ffc0000 [ 938.532106][ T30] audit: type=1326 audit(1764021249.534:1430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f0722590f77 code=0x7ffc0000 [ 938.579539][ T30] audit: type=1326 audit(1764021249.534:1431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=3 compat=0 ip=0x7f072258e3aa code=0x7ffc0000 [ 938.617868][T16489] hsr_slave_0: entered promiscuous mode [ 938.659983][T16489] hsr_slave_1: entered promiscuous mode [ 938.702313][T16489] debugfs: 'hsr0' already exists in 'hsr' [ 938.768767][ T30] audit: type=1326 audit(1764021249.534:1432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f072258f749 code=0x7ffc0000 [ 938.869623][T16489] Cannot create hsr debugfs directory [ 938.889935][ T30] audit: type=1326 audit(1764021249.534:1433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f072258f749 code=0x7ffc0000 [ 939.244508][ T30] audit: type=1326 audit(1764021249.564:1434): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16642 comm="syz.2.2856" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7f072258f749 code=0x7ffc0000 [ 939.506907][ T6909] IPVS: stop unused estimator thread 0... [ 940.565840][T16489] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 940.601282][T16489] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 940.637436][T16489] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 940.660864][T16489] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 940.679040][ T7767] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 940.790489][ T5975] usb 4-1: new high-speed USB device number 77 using dummy_hcd [ 940.853104][ T7767] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 940.884052][ T7767] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 940.919181][ T7767] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 940.929655][T16489] 8021q: adding VLAN 0 to HW filter on device bond0 [ 940.938946][ T7767] usb 6-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 940.959465][ T5975] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 940.979307][ T7767] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.005650][T16489] 8021q: adding VLAN 0 to HW filter on device team0 [ 941.025350][ T7767] usb 6-1: Product: syz [ 941.026760][ T5975] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 941.036683][ T7767] usb 6-1: Manufacturer: syz [ 941.054794][ T6909] bridge0: port 1(bridge_slave_0) entered blocking state [ 941.062061][ T6909] bridge0: port 1(bridge_slave_0) entered forwarding state [ 941.070158][ T7767] usb 6-1: SerialNumber: syz [ 941.073524][ T5975] usb 4-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 941.084581][ T5975] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 941.090060][ T7767] usb 6-1: config 0 descriptor?? [ 941.095464][ T5975] usb 4-1: Product: syz [ 941.116582][T13731] bridge0: port 2(bridge_slave_1) entered blocking state [ 941.123815][T13731] bridge0: port 2(bridge_slave_1) entered forwarding state [ 941.129830][T16686] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 941.138512][T16686] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 941.147452][ T7767] usb 6-1: ucan: probing device on interface #0 [ 941.153582][ T5975] usb 4-1: Manufacturer: syz [ 941.160344][ T5975] usb 4-1: SerialNumber: syz [ 941.192833][ T5975] usb 4-1: config 0 descriptor?? [ 941.209122][T16688] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 941.217017][T16688] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 941.331020][T16713] netlink: 4 bytes leftover after parsing attributes in process `syz.2.2865'. [ 941.358550][ T7767] usb 6-1: ucan: could not read protocol version, ret=0 [ 941.365547][ T7767] usb 6-1: ucan: probe failed; try to update the device firmware [ 942.102583][T16688] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 942.135862][ T7767] usb 6-1: USB disconnect, device number 31 [ 942.143309][T16688] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 942.584639][ T5975] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 942.600386][T16489] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 942.792333][ T5975] dm9601 4-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 943.022792][ T5975] usb 4-1: USB disconnect, device number 77 [ 944.100626][T16489] veth0_vlan: entered promiscuous mode [ 944.269917][T16489] veth1_vlan: entered promiscuous mode [ 944.787192][T16766] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 945.031258][T16489] veth0_macvtap: entered promiscuous mode [ 945.097974][T16489] veth1_macvtap: entered promiscuous mode [ 945.217745][T16489] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 945.245868][T16489] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 945.273004][T14446] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 945.760435][ T30] kauditd_printk_skb: 6 callbacks suppressed [ 945.760470][ T30] audit: type=1400 audit(1764021257.024:1441): avc: denied { read } for pid=16772 comm="syz.5.2876" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 945.925404][ T30] audit: type=1400 audit(1764021257.084:1442): avc: denied { shutdown } for pid=16772 comm="syz.5.2876" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 945.956930][T14446] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 946.013078][ T6909] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 946.023865][ T6909] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 946.279888][T16780] xt_TPROXY: Can be used only with -p tcp or -p udp [ 946.291055][T16786] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2880'. [ 946.413611][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 946.424418][T16788] netlink: 28 bytes leftover after parsing attributes in process `syz.5.2879'. [ 946.433806][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 946.476065][T16788] netlink: 'syz.5.2879': attribute type 7 has an invalid length. [ 946.509824][T16788] netlink: 'syz.5.2879': attribute type 8 has an invalid length. [ 946.548594][ T6909] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 946.564989][T16788] netlink: 4 bytes leftover after parsing attributes in process `syz.5.2879'. [ 946.578953][ T6909] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 946.596805][ T7767] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 946.776656][ T7767] usb 4-1: Using ep0 maxpacket: 8 [ 946.818587][ T7767] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 947.007840][ T7767] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 947.550476][ T7767] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 947.570938][ T7767] usb 4-1: Product: syz [ 947.584059][ T7767] usb 4-1: Manufacturer: syz [ 947.611845][ T7767] usb 4-1: SerialNumber: syz [ 947.660691][ T7767] usb 4-1: config 0 descriptor?? [ 947.788645][ T7767] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 947.831066][ T7767] usb 4-1: setting power ON [ 947.835649][ T7767] dvb-usb: bulk message failed: -22 (2/0) [ 947.870035][ T7767] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 947.919645][ T7767] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 947.948843][ T7767] usb 4-1: media controller created [ 948.172775][ T7767] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 948.313668][T16813] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2885'. [ 948.878896][ T7767] usb 4-1: selecting invalid altsetting 6 [ 949.066063][ T7767] usb 4-1: digital interface selection failed (-22) [ 949.176658][ T7767] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 949.251283][T16820] dvb-usb: bulk message failed: -22 (3/0) [ 949.303148][ T7767] usb 4-1: setting power OFF [ 949.321860][T16820] cxusb: i2c wr: len=2053 is too big! [ 949.321860][T16820] [ 949.321874][ T7767] dvb-usb: bulk message failed: -22 (2/0) [ 949.336145][ T7767] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 949.347720][ T7767] (NULL device *): no alternate interface [ 949.383122][T16823] netlink: 32 bytes leftover after parsing attributes in process `syz.7.2888'. [ 949.580605][ T7767] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 949.781714][ T7767] usb 4-1: USB disconnect, device number 78 [ 951.940982][ T30] audit: type=1400 audit(1764021263.244:1443): avc: denied { append } for pid=16843 comm="syz.7.2893" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 953.256644][ T5973] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 953.266719][ T5828] usb 3-1: new high-speed USB device number 85 using dummy_hcd [ 953.443959][T16874] tipc: New replicast peer: 255.255.255.255 [ 953.451787][T16874] tipc: Enabled bearer , priority 10 [ 953.665331][ T5973] usb 6-1: config 0 has an invalid interface number: 133 but max is 0 [ 953.726834][ T5828] usb 3-1: Using ep0 maxpacket: 16 [ 953.779820][ T5973] usb 6-1: config 0 has no interface number 0 [ 953.796824][ T5828] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 953.822507][ T5973] usb 6-1: New USB device found, idVendor=203e, idProduct=8888, bcdDevice=a8.71 [ 953.837283][ T5828] usb 3-1: config 0 has no interface number 0 [ 953.849877][ T5973] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 953.863510][ T5828] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 953.893882][ T5973] usb 6-1: Product: syz [ 953.905438][ T5828] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 953.916004][ T5973] usb 6-1: Manufacturer: syz [ 953.930218][ T5973] usb 6-1: SerialNumber: syz [ 953.940414][ T5828] usb 3-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 953.956053][ T5973] usb 6-1: config 0 descriptor?? [ 953.969093][ T5828] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 954.001995][T16886] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2899'. [ 954.007772][ T5973] usb-storage 6-1:0.133: USB Mass Storage device detected [ 954.023971][T16886] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2899'. [ 954.033538][T16886] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2899'. [ 954.121640][ T5828] usb 3-1: config 0 descriptor?? [ 954.200011][T16891] netlink: 'syz.6.2901': attribute type 11 has an invalid length. [ 954.257002][T16891] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2901'. [ 954.352884][T16898] overlayfs: missing 'lowerdir' [ 954.463280][T16898] bridge5: entered promiscuous mode [ 954.535532][T16897] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2895'. [ 955.106888][ T5973] usb 6-1: USB disconnect, device number 32 [ 955.604719][ T30] audit: type=1326 audit(1764021266.974:1444): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=16908 comm="syz.3.2903" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8403d8f749 code=0x0 [ 955.640587][ T5828] usbhid 3-1:0.1: can't add hid device: -71 [ 955.646801][ T5828] usbhid 3-1:0.1: probe with driver usbhid failed with error -71 [ 955.702113][ T5828] usb 3-1: USB disconnect, device number 85 [ 956.015513][T16924] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2906'. [ 957.359936][T16937] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 957.516739][ T53] Bluetooth: hci5: SCO packet for unknown connection handle 395 [ 958.690783][T16948] vivid-002: kernel_thread() failed [ 958.901261][T16951] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2913'. [ 959.160771][T16954] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2908'. [ 959.270553][T16955] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2908'. [ 959.541999][T16955] xt_hashlimit: overflow, try lower: 17592186044416/11 [ 961.437292][ T5905] usb 7-1: new high-speed USB device number 10 using dummy_hcd [ 961.796753][ T5905] usb 7-1: Using ep0 maxpacket: 8 [ 961.809812][ T5905] usb 7-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 961.830587][ T5905] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 961.849973][ T5905] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 962.089273][ T30] audit: type=1400 audit(1764021273.464:1445): avc: denied { bind } for pid=16984 comm="syz.2.2921" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 962.696842][ T7768] usb 3-1: new high-speed USB device number 86 using dummy_hcd [ 962.838665][T17001] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 962.869058][T17001] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 962.888616][T17005] IPv6: Can't replace route, no match found [ 962.926630][ T5905] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 963.006623][ T7768] usb 3-1: Using ep0 maxpacket: 16 [ 963.018657][ T7768] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 963.098354][ T5905] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 963.115201][ T5905] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 963.116736][ T7768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 963.158455][ T5905] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 963.173029][ T7768] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 963.185539][ T7768] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 963.198770][ T7768] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 963.415528][ T7768] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 963.419374][ T5905] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 963.436315][ T5905] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 963.440718][T17017] netlink: 220 bytes leftover after parsing attributes in process `syz.7.2918'. [ 963.457103][ T7768] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 963.476735][ T5905] usb 4-1: Product: syz [ 963.481210][ T5905] usb 4-1: Manufacturer: syz [ 963.484943][ T7768] usb 3-1: Manufacturer: syz [ 963.497034][ T5905] usb 4-1: SerialNumber: syz [ 963.612884][ T5905] usb 4-1: config 0 descriptor?? [ 963.615796][ T7768] usb 3-1: config 0 descriptor?? [ 963.625439][T16996] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 963.646855][T16996] raw-gadget.1 gadget.3: fail, usb_ep_enable returned -22 [ 963.662736][ T5905] usb 4-1: ucan: probing device on interface #0 [ 963.862970][ T5905] usb 4-1: ucan: could not read protocol version, ret=0 [ 963.879479][ T5905] usb 4-1: ucan: probe failed; try to update the device firmware [ 963.919489][T17029] netlink: 28 bytes leftover after parsing attributes in process `syz.7.2928'. [ 963.957418][ T7768] rc_core: IR keymap rc-hauppauge not found [ 963.963336][ T7768] Registered IR keymap rc-empty [ 