last executing test programs: 18m29.920649962s ago: executing program 32 (id=136): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r2 = syz_open_dev$ndb(&(0x7f0000000000), 0x0, 0x101000) ioctl$BLKDISCARDZEROES(r2, 0x127c, &(0x7f0000000040)) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0x8000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) fsopen(0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) r5 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r7, 0x1, 0x1a, &(0x7f0000000000)={0x3, &(0x7f00000000c0)=[{0x20, 0x5, 0x2, 0xfffff038}, {0x28, 0x7, 0x0, 0xa56e}, {0x6, 0x0, 0x0, 0xa1a}]}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000050000000100000001000013040000000200000088060000ff0f0000002e"], 0x0, 0x35, 0x0, 0x1, 0x18000000}, 0x28) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000540)=ANY=[@ANYBLOB="020100020a19000000000000000000000300050000000000020000000000000000000000000000000200100000000000ffffffff00000000030006000020000002000000e0000001000000000000000038040e2257c9a120c3fd35626e4e383a7787dc83b335a006be7e26e95846c9b2768eb9c582656f3c0f0da0af1017e50e9458acb298d4caacd75da4733a361002332ab37f7ce7721b4dd9eb9f093bacd7c0a793fa192d1d99c563ba69f0be20f5c8c2d3fedce78f535471489f3906f4b29bd5595e165291abe214b852c4242f4685394c3c908f69774edae6d2"], 0x50}}, 0x0) sendmmsg(r6, &(0x7f0000000180), 0x4000190, 0x0) ioctl$USBDEVFS_CLEAR_HALT(r5, 0xc0105502, 0x0) dup(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) 18m29.88782715s ago: executing program 33 (id=140): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) lchown(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) statx(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x1000, 0x40, &(0x7f0000000c00)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_SETQUOTA(r1, 0xffffffff80000801, r2, &(0x7f0000000d00)={0x1, 0x1, 0x0, 0x9, 0x2, 0xf, 0x7, 0x8, 0x168}) getsockopt$sock_cred(r0, 0x1, 0x11, &(0x7f0000002840)={0x0, 0x0, 0x0}, &(0x7f0000002880)=0xc) stat(&(0x7f00000028c0)='./file0\x00', &(0x7f0000002900)={0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000002980)={{0x1, 0x1, 0x18, r0, {0xffffffffffffffff, 0x0}}, './file0\x00'}) lstat(&(0x7f00000029c0)='./file0\x00', &(0x7f0000002a00)={0x0, 0x0, 0x0, 0x0, 0x0}) lstat(&(0x7f0000002a80)='./file0\x00', &(0x7f0000002ac0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000002b40)={{0x1, 0x1, 0x18, r0, {0xee00, 0xee01}}, './file0\x00'}) r9 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, 0x2}, 0x94) r10 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r9}, 0x10) fstat(r10, &(0x7f0000000680)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mount$fuse(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000600), 0x8808, &(0x7f0000000840)={{}, 0x2c, {'rootmode', 0x3d, 0x2000}, 0x2c, {}, 0x2c, {'group_id', 0x3d, r11}}) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000002b80)=0x0) r13 = getegid() statx(0xffffffffffffff9c, &(0x7f0000002bc0)='./file0\x00', 0x0, 0x1, &(0x7f0000002c00)={0x0, 0x0, 0x0, 0x0, 0x0}) getresgid(&(0x7f0000002d00), &(0x7f0000002d40), &(0x7f0000002d80)=0x0) r16 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r16, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0x5) setreuid(r17, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000003400)={0x3, 0xd, {}, {0x0}, 0x6, 0xbf}) stat(&(0x7f0000003440)='./file0\x00', &(0x7f0000003480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000400)="364375ae25befbaa56de9ce004fd6a89eee87c678f3b3407a4a27c552013abff73d009ebdb8ac0797ed0e29bbe0241081b8cc3fc188575da22d09f1d283ade55abe6179e0bc69557ca2ca4395e1ec5b7f0640980ba4296099e12c837a72a99d55b6a73d8e589e2f6615a4d31f08b1364ddafdb7e86128e751dd824597f6f34ed47fd02ce06831580dd538a6ae50d89becd9932b55c712d075efe3ba0c1e051f234413ecf1725865411440ee2b2f6c7bfd3941d09ca759b795a554ac60d9f31d38b87546dc159e9e208a295127515cce3c1efe6791eaaebe0888a3f17a257a460d1ee3578a9c73e973d50fd1a5dc44cffbff4021d3ef30e8fa5e282ef4d2e0ecc5f972f3fdc449e1054e1882d6cf243492ff5b6e2654448bef83730e24cccda6e174dcafefc5ba832ce8515f3765f80e317e6e98bf6ce9149994d9e8887f2e2f932a56e34a593764ad0edbaf145ff97e9137741d78692f5a31978e4c64576eb95911e4db28d02791c97ee7743733316ef5f9d0604f38b04b66194ca31bd2a55a4b08e5abef2da2c2b377726a0fae5c8b31ed11a7cfb49de94ed45534e9ed0d6c60581823e0ce33477db7eede7da3074378081df5a9b0bc987a9f3dec3e59bc967e24528d378817dc378e5a42072975679a630c04a57a5f4ec6317f7764912d40113f4ecfacdc0109e9c2ee94ad75a4e6481bd6a608f04c2449e5a7097c9201426aafa64185c58457cc0d7b28424d90ddb412d59b104b4d1e8fb018fc5c199a47e90e55ae286069371a9f15babde72ac3245235eaf1bc0fc51b8902c86043464c73a726b343fcd36c178a485233b704f6b317826b0a4ae0e61322f0002f8503dce2c88256696823c4c81b659e9c4b0ffda7e0e85ddeec2091dbf144498561e3289bf6988e18eb404838644308833ff327030738a724368b44efcd6954fdbd93b7399366f254391a0a8c1917eb16d6487c62b0e013c80a3edd38aa3b694127306cfa2f359c4e37d012be1f624cf4ef800a617bec4aee607f69a9b9d3f2490a7849d76a9fec7cd6c26d140ed81dc83d3d1a29b45aa496bfac86e9dd7cfab2a284d83a5c08c82861659d388ad3d238e90e0e7bac7042e8ef7d19fd20b9ec02456ac9963959b1b0bed97d98a901304da8d7c666e765f788d71e61cfbe908fe0383d37e217b9b08775a5839a2b6ab894a503423bc3c90aa284d5ddca3fa94d351493daf0260b702f542be6243bb5c6cf43c996dc4e36a8aabde403583b299a6b59f1f1727490d823896f5d8a3d407baf7d6024970a8f47faf20fd9dd125ccb77a15f864159fa83006bab2843bb6c8db4e72c24eeadb0ef5b83935ba21a558c42758fa19e578c18f3ff9bf84c101e629c72862656ca8f74d50e83463bfab27e2f9a39cb135717cb68812332d11c23e3909595aa36e9126fa10ac011316933b20ac5999d6231d83b62ca072a3ed8abea9db9f60ce04851a288d509d02c7677022bf57f8c32de29b7db00bba4a85762c10587acf53ca23e0f2c0ffdafaf181075c17af8f8f5a5b712d399d10824be533e05851e7543b8cdc2b0d399ef794124e74aa5f76de1e2055ec026dca1db3567eb9ac5f257edc5c12bcb7c62bb964d2801e0699bb2a531ec5f0913e50e927df5d771862d1643a85f9284335e8ae69cf5b0cee5b9d3cbcdbdd344de6e1754256480728ca8129dc3b4f4cdf141be5b33cb8c02b8c41eed71042a577f585b6707b8e1d75273378276b55af5249177f9805993c48fab221cef58a8601546bbba8f0345be12c14cd25bfe4c01f3c602f04a611191245cdf4daddb6698bb155c2a59544a9853420c4e5255a04591a73fc46a31fd11de16e03c15e4afda68f7b7ff9ec36bf1bc0fd0f81f2918185a6a556e7c49abdb7dc1745fdc8ebae5fe6d01ae8735e8a30e8522ad505a5dd28010cad591b905e09a6d58d14c80e6241660d27a4d136dc048a4631a6234fe3e4d40d9c295117a20f59f9881477771daa4ea0b54a78d75aab82ff29a0b2975362775b4bd330dd61faebe0f3dfd58e70839b6f8a641459a55d227f59794d860582aac2856fd7299a5165798389943e448f9d775ea010a9adfdc5f905d2419bed83b82b0969092144bc943e5ac135ed8e464721bb54a0bf91124b4422cac3743aa7fff23ce075a7af71d990296ccdf0ea7ad1c19ce6cc82608cd493b8d0e9d36fa2c06b7767fe5a6c027f4d053da6b599fd199e34fe2ccde7f97f47dbacb9ab9ae6daf23b2b21ce3063b8713281fea81a94b8d4b61925fda416128086d623c3fc5a60fae7ad24940be3c9bf764859bbd27d9aa5f93818c46cfd6a74d9122ef09bb2df69d58e15f4f533fc4d741441a1ffee9e1e921255626f1cdeadc3acf469381c8449923751d5ee0a3b12598512e0d0f073f9a731061136b2e2401b7fbb009baa2192039db2880304d4019d7acf3989734cc876dcee90d6fa76e455df9c50f50bba57db31202eaf46b8ef4d2398322c2cd3a152e9c78039a68df978e0ba5d30c32ef58a8aafacaeecb08800fea8f7c12188753593297cd079f2026d65bc1acfff96b775d99f8dadedcdc36bc9128e4b642877dcf2f61bd09435f77570925607e31599373a986816e1aca115d03740adef51969b2b5f7daf5c778696f266bec757f4e8d95d2b3e0fe9e4075a638d8d4eadb0239f7df2cd193f038ea49ca35d15ecf196ec9d58e9e14e6c6e36375d2c962a2e5e62c1c5d410b6310cce66a5c326a693f50556ad131a4c3424aa8c97a2c91eed9e310595db05d75d65e85e2af008d2fc2053c2c2651add876f54e38d1e4201b84937d5d38f8d8d4b05a7c1cab21e5d80e8f1c8f491a02ff3fef8cd57b9fa44ab6fa253087bda3245e290ffbbeb95a3871f7583c6287b258681d84e6e2be0cc32b95a9fe4550ad16b0a014d84ae796ce40ee50cbdc4ce36f3758c02a300a96d76f55885834c8b73e6d295ad64ff11038f32e1e5133ad765d38fb9aa5e219c4f04d0edd7f9297b6225ce6cd94572e7ace28e7610d30fee88eda0f264e25039991891cfa5df8bcbe47d9cd74437fd300f19278a9ed85fcf988d08cb4b513d5a2e8a2694186b3fe36195471af0e3f712711d6989848ff637c827648ecc0fc057df7b4a0e2b54522a2dcdbafbce4f93fd2919d44c559aa0bfce96d3ae411afc6da278f6596b872e638552618283d429d1216a8dd74cc9c9c38adbc01ae963c9a0bc7c12fb472a64ae7fdcb6aaed378fd67f8d3ea7f428f78615459f68a3df8cdb089d2f517b94fddb5d65a201944e09d6025e36560d27e75aded20984d0870e21c6345aebd39d93be441a48552953990c63c5522679b43293436333f62ddf912be5a5e21ba9664de1655e4c7074088ee4cb448f5b9d84a8152bea25cd14d1069370221722a08da389e18b5b05af7eb24fcf518d6b6f338d7898a7e865e9d282615986f51981b9a8f4049003795ea1592070c8c2602c8182208f03ab18523091e76407b894e9013e53ae4ebe56f48bd7174cc854a83a6a643b0e34281e895b9d41ad4cb9513f23b4e0c25d3b6f519e2fe85f396494b155697ccff38999dfb06a54ff80cd4e9d20da7ff497aa27c0ad8a7034b28269a95a44b1e2a38742429000adc31ebf443cd02dcee37b2dfd9293e75ed829f1f113e1afda63cdba868fb2910a8e4b950b2a9cb575a6e47acb4e83a56ba1ae2522df643ec3b1431316ace24eddb7d367a52ef48e65d826f333b2197435b3051a66e1d1e27368e6379adea0e95b17859f2e3ff38e798035ec7352c34a72787f0724e0645bd97c57185ea8b0271fc6c5a913eebcbe005f6b3d96cae9e485f18b68db2dbb900dc79449aed77f3ea82440b5995a56fde4465e70845dc4173ec9f37ec868f9f0c7404e41223945c4712fde98fa87c53548b9aa0b6c55868cac5ad4d757299ef24d6ecb2886c18ef95e7385ce7c00f139ca12170d797dd6c3db71680a51dd9358a2a758257637800569eb7fc1adbefb84727e9d9f5591d68d2ac7976a15dedd8ffc65b6296e188f018ad7cf825c784244342dc44f3d5ab884b2751c23e2d5f45f3f5166fe642e182462e8b4aa6d4d4313bda067ee004d3bb8cd6bf57b5cce267ba3aa778f96133ef47dd2e35696fbdfad40d90ae7cbe9e876ecb94ddcac56274d6d4c8ababdfa60e410a7d26adac274229ff4c5ac41b142bc8be418eb23c7204f026493626a755b15c92ad4a611427b9cf56b1405beb766640aedb49b531e026b28ce6c2b855564588860e0161e550b82d1529c54f0a0ec9594c2bd49072e153ecef0a210f53ed7e8e5334fee5810d292f7dd714587281aaf692635e5fbfe8311c9cebd2f60a90ebd28e32afdf3531ce606f165af1a020e9751324027fb17223793a6a6bc28b12f173b7680e9a93892be5259a1267a0c487860c33b6434b2e1be1427b65e2eeec50c8332426bc102af7354d6fb8ebf11b88958146a1e53c892f4f66127aa30904ee97beb2a39b72cfcf55e1fd775222afb9dcda6c3d46977aaba100d9391767e7af305384f5806490b9cf351c6550940a0cc86bfccf5493f0037d4e207db5924ff1f745f4cbe1a185686272957c71483ea90c9cf443b88e324ee05dca2aee45ea0c17b8f8ce2da46ad7bec5ebadf7e48a0d7d0076705f683b1e5ff296bfafda1c80b5c596cd137c4ec169e392d38dadf225cd9719c2b1c14a1df5a8c27201c0766c2d4a9dccf4051fb6758273e428c25c14c871b61f366ed44e327553388e95fc77fc730ca3bafc04d6bf13eb21311ae3edc710f4ed713482adf2c1e8228e70905a7ebe691b86425ebacd12b352fdb05b1a17eec3c9449545b521badfc72c53f162274d7d517dc4f4d047393007d3c071e78b013563f1895bcf95a1548468db12b86749d29204dabbbdfe7d55cd1ec2f022d68225b312efaa94bed5a502a83226402b43b6a3a438c53bed83bd0082995dccd8a6adaa88d4093fa309fb8eeda52786763ac25da36679065c80fc46e98ccd58d7bc86b383901941ac7761877dade2cb17ea37142c76aa650d9c5d6acac3f5d54f074458f985814ef7a319c98ae36f4ec87ae17ad6d97b1974b6e91e5d7836b71af884530ee42bc2436c453c398f17d4aac6831804971701636c4aa2429d5f55c428479d269c4ff1b5b934ea851e9962410c1fea7e7e5db22bd9e63095001b86fce21cc8db6e737b47a8f5b96d9e9c3d984a9ea30e8653b6143805c1674d3d76854b5ffd12ffe86e0ab1950292f6b1e59ee31fd0077ab540e52fc3bc352d6298b49af015dd32e6ad0069d338bbfb13c865fab8d1d34dd6efd22e9e90f3c3cabbd171e59bd02d581492000e60199777e58b9b4a492d58935f1190814da18d6ef460d27818f51e022a1725ba13bec12bfdbc5ca217282459e886c8ecc21b87aaab2704b99bb82c8a27a33e1a12fd0ac5ed1b33d325fa8eede3c18d2f8b11c98c7bebbcce9a0919286b673ee1d75447745e7003c6b20769bbea982f1a4d20b38c84e51146d2803fa576f3fa1bfa7c5f1e151b6ae56b19656db9d5589cc298774467095aced1abb88c535afe4be8010b7c48c19abf10cdeb24f8fdcb9d1e8bb9b364af4e59d501e2c4863b7760846763c539e981ef0ae927d69771e5d2d61d86d4790693d081048a28a812cd42423cd587d1471db676683bfdb3cfb3ccd0e907052bb729c3fd6728f2f89aa1e5bae4f535e1f95ed36360d4fdaf4dd207e2208b7ef2f6c0ff4bc2891829006614ea28b435c64e33648ce3b0dc00977cf2d8d6bef4028fd21fc4f6d2b908ce2bcb950431c7d5feeda85dc48d5877ab604e9cac4ad79e93b8ee6c0a03be80edbd0