963.975147][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.027623][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.125538][ T7768] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 964.504445][ T7768] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input29 [ 964.522168][ T30] audit: type=1400 audit(1764021275.894:1446): avc: denied { write } for pid=17028 comm="syz.7.2928" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 964.565705][ T5889] usb 7-1: USB disconnect, device number 10 [ 964.586637][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.616761][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.627388][ T5905] usb 4-1: USB disconnect, device number 79 [ 964.657317][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.678766][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.706703][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.737709][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 964.768017][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 965.132312][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 965.526809][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 965.562237][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 965.660613][ T7768] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 965.688924][ T7768] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 965.707085][ T7768] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 966.237352][ T7768] usb 3-1: USB disconnect, device number 86 [ 966.654913][T17075] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2934'. [ 967.155670][T17081] rdma_rxe: rxe_newlink: failed to add ipvlan0 [ 969.576810][ T5828] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 969.846793][ T5828] usb 4-1: Using ep0 maxpacket: 8 [ 969.899213][ T5828] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 969.969218][ T5828] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 970.156644][ T5828] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 970.195472][ T5828] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 970.270086][ T5828] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 970.296651][ T5828] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 970.306606][ T7768] usb 7-1: new high-speed USB device number 11 using dummy_hcd [ 970.327379][ T5828] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 970.525453][ T5828] usb 4-1: config 0 descriptor?? [ 970.965712][ T7768] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 970.966739][T17128] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 971.010514][ T7768] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 971.090461][ T7768] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 971.105344][ T7768] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 971.128179][ T7768] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 971.184728][ T7768] usb 7-1: Product: syz [ 971.229048][ T7768] usb 7-1: Manufacturer: syz [ 971.233699][ T7768] usb 7-1: SerialNumber: syz [ 971.253125][ T7768] usb 7-1: config 0 descriptor?? [ 971.269743][ T53] Bluetooth: hci3: Opcode 0x0c03 failed: -71 [ 971.271446][ T24] usb 4-1: USB disconnect, device number 80 [ 971.298382][T17148] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 971.305685][T17148] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 971.432734][ T7768] usb 7-1: ucan: probing device on interface #0 [ 972.025896][ T7768] usb 7-1: ucan: could not read protocol version, ret=0 [ 972.049485][ T7768] usb 7-1: ucan: probe failed; try to update the device firmware [ 972.407079][ T24] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 972.824660][ T5828] usb 7-1: USB disconnect, device number 11 [ 974.785499][T17191] mac80211_hwsim hwsim20 wlan1: entered allmulticast mode [ 974.922205][T17194] netlink: 'syz.6.2961': attribute type 29 has an invalid length. [ 974.979631][T17195] netlink: 92 bytes leftover after parsing attributes in process `syz.6.2961'. [ 975.036637][ T5889] usb 3-1: new low-speed USB device number 87 using dummy_hcd [ 975.062728][T17194] netlink: 'syz.6.2961': attribute type 29 has an invalid length. [ 975.101018][T17195] netlink: 500 bytes leftover after parsing attributes in process `syz.6.2961'. [ 975.181367][ T5889] usb 3-1: device descriptor read/64, error -71 [ 975.246893][T17195] unsupported nla_type 58 [ 975.336009][T17194] bridge_slave_0: left allmulticast mode [ 975.364083][T17194] bridge_slave_0: left promiscuous mode [ 975.401334][T17194] bridge0: port 1(bridge_slave_0) entered disabled state [ 975.436660][ T5889] usb 3-1: new low-speed USB device number 88 using dummy_hcd [ 975.476468][T17194] bridge_slave_1: left allmulticast mode [ 975.506340][T17194] bridge_slave_1: left promiscuous mode [ 975.536982][T17194] bridge0: port 2(bridge_slave_1) entered disabled state [ 975.565130][T17194] bond0: (slave bond_slave_0): Releasing backup interface [ 975.576715][ T5889] usb 3-1: device descriptor read/64, error -71 [ 975.668490][T17194] team0: Port device team_slave_0 removed [ 975.700072][T17194] team0: Port device team_slave_1 removed [ 975.737125][ T5889] usb usb3-port1: attempt power cycle [ 975.771533][T17194] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 975.774090][T17205] binder: 17204:17205 ioctl 5201 0 returned -22 [ 975.840095][T17194] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 975.901837][T17207] xt_addrtype: both incoming and outgoing interface limitation cannot be selected [ 975.955720][T17194] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 976.137291][ T5889] usb 3-1: new low-speed USB device number 89 using dummy_hcd [ 976.203481][T17194] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 976.249721][ T5889] usb 3-1: device descriptor read/8, error -71 [ 976.487001][ T5889] usb 3-1: new low-speed USB device number 90 using dummy_hcd [ 976.654020][T17194] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 976.697377][ T5889] usb 3-1: device descriptor read/8, error -71 [ 976.731294][T17212] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2965'. [ 976.827755][ T5889] usb usb3-port1: unable to enumerate USB device [ 977.664635][T17228] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 979.249627][T17235] netlink: 220 bytes leftover after parsing attributes in process `syz.6.2972'. [ 980.675029][T16115] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 980.687087][T16115] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 980.696969][T16115] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 980.706749][T16115] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 980.715553][T16115] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 980.781387][T17250] lo speed is unknown, defaulting to 1000 [ 980.788464][T17255] syzkaller1: entered promiscuous mode [ 980.794983][T17255] syzkaller1: entered allmulticast mode [ 980.969979][T17255] lo speed is unknown, defaulting to 1000 [ 980.996748][ T5973] usb 6-1: new high-speed USB device number 33 using dummy_hcd [ 981.146839][ T5973] usb 6-1: Using ep0 maxpacket: 8 [ 981.154061][ T5973] usb 6-1: config index 0 descriptor too short (expected 30, got 18) [ 981.167220][ T5973] usb 6-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 981.176718][ T5973] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 981.184731][ T5973] usb 6-1: Product: syz [ 981.195941][ T5973] usb 6-1: Manufacturer: syz [ 981.206634][ T5973] usb 6-1: SerialNumber: syz [ 981.215022][ T5973] usb 6-1: config 0 descriptor?? [ 981.224604][ T5973] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 981.242012][ T5973] usb 6-1: setting power ON [ 981.252150][ T5973] dvb-usb: bulk message failed: -22 (2/0) [ 981.276004][ T5973] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 981.293583][T17250] chnl_net:caif_netlink_parms(): no params data found [ 981.302257][ T5973] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 981.313276][T17261] usb usb8: usbfs: process 17261 (syz.6.2978) did not claim interface 0 before use [ 981.313423][ T5973] usb 6-1: media controller created [ 981.359297][ T5973] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 981.423974][ T5973] usb 6-1: selecting invalid altsetting 6 [ 981.435370][ T5973] usb 6-1: digital interface selection failed (-22) [ 981.445231][ T5973] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 981.469442][ T5973] usb 6-1: setting power OFF [ 981.478855][ T5973] dvb-usb: bulk message failed: -22 (2/0) [ 981.494896][ T5973] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 981.536200][ T5973] (NULL device *): no alternate interface [ 981.591255][T17272] dvb-usb: bulk message failed: -22 (3/0) [ 981.611171][T17272] cxusb: i2c wr: len=2053 is too big! [ 981.611171][T17272] [ 981.795690][T17250] bridge0: port 1(bridge_slave_0) entered blocking state [ 981.803545][T17250] bridge0: port 1(bridge_slave_0) entered disabled state [ 981.814153][T17250] bridge_slave_0: entered allmulticast mode [ 981.835861][T17250] bridge_slave_0: entered promiscuous mode [ 981.852517][T17250] bridge0: port 2(bridge_slave_1) entered blocking state [ 981.863297][T17250] bridge0: port 2(bridge_slave_1) entered disabled state [ 981.871654][T17250] bridge_slave_1: entered allmulticast mode [ 981.881675][T17250] bridge_slave_1: entered promiscuous mode [ 982.842448][T16115] Bluetooth: hci1: command tx timeout [ 983.190679][T17250] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 983.229692][T17250] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 983.274788][T17284] Bluetooth: MGMT ver 1.23 [ 983.285831][T17250] team0: Port device team_slave_0 added [ 983.295110][T17250] team0: Port device team_slave_1 added [ 983.324931][T17250] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 983.336999][T17250] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 983.363945][T17250] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 983.378724][T17250] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 983.385775][T17250] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 983.413528][T17250] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 983.451470][T17250] hsr_slave_0: entered promiscuous mode [ 983.457684][ T5889] usb 7-1: new high-speed USB device number 12 using dummy_hcd [ 983.458687][T17250] hsr_slave_1: entered promiscuous mode [ 983.472731][T17250] debugfs: 'hsr0' already exists in 'hsr' [ 983.478646][T17250] Cannot create hsr debugfs directory [ 983.594118][T17250] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.607871][T17250] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 20001 - 0 [ 983.630629][ T5889] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 983.640889][ T5889] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 983.652521][ T5889] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 983.671580][ T5889] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 983.680865][ T5889] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 983.689084][ T5889] usb 7-1: Product: syz [ 983.694174][ T5889] usb 7-1: Manufacturer: syz [ 983.700050][ T5889] usb 7-1: SerialNumber: syz [ 983.709649][ T5889] usb 7-1: config 0 descriptor?? [ 983.716931][T17282] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 983.724538][T17282] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 983.737831][T17250] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.749633][ T5889] usb 7-1: ucan: probing device on interface #0 [ 983.751049][T17250] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 20001 - 0 [ 983.848058][T17250] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 983.859668][T17250] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 20001 - 0 [ 983.974230][ T5889] usb 7-1: ucan: could not read protocol version, ret=0 [ 983.981418][ T5889] usb 7-1: ucan: probe failed; try to update the device firmware [ 984.097863][T17288] netlink: 16 bytes leftover after parsing attributes in process `syz.3.2984'. [ 984.452399][T17250] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 984.492827][T17250] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 20001 - 0 [ 984.897291][T16115] Bluetooth: hci1: command tx timeout [ 984.965513][ T5828] usb 7-1: USB disconnect, device number 12 [ 985.441586][T17250] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 985.452761][T17250] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 985.484589][T17250] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 985.495221][T17250] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 985.719575][T17303] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2986'. [ 985.746679][T17303] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2986'. [ 986.108589][T17250] 8021q: adding VLAN 0 to HW filter on device bond0 [ 986.126108][T17250] 8021q: adding VLAN 0 to HW filter on device team0 [ 986.137406][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 986.144567][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 986.158799][T14446] bridge0: port 2(bridge_slave_1) entered blocking state [ 986.165911][T14446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 987.110575][T16115] Bluetooth: hci1: command tx timeout [ 987.286947][T17318] netlink: 220 bytes leftover after parsing attributes in process `syz.3.2989'. [ 987.600887][T17250] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 987.721650][T17250] veth0_vlan: entered promiscuous mode [ 987.751653][T17250] veth1_vlan: entered promiscuous mode [ 988.202368][T17250] veth0_macvtap: entered promiscuous mode [ 988.268702][T17250] veth1_macvtap: entered promiscuous mode [ 988.306214][T17250] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 988.319785][T17250] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 988.482855][ T69] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 988.525671][T14446] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 988.578604][T14446] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 988.614436][T14446] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 988.726271][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 988.747304][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 988.978523][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 988.996289][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 989.206338][T16115] Bluetooth: hci1: command tx timeout [ 990.058505][T17354] netlink: 256 bytes leftover after parsing attributes in process `syz.2.2970'. [ 990.119047][T17354] netlink: 64 bytes leftover after parsing attributes in process `syz.2.2970'. [ 990.137766][T17356] netlink: 96 bytes leftover after parsing attributes in process `syz.3.2999'. [ 990.616827][ T5905] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 990.657136][ T24] usb 3-1: new high-speed USB device number 91 using dummy_hcd [ 990.766657][ T5905] usb 7-1: Using ep0 maxpacket: 16 [ 990.791893][ T5905] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 990.805431][ T5905] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 990.817340][ T5905] usb 7-1: New USB device found, idVendor=0458, idProduct=5016, bcdDevice= 0.00 [ 991.257363][ T5905] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 991.277127][ T5905] usb 7-1: config 0 descriptor?? [ 991.280816][ T24] usb 3-1: config 0 has an invalid interface number: 133 but max is 0 [ 991.299766][ T24] usb 3-1: config 0 has no interface number 0 [ 991.310693][ T24] usb 3-1: New USB device found, idVendor=203e, idProduct=8888, bcdDevice=a8.71 [ 991.325839][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 991.336662][ T24] usb 3-1: Product: syz [ 991.340966][ T24] usb 3-1: Manufacturer: syz [ 991.347014][ T24] usb 3-1: SerialNumber: syz [ 991.357034][ T24] usb 3-1: config 0 descriptor?? [ 991.368670][ T24] usb-storage 3-1:0.133: USB Mass Storage device detected [ 991.755594][T17380] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3001'. [ 992.233888][T17384] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 992.980855][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.244641][ T5905] usbhid 7-1:0.0: can't add hid device: -71 [ 993.250691][ T5905] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 993.262337][ T5905] usb 7-1: USB disconnect, device number 13 [ 993.805845][T17393] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3007'. [ 994.171819][T17396] netlink: 220 bytes leftover after parsing attributes in process `syz.6.3008'. [ 994.986616][T15645] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 995.136595][T15645] usb 4-1: Using ep0 maxpacket: 8 [ 995.152930][T15645] usb 4-1: config 150 has an invalid interface number: 204 but max is 1 [ 995.161491][T15645] usb 4-1: config 150 has no interface number 0 [ 995.177186][T15645] usb 4-1: config 150 interface 204 has no altsetting 0 [ 995.210140][T15645] usb 4-1: config 150 interface 1 has no altsetting 0 [ 995.229713][T15645] usb 4-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=c7.eb [ 995.243969][T15645] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 995.252719][T15645] usb 4-1: Product: syz [ 995.257270][T15645] usb 4-1: Manufacturer: syz [ 995.277237][T15645] usb 4-1: SerialNumber: syz [ 995.372844][ T5889] usb 3-1: USB disconnect, device number 91 [ 995.534972][T15645] xr_serial 4-1:150.204: xr_serial converter detected [ 995.543434][T15645] xr_serial ttyUSB0: Failed to set reg 0x60: -71 [ 995.550223][T15645] xr_serial ttyUSB0: probe with driver xr_serial failed with error -71 [ 995.564410][T15645] usb 4-1: USB disconnect, device number 82 [ 995.576385][T15645] xr_serial 4-1:150.204: device disconnected [ 995.988710][ T53] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 995.999431][ T53] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 996.010849][ T53] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 996.020554][ T53] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 996.028452][ T53] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 996.066080][T17422] lo speed is unknown, defaulting to 1000 [ 996.252584][T17422] chnl_net:caif_netlink_parms(): no params data found [ 996.513719][T17433] netlink: 32 bytes leftover after parsing attributes in process `syz.3.3018'. [ 996.526977][ T30] audit: type=1400 audit(1764021307.864:1447): avc: denied { ioctl } for pid=17424 comm="syz.3.3018" path="socket:[61565]" dev="sockfs" ino=61565 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 996.551820][ C0] vkms_vblank_simulate: vblank timer overrun [ 996.677042][T17422] bridge0: port 1(bridge_slave_0) entered blocking state [ 996.684193][T17422] bridge0: port 1(bridge_slave_0) entered disabled state [ 996.696222][T17422] bridge_slave_0: entered allmulticast mode [ 996.708479][T17422] bridge_slave_0: entered promiscuous mode [ 996.719698][T17422] bridge0: port 2(bridge_slave_1) entered blocking state [ 996.730973][T17422] bridge0: port 2(bridge_slave_1) entered disabled state [ 996.740298][T17422] bridge_slave_1: entered allmulticast mode [ 996.748316][T17422] bridge_slave_1: entered promiscuous mode [ 996.927998][T17422] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 997.013639][T17422] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 997.058823][T17422] team0: Port device team_slave_0 added [ 997.077780][T17422] team0: Port device team_slave_1 added [ 997.145882][T17422] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 997.160313][T17422] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 997.187310][ C0] vkms_vblank_simulate: vblank timer overrun [ 997.195573][T17422] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 997.216851][T17422] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 997.236434][T17422] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 997.306648][T17422] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 997.397715][T17422] hsr_slave_0: entered promiscuous mode [ 997.404895][T17422] hsr_slave_1: entered promiscuous mode [ 997.412523][T17422] debugfs: 'hsr0' already exists in 'hsr' [ 997.418704][T17422] Cannot create hsr debugfs directory [ 998.107691][T16115] Bluetooth: hci3: command tx timeout [ 998.325490][T17422] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 998.634960][T17422] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 998.754618][T17422] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 999.330592][T17422] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 999.522615][T17457] binder: BINDER_SET_CONTEXT_MGR already set [ 999.528949][T17457] binder: 17454:17457 ioctl 4018620d 200000000040 returned -16 [ 999.574244][T17456] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=17456 comm=syz.2.3024 [ 1000.001644][T17422] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1000.025565][T17422] 8021q: adding VLAN 0 to HW filter on device team0 [ 1000.040842][ T6905] bridge0: port 1(bridge_slave_0) entered blocking state [ 1000.048122][ T6905] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1000.125494][T17475] netlink: 16 bytes leftover after parsing attributes in process `syz.2.3027'. [ 1000.492236][T16115] Bluetooth: hci3: command tx timeout [ 1000.633518][ T6909] bridge0: port 2(bridge_slave_1) entered blocking state [ 1000.640800][ T6909] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1001.486707][ T30] audit: type=1400 audit(1764021312.854:1448): avc: denied { create } for pid=17488 comm="syz.7.3031" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 1001.571627][ T30] audit: type=1400 audit(1764021312.934:1449): avc: denied { sys_admin } for pid=17488 comm="syz.7.3031" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 1001.676646][ T30] audit: type=1400 audit(1764021313.014:1450): avc: denied { unmount } for pid=17250 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 1001.841926][T17422] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1002.422195][T17500] netlink: 220 bytes leftover after parsing attributes in process `syz.7.3033'. [ 1002.578928][T16115] Bluetooth: hci3: command tx timeout [ 1002.813348][T17422] veth0_vlan: entered promiscuous mode [ 1002.874144][T17422] veth1_vlan: entered promiscuous mode [ 1002.976485][T17422] veth0_macvtap: entered promiscuous mode [ 1003.024665][T17422] veth1_macvtap: entered promiscuous mode [ 1003.100937][T17422] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1003.135530][T17422] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1003.211242][T13731] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.226147][T13731] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.483284][T14446] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.516752][T15645] usb 7-1: new high-speed USB device number 14 using dummy_hcd [ 1003.536620][T14446] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1003.754178][T15645] usb 7-1: Using ep0 maxpacket: 32 [ 1003.895793][T15645] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1004.002876][T15645] usb 7-1: config 7 has an invalid interface number: 187 but max is 0 [ 1004.041803][T15645] usb 7-1: config 7 has no interface number 0 [ 1004.063504][T15645] usb 7-1: config 7 interface 187 altsetting 6 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1004.085907][ T6909] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1004.087165][T15645] usb 7-1: config 7 interface 187 altsetting 6 bulk endpoint 0x3 has invalid maxpacket 0 [ 1004.120336][T15645] usb 7-1: config 7 interface 187 has no altsetting 0 [ 1004.138879][T15645] usb 7-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=5a.bb [ 1004.148259][ T6909] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1004.177066][T15645] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1004.192871][T15645] usb 7-1: Product: syz [ 1004.208516][T15645] usb 7-1: Manufacturer: syz [ 1004.236610][T15645] usb 7-1: SerialNumber: syz [ 1004.432348][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1004.448804][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1004.673457][T16115] Bluetooth: hci3: command tx timeout [ 1004.717518][T17529] tipc: Started in network mode [ 1004.722830][T17529] tipc: Node identity ac14140f, cluster identity 4711 [ 1004.737973][T17529] tipc: New replicast peer: 255.255.255.255 [ 1004.748453][T17529] tipc: Enabled bearer , priority 10 [ 1004.798542][T15645] usb 7-1: Cannot retrieve CPort count: -110 [ 1004.819599][T15645] usb 7-1: Cannot retrieve CPort count: -110 [ 1004.828006][T15645] es2_ap_driver 7-1:7.187: probe with driver es2_ap_driver failed with error -110 [ 1004.953442][T17526] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1005.858733][ T5905] tipc: Node number set to 2886997007 [ 1006.782228][ T5905] usb 7-1: USB disconnect, device number 14 [ 1007.551249][T17550] tipc: Started in network mode [ 1007.558139][T17550] tipc: Node identity ac14140f, cluster identity 4711 [ 1007.565408][T17550] tipc: New replicast peer: 255.255.255.255 [ 1007.572257][T17550] tipc: Enabled bearer , priority 10 [ 1008.707526][T14719] tipc: Node number set to 2886997007 [ 1009.027108][T17573] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3047'. [ 1009.640502][T17578] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:0 [ 1009.713589][T17582] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3050'. [ 1009.769177][T17582] siw: device registration error -23 [ 1009.978955][T17590] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3054'. [ 1009.989383][T17590] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3054'. [ 1009.999755][T17590] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3054'. [ 1010.116163][ T5889] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1010.536587][ T5889] usb 7-1: Using ep0 maxpacket: 32 [ 1010.562937][T17598] ubi31: attaching mtd0 [ 1010.570456][ T5889] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 1010.579800][ T5889] usb 7-1: config 0 has no interface number 0 [ 1010.618608][ T5889] usb 7-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1011.115032][T17598] ubi31: scanning is finished [ 1011.120496][T17598] ubi31: empty MTD device detected [ 1011.302461][ T5889] usb 7-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1012.128790][T17603] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1012.144607][ T5889] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1012.195435][ T5889] usb 7-1: Product: syz [ 1012.246634][ T24] usb 3-1: new high-speed USB device number 92 using dummy_hcd [ 1012.316594][ T5889] usb 7-1: Manufacturer: syz [ 1012.321865][ T5889] usb 7-1: SerialNumber: syz [ 1012.386604][ T5889] usb 7-1: config 0 descriptor?? [ 1012.419213][ T5889] em28xx 7-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1012.434990][ T5889] em28xx 7-1:0.132: Video interface 132 found: [ 1012.509525][ T24] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1012.586605][ T24] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1012.702078][ T24] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1012.805461][ T24] usb 3-1: config 1 interface 1 has no altsetting 1 [ 1012.806667][ T5905] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 1012.856945][ T5889] em28xx 7-1:0.132: unknown em28xx chip ID (0) [ 1012.862335][T17624] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 1012.926549][ T24] usb 3-1: New USB device found, idVendor=0525, idProduct=efa1, bcdDevice=8d.cc [ 1012.949531][ T24] usb 3-1: New USB device strings: Mfr=183, Product=24, SerialNumber=3 [ 1012.959694][T17598] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1012.983347][ T24] usb 3-1: Product: syz [ 1012.990555][ T5889] em28xx 7-1:0.132: failed to trigger read from i2c address 0xa0 (error=-5) [ 1012.994554][ T5905] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1013.014570][ T24] usb 3-1: Manufacturer: syz [ 1013.028171][ T5905] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1013.042906][ T5905] usb 9-1: config 1 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1013.067295][ T5889] em28xx 7-1:0.132: board has no eeprom [ 1013.081059][ T5905] usb 9-1: config 1 interface 0 has no altsetting 1 [ 1013.102598][ T5905] usb 9-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 1013.113381][ T24] usb 3-1: SerialNumber: syz [ 1013.123392][ T5905] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1013.156287][ T5905] usb 9-1: Product: syz [ 1013.165812][T17598] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1013.175774][ T5905] usb 9-1: Manufacturer: syz [ 1013.206856][ T5889] em28xx 7-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1013.226084][ T5889] em28xx 7-1:0.132: analog set to bulk mode. [ 1013.231533][ T5905] usb 9-1: SerialNumber: syz [ 1013.259522][ T5905] smsusb:smsusb_probe: board id=8, interface number 0 [ 1013.340009][ T7768] em28xx 7-1:0.132: Registering V4L2 extension [ 1013.350207][T17598] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1013.380525][ T5889] usb 7-1: USB disconnect, device number 15 [ 1013.395788][T17629] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3062'. [ 1013.440368][ T5889] em28xx 7-1:0.132: Disconnecting em28xx [ 1013.456249][ T5905] smsusb:smsusb_probe: usb_set_interface failed, rc -71 [ 1013.491337][T17598] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 1013.527199][ T5905] smsusb 9-1:1.0: probe with driver smsusb failed with error -71 [ 1013.553241][T17598] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1013.569671][ T5905] usb 9-1: USB disconnect, device number 2 [ 1013.652035][T17598] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1013.770838][T17598] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 949052097 [ 1013.893963][T17598] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1014.005721][T17626] ubi31: background thread "ubi_bgt31d" started, PID 17626 [ 1014.022522][ T7768] em28xx 7-1:0.132: Config register raw data: 0xffffffed [ 1014.086452][ T7768] em28xx 7-1:0.132: AC97 chip type couldn't be determined [ 1014.094136][ T7768] em28xx 7-1:0.132: No AC97 audio processor [ 1014.171528][ T7768] usb 7-1: Decoder not found [ 1014.176199][ T7768] em28xx 7-1:0.132: failed to create media graph [ 1014.207090][ T7768] em28xx 7-1:0.132: V4L2 device video103 deregistered [ 1014.238671][ T7768] em28xx 7-1:0.132: Remote control support is not available for this card. [ 1014.288308][ T5889] em28xx 7-1:0.132: Closing input extension [ 1015.275151][ T5889] em28xx 7-1:0.132: Freeing device [ 1015.319881][T17651] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3066'. [ 1016.030962][ T24] usb 3-1: selecting invalid altsetting 1 [ 1016.060764][ T24] cdc_ncm 3-1:1.0: bind() failure [ 1016.142182][ T24] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 1016.199345][ T24] cdc_ncm 3-1:1.1: bind() failure [ 1016.246917][ T24] usb 3-1: USB disconnect, device number 92 [ 1018.288023][T17685] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3074'. [ 1018.297148][T17685] netlink: 'syz.3.3074': attribute type 7 has an invalid length. [ 1018.379727][T17685] netlink: 'syz.3.3074': attribute type 8 has an invalid length. [ 1018.406171][T17685] netlink: 4 bytes leftover after parsing attributes in process `syz.3.3074'. [ 1020.793214][T17709] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1021.652085][T17721] block nbd7: NBD_DISCONNECT [ 1021.755344][T17727] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3083'. [ 1021.813400][T17721] block nbd7: Disconnected due to user request. [ 1021.862997][T17721] block nbd7: shutting down sockets [ 1022.143239][ T30] audit: type=1400 audit(1764021333.514:1451): avc: denied { getopt } for pid=17712 comm="syz.6.3082" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1024.281353][T17753] tipc: Enabling of bearer rejected, already enabled [ 1025.950118][T17772] netlink: 'syz.8.3093': attribute type 10 has an invalid length. [ 1025.984247][T17772] hsr0: A HSR master's MTU cannot be greater than the smallest MTU of its slaves minus the HSR Tag length (6 octets). [ 1026.806205][T17782] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3095'. [ 1027.403944][T17790] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3098'. [ 1027.420562][T17790] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3098'. [ 1029.645127][T17823] netlink: 256 bytes leftover after parsing attributes in process `syz.2.3109'. [ 1029.654661][T17823] netlink: 64 bytes leftover after parsing attributes in process `syz.2.3109'. [ 1029.864323][ T30] audit: type=1400 audit(1764021341.234:1452): avc: denied { lock } for pid=17829 comm="syz.7.3111" path="/dev/media6" dev="devtmpfs" ino=988 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1031.006249][T17852] mkiss: ax0: crc mode is auto. [ 1031.463371][T17862] tipc: Started in network mode [ 1031.468492][T17862] tipc: Node identity ac14140f, cluster identity 4711 [ 1031.477357][T17862] tipc: New replicast peer: 255.255.255.255 [ 1031.484596][T17862] tipc: Enabled bearer , priority 10 [ 1031.886819][T14719] usb 3-1: new high-speed USB device number 93 using dummy_hcd [ 1032.151115][T17866] trusted_key: encrypted_key: keyword 'new' not allowed when called from .update method [ 1032.596653][ T42] tipc: Node number set to 2886997007 [ 1032.776194][T17866] vivid-001: kernel_thread() failed [ 1033.647016][T14719] usb 3-1: Using ep0 maxpacket: 8 [ 1033.702224][T14719] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1033.748787][T14719] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1033.759419][T14719] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1033.771509][T14719] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1033.794999][T14719] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1033.810051][T14719] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1033.832101][T14719] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1033.846557][ T5905] usb 7-1: new full-speed USB device number 16 using dummy_hcd [ 1033.853318][T14719] usbtmc 3-1:16.0: probe with driver usbtmc failed with error -22 [ 1034.038629][ T5905] usb 7-1: config 0 has an invalid interface number: 113 but max is 0 [ 1034.078302][ T42] usb 9-1: new full-speed USB device number 3 using dummy_hcd [ 1034.101884][ T5905] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1034.112903][ T5905] usb 7-1: config 0 has no interface number 0 [ 1034.124191][ T5905] usb 7-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1034.589034][ T5905] usb 7-1: config 0 interface 113 altsetting 2 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1034.599094][ T5905] usb 7-1: config 0 interface 113 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1034.614195][ T5905] usb 7-1: config 0 interface 113 has no altsetting 0 [ 1034.615415][ T30] audit: type=1400 audit(1764021345.584:1453): avc: denied { write } for pid=17880 comm="syz.7.3125" lport=35173 faddr=::ffff:100.1.1.0 fport=20003 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1034.624872][ T5905] usb 7-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1034.657596][ T5905] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.665643][ T5905] usb 7-1: Product: syz [ 1034.668877][ T42] usb 9-1: config 0 has an invalid interface number: 113 but max is 0 [ 1034.670359][ T5905] usb 7-1: Manufacturer: syz [ 1034.678867][ T42] usb 9-1: config 0 has no interface number 0 [ 1034.682880][ T5905] usb 7-1: SerialNumber: syz [ 1034.689427][ T42] usb 9-1: config 0 interface 113 altsetting 2 has an endpoint descriptor with address 0x14, changing to 0x4 [ 1034.696271][ T5905] usb 7-1: config 0 descriptor?? [ 1034.705687][ T42] usb 9-1: config 0 interface 113 altsetting 2 endpoint 0x82 has invalid maxpacket 43115, setting to 64 [ 1034.716305][ T5905] pn533_usb 7-1:0.113: NFC: Could not find bulk-in or bulk-out endpoint [ 1034.723515][ T42] usb 9-1: config 0 interface 113 has no altsetting 0 [ 1034.736958][T14719] usb 4-1: new high-speed USB device number 83 using dummy_hcd [ 1034.749488][ T42] usb 9-1: New USB device found, idVendor=054c, idProduct=02e1, bcdDevice=e2.c8 [ 1034.762614][ T42] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.774696][ T42] usb 9-1: Product: syz [ 1034.779261][ T42] usb 9-1: Manufacturer: syz [ 1034.783868][ T42] usb 9-1: SerialNumber: syz [ 1034.798212][ T42] usb 9-1: config 0 descriptor?? [ 1034.849248][T17876] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22 [ 1034.887029][ C1] usb 9-1: NFC: Urb failure (status -71) [ 1034.895441][ C1] usb 9-1: NFC: Urb failure (status -71) [ 1034.904530][ T42] usb 9-1: NFC: Unable to get FW version [ 1034.925589][ T42] pn533_usb 9-1:0.113: probe with driver pn533_usb failed with error -71 [ 1034.958389][T14719] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1034.978001][T17890] IPv6: Can't replace route, no match found [ 1034.997083][T14719] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1035.013430][T14719] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1035.028830][T14719] usb 4-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1035.038298][ T30] audit: type=1400 audit(1764021346.404:1454): avc: denied { write } for pid=17871 comm="syz.6.3121" path="socket:[64325]" dev="sockfs" ino=64325 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1035.042922][ T5905] usb 7-1: USB disconnect, device number 16 [ 1035.062156][T14719] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1035.077000][ T42] usb 9-1: USB disconnect, device number 3 [ 1035.088771][T14719] usb 4-1: Product: syz [ 1035.102662][T14719] usb 4-1: Manufacturer: syz [ 1035.109102][ T30] audit: type=1400 audit(1764021346.414:1455): avc: denied { read } for pid=17871 comm="syz.6.3121" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1035.132216][T14719] usb 4-1: SerialNumber: syz [ 1035.146413][T14719] usb 4-1: config 0 descriptor?? [ 1035.154460][T17883] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1035.161900][T17883] raw-gadget.4 gadget.3: fail, usb_ep_enable returned -22 [ 1035.170525][T14719] usb 4-1: ucan: probing device on interface #0 [ 1035.371501][T14719] usb 4-1: ucan: could not read protocol version, ret=0 [ 1035.378814][T14719] usb 4-1: ucan: probe failed; try to update the device firmware [ 1035.936826][T14719] usb 4-1: USB disconnect, device number 83 [ 1036.138621][ T42] usb 3-1: USB disconnect, device number 93 [ 1037.387424][ T30] audit: type=1400 audit(1764021348.744:1456): avc: denied { mount } for pid=17903 comm="syz.2.3131" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1037.413413][ T30] audit: type=1400 audit(1764021348.754:1457): avc: denied { unmount } for pid=17250 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 1037.433710][ C0] vkms_vblank_simulate: vblank timer overrun [ 1039.868118][ T42] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1040.026740][ T42] usb 9-1: Using ep0 maxpacket: 8 [ 1040.202656][ T42] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1040.216642][ T42] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1040.228485][ T42] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1040.245363][ T42] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 0 [ 1040.268061][ T42] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1040.286277][ T42] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1040.298005][ T42] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.327568][ T42] usbtmc 9-1:16.0: probe with driver usbtmc failed with error -22 [ 1041.217126][T17969] netlink: 52 bytes leftover after parsing attributes in process `syz.6.3147'. [ 1041.517338][ T53] Bluetooth: hci3: command 0x0405 tx timeout [ 1041.952306][T17983] IPv6: Can't replace route, no match found [ 1043.112874][ T42] usb 9-1: USB disconnect, device number 4 [ 1044.893894][T18022] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3160'. [ 1048.896591][ T42] usb 3-1: new high-speed USB device number 94 using dummy_hcd [ 1048.940975][T18059] netlink: 'syz.6.3169': attribute type 3 has an invalid length. [ 1048.968302][T18059] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3169'. [ 1049.086722][ T42] usb 3-1: Using ep0 maxpacket: 32 [ 1049.124140][T18063] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3171'. [ 1049.127595][ T42] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 1049.182476][ T42] usb 3-1: config 0 has no interface number 0 [ 1049.198224][ T42] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1049.219695][ T42] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.247100][ T42] usb 3-1: Product: syz [ 1049.270958][ T42] usb 3-1: Manufacturer: syz [ 1049.284734][ T42] usb 3-1: SerialNumber: syz [ 1049.410478][ T42] usb 3-1: config 0 descriptor?? [ 1049.527814][ T42] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1049.628958][T18067] netlink: 220 bytes leftover after parsing attributes in process `syz.6.3172'. [ 1050.509794][T18076] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1050.642479][T18076] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1050.901194][ T42] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1050.924642][ T42] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1051.008859][ C1] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1051.021324][T15645] usb 3-1: USB disconnect, device number 94 [ 1051.167766][T15645] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1051.489494][T15645] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1051.516098][ T30] audit: type=1400 audit(1764021362.884:1458): avc: denied { write } for pid=18078 comm="syz.3.3175" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1051.550318][T15645] quatech2 3-1:0.51: device disconnected [ 1051.763700][ T30] audit: type=1400 audit(1764021363.134:1459): avc: denied { append } for pid=18097 comm="syz.6.3182" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 1051.788231][ C0] vkms_vblank_simulate: vblank timer overrun [ 1053.181959][ T42] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1053.352781][ T42] usb 9-1: Using ep0 maxpacket: 32 [ 1053.365157][ T42] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 1053.376548][ T42] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1053.416616][ T42] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1053.455780][ T42] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1053.472958][ T42] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1053.516809][ T42] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1053.563725][ T42] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1053.633633][T18116] netlink: 220 bytes leftover after parsing attributes in process `syz.7.3187'. [ 1053.638852][ T42] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1053.951104][ T42] usb 9-1: config 0 descriptor?? [ 1054.221863][ T42] usblp 9-1:0.0: usblp0: USB Bidirectional printer dev 5 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1054.634474][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.710184][ T42] usb 9-1: USB disconnect, device number 5 [ 1054.724880][ T42] usblp0: removed [ 1055.028416][T18128] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 