c0d30395ff2b6ae1a61f0822f74ec6385db6421905c0b06c75a4220bb686209b697eb038ea46f2c3573592a94b3034154d6be62245d2c6fb3eef09ab4555cff1217a607c60cd1ead5a5ab26d2011a441ca96037c2874155edbdf4f9bd68654307d6ad939e5e3b22666e6c28e427f28619b311c6b98952312f15a729198c50b6d057e4b6e91575167e4f0f623c5481f90de752485c84b363e681e4dba7356cb57d2a7f8534ad7645ccd273caef1730a0734d08226bbb2d594be6635932f850e2d4aad8d2710de60690f6b677c9fd58c4225a178b5cfa613e4941cfda6ddc7a7aa5aec3fa775a0d38b3e302ddb28b276ccccf58cefda947d479887b2c91fa77a9c0582424305329edf20bb49d52d0217efabd9aaf3db0d53eb71f8002ac36aaa67744ac801f4ca8bd1def7eac0932214ecbd21f95beb5b918c7ed9fe34237e12d6451e1745f4f910f95be6dde7e75d27c7a23d13273a1c99084debed392393ffc1b70e0e486329b0807e527b0d445977f80288a2a18836f7204e69e119fd8220e7086023fdbd4e4479c388b04d2fee4ed7968df291df26043e82a079bb59742cde10ee2ce912e1f6274a47d09d4a50109d3f8e422e9d3fbc02aceb548511a8ea134daa0cd5c454d1c64250e39f0b4de33b8f221bd5b7791b6979580ef2fdcca9b165f2faf5ca41827a4a17dbd9e2d90375b9ea5d9263e73c1261b0c05c65d3d1d17a1b48eb0f6f81b37ea6d68dbefcc8f8be0e3932737142929c494ccc6634636591361c0657bf449bbaad06c0343a3ad7f5df39092af2ec87214b227b4d76dfce3d003e76bad9361768c6af85aed983fba00acb912e3088f6b9fb22c6f6c22ee89ba6d31352a5fe4027550de588eacc5c77f928130913952525a05d329464f4e076b2c18de87af94e55e1132d4a32976e53ef8369d0834a8368cc33f5a3fee06f52f609535ffed35e99350d99ccfdb5f674146a555d2840d20799e2a7239e808d0718c72811506523e96f7a96043a0985456916a46be766c320b5e17c6417bae8bada91ac2d09e100596f7bd33a1d5d88268a78c241007fea9998d24e2fae30d61cb13ea769c8440a3a9e5eb1cf6fda05a1fc41049ee4043f1ab33a0612cc2a12a64c354a10d4da52fd04c5eba1f376890709ececac6ba4d8b7b754e387dbe594c43486afa9fd7d2ab84e274a2ec342acc4caef180b3821ce9e1b8fce2c2976887ee34dd1c4cc0fa9b102d14fc90db1d9c1459aae20a5917039287fd150325140a640fb1ddd94e5741c1061f054a951b102700eace879067828531537ac5c08dc8c6b357763e07ca56946b41a52cbc683ad651e4470f906214a876e312dccbf6c05825dce7e0da8be2483a727019b968216a9ba4f5f0970b48dca887818242212e56867d4f3af61294bd003106bb3ee5176ac6b70d3314863a0d22bd44767fb6d7653738aa33828c9326a361c9f3f4b6f645fe0dbe726caf1f68e237059b98228b0add206586faa4690fd534554f507b935c122ecc42c3d54aa0cf6c2b84ba4db7b01ffb62d2ee6eef0939037bd8b519e7f21c7e997e510dfda78aa8c1dff95bcc70cb5ff888dec9f7575a94dcbf5223597b815c143065facf2fecf37832d734310de4cf26d65414b1d3fe9b30c8a09471fe04a250fc91c06bf3e8baf6634778fb241e7c9851e916f3ed8d9c4112f57a9e658fc63a7ebd736a18b0daadd80b4612a807870e96e392e76586df61bf92937662d9666e11433ce5f81b53b8cf57c0d35d737a2c95958c595a0f7d2aab092750268d238573e32caf57ec5a70f4b2241487f00ca6fa790e299ad6cf7d2fd5e7082e1a9d0b2e40a3063151159bb1fcd52882b87f12b4d49b360702528aa633ec792c7523dedbe32cafc727ab75c0fdec193c66e4ff5a52c96c326df31e015d3cb65f3c341b6ad197f87c2e1c0e5ed616e50bdc930b2dbf04a7d39297afbf80437b9091153e38ccd0653af7bbb1af507c882cc0225951e595db0b7ea702bf9b67b4dfccaf95e113df9037223708ff21fcd7ca68ff3238cf4d454e689b973a8e13b59a25af202a6ed2f8bcda706ee87b8d58c342ac130b794893872dbd6b88f5975a7c42f99167adf7256f62abd286d3acf78624a74fbc6884fdec1710ae4dea77e7d44831f1cd0d18119abd8a42eb38c1fe037e03518d4e39c10aa991872d5ced0a766c470c375c8db6907de99c3916a64f3e0af27de5ba22fb30a3c12f551a2e3fc427ae7fb9c01d67ee9e83e4dcc762430f99b46ec4fe77e9aff83e56a4b60546eff3741813d09cc69effb2699db83491fd97e6779df774ce9bddf8100305dc5cd3099b0567ccde6d9a1a983337e20b5e58b0f69c38dd35d04a6f4d0b121ae3c8aa4b8c652d2730369a67aa2bbd0d5317c4cb2f82744002d8c94a9e0fce0919eef439026d9336bcf4cff73a7b80965a9480fa1e280ee4562a5341b72fb10bd4f8ea1f56ec89063868708aa5e032cd26a54f3b79dfe58c5fdb23faa364832b459b0c287593e17cd488e6971d83f5c6d59bf650d093dad400f59f36fe9d3865d7377dd9b8821f00a85281e5576982636f8511fd6addffda43f33d7fdfa93edc9d0918946913b122a02b06945c808715fd7ba33e544405361977775bb93eedf42788d0231f3841f19ddfd60a692308d8da8d46fcaa6e9121fa27ad5e6cd24f74c062bc8aa314b840fda61fb179aa0cd82e6f15522c5fda02f2d57feca54e67245b27c37c8fd27f658cfcf7f5e51df90e34203f8f4ae6c7e68372a48d85ab88e9b3b25408d69a641c388f06e548ece5d4fe15bb9734202c97de90876796e9fbc401eb25962856f4df5981121f0356802d93f1b90c78a8c21ed143e7178d558b9a71f661eec15af3c51c96fd5b039296700300040b5abe632ec222e1822e4812097c6fc1a580faf2bdccbdd00f95d718b5ceaa7a29ecc3fb57943f703f40e05f29cdebd80b9ed28bf70fa365d942667cdbd4133dcfe4258c46208c422732aa6b0efdd1b3e52011511d47b42501aea477bff23af6d384ac768bb298896781967ff5e340e98e08e1cb2ed89a9596faa5f8e5b40e6dbf0898ceeb3c3e59d0e0cec42b07f296c3c1e61ff76ad173f3d17215d9775ac177eb54c0f74f3cf5264c89d3fe452413a3a76ec754bd226256f71363bd8bb14a3a807481d8dad46cfef54bf2c231d12f469cabecfb0578bb2f9adecc07225a9c2c2261343aaf93f06f1a157173f63e4d457195dff2556bbb81434a52eeb246c1817145ab06ade5d18b6ac1aba05f07490668ede52013821a1bfdaede6c9dfd69efdd8fef58d8200f873f46e2fdbea8c9d10675ca33c004ba262f83ad85df0d1751eb845eebc233ae094dd591c276d04bb363c59250cf07235fbb286140aaf42294790ae55212e6eb23aed71a4ee76014af5593ad2ede348dd0c11409ef8af54e546c08bc0f22160a7530297285fedca2d6c2b9bb6f1642c2b66177d4b1a6bb20eb17d71c396ee23d2d32bf764d52478de0a02d465ed715476e495562ae8b9c10be023880c18c5a80cf2936982410483bfd5f38c58f8efa95e6a90214113157235ba676aeefd07565506e0203273ee5d72bfea1c6b137a789d57d0313b59425cd883c398c5364f9f9312ccc241691164fa81bd561e385a4cb1a7850a6a9c61a9e8d369585c3c0aaf9b105f972e057b3938236c25f38e9ea3f02edcf7486ff67b53289c8849b77a72c478bab2e2f8c30fbe8bcdf597b72bf8eb1abd44594d27adb9661c6e46473b09941a7cd31ddb06c99a39f7bb8b21fe2f6810ab79cd8e9619a017350fb416e5e73ceb1204dd7cb6300dd36e7ffcbb287ef5cebbd0546a92c9c86fc4f0fdbfb587a0550cc76d2836aa050fc68e463ed93e3dbd1aa7f6878592b128d26a8f8f7508cc8f4c94b55ef752a299fdd67595c11f17b75222c5c328df734861e23f1bdd8cb76a56d2d1c03c81af531b66e19b1447936c283db7a81f06db270cfa915fe2cddd66f510168d9b7d964e6f38e3985d740e0548079bfc7eb40c02c9dbe4cb7f2a3c0666b22e87af5612b2913808b3c7bca849fd200a53ae3dfb5f36b0d0edcda4949285f337ac53cbd26d859cada0723286f81ee99d0764db27d3e57d5f761444af9835784a4ac1b81448446f707e68dcc96f08629cfdb1a4c77237ec490d21f7a25c7fdb54b81a34290773d94bb56287493526ea61cd4d2b4ec6185c3c1ff60813d227d7f7c26e4d0004c9eafcee31ea8253dc21d11d6b60f195be1caf74ad8c782b2ebe966d89d0880a63a55773d75315decfea8d64b3dd986225bdc897f569721a4f7b81b28d554c9fe318d4a44808f2cee8a2ec3d734b322dc5defdd0bfe71abe638c12dc20fd11ddfb72e803b358b272bd20f9d04fa75dbad77b50a9406967a26ecb499f803d89008e22d3d374dd94cc27a8c543fae510791d803610091dc388692f93f8b020fde67ba1c34b666bfc65c4c14d79082c4e95054bd3fc3f064453bb6052ae6b5f5de52903b6b9c2c6eb35a29f14abf3a98b7da0a0ab7a2e04ed290736671836eac833982b7ae7b011257f54c74a4b336e5cc68fbd90c527260004e708e224dd0cb71bbbb0146818e122d11781241e6f28b41c730f3137f7c605fe26fafcd8e70599e951493daea3159c24a4fc4d2d8629e7be1a17bc3c5b143e27e2ad664394c1b007e22179f015eb372eeaa3e5147c55c4118fe0d8892be85eff9556cb23e7785bf9bb0b1dd60efda534665a14976fd126e4488b025e0b80e8fe07727ff022f2415b914d1112c85721b9c4338e717ff386ebe3cd3db0602c48eb9ff96801c4a9392ce0ff1c4b579c89ebc621d7b3ff8b480ae10d01a61843d1f275da4fe9f69f7bbecee9e330714e0b8d5b575cd163786127c00dcf35e3ffcc51e7d026c402055c1db6a9537237d74dea49128916563249fee46818488c45a3ab728b739e1706dce2623d5d03f8ae1f1eed8410470005df9c991a2628acc77a574a61cbe6d68370f88ce38e9a14c0360d61c2f7ad7cae78d1d59a565ea546721bfff9b56861af315a9765cc1ec4a4496412447ab46fe387c9641e416ff929bd5f05e16653627c5a8efb8ccf0974ad3b3a2067743683d80e19166b80ca628728d4f3fcc79d68f7dc8a8aa0ffdab1205eb8e895d632cdbb54671859e4077c3b71703446e61cc6cb936a04b77285b952fa308d8b36dc4df7d6fe0addcfdb32725bed77d8fef7b11069447cca10b4ffcab68e126fab9e90545a523a1f92249ad8f07959a4f7dc0fed79ef4993e1441278cbf4f9ac1420a9137f799decb95c8ffa5fb719dd0a3a375319c5a0a7b37fb389aa676cc0057cca659be22d363a9d093d01da7e40337ba65eea09a04fd4e9ef98fd1df75f0dbe8f62011099375ebc9f01e93e43c9da2e9745e210fc50820770cbc5c6e34a44e9d7be75c118272bf445c4a9306df56958c026fe4379788659511bfbd4e12a00d57b1699cd9d2dc3c6d07aac62341c3f5b3c1cc26062531a24e0ffabcdd140294dc74fb5f6a246dd5aeeef4841654fd86bf37ec33789914afaf2b4695c141a5a62728bdd224bdc419d6e1752908759af1d55a8f1920a27b4ded8d8a7c1478b706dc9d8f4b1cf7e281c34e8c9be00915fce91d1afeba04b325b7bbc92b5ade81676d095d95cbd874441705a636aed62aed8cae23f5f79b93711f919e526d9f0910ac6805dfbd2a14eccc2847b2042bba9fc1c45246acb1167abeb14ca5c32db1197f40885aa", 0x2000, &(0x7f0000003640)={&(0x7f0000000100)={0x50, 0xffffffffffffffda, 0x88, {0x7, 0x2b, 0x0, 0x32008, 0x2, 0x4, 0x1, 0x4, 0x0, 0x0, 0x100, 0x6}}, &(0x7f00000001c0)={0x18, 0xfffffffffffffffe, 0xf40000000000000, {0x6}}, &(0x7f0000000200)={0x18, 0x0, 0xdd00000000000, {0xc}}, &(0x7f0000000240)={0x18, 0x0, 0x3ff, {0xf}}, &(0x7f0000000280)={0x18, 0x0, 0x1, {0x8}}, &(0x7f00000002c0)={0x28, 0xfffffffffffffffe, 0x2, {{0xebf, 0xffffffffffffffff, 0x1}}}, &(0x7f0000002400)={0x60, 0xffffffffffffffb4, 0x8000, {{0x8, 0x10001, 0x3, 0x33c8, 0x800, 0x7, 0x9c, 0x2}}}, &(0x7f0000000300)={0x18, 0xfffffffffffffff5, 0x9, {0x82}}, &(0x7f0000002480)={0x11, 0x0, 0x3, {'\x00'}}, &(0x7f00000024c0)={0x20, 0x0, 0x4f}, &(0x7f0000002580)={0x78, 0x0, 0x9, {0x5, 0x73c, 0x0, {0x3, 0x26cf, 0xfffffffffffffff0, 0x2, 0x6, 0x401, 0x3, 0x2, 0x8, 0xa000, 0x40, 0xffffffffffffffff, 0x0, 0x7ff, 0x1}}}, &(0x7f0000002600)={0x90, 0x0, 0x6, {0x1, 0x0, 0xda, 0x7, 0x10001, 0x7287, {0x1, 0x7, 0x6bad7afe, 0x5, 0x7, 0x3673, 0x9, 0x2, 0x2, 0x4000, 0x9, 0x0, 0x0, 0x89, 0x506c727f}}}, &(0x7f00000026c0)={0x90, 0x0, 0x9, [{0x0, 0x7, 0x1, 0x6, '\x00'}, {0x4, 0x81, 0x1, 0x8001, '\x00'}, {0x1, 0xa14, 0x2, 0x5, '-!'}, {0x4, 0x7, 0x1, 0x7, '\x00'}]}, &(0x7f0000002dc0)={0x508, 0xffffffffffffffda, 0x9, [{{0x1, 0x2, 0xfffffffffffff766, 0x8000000000000001, 0x80000001, 0xfffffffe, {0x3, 0x1, 0xb, 0x10, 0x2, 0x2, 0x3, 0x794, 0xbac7, 0x2000, 0x27, 0x0, 0x0, 0x40, 0x44b1}}, {0x0, 0x7f, 0x2, 0x7, '-^'}}, {{0x1, 0x3, 0x80000000, 0x0, 0x4, 0x0, {0x0, 0x3, 0x3, 0xb004, 0x5, 0x10001, 0x7, 0x5, 0xc2, 0x1000, 0xa, 0x0, 0x0, 0x1, 0x2ec}}, {0x6, 0x7, 0x2, 0x8, ',\x17'}}, {{0x3, 0x0, 0x8, 0x42f7, 0x5, 0x7, {0x1, 0x5, 0x1, 0x6, 0x0, 0x9a24, 0x9, 0x9, 0x401, 0x6000, 0xffffffff, r2, r3, 0x8b0, 0xff}}, {0x4, 0x0, 0x2, 0x0, '{,'}}, {{0x6, 0x1, 0x7, 0x2, 0xa, 0x1, {0x3, 0x1d2, 0x2, 0x1, 0x0, 0x3, 0x10001, 0x3, 0xd77b, 0xc000, 0x0, r4, r5, 0x2, 0x48000000}}, {0x2, 0x61, 0x1, 0x800, '\x00'}}, {{0x6, 0x1, 0x2000, 0xc, 0x5, 0x0, {0x1, 0x8, 0x3ff, 0x4af5800000000, 0xe1, 0x792, 0x5, 0x5f4e6ace, 0x7, 0x1000, 0xb41, r6, r7, 0xffffffc0, 0x6}}, {0x6, 0x8, 0x6, 0x3d9, '\\#(+\x18@'}}, {{0x4, 0x2, 0x9, 0x2, 0x9, 0x0, {0x6, 0xaf7f, 0x2, 0xfffffffffffffff9, 0x5, 0xfff, 0xa, 0x55, 0x9, 0xa000, 0x40, r8, r11, 0x6, 0x4}}, {0x5, 0x1, 0x4, 0x9, '\'%\xbf*'}}, {{0x3, 0x3, 0xa, 0x9, 0x6, 0x1, {0x0, 0x7, 0x2, 0x0, 0xb0bc, 0x2, 0x9, 0x6, 0x4, 0x2000, 0x953, r12, r13, 0xffffffff, 0x800}}, {0x2, 0x7, 0x1, 0xfff, '\x00'}}, {{0x6, 0x0, 0x3ff, 0x7e8, 0xfffffffb, 0x7f, {0x2, 0x0, 0x9, 0x7fffffffffffffff, 0x3, 0x2, 0x87df, 0x8, 0xaf6e, 0x6000, 0x401, r14, r15, 0x4, 0x2}}, {0x0, 0x3, 0x0, 0x440}}]}, &(0x7f0000003300)={0xa0, 0x24, 0x2, {{0x1, 0x1, 0x5, 0x5, 0x38000, 0x1000, {0x0, 0x7, 0x75ac, 0x3, 0x9, 0x1, 0xa74, 0x2, 0xfffffffb, 0x8000, 0x400000, r17, 0xee00, 0xb, 0x6}}, {0x0, 0x19}}}, &(0x7f00000033c0)={0x20, 0xfffffffffffffffe, 0x2, {0x6, 0x0, 0xd9f, 0x2}}, &(0x7f0000003500)={0x130, 0x0, 0x3ff, {0x5, 0xabb0, 0x0, '\x00', {0x200, 0x7, 0xd, 0xba, r18, r19, 0xa000, '\x00', 0x60f6, 0x470, 0x7, 0x6, {0x3, 0x14c}, {0xbc4, 0x8}, {0x4, 0x6}, {0x8000000000000001, 0x1}, 0x6, 0x3, 0x8, 0x2}}}}) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000000)={r20, @in={{0x2, 0x0, @empty}}, 0x0, 0x7ffe}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000340)={r20, @in6={{0xa, 0x4e24, 0x7, @empty, 0x2800}}, 0xf, 0x0, 0x20000, 0x3, 0x94, 0x0, 0x4}, 0x9c) 17m37.841117823s ago: executing program 34 (id=294): r0 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') r1 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') r2 = openat$binfmt(0xffffffffffffff9c, r1, 0x42, 0x1ff) write$binfmt_elf64(r2, &(0x7f0000000040)=ANY=[@ANYBLOB="7f454c4602010103fcffffffffffffff03003e005666d37500010000000000004000000000000000df012000040000000000000003003800010007000200010003000000000000000300000000010100ff"], 0x509) close(r2) write$binfmt_elf64(r2, &(0x7f00000000c0)={{0x7f, 0x45, 0x4c, 0x46, 0xd, 0x10, 0x8, 0xa6, 0x9, 0x2, 0x6, 0x7ff, 0x3de, 0x40, 0x3dd, 0x0, 0x7ff, 0x38, 0x1, 0x401, 0xff, 0x1b09}, [{0x5, 0x80000000, 0xa, 0x2, 0x7, 0x4, 0xffffffffffffffb8, 0x1ff}]}, 0x78) r3 = openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) write$binfmt_elf64(r3, &(0x7f00000000c0)=ANY=[], 0x40) close(r3) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x2000405, 0x0) memfd_create(&(0x7f0000000000)='@+&!