1055.146845][ T42] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1055.326695][ T42] usb 9-1: Using ep0 maxpacket: 32 [ 1055.587314][ T42] usb 9-1: config index 0 descriptor too short (expected 29220, got 36) [ 1055.636279][ T42] usb 9-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1055.673720][ T42] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1055.719338][ T42] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1055.764626][ T42] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1055.814858][ T42] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1055.864471][ T42] usb 9-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1055.932801][ T42] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1055.969435][T18137] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3191'. [ 1055.990666][ T42] usb 9-1: config 0 descriptor?? [ 1056.035247][ T42] usb 9-1: can't set config #0, error -71 [ 1056.046247][T18137] netlink: 'syz.6.3191': attribute type 7 has an invalid length. [ 1056.075232][ T42] usb 9-1: USB disconnect, device number 6 [ 1056.101966][T18137] netlink: 'syz.6.3191': attribute type 8 has an invalid length. [ 1056.269276][T18137] netlink: 4 bytes leftover after parsing attributes in process `syz.6.3191'. [ 1057.291866][T18150] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3192'. [ 1057.578590][T18149] can: request_module (can-proto-0) failed. [ 1057.916645][ T5828] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1058.322732][ T5828] usb 9-1: Using ep0 maxpacket: 16 [ 1058.340753][ T5828] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1058.365828][ T5828] usb 9-1: config 0 has no interface number 0 [ 1058.434603][ T5828] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 159, changing to 11 [ 1059.155417][ T5828] usb 9-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid maxpacket 41313, setting to 1024 [ 1059.312294][ T5828] usb 9-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 1059.451748][ T5828] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1059.517881][ T5828] usb 9-1: config 0 descriptor?? [ 1059.903457][T18178] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1059.928210][T18178] loop7: detected capacity change from 0 to 7 [ 1060.086552][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.095774][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.129276][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.139007][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.154318][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.164447][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.174881][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.184275][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.198267][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.208542][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.219527][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.229873][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.240299][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.250805][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.259186][T18178] ldm_validate_partition_table(): Disk read failed. [ 1060.269234][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.278559][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.294214][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.303518][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.314623][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1060.325429][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1060.335901][T18178] Dev loop7: unable to read RDB block 0 [ 1060.347949][T18178] loop7: unable to read partition table [ 1060.353817][T18178] loop7: partition table beyond EOD, truncated [ 1060.360115][T18178] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 1060.616629][T18183] overlayfs: statfs failed on './file0' [ 1060.635927][T18183] bridge1: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 1060.660371][ T5828] uclogic 0003:28BD:0071.0013: failed retrieving string descriptor #100: -71 [ 1060.669450][ T5828] uclogic 0003:28BD:0071.0013: failed retrieving pen parameters: -71 [ 1060.677579][ T5828] uclogic 0003:28BD:0071.0013: pen probing failed: -71 [ 1060.686694][ T5828] uclogic 0003:28BD:0071.0013: failed probing parameters: -71 [ 1060.694342][ T5828] uclogic 0003:28BD:0071.0013: probe with driver uclogic failed with error -71 [ 1060.780389][ T5828] usb 9-1: USB disconnect, device number 7 [ 1062.095623][T18194] netlink: 220 bytes leftover after parsing attributes in process `syz.6.3206'. [ 1062.866632][ T5828] usb 3-1: new high-speed USB device number 95 using dummy_hcd [ 1063.199325][ T5828] usb 3-1: Using ep0 maxpacket: 8 [ 1063.216439][ T5828] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1063.240502][ T5828] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1063.288014][ T5828] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1063.384377][ T5828] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1063.467362][T18216] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1063.500256][ T5828] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1063.515559][ T5828] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1063.520336][ T36] Bluetooth: (null): Invalid header checksum [ 1063.603026][ T36] Bluetooth: (null): Invalid header checksum [ 1063.625530][ T36] Bluetooth: (null): Invalid header checksum [ 1063.831178][ T5828] usb 3-1: usb_control_msg returned -32 [ 1063.858765][ T5828] usbtmc 3-1:16.0: can't read capabilities [ 1064.178798][T18245] IPv6: Can't replace route, no match found [ 1064.185713][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1064.195010][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1064.204311][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1064.213644][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1064.222943][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1064.232389][ C0] usbtmc 3-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1064.241774][ C0] vkms_vblank_simulate: vblank timer overrun [ 1065.317223][ T5905] usb 7-1: new high-speed USB device number 17 using dummy_hcd [ 1065.557024][T18258] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1065.901057][ T42] usb 3-1: USB disconnect, device number 95 [ 1065.942464][ T5905] usb 7-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1 [ 1065.960042][ T5905] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1066.021864][ T5905] usb 7-1: Product: syz [ 1066.026145][ T5905] usb 7-1: Manufacturer: syz [ 1066.031065][ T5905] usb 7-1: SerialNumber: syz [ 1066.038491][ T5905] usb 7-1: config 0 descriptor?? [ 1066.256984][ T5905] int51x1 7-1:0.0: probe with driver int51x1 failed with error -71 [ 1066.311284][ T5905] usb 7-1: USB disconnect, device number 17 [ 1066.875803][T18277] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3227'. [ 1067.839585][T18284] netlink: 'syz.2.3231': attribute type 1 has an invalid length. [ 1067.949255][T18284] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1067.979929][T18284] netlink: 60 bytes leftover after parsing attributes in process `syz.2.3231'. [ 1068.015508][T18286] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1068.023332][T18286] bond1: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1068.037182][T18286] bond1: (slave vxcan3): Error -95 calling set_mac_address [ 1068.066650][T17520] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1068.259224][T18301] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3237'. [ 1068.268390][T18301] IPv6: NLM_F_CREATE should be specified when creating new route [ 1068.361625][T17520] usb 9-1: Using ep0 maxpacket: 16 [ 1068.378006][T17520] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1068.390168][T17520] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1068.400126][T17520] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1068.415104][T17520] usb 9-1: New USB device found, idVendor=0955, idProduct=7214, bcdDevice=ed.00 [ 1068.424546][T17520] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1068.435372][T17520] usb 9-1: config 0 descriptor?? [ 1068.496844][T14719] usb 4-1: new high-speed USB device number 84 using dummy_hcd [ 1068.505233][ T5889] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 1068.659174][ T5889] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1068.669523][T14719] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 1068.679650][ T5889] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1068.691644][T14719] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1068.702628][ T5889] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1068.716257][ T5889] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1068.729678][ T5889] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.741290][T14719] usb 4-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1068.750699][ T5889] usb 7-1: Product: syz [ 1068.754896][ T5889] usb 7-1: Manufacturer: syz [ 1068.759635][T14719] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1068.767759][ T5889] usb 7-1: SerialNumber: syz [ 1068.773819][T14719] usb 4-1: Product: syz [ 1068.779011][T14719] usb 4-1: Manufacturer: syz [ 1068.783732][T14719] usb 4-1: SerialNumber: syz [ 1068.789662][ T5889] usb 7-1: config 0 descriptor?? [ 1068.908429][T18298] raw-gadget.4 gadget.6: fail, usb_ep_enable returned -22 [ 1068.916753][T18298] raw-gadget.4 gadget.6: fail, usb_ep_enable returned -22 [ 1068.937331][ T5889] usb 7-1: ucan: probing device on interface #0 [ 1068.937487][T17520] input: HID 0955:7214 Haptics as /devices/virtual/input/input31 [ 1068.946153][T14719] usb 4-1: config 0 descriptor?? [ 1068.968638][T18297] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1068.979029][T18297] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1069.390254][T18280] random: crng reseeded on system resumption [ 1069.393891][T17520] shield 0003:0955:7214.0014: Registered Thunderstrike controller [ 1069.424200][ T5889] usb 7-1: ucan: could not read protocol version, ret=0 [ 1069.431830][T17520] shield 0003:0955:7214.0014: : USB HID v0.00 Device [HID 0955:7214] on usb-dummy_hcd.8-1/input0 [ 1069.434470][T18297] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1069.443525][ T5889] usb 7-1: ucan: probe failed; try to update the device firmware [ 1069.450954][T18297] raw-gadget.3 gadget.3: fail, usb_ep_enable returned -22 [ 1069.473040][T18280] netlink: 56 bytes leftover after parsing attributes in process `syz.8.3229'. [ 1069.499828][T18280] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1069.513626][T18280] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1069.572284][ T5905] shield 0003:0955:7214.0014: Failed to output Thunderstrike HOSTCMD request HID report due to -EPROTO [ 1069.577378][ T5889] usb 9-1: USB disconnect, device number 8 [ 1069.595952][ T5905] shield 0003:0955:7214.0014: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1069.607915][ T5905] shield 0003:0955:7214.0014: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1069.620003][ T5905] shield 0003:0955:7214.0014: Failed to output Thunderstrike HOSTCMD request HID report due to -ENODEV [ 1070.043557][T14719] Error reading MAC address [ 1070.168988][T14719] usb 4-1: USB disconnect, device number 84 [ 1070.250378][ T5828] usb 7-1: USB disconnect, device number 18 [ 1070.569230][T18317] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3242'. [ 1070.945833][ T42] usb 3-1: new high-speed USB device number 96 using dummy_hcd [ 1071.485373][ T42] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1071.495685][ T42] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1071.533244][ T42] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1071.581191][T18319] netlink: 220 bytes leftover after parsing attributes in process `syz.3.3243'. [ 1071.620009][ T42] usb 3-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1071.631185][ T42] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1071.641281][ T42] usb 3-1: Product: syz [ 1071.645776][ T42] usb 3-1: Manufacturer: syz [ 1071.650860][ T42] usb 3-1: SerialNumber: syz [ 1071.698571][ T42] usb 3-1: config 0 descriptor?? [ 1071.717177][T18311] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1071.724441][T18311] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 1071.764718][ T42] usb 3-1: ucan: probing device on interface #0 [ 1072.092327][ T42] usb 3-1: ucan: could not read protocol version, ret=0 [ 1072.135788][ T42] usb 3-1: ucan: probe failed; try to update the device firmware [ 1072.986365][T18339] netlink: 256 bytes leftover after parsing attributes in process `syz.3.3249'. [ 1072.996187][T18339] netlink: 64 bytes leftover after parsing attributes in process `syz.3.3249'. [ 1073.867932][T17520] usb 3-1: USB disconnect, device number 96 [ 1073.904221][T18345] kthread_run failed with err -4 [ 1074.676787][T18356] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1075.246646][ T5905] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1075.276834][T18365] FAULT_INJECTION: forcing a failure. [ 1075.276834][T18365] name failslab, interval 1, probability 0, space 0, times 0 [ 1075.326557][T18365] CPU: 0 UID: 0 PID: 18365 Comm: syz.6.3256 Not tainted syzkaller #0 PREEMPT(full) [ 1075.326584][T18365] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1075.326596][T18365] Call Trace: [ 1075.326603][T18365] [ 1075.326610][T18365] dump_stack_lvl+0x16c/0x1f0 [ 1075.326635][T18365] should_fail_ex+0x512/0x640 [ 1075.326663][T18365] ? __kmalloc_noprof+0xca/0x880 [ 1075.326692][T18365] should_failslab+0xc2/0x120 [ 1075.326715][T18365] __kmalloc_noprof+0xdd/0x880 [ 1075.326739][T18365] ? iter_file_splice_write+0x1cc/0x12e0 [ 1075.326764][T18365] ? iter_file_splice_write+0x1cc/0x12e0 [ 1075.326782][T18365] iter_file_splice_write+0x1cc/0x12e0 [ 1075.326808][T18365] ? kfree+0x2b8/0x6d0 [ 1075.326829][T18365] ? copy_splice_read+0x897/0xc20 [ 1075.326854][T18365] ? copy_splice_read+0x897/0xc20 [ 1075.326872][T18365] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1075.326893][T18365] ? __lock_acquire+0xb8a/0x1c90 [ 1075.326918][T18365] ? __pfx_copy_splice_read+0x10/0x10 [ 1075.326954][T18365] ? __pfx_iter_file_splice_write+0x10/0x10 [ 