\x00', 0x4) execveat$binfmt(0xffffffffffffff9c, r0, 0x0, 0x0, 0x0) 17m33.262094744s ago: executing program 35 (id=306): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000001300000000010000000900010073797a30000000000900030068797a32000000007c000000060a010400000000000000000100000008000b400000000054000480340001800b00010065787468647200002400028008000140000000010800034000000000080004400000003605000200070000001c000180090001006d617371000000000c000280080002400000000f0900010073797a3000"], 0xf0}}, 0x0) 17m29.828162424s ago: executing program 36 (id=317): r0 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r0, &(0x7f0000000280)=[{&(0x7f00000005c0)="580000001400192340834b80040d8c560a06ffffff7f07000000000000a658000b480400945f64009400050038925a01000000800000008004000000ff0109000000fff5dd0000000800030006010000418e01400004fcff", 0x58}], 0x1) 16m59.558754373s ago: executing program 37 (id=385): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) r1 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000180)='user\x00', &(0x7f00000002c0)='\x00\x00E\x01\x00\x00\f\x01\x00\x00\x00\x00\x00\xc1~\x99l\xb7\xd6\xfc\xebw1hn\x1a\xc5\xef\xec,\xa1\xa0\x12\x1c\x7fn\a\\\xec\xd8\x94oh\x1d\xec\xf5jb\xe5\xb2\xa2e\xfd\x9c\xc4\xd22\x9c\xe97#(/\xb1\xe6\x03\xe1\xaa\x96\x92\x8b4}\xc1L\x1b\x9b\xe6n\x97\xc7\x06\xb2Y\xadQ\xa4c\x1b&\x0e?\xc0\x90\xaf\xb29\xf6>\xe1\xe8}D\f\xc1u\xab]$\x1b\x1bt\xda\x9eA\xd3\x1b\x12A\x82\xd5\xa8@\x1eIw\xb2y2F\xe8\xc7\x03e&\x98\"9\t\xe0\x81Pj\xee&\xae{P\xe8\xceL\xe1\xd1V\xc7\xeaF\xd54\x80\xb6%\xaf\xbbK\x85\x95\xf2\x1bG\xf1\xdaq:\xae\xe22\\~j~\xfe\x83\xbb>\xb0\x9b.\xa4\x95\x0eY\xb8j\xe1M\xf5\xa5\x87`\x04\xab\xf1\xc7[\xda{\r\x95\xa4\xea^\xfc\xa7\x8b\x85\xd1ld\xacK\x8aqd\x1d\xaa\x99\xeb\t|@\xd5p\x1d>+\x0e\xec\xe2\xcd\xdc\x8f\x01\xf7\xabH=z\xa5x\x1b\x9f\x95\xd1\x88k\x85L#\x99^p\x18\x98\xec6\xf69y\x052', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000080)='user\x00', &(0x7f00000000c0)='ocfs2\x00', 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, &(0x7f0000000440)={0x2c, &(0x7f00000002c0), 0x0, 0x0, 0x0, 0x0}) 15m47.094734242s ago: executing program 3 (id=675): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb010018000000000000003c0020003c000000020000000000000002000004080000000000000003000000000000000000000002000000000000000000000000000002000000000000000000000004"], 0x0, 0x56}, 0x28) 15m46.637518643s ago: executing program 3 (id=676): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0x0, 0xfffe}, 0x0, [0x0, 0x0, 0xfffffffe, 0x9, 0x80, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40006, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1cc], [0x0, 0x0, 0x8, 0xb16, 0x0, 0x200000, 0x9, 0x0, 0xa, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0xc1a5, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0xd, 0x1000, 0x0, 0xf, 0x4, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x1, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffd, 0x0, 0xfffffffa, 0x0, 0x80000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb51, 0x0, 0xe], [0x80000007, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xddc, 0x0, 0x0, 0xfffffffc, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x5f78, 0x0, 0x0, 0xfffffffc, 0x0, 0xb, 0x4], [0xfffffffc, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xc045, 0x0, 0x0, 0x0, 0x1000, 0x2, 0x80, 0x0, 0x3, 0x9cac, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xdb9, 0xb50, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0xfffd, 0xd}, 0x4d, [0x400, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004, 0x0, 0xfffffffe, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x2, 0x120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0xffffffff, 0x3, 0x3, 0x1, 0x0, 0x6, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0x400000, 0x1, 0xfffffffd, 0xfffffffc, 0xfffffffe, 0x0, 0x4, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, 0xfd5], [0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200000, 0x0, 0x0, 0x3, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x7fffffc, 0x0, 0x0, 0x7fff, 0x0, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x6, 0x2], [0x5, 0x0, 0x405d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xd5f5, 0x0, 0x0, 0x100, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0xfc2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xe58b, 0xe, 0x0, 0x3, 0x0, 0x1, 0x1ff, 0x3]}, 0x45c) 15m46.426586019s ago: executing program 3 (id=678): openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = getpgrp(0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, r0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) ioctl$X86_IOC_RDMSR_REGS(r3, 0xc02063a0, &(0x7f0000000000)=[0x8, 0x8, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1]) openat$binfmt(0xffffffffffffff9c, 0x0, 0x42, 0x1ff) syz_open_procfs(0xffffffffffffffff, 0x0) mkdir(&(0x7f00000002c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) r4 = open(&(0x7f0000000140)='./file0\x00', 0x0, 0x0) mknodat$loop(r4, &(0x7f0000001600)='./file1\x00', 0x0, 0x0) chdir(0x0) linkat(r4, &(0x7f0000000100)='./file1\x00', r4, 0x0, 0x0) unlink(0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x1) 15m45.607000329s ago: executing program 3 (id=680): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x660a00, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$igmp(0x2, 0x3, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)) socket$netlink(0x10, 0x3, 0x10) memfd_secret(0x80000) socket$inet_tcp(0x2, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r1, 0x4236}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x106, 0x8}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4e21, 0x9, @mcast1, 0x9}, r2, 0x8001}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f000001b700)=""/102392, 0x18ff8) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r5, 0x0) syz_clone3(&(0x7f0000000500)={0x81103280, &(0x7f00000000c0), 0x0, 0x0, {0x1a}, 0x0, 0x0, 0x0, 0x0}, 0x58) r6 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x16, 0xc, &(0x7f0000000ac0)=ANY=[@ANYBLOB="18000000ffffffff0000000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007b000000850000002300000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000740)={r7, 0x0, 0xe, 0x0, &(0x7f0000000640)="0cffffdf71c8afefeba000dee560", 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 15m43.584514035s ago: executing program 38 (id=632): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r0 = socket(0x28, 0x801, 0x0) close(0x3) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route(r1, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x24040000) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) mq_open(&(0x7f000084dff0)='rmdF\x17\x16\xbc\xec', 0x6e93ebbbcc0884f2, 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004845) r2 = io_uring_setup(0x4fef, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0x0, 0x20002f6}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x3, 0xffff}, {0xe, 0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x48080}, 0x40010) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x5, &(0x7f0000000000)=0x6, 0x2c) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080), 0x8c, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r0}}) 15m39.154601501s ago: executing program 3 (id=701): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x10a}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000280)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f00000002c0)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000e00)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x1, 0xfdfd, &(0x7f0000001540)='\t'}) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, 0x0, 0x0}, 0x20) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r4, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r5 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r5, 0x40049366, &(0x7f0000000180)) r6 = open(&(0x7f0000000000)='.\x00', 0x0, 0x14) ioctl$AUTOFS_IOC_PROTOSUBVER(r6, 0x40049366, 0x0) 15m38.130331068s ago: executing program 3 (id=709): bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="7000000012000302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003", @ANYRES32=0x0, @ANYBLOB="816900000000080000000000000000002100010008081c"], 0x70}}, 0x0) 15m22.904678154s ago: executing program 39 (id=709): bind$alg(0xffffffffffffffff, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(aes))\x00'}, 0x58) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="7000000012000302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003", @ANYRES32=0x0, @ANYBLOB="816900000000080000000000000000002100010008081c"], 0x70}}, 0x0) 15m10.911819873s ago: executing program 5 (id=790): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="1801000000000000f000000000000000070000000000000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) 15m10.681201453s ago: executing program 5 (id=793): socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) getsockopt$sock_cred(r0, 0x1, 0x11, 0x0, 0x0) timer_create(0x0, &(0x7f000001b080)={0x0, 0x29, 0x4}, &(0x7f000001b0c0)) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) keyctl$read(0x2, 0x0, 0x0, 0x0) keyctl$read(0xb, 0x0, 0x0, 0x0) mount(0x0, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='btrfs\x00', 0x210818, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) clock_adjtime(0x0, &(0x7f0000000040)={0xd54, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3000000}) 15m9.287023209s ago: executing program 5 (id=797): r0 = syz_open_procfs(0x0, &(0x7f0000000400)='ns\x00') ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[@ANYBLOB], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) fsopen(0x0, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) r2 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) bind$alg(r2, &(0x7f0000000300)={0x26, 'hash\x00', 0x0, 0x0, 'streebog256\x00'}, 0x58) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) r4 = accept4(r2, 0x0, 0x0, 0x800) recvmmsg$unix(r4, &(0x7f0000003700)=[{{0x0, 0x700, 0x0, 0x0, 0x0, 0x500}}], 0x600, 0x0, 0x0) readlinkat(r0, &(0x7f0000000100)='./mnt\x00', &(0x7f0000000440)=""/163, 0xa3) r5 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_INIT(r5, 0x29, 0xc8, &(0x7f0000000340), 0x4) socket$inet6(0xa, 0x2, 0x0) r6 = ioctl$KVM_GET_STATS_FD_vm(r0, 0xaece) ioctl$USBDEVFS_CLEAR_HALT(r6, 0x80045515, &(0x7f0000000000)={0x6, 0x1}) 15m4.920173969s ago: executing program 5 (id=807): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000400)=[{0x6, 0xff, 0x2, 0x7fff7ffc}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000f8ffffff7b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r4}, &(0x7f0000000080), 0x0}, 0x20) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r5, r7, 0x25, 0x2}, 0x14) syz_emit_ethernet(0x7a, &(0x7f0000000580)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a81000000000800410073697700140033006c6f00"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) 