1075.326977][T18365] direct_splice_actor+0x192/0x6c0 [ 1075.327000][T18365] splice_direct_to_actor+0x345/0xa30 [ 1075.327020][T18365] ? __pfx_direct_splice_actor+0x10/0x10 [ 1075.327043][T18365] ? __pfx_splice_direct_to_actor+0x10/0x10 [ 1075.327061][T18365] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1075.327086][T18365] ? rcu_preempt_deferred_qs_irqrestore+0x500/0xbc0 [ 1075.327112][T18365] do_splice_direct+0x174/0x240 [ 1075.327129][T18365] ? __pfx_do_splice_direct+0x10/0x10 [ 1075.327147][T18365] ? __pfx_direct_file_splice_eof+0x10/0x10 [ 1075.327178][T18365] ? rw_verify_area+0xcf/0x6c0 [ 1075.327203][T18365] do_sendfile+0xb06/0xe50 [ 1075.327233][T18365] ? __pfx_do_sendfile+0x10/0x10 [ 1075.327258][T18365] ? __fget_files+0x20e/0x3c0 [ 1075.327282][T18365] __x64_sys_sendfile64+0x1d8/0x220 [ 1075.327303][T18365] ? ksys_write+0x1ac/0x250 [ 1075.327319][T18365] ? __pfx___x64_sys_sendfile64+0x10/0x10 [ 1075.327348][T18365] do_syscall_64+0xcd/0xfa0 [ 1075.327368][T18365] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1075.327388][T18365] RIP: 0033:0x7f971278f749 [ 1075.327405][T18365] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1075.327423][T18365] RSP: 002b:00007f9713617038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028 [ 1075.327442][T18365] RAX: ffffffffffffffda RBX: 00007f97129e5fa0 RCX: 00007f971278f749 [ 1075.327456][T18365] RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000005 [ 1075.327468][T18365] RBP: 00007f9713617090 R08: 0000000000000000 R09: 0000000000000000 [ 1075.327480][T18365] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000001 [ 1075.327492][T18365] R13: 00007f97129e6038 R14: 00007f97129e5fa0 R15: 00007ffec83b9c48 [ 1075.327521][T18365] [ 1075.610379][ C0] vkms_vblank_simulate: vblank timer overrun [ 1075.706614][ T5905] usb 9-1: Using ep0 maxpacket: 8 [ 1075.713385][ T5905] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1075.725210][ T5905] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1075.736302][ T5905] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1075.767531][ T5905] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1075.798511][ T5905] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1075.808795][ T5905] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1076.345039][T18371] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1076.812943][T18376] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1076.914296][T18376] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1076.928883][ T5905] usb 9-1: usb_control_msg returned -32 [ 1076.942838][ T5905] usbtmc 9-1:16.0: can't read capabilities [ 1077.000773][T18376] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1077.116704][T18376] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1077.157535][T18390] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 1077.296399][T18391] IPv6: Can't replace route, no match found [ 1077.323499][ C1] usbtmc 9-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1077.333130][ C1] usbtmc 9-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1077.353945][ T12] netdevsim netdevsim6 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1077.366590][ C1] usbtmc 9-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1077.402136][ T12] netdevsim netdevsim6 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1077.539497][ T12] netdevsim netdevsim6 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1077.562532][ T12] netdevsim netdevsim6 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1078.412455][ T42] usb 9-1: USB disconnect, device number 9 [ 1078.988199][T18422] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3275'. [ 1079.067435][T18425] tipc: Enabled bearer , priority 0 [ 1079.241961][T18425] tipc: Disabling bearer [ 1079.350103][T18429] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1080.304325][T18454] netlink: 'syz.3.3286': attribute type 1 has an invalid length. [ 1080.313069][T18454] netlink: 'syz.3.3286': attribute type 4 has an invalid length. [ 1080.321576][T18454] netlink: 15334 bytes leftover after parsing attributes in process `syz.3.3286'. [ 1080.716221][T18465] vxlan0: entered promiscuous mode [ 1080.730218][T18465] vxlan0: entered allmulticast mode [ 1080.736201][ T4588] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1080.747926][ T30] audit: type=1400 audit(1764021392.124:1460): avc: denied { ioctl } for pid=18459 comm="syz.3.3289" path="/dev/cpu/0/msr" dev="devtmpfs" ino=87 ioctlcmd=0x9418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cpu_device_t tclass=chr_file permissive=1 [ 1080.774343][ T4588] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1080.788873][ T4588] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1080.815409][T18466] macvlan0: entered allmulticast mode [ 1080.871107][ T4588] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1080.935196][T18471] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1082.181361][T18483] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1083.239431][T18487] netlink: 220 bytes leftover after parsing attributes in process `syz.8.3295'. [ 1083.361447][T18494] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3296'. [ 1084.925652][T18514] netlink: 220 bytes leftover after parsing attributes in process `syz.7.3303'. [ 1085.342290][T18518] netlink: 220 bytes leftover after parsing attributes in process `syz.8.3304'. [ 1086.524367][T18531] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3308'. [ 1086.605226][T18533] bridge0: port 1(bridge_slave_0) entered disabled state [ 1086.627719][T18540] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3308'. [ 1086.648936][T18533] bridge0: port 2(bridge_slave_1) entered disabled state [ 1086.697811][T18540] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3308'. [ 1089.006630][T14719] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1089.196584][T14719] usb 9-1: Using ep0 maxpacket: 32 [ 1089.203723][T14719] usb 9-1: config 0 has an invalid interface number: 188 but max is 0 [ 1089.226542][T14719] usb 9-1: config 0 has no interface number 0 [ 1089.227121][ T30] audit: type=1400 audit(1764021400.604:1461): avc: denied { append } for pid=18584 comm="syz.2.3319" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1089.235190][T14719] usb 9-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 40 [ 1089.416866][T14719] usb 9-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1089.426301][T14719] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.434854][T14719] usb 9-1: Product: syz [ 1089.446694][T14719] usb 9-1: Manufacturer: syz [ 1089.458047][T18587] netlink: 'syz.3.3320': attribute type 1 has an invalid length. [ 1089.466581][T14719] usb 9-1: SerialNumber: syz [ 1089.493186][T14719] usb 9-1: config 0 descriptor?? [ 1089.502891][T18563] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1089.687220][T14719] asix 9-1:0.188: probe with driver asix failed with error -71 [ 1089.703914][T18587] netlink: 244 bytes leftover after parsing attributes in process `syz.3.3320'. [ 1089.750288][T14719] usb 9-1: USB disconnect, device number 10 [ 1090.406768][T17520] usb 7-1: new high-speed USB device number 19 using dummy_hcd [ 1090.589242][T17520] usb 7-1: config 0 has an invalid interface number: 133 but max is 0 [ 1090.660710][T17520] usb 7-1: config 0 has no interface number 0 [ 1090.774259][T17520] usb 7-1: New USB device found, idVendor=203e, idProduct=8888, bcdDevice=a8.71 [ 1090.892580][T17520] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1091.310310][T17520] usb 7-1: Product: syz [ 1091.314562][T17520] usb 7-1: Manufacturer: syz [ 1091.359546][T18603] netlink: 7060 bytes leftover after parsing attributes in process `syz.2.3325'. [ 1091.387375][T17520] usb 7-1: SerialNumber: syz [ 1091.417843][T17520] usb 7-1: config 0 descriptor?? [ 1091.460560][T17520] usb-storage 7-1:0.133: USB Mass Storage device detected [ 1091.806734][T18615] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1091.815958][T18615] loop7: detected capacity change from 0 to 7 [ 1092.626606][ T5905] usb 3-1: new low-speed USB device number 97 using dummy_hcd [ 1092.645119][ C0] blk_print_req_error: 10 callbacks suppressed [ 1092.645170][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.660713][ C0] buffer_io_error: 10 callbacks suppressed [ 1092.660733][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.770401][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.779663][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.800862][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.810090][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.866525][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.875744][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.883910][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.893108][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.911172][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.920435][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.949701][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.958940][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.966875][T18615] ldm_validate_partition_table(): Disk read failed. [ 1092.973650][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1092.982858][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1092.992225][T18622] netlink: 'syz.6.3322': attribute type 2 has an invalid length. [ 1092.992781][T18596] netlink: 12 bytes leftover after parsing attributes in process `syz.6.3322'. [ 1093.004858][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1093.018689][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1093.028563][ T5905] usb 3-1: config 65 has an invalid interface number: 95 but max is 0 [ 1093.033524][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1093.037151][ T5905] usb 3-1: config 65 has no interface number 0 [ 1093.045975][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1093.061424][T18615] Dev loop7: unable to read RDB block 0 [ 1093.072467][ T5905] usb 3-1: string descriptor 0 read error: -22 [ 1093.076619][T18615] loop7: unable to read partition table [ 1093.085105][T18615] loop7: partition table beyond EOD, truncated [ 1093.091559][T18615] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 1093.101519][ T5905] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice=6f.b6 [ 1093.202588][ T5905] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1093.229952][ T5905] usbtest 3-1:65.95: Linux gadget zero [ 1093.235554][ T5905] usbtest 3-1:65.95: low-speed {control in/out} tests (+alt) [ 1093.537186][ T5828] usb 7-1: USB disconnect, device number 19 [ 1094.459043][T17520] usb 3-1: USB disconnect, device number 97 [ 1095.361293][T18649] overlayfs: missing 'lowerdir' [ 1097.175183][T18677] netlink: 256 bytes leftover after parsing attributes in process `syz.8.3341'. [ 1097.406438][T18677] netlink: 64 bytes leftover after parsing attributes in process `syz.8.3341'. [ 1098.194818][T18685] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1098.427904][T18688] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1100.962770][T18710] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3351'. [ 1101.197120][ T24] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1101.446606][ T24] usb 7-1: Using ep0 maxpacket: 8 [ 1101.460698][ T24] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1101.620773][T18718] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3352'. [ 1101.637678][T18718] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3352'. [ 1101.921502][ T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1101.944505][ T24] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1101.954540][ T24] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1101.967769][ T24] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1101.968843][T18716] bridge0: port 1(bridge_slave_0) entered disabled state [ 1101.977226][ T24] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1102.011818][T18716] bridge0: port 2(bridge_slave_1) entered disabled state [ 1103.511135][ T24] usb 7-1: usb_control_msg returned -32 [ 1103.517146][ T24] usbtmc 7-1:16.0: can't read capabilities [ 1103.898425][T18733] IPv6: Can't replace route, no match found [ 1103.940739][ C1] usbtmc 7-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 1103.987252][T18734] netlink: 24 bytes leftover after parsing attributes in process `syz.3.3357'. [ 1104.652400][T18740] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1104.669385][T18740] loop7: detected capacity change from 0 to 7 [ 1105.074292][ C0] blk_print_req_error: 15 callbacks suppressed [ 1105.074313][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.089739][ C0] buffer_io_error: 15 callbacks suppressed [ 1105.089751][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.106301][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.115684][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.123817][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.132992][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.141836][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.151000][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.159999][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.169159][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.185365][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.194651][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.194734][T18744] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1105.211037][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.220321][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.228374][T18740] ldm_validate_partition_table(): Disk read failed. [ 1105.237933][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.247211][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.255769][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.265118][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.274584][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1105.283754][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1105.292980][T18740] Dev loop7: unable to read RDB block 0 [ 1105.307365][T18740] loop7: unable to read partition table [ 1105.313275][T18740] loop7: partition table beyond