15m2.604354928s ago: executing program 5 (id=808): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, 0x0, 0x0}, 0x20) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x1c, 0x46, 0x107, 0x70bd28, 0x0, {0x1f, 0x7c}, [@nested={0x7, 0x3, 0x0, 0x1, [@generic='N2V']}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) openat$binderfs(0xffffffffffffff9c, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r5 = syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x68f1, 0x80, 0x0, 0x359}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, 0x0, 0x0, 0x4) syz_io_uring_setup(0x3eb7, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)) syz_io_uring_submit(r8, r7, 0x0) io_uring_enter(r5, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NBD_CMD_CONNECT(r1, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x3c, r2, 0x1, 0xfffffffe, 0x0, {}, [@NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r3}}]}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0xffff}, @NBD_ATTR_TIMEOUT={0xc, 0x4, 0x2}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000001}, 0x20000000) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r9, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2000, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) 15m1.130405629s ago: executing program 5 (id=811): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000004000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000aa00000095"], &(0x7f0000000300)='GPL\x00', 0x4}, 0x94) 14m55.225941444s ago: executing program 9 (id=833): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'netdevsim0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1703}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000380)={'netdevsim0\x00'}) (async) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x1703}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) (async) 14m54.902568258s ago: executing program 9 (id=838): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000000000000000010080030900010073797a30000000002c000000030a01010000000000000000080000000900010073797a30000000000900030068797a32000000007c000000060a010400000000000000000100000008000b400000000054000480340001800b00010065787468647200002400028008000140000000010800034000000000080004400000003605000200070000001c000180090001006d617371000000000c000280080002400000000f0900010073797a3000"], 0xf0}}, 0x0) 14m54.835535407s ago: executing program 9 (id=839): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T4(r0, 0x103, 0x6, &(0x7f0000000000)=0x7f, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff000000000200"], 0x7c}, 0x1, 0x0, 0x0, 0x10}, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000003c0)={0x0, 0x24}}, 0x0) getsockname$packet(r4, &(0x7f0000000380)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffffffff00f687000000", @ANYRES32=r5, @ANYBLOB="01000000010000001c0012000c000100627269646765"], 0x3c}, 0x1, 0x0, 0x0, 0x300}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=@newqdisc={0x1a4, 0x24, 0x400, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r5, {0x2}, {0xffff, 0x6}, {0xfff3, 0x6}}, [@qdisc_kind_options=@q_pfifo={{0xa}, {0x8, 0x2, 0x5495}}, @qdisc_kind_options=@q_gred={{0x9}, {0x160, 0x2, [@TCA_GRED_MAX_P={0x8, 0x4, 0x3}, @TCA_GRED_LIMIT={0x8, 0x5, 0x5}, @TCA_GRED_DPS={0x10, 0x3, {0xf, 0xf, 0x1, 0x5}}, @TCA_GRED_STAB={0x104, 0x2, "3644ead909dc49ab8e033f09dd34ce6e31b8ad776433dfe8f8e396a3f5c0bcecef7cabf6e4edd38b960d2b81ea8ceb005c8b919e55bb3a0569aca7f5bd05a7cd3b369e6ca1845e97d1712601f426d56fd5b3ef0ddff29268614f9cfa2b0efe79cca1daf9e32d15a8ba4b3773d3853c528a4e3d7cb7b7e48f5c0a6f9b5bad431bff8f070949166258216f9a8cf567305fd740d226d2427f4353a2aa9abd36df871eef9c51d32f492fcd7e048fe2cd5314ee1facf692bdbd1e752590f5e7e6bbdac9de2bd9714bc098d8e776239e26e2fced5a957959dff63bf07d9328f3117db4d96d9fa8e0e73584b4c99c436eaacc734d4a2a9ba6f847c7dcd94cfc7e077873"}, @TCA_GRED_PARMS={0x38, 0x1, {0x3, 0x2, 0x2e3, 0x8, 0x22e3, 0x401, 0x1, 0xffffffff, 0x9, 0x4, 0x12, 0xa, 0x1, 0x3, 0x100, 0xcc}}]}}]}, 0x1a4}}, 0x4044080) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @remote}, 0x14) sendto$inet6(r2, &(0x7f0000000800)="4103082c1116480401020200c52cf7c25975e005b02f000006892f000300897c6b118777faffffff3066090cb600c5471d130a66321a54e7df305fbe258161b6fd8f2428652265d94c6fdbaefc57376a57c2feffff188be9427c323ef024a37016d2a7f9ab6e7941a6fc4f95aa73c1dfff4941f6503b5bd8c91db22cd33795481c94085fa12cdc679ac2a5d7b5d99b93fb07acb0da680e78b74c74aae8d7690d5986a9af81622a0ac210bc7b5ca5fed11cb54d046642670041e846bb184ff5d39fe8516d2d2a8d84e6e7dfcb2b8a8023444db513a3d7a124b59f0a5cd36489dbbb75cce3145d0ea3c3aa21af7cbcbc7a7575db782e757ca543109f5ddcec4930aa91f4119ea3d1f56140cb86cfe0724b23904ef5d05c725ee23918a502b1afe09fb0757d", 0xfc13, 0x880, 0x0, 0xfffffffffffffef0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x58}}, 0x800) ioctl$sock_SIOCINQ(r0, 0x541b, 0x0) 14m54.015476074s ago: executing program 9 (id=841): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000600050000080900010073797a30000000005c000000030a03000000001f00000000050000000900010073797a30000000000900030073797a300000000008000a4000000003280004800800024000000012080001"], 0xa4}}, 0x0) 14m53.91966634s ago: executing program 9 (id=843): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{}, 0x0, 0x0}, 0x20) chdir(&(0x7f0000000080)='./file1\x00') mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$radio(&(0x7f0000000940), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_QUERYMENU(r1, 0xc02c5625, &(0x7f0000000040)={0x98f905, 0x2, @name="f5dffeb25310cf3d8a2bd36132de4fb826f76a1d681c5f68cac8f070939e30b0"}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newlink={0x34, 0x10, 0x44b, 0x0, 0x0, {0x7a, 0x0, 0x0, 0x0, 0x1840, 0x42c04}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}]}, 0x34}}, 0x24) ioctl$KVM_SET_IRQCHIP(r2, 0x4020aeb2, &(0x7f0000000300)={0x0, 0x12c, @ioapic={0xffff1000, 0x5, 0x2, 0x80000001, 0x0, [{0x1, 0x85, 0x4, '\x00', 0x4}, {0x5, 0x3, 0x0, '\x00', 0x6}, {0x7, 0x2, 0xe, '\x00', 0x3b}, {0x4e, 0xe, 0x9, '\x00', 0x82}, {0xc, 0xb, 0x6, '\x00', 0x4}, {0xd, 0x7, 0xf5, '\x00', 0x3}, {0x2, 0xa, 0x50, '\x00', 0x8}, {0x88, 0x3, 0x2a, '\x00', 0x80}, {0x4, 0x0, 0xd, '\x00', 0x1}, {0x8, 0x9, 0x3, '\x00', 0x8}, {0x3, 0x6, 0x3, '\x00', 0x6}, {0x2, 0x9, 0x0, '\x00', 0x7f}, {0x14, 0x51, 0xa, '\x00', 0xfc}, {0x2c, 0xfc, 0x5, '\x00', 0x1}, {0x9, 0x2, 0x6, '\x00', 0x9}, {0x1, 0x3, 0xfe, '\x00', 0x3}, {0x2, 0xb, 0xd6, '\x00', 0x7f}, {0x7, 0x15, 0xca, '\x00', 0x6}, {0x0, 0x1, 0x4, '\x00', 0x13}, {0x4, 0x0, 0x40, '\x00', 0x5a}, {0x3, 0x3, 0x6, '\x00', 0x9}, {0x9, 0x3, 0x1, '\x00', 0x2}, {0xf9, 0x1, 0x2, '\x00', 0x8}, {0x8, 0xc, 0x0, '\x00', 0x6}]}}) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000840)=ANY=[@ANYBLOB='fd=', @ANYRESOCT=r3, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r4 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r4, 0x40049366, &(0x7f0000000180)) 14m52.536890857s ago: executing program 9 (id=846): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00'}) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000008, 0x810, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000140)={0x5, 0x7ff, 0xfffffffffffffff3}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mount(&(0x7f0000000480)=@nullb, &(0x7f0000000500)='./cgroup\x00', &(0x7f0000000040)='efs\x00', 0x208000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f00000fe000/0xd000)=nil, 0xd000, 0x1000005, 0xd2952, 0xffffffffffffffff, 0xfffff000) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r3}, 0x94) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r5 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r5, &(0x7f0000000000)='blacklist\x00', &(0x7f0000000100)={'syz', 0x1}, r5) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) setsockopt$TIPC_IMPORTANCE(r6, 0x10f, 0x7f, &(0x7f0000000180)=0xe85d31ef, 0x4) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f00000001c0)='asymmetric\x00', &(0x7f00000000c0)) sendmmsg$inet(r4, &(0x7f0000000240)=[{{&(0x7f00000003c0)={0x2, 0x4e22, @empty}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000200)="a90500040000746400009e150451160200000064c6", 0x15}, {0x0}, {&(0x7f0000000600)="12ae813e8fdf940489dbf364bfdf94155954811c4a6a7f1774356212bb473c926ab4b65b0ddb757171a0e3c5a8f6413693e5cd62b6b6cbb09113dcacca8529a2c277026f30ef6426f7743a636ffb52d075b74264e19135f33d0a5b4401ad436ffcd020c9060456f8cb4c50ca45be1d2328b4d14a5cb88dc5e6cb5bbda2a3b5e05399b6cd3208efa3fef9fabcd029313561d603d79d04e0d3fa6ebe6cb7ceeba18c6b0fa8f84639b73df4acb5d9248055af64dbd8", 0xb4}, {&(0x7f00000002c0)="fa39b2dd7d8032597fd3c2c5844890ec62a55b990b7147e114c618944a442c32a98edcaece73329f98", 0x29}, {&(0x7f0000000380)="4ec4203100df149fb6bac8145c23227cb76ad3564f8886c5ed8663ff8972e08fa8ceea96bb1956a8d413", 0x2a}], 0x5}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="5825be06000000000000007ca2746314d178", 0x12}], 0xd}}], 0x1, 0x0) 14m45.503975531s ago: executing program 40 (id=811): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000004000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bf8100000000000007080000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018210000", @ANYRES32=r0, @ANYBLOB="0000000002000000b70500000800000085000000aa00000095"], &(0x7f0000000300)='GPL\x00', 0x4}, 0x94) 14m37.019335351s ago: executing program 41 (id=846): r0 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'veth0_to_bond\x00'}) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000008, 0x810, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) ioctl$FITRIM(r2, 0xc0185879, &(0x7f0000000140)={0x5, 0x7ff, 0xfffffffffffffff3}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mount(&(0x7f0000000480)=@nullb, &(0x7f0000000500)='./cgroup\x00', &(0x7f0000000040)='efs\x00', 0x208000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f00000fe000/0xd000)=nil, 0xd000, 0x1000005, 0xd2952, 0xffffffffffffffff, 0xfffff000) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x15, r3}, 0x94) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) socket$igmp6(0xa, 0x3, 0x2) setsockopt$MRT6_ADD_MIF(0xffffffffffffffff, 0x29, 0xca, 0x0, 0x0) openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) r5 = add_key$keyring(&(0x7f0000000040), &(0x7f0000000340)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) keyctl$search(0xa, r5, &(0x7f0000000000)='blacklist\x00', &(0x7f0000000100)={'syz', 0x1}, r5) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff}) setsockopt$TIPC_IMPORTANCE(r6, 0x10f, 0x7f, &(0x7f0000000180)=0xe85d31ef, 0x4) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r5, &(0x7f00000001c0)='asymmetric\x00', &(0x7f00000000c0)) sendmmsg$inet(r4, &(0x7f0000000240)=[{{&(0x7f00000003c0)={0x2, 0x4e22, @empty}, 0x10, &(0x7f00000006c0)=[{&(0x7f0000000200)="a90500040000746400009e150451160200000064c6", 0x15}, {0x0}, {&(0x7f0000000600)="12ae813e8fdf940489dbf364bfdf94155954811c4a6a7f1774356212bb473c926ab4b65b0ddb757171a0e3c5a8f6413693e5cd62b6b6cbb09113dcacca8529a2c277026f30ef6426f7743a636ffb52d075b74264e19135f33d0a5b4401ad436ffcd020c9060456f8cb4c50ca45be1d2328b4d14a5cb88dc5e6cb5bbda2a3b5e05399b6cd3208efa3fef9fabcd029313561d603d79d04e0d3fa6ebe6cb7ceeba18c6b0fa8f84639b73df4acb5d9248055af64dbd8", 0xb4}, {&(0x7f00000002c0)="fa39b2dd7d8032597fd3c2c5844890ec62a55b990b7147e114c618944a442c32a98edcaece73329f98", 0x29}, {&(0x7f0000000380)="4ec4203100df149fb6bac8145c23227cb76ad3564f8886c5ed8663ff8972e08fa8ceea96bb1956a8d413", 0x2a}], 0x5}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000005c0)="5825be06000000000000007ca2746314d178", 0x12}], 0xd}}], 0x1, 0x0) 4m52.525561623s ago: executing program 0 (id=3201): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x800c5012, 0x0) ioctl$FS_IOC_GETFLAGS(r0, 0x80086601, &(0x7f0000