EOD, truncated [ 1105.319616][T18740] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 1105.393661][T15645] usb 7-1: USB disconnect, device number 20 [ 1105.578484][T18748] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3360'. [ 1105.598651][ T30] audit: type=1400 audit(1764021416.954:1462): avc: denied { write } for pid=18747 comm="syz.3.3360" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 1106.225860][T18753] overlayfs: statfs failed on './file0' [ 1107.161004][T18773] veth0: entered promiscuous mode [ 1108.260393][T16115] Bluetooth: hci1: command 0x0406 tx timeout [ 1108.941050][T18771] veth0: left promiscuous mode [ 1109.684953][ T30] audit: type=1400 audit(1764021421.034:1463): avc: denied { setopt } for pid=18794 comm="syz.3.3376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1109.807088][ T24] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 1110.028881][ T24] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1110.319555][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1110.361385][ T24] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1110.416085][ T24] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1110.452263][ T24] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1110.470935][ T24] usb 9-1: Product: syz [ 1110.475191][ T24] usb 9-1: Manufacturer: syz [ 1110.532972][ T24] usb 9-1: SerialNumber: syz [ 1110.543261][ T24] usb 9-1: config 0 descriptor?? [ 1110.557053][ T24] streamzap 9-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?! [ 1110.785078][ T5828] usb 9-1: USB disconnect, device number 11 [ 1110.988703][T18819] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1111.026101][T18819] loop7: detected capacity change from 0 to 7 [ 1111.303343][ C1] blk_print_req_error: 5 callbacks suppressed [ 1111.303366][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.318819][ C1] buffer_io_error: 5 callbacks suppressed [ 1111.318831][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.333241][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.342413][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.350587][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.359876][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.370402][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.379635][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.388439][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.397627][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.406670][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.415834][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.428377][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.437629][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.445805][T18819] ldm_validate_partition_table(): Disk read failed. [ 1111.453167][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.462946][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.471958][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.481117][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.490048][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1111.499264][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.510714][T18819] Dev loop7: unable to read RDB block 0 [ 1111.522483][T18819] loop7: unable to read partition table [ 1111.528495][T18819] loop7: partition table beyond EOD, truncated [ 1111.534689][T18819] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 1112.104815][T18829] tipc: Enabling of bearer rejected, already enabled [ 1113.029762][T18836] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3389'. [ 1114.213461][T18852] netlink: 'syz.3.3392': attribute type 39 has an invalid length. [ 1114.368973][T18852] syz_tun (unregistering): left allmulticast mode [ 1114.999250][T18852] syz_tun (unregistering): left promiscuous mode [ 1115.016617][T15645] usb 3-1: new high-speed USB device number 98 using dummy_hcd [ 1115.182242][T18863] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1115.206628][T15645] usb 3-1: Using ep0 maxpacket: 16 [ 1115.300510][T15645] usb 3-1: config 222 has an invalid interface number: 31 but max is 0 [ 1115.360867][T15645] usb 3-1: config 222 has no interface number 0 [ 1115.398021][T15645] usb 3-1: config 222 interface 31 altsetting 11 endpoint 0xE has an invalid bInterval 0, changing to 7 [ 1115.418952][ T42] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1115.521972][T15645] usb 3-1: config 222 interface 31 altsetting 11 endpoint 0xE has invalid wMaxPacketSize 0 [ 1115.546680][T15645] usb 3-1: config 222 interface 31 has no altsetting 0 [ 1116.317321][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.402360][ T42] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1116.482843][ T42] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1116.559451][ T42] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1116.597591][T18883] netlink: 51 bytes leftover after parsing attributes in process `syz.6.3402'. [ 1116.636934][ T42] usb 9-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1116.646257][ T42] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1116.807385][ T42] usb 9-1: Product: syz [ 1116.828513][ T42] usb 9-1: Manufacturer: syz [ 1117.572748][ T42] usb 9-1: SerialNumber: syz [ 1117.602209][ T42] usb 9-1: config 0 descriptor?? [ 1117.620517][T18865] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1117.627864][T18865] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1117.645985][ T42] usb 9-1: ucan: probing device on interface #0 [ 1117.939556][ T42] usb 9-1: ucan: could not read protocol version, ret=0 [ 1118.086922][ T42] usb 9-1: ucan: probe failed; try to update the device firmware [ 1118.964463][ T42] usb 9-1: USB disconnect, device number 12 [ 1120.580042][T15645] usb 3-1: string descriptor 0 read error: -32 [ 1120.586437][T15645] usb 3-1: New USB device found, idVendor=0f11, idProduct=2030, bcdDevice=a9.fd [ 1120.608508][T15645] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1120.776373][T15645] usb 3-1: can't set config #222, error -71 [ 1121.257080][T15645] usb 3-1: USB disconnect, device number 98 [ 1121.682268][T18912] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1121.715301][T18912] loop7: detected capacity change from 0 to 7 [ 1121.815854][ C0] blk_print_req_error: 5 callbacks suppressed [ 1121.815876][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.831215][ C0] buffer_io_error: 5 callbacks suppressed [ 1121.831236][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.846940][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.856101][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.895899][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.905379][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.913657][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.922840][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.937208][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.946391][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.956967][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.966146][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.975525][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1121.984827][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1121.992822][T18912] ldm_validate_partition_table(): Disk read failed. [ 1122.001742][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1122.010967][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1122.019254][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1122.028509][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1122.038131][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1122.047378][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1122.055757][T18912] Dev loop7: unable to read RDB block 0 [ 1122.063809][T18912] loop7: unable to read partition table [ 1122.070069][T18912] loop7: partition table beyond EOD, truncated [ 1122.076273][T18912] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 1122.148323][T18918] netlink: 28 bytes leftover after parsing attributes in process `syz.2.3413'. [ 1122.188400][T18918] netlink: 'syz.2.3413': attribute type 7 has an invalid length. [ 1122.216848][T18918] netlink: 'syz.2.3413': attribute type 8 has an invalid length. [ 1122.225163][T18918] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3413'. [ 1122.952825][T18918] ip6gretap0: entered promiscuous mode [ 1122.989127][T18918] syz_tun: entered promiscuous mode [ 1123.013927][T18918] gretap0: entered promiscuous mode [ 1123.020045][T18918] debugfs: 'hsr1' already exists in 'hsr' [ 1123.025796][T18918] Cannot create hsr debugfs directory [ 1123.048206][T18927] netlink: 220 bytes leftover after parsing attributes in process `syz.8.3411'. [ 1123.270175][T18936] netlink: 88 bytes leftover after parsing attributes in process `syz.6.3417'. [ 1123.297245][T11538] Bluetooth: hci3: command 0x0405 tx timeout [ 1123.448061][T18930] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1123.473682][T18930] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1124.297761][T18942] openvswitch: netlink: Unexpected mask (mask=840, allowed=10048) [ 1124.475266][T18949] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1125.010809][T18959] netlink: 16402 bytes leftover after parsing attributes in process `syz.8.3423'. [ 1125.611457][T18971] tipc: Enabling of bearer rejected, already enabled [ 1126.706540][T15645] usb 3-1: new high-speed USB device number 99 using dummy_hcd [ 1127.111194][T15645] usb 3-1: Using ep0 maxpacket: 8 [ 1127.209431][T15645] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1127.324887][T15645] usb 3-1: config 4 interface 0 has no altsetting 0 [ 1127.974687][T15645] usb 3-1: string descriptor 0 read error: -22 [ 1128.047387][T15645] usb 3-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 1128.108186][T15645] usb 3-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 1128.159885][T15645] usb 3-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 1128.178576][T15645] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1128.191751][T15645] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 1128.199460][T15645] usb 3-1: media controller created [ 1128.233144][T15645] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1128.296855][T18993] netlink: 256 bytes leftover after parsing attributes in process `syz.7.3434'. [ 1128.328881][T18993] netlink: 64 bytes leftover after parsing attributes in process `syz.7.3434'. [ 1128.345299][T15645] zl10353_read_register: readreg error (reg=127, ret==0) [ 1128.536979][T15645] usb 3-1: USB disconnect, device number 99 [ 1128.546718][T19001] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1128.916697][T17520] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1128.975863][T19013] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3440'. [ 1129.404073][T19014] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3440'. [ 1129.421554][T17520] usb 9-1: Using ep0 maxpacket: 16 [ 1129.571388][T17520] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1129.577344][T19019] lo speed is unknown, defaulting to 1000 [ 1129.585586][T17520] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1129.598773][T17520] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1129.614877][T17520] usb 9-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice= 0.00 [ 1129.625219][T17520] usb 9-1: New USB device strings: Mfr=32, Product=0, SerialNumber=0 [ 1129.635312][T17520] usb 9-1: Manufacturer: syz [ 1129.655388][T17520] usb 9-1: config 0 descriptor?? [ 1130.152741][ T42] usb 3-1: new high-speed USB device number 100 using dummy_hcd [ 1130.154798][T17520] playstation 0003:054C:0DF2.0015: item fetching failed at offset 4/5 [ 1130.188204][T17520] playstation 0003:054C:0DF2.0015: Parse failed [ 1130.197990][T17520] playstation 0003:054C:0DF2.0015: probe with driver playstation failed with error -22 [ 1130.394162][T19033] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.3445'. [ 1130.396720][ T42] usb 3-1: Using ep0 maxpacket: 32 [ 1130.488487][ T42] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 1130.517942][ T42] usb 3-1: config 0 has no interface number 0 [ 1130.539986][ T42] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1130.804779][ T42] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.827864][ T42] usb 3-1: Product: syz [ 1130.832085][ T42] usb 3-1: Manufacturer: syz [ 1130.857428][ T42] usb 3-1: SerialNumber: syz [ 1130.880416][ T42] usb 3-1: config 0 descriptor?? [ 1130.900661][ T42] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1131.558354][T19044] block nbd8: shutting down sockets [ 1132.083196][ T42] usb 3-1: qt2_setup_urbs - submit read urb failed -8 [ 1132.085913][T19050] fuse: Bad value for 'fd' [ 1132.108385][ T42] quatech2 3-1:0.51: probe with driver quatech2 failed with error -8 [ 1132.871669][ T42] usb 9-1: USB disconnect, device number 13 [ 1133.143039][ T5889] usb 3-1: USB disconnect, device number 100 [ 1133.378490][T19060] bond0: entered promiscuous mode [ 1133.392483][T19060] bond_slave_0: entered promiscuous mode [ 1133.409741][T19060] bond_slave_1: entered promiscuous mode [ 1133.420599][T19060] batadv0: entered promiscuous mode [ 1133.431317][T19060] debugfs: 'hsr1' already exists in 'hsr' [ 1133.439233][T19060] Cannot create hsr debugfs directory [ 1133.444986][T19060] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 1133.455153][T19060] hsr1: Slave B (batadv0) is not up; please bring it up to get a fully working HSR network [ 1133.475975][T19060] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1133.485334][T19060] bond0: left promiscuous mode [ 1133.491631][T19060] bond_slave_0: left promiscuous mode [ 1133.498483][T19060] bond_slave_1: left promiscuous mode [ 1133.505583][T19060] batadv0: left promiscuous mode [ 1133.546262][T19065] netlink: 220 bytes leftover after parsing attributes in process `syz.2.3453'. [ 1133.779823][ T31] INFO: task kworker/0:6:5973 blocked for more than 143 seconds. [ 1133.788726][ T31] Not tainted syzkaller #0 [ 1133.793866][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1133.944403][ T31] task:kworker/0:6 state:D stack:22984 pid:5973 tgid:5973 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1133.996627][ T31] Workqueue: usb_hub_wq hub_event [ 1134.004203][ T31] Call Trace: [ 1134.016496][ T31] [ 1134.023050][ T31] __schedule+0x1190/0x5de0 [ 1134.039177][ T31] ? device_del+0x64e/0x9f0 [ 1134.055098][ T31] ? device_unregister+0x1d/0xc0 [ 1134.066427][ T31] ? i2c_del_adapter+0x53e/0x6f0 [ 1134.072659][ T31] ? dvb_usb_i2c_exit+0x9f/0xf0 [ 1134.077832][ T31] ? __driver_probe_device+0x1de/0x440 [ 1134.083314][ T31] ? __lock_acquire+0x622/0x1c90 [ 1134.088312][ T31] ? __pfx___schedule+0x10/0x10 [ 1134.093470][ T31] ? find_held_lock+0x2b/0x80 [ 1134.098350][ T31] ? schedule+0x2d7/0x3a0 [ 1134.103070][ T31] schedule+0xe7/0x3a0 [ 1134.107243][ T31] schedule_timeout+0x257/0x290 [ 1134.112413][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1134.117945][ T31] ? mark_held_locks+0x49/0x80 [ 1134.123114][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1134.128485][ T31] __wait_for_common+0x2fc/0x4e0 [ 1134.133440][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1134.139229][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 1134.146634][ T31] ? __pfx_device_del+0x10/0x10 [ 1134.151680][ T31] ? kobject_put+0xab/0x5a0 [ 1134.156288][ T31] i2c_del_adapter+0x546/0x6f0 [ 1134.161585][ T31] ? usb_free_stream_buffers.isra.0+0x1b8/0x2b0 [ 1134.168249][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 1134.173543][ T31] ? rcu_is_watching+0x12/0xc0 [ 1134.178899][ T31] ? kfree+0x252/0x6d0 [ 1134.185429][ T31] ? usb_urb_exit+0x1ff/0x2b0 [ 1134.190278][ T31] dvb_usb_i2c_exit+0x9f/0xf0 [ 1134.194995][ T31] dvb_usb_device_exit+0x334/0x580 [ 1134.200318][ T31] ? __pfx_dvb_usb_device_exit+0x10/0x10 [ 1134.205984][ T31] cxusb_probe+0x1c9/0x7d0 [ 1134.210526][ T31] ? mark_held_locks+0x49/0x80 [ 1134.215309][ T31] ? __pfx_cxusb_probe+0x10/0x10 [ 1134.220361][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1134.225572][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1134.231603][ T31] ? __pm_runtime_set_status+0x13c/0xa80 [ 1134.237420][ T31] usb_probe_interface+0x303/0xa40 [ 1134.242544][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 1134.248988][ T31] really_probe+0x241/0xa90 [ 1134.253529][ T31] __driver_probe_device+0x1de/0x440 [ 1134.261636][ T31] driver_probe_device+0x4c/0x1b0 [ 1134.266859][ T31] __device_attach_driver+0x1df/0x310 [ 1134.272253][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1134.278241][ T31] bus_for_each_drv+0x159/0x1e0 [ 1134.283106][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1134.288565][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1134.293768][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1134.299653][ T31] __device_attach+0x1e4/0x4b0 [ 1134.304599][ T31] ? __pfx___device_attach+0x10/0x10 [ 1134.309972][ T31] ? do_raw_spin_unlock+0x172/0x230 [ 1134.315193][ T31] bus_probe_device+0x17f/0x1c0 [ 1134.320261][ T31] device_add+0x1148/0x1aa0 [ 1134.324864][ T31] ? __pfx_device_add+0x10/0x10 [ 1134.329827][ T31] ? mark_held_locks+0x49/0x80 [ 1134.334604][ T31] usb_set_configuration+0x1187/0x1e20 [ 1134.340356][ T31] ? __pfx_usb_generic_driver_probe+0x10/0x10 [ 1134.346561][ T31] usb_generic_driver_probe+0xb1/0x110 [ 1134.352397][ T31] usb_probe_device+0xef/0x3e0 [ 1134.357261][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 1134.362645][ T31] really_probe+0x241/0xa90 [ 1134.367538][ T31] __driver_probe_device+0x1de/0x440 [ 1134.372959][ T31] ? usb_driver_applicable+0x1c7/0x220 [ 1134.378649][ T31] driver_probe_device+0x4c/0x1b0 [ 1134.383702][ T31] __device_attach_driver+0x1df/0x310 [ 1134.389193][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1134.395097][ T31] bus_for_each_drv+0x159/0x1e0 [ 1134.400115][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1134.405512][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1134.410833][ T31] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1134.417284][ T31] __device_attach+0x1e4/0x4b0 [ 1134.422237][ T31] ? __pfx___device_attach+0x10/0x10 [ 1134.427701][ T31] ? do_raw_spin_unlock+0x172/0x230 [ 1134.432920][ T31] bus_probe_device+0x17f/0x1c0 [ 1134.437855][ T31] device_add+0x1148/0x1aa0 [ 1134.442401][ T31] ? __pfx_device_add+0x10/0x10 [ 1134.447403][ T31] ? add_device_randomness+0xb7/0xf0 [ 1134.453165][ T31] ? __usb_get_extra_descriptor+0x158/0x1c0 [ 1134.459336][ T31] usb_new_device+0xd07/0x1a60 [ 1134.464127][ T31] ? do_raw_spin_lock+0x12c/0x2b0 [ 1134.469281][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 1134.474587][ T31] ? mark_held_locks+0x49/0x80 [ 1134.479431][ T31] hub_event+0x2f34/0x4fe0 [ 1134.483889][ T31] ? __pfx_hub_event+0x10/0x10 [ 1134.489109][ T31] ? interval_tree_remove+0xae0/0xee0 [ 1134.494508][ T31] ? rcu_is_watching+0x12/0xc0 [ 1134.499571][ T31] process_one_work+0x9cf/0x1b70 [ 1134.504626][ T31] ? __pfx_hcd_resume_work+0x10/0x10 [ 1134.510040][ T31] ? __pfx_process_one_work+0x10/0x10 [ 1134.515431][ T31] ? assign_work+0x1a0/0x250 [ 1134.520115][ T31] worker_thread+0x6c8/0xf10 [ 1134.524731][ T31] ? __kthread_parkme+0x19e/0x250 [ 1134.529883][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1134.535091][ T31] kthread+0x3c5/0x780 [ 1134.539234][ T31] ? __pfx_kthread+0x10/0x10 [ 1134.543831][ T31] ? rcu_is_watching+0x12/0xc0 [ 1134.548689][ T31] ? __pfx_kthread+0x10/0x10 [ 1134.553819][ T31] ret_from_fork+0x675/0x7d0 [ 1134.558546][ T31] ? __pfx_kthread+0x10/0x10 [ 1134.563168][ T31] ret_from_fork_asm+0x1a/0x30 [ 1134.568051][ T31] [ 1134.571277][ T31] INFO: task syz.5.2975:17249 blocked for more than 144 seconds. [ 1134.579759][ T31] Not tainted syzkaller #0 [ 1134.584691][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1134.593525][ T31] task:syz.5.2975 state:D stack:27064 pid:17249 tgid:17248 ppid:10782 task_flags:0x400140 flags:0x00080002 [ 1134.605649][ T31] Call Trace: [ 1134.609031][ T31] [ 1134.612406][ T31] __schedule+0x1190/0x5de0 [ 1134.616975][ T31] ? __pfx___schedule+0x10/0x10 [ 1134.621844][ T31] ? find_held_lock+0x2b/0x80 [ 1134.626592][ T31] ? schedule+0x2d7/0x3a0 [ 1134.630934][ T31] ? usbdev_open+0x1b6/0x8b0 [ 1134.635947][ T31] schedule+0xe7/0x3a0 [ 1134.640192][ T31] schedule_preempt_disabled+0x13/0x30 [ 1134.645674][ T31] __mutex_lock+0x818/0x1060 [ 1134.650360][ T31] ? klist_put+0xc7/0x1b0 [ 1134.654698][ T31] ? usbdev_open+0x1b6/0x8b0 [ 1134.659836][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1134.664883][ T31] ? kobject_put+0xab/0x5a0 [ 1134.669457][ T31] ? __pfx_device_match_devt+0x10/0x10 [ 1134.674933][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 1134.680335][ T31] ? usbdev_open+0x1b6/0x8b0 [ 1134.684932][ T31] usbdev_open+0x1b6/0x8b0 [ 1134.689419][ T31] ? kobject_get_unless_zero+0x156/0x1e0 [ 1134.695064][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 1134.700072][ T31] ? chrdev_open+0x10b/0x6a0 [ 1134.704671][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 1134.709820][ T31] chrdev_open+0x234/0x6a0 [ 1134.714606][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1134.719607][ T31] ? fsnotify_open_perm_and_set_mode+0x17c/0xa60 [ 1134.725943][ T31] do_dentry_open+0x982/0x1530 [ 1134.730962][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1134.735913][ T31] vfs_open+0x82/0x3f0 [ 1134.740256][ T31] path_openat+0x1de4/0x2cb0 [ 1134.744860][ T31] ? __pfx_path_openat+0x10/0x10 [ 1134.749844][ T31] ? __lock_acquire+0xb8a/0x1c90 [ 1134.755002][ T31] do_filp_open+0x20b/0x470 [ 1134.760101][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 1134.765254][ T31] ? alloc_fd+0x471/0x7d0 [ 1134.769661][ T31] do_sys_openat2+0x11b/0x1d0 [ 1134.774363][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1134.780330][ T31] __x64_sys_openat+0x174/0x210 [ 1134.785209][ T31] ? __pfx___x64_sys_openat+0x10/0x10 [ 1134.790671][ T31] do_syscall_64+0xcd/0xfa0 [ 1134.795191][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1134.801150][ T31] RIP: 0033:0x7fb4e0d8df90 [ 1134.805589][ T31] RSP: 002b:00007fb4e1c3cb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 [ 1134.814138][ T31] RAX: ffffffffffffffda RBX: 0000000000101301 RCX: 00007fb4e0d8df90 [ 1134.823399][ T31] RDX: 0000000000101301 RSI: 00007fb4e1c3cc10 RDI: 00000000ffffff9c [ 1134.832028][ T31] RBP: 00007fb4e1c3cc10 R08: 0000000000000000 R09: 0000000000000000 [ 1134.840124][ T31] R10: 0000000000000000 R11: 0000000000000293 R12: cccccccccccccccd [ 1134.848226][ T31] R13: 00007fb4e0fe6038 R14: 00007fb4e0fe5fa0 R15: 00007ffdf65f2648 [ 1134.856210][ T31] [ 1134.859348][ T31] [ 1134.859348][ T31] Showing all locks held in the system: [ 1134.869235][ T31] 1 lock held by ksoftirqd/0/15: [ 1134.874220][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1134.884808][ T31] 1 lock held by ksoftirqd/1/23: [ 1134.890675][ T31] 1 lock held by khungtaskd/31: [ 1134.895597][ T31] #0: ffffffff8e3c4760 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1134.906143][ T31] 2 locks held by getty/5584: [ 1134.911063][ T31] #0: ffff88814d6bd0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1134.921179][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1134.931432][ T31] 5 locks held by kworker/0:6/5973: [ 1134.936715][ T31] #0: ffff888143eb7d48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1134.947778][ T31] #1: ffffc90002ed7d00 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1134.959152][ T31] #2: ffff888144bc2198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fe0 [ 1134.969690][ T31] #3: ffff888025ae4198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1134.979075][ T31] #4: ffff888031722160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1134.988446][ T31] 4 locks held by udevd/14443: [ 1134.993679][ T31] #0: ffff88805d0698b8 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xe1/0x12d0 [ 1135.002945][ T31] #1: ffff888031dd6888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x4f/0x2a0 [ 1135.013065][ T31] #2: ffff88804921eb48 (kn->active#19){++++}-{0:0}, at: kernfs_seq_start+0xbc/0x2a0 [ 1135.022823][ T31] #3: ffff888025ae4198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 1135.032445][ T31] 4 locks held by kworker/u8:6/14446: [ 1135.037924][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1135.048088][ T31] #1: ffff8880b8524088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1135.058180][ T31] #2: ffff8880b8525b18 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x127/0x1d0 [ 1135.068002][ T31] #3: ffffffff9acc9288 (&obj_hash[i].lock){-.-.}-{2:2}, at: debug_object_activate+0x14c/0x4c0 [ 1135.078904][ T31] 3 locks held by kworker/u8:7/17156: [ 1135.084285][ T31] #0: ffff8880b843a398 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1135.094285][ T31] #1: ffff8880b8424088 (psi_seq){-.-.}-{0:0}, at: __schedule+0x1861/0x5de0 [ 1135.103089][ T31] #2: ffff88804b860788 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: cfg80211_wiphy_work+0x99/0x580 [ 1135.113684][ T31] 1 lock held by syz.5.2975/17249: [ 1135.118874][ T31] #0: ffff888144bc2198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x1b6/0x8b0 [ 1135.128182][ T31] [ 1135.130503][ T31] ============================================= [ 1135.130503][ T31] [ 1135.139874][ T31] NMI backtrace for cpu 1 [ 1135.139891][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1135.139914][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1135.139926][ T31] Call Trace: [ 1135.139933][ T31] [ 1135.139942][ T31] dump_stack_lvl+0x116/0x1f0 [ 1135.139972][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1135.139998][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1135.140027][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1135.140052][ T31] watchdog+0xf3f/0x1170 [ 1135.140080][ T31] ? rcu_is_watching+0x12/0xc0 [ 1135.140105][ T31] ? __pfx_watchdog+0x10/0x10 [ 1135.140126][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1135.140148][ T31] ? __kthread_parkme+0x19e/0x250 [ 1135.140188][ T31] ? __pfx_watchdog+0x10/0x10 [ 1135.140211][ T31] kthread+0x3c5/0x780 [ 1135.140232][ T31] ? __pfx_kthread+0x10/0x10 [ 1135.140253][ T31] ? rcu_is_watching+0x12/0xc0 [ 1135.140277][ T31] ? __pfx_kthread+0x10/0x10 [ 1135.140297][ T31] ret_from_fork+0x675/0x7d0 [ 1135.140314][ T31] ? __pfx_kthread+0x10/0x10 [ 1135.140333][ T31] ret_from_fork_asm+0x1a/0x30 [ 1135.140374][ T31] [ 1135.140382][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1135.261480][ C0] NMI backtrace for cpu 0 [ 1135.261497][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 1135.261528][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1135.261541][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 1135.261577][ C0] Code: a7 6c 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 55 29 00 fb f4 3c 0a 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 1135.261596][ C0] RSP: 0018:ffffffff8e007df8 EFLAGS: 000002c6 [ 1135.261613][ C0] RAX: 000000000454d935 RBX: 0000000000000000 RCX: ffffffff8b60d2a9 [ 1135.261626][ C0] RDX: 0000000000000000 RSI: ffffffff8da2c59c RDI: ffffffff8bf073c0 [ 1135.261639][ C0] RBP: fffffbfff1c12f40 R08: 0000000000000001 R09: ffffed1017086655 [ 1135.261652][ C0] R10: ffff8880b84332ab R11: 0000000000000001 R12: 0000000000000000 [ 1135.261665][ C0] R13: ffffffff8e097a00 R14: ffffffff908216d0 R15: 0000000000000000 [ 1135.261678][ C0] FS: 0000000000000000(0000) GS:ffff888124a05000(0000) knlGS:0000000000000000 [ 1135.261706][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1135.261719][ C0] CR2: 00007fd665bb9358 CR3: 000000004a67d000 CR4: 00000000003526f0 [ 1135.261732][ C0] Call Trace: [ 1135.261740][ C0] [ 1135.261746][ C0] default_idle+0x13/0x20 [ 1135.261768][ C0] default_idle_call+0x6c/0xb0 [ 1135.261790][ C0] do_idle+0x38d/0x500 [ 1135.261817][ C0] ? __pfx_do_idle+0x10/0x10 [ 1135.261840][ C0] ? trace_sched_exit_tp+0x2f/0x120 [ 1135.261866][ C0] cpu_startup_entry+0x4f/0x60 [ 1135.261889][ C0] rest_init+0x16b/0x2b0 [ 1135.261912][ C0] ? acpi_subsystem_init+0x133/0x180 [ 1135.261940][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 1135.261971][ C0] start_kernel+0x3f6/0x4e0 [ 1135.261999][ C0] x86_64_start_reservations+0x18/0x30 [ 1135.262027][ C0] x86_64_start_kernel+0x130/0x190 [ 1135.262055][ C0] common_startup_64+0x13e/0x148 [ 1135.262084][ C0] [ 1135.456467][ C0] vkms_vblank_simulate: vblank timer overrun [ 1137.068355][ T5184] udevd[5184]: worker [14443] /devices/platform/dummy_hcd.5/usb6/6-1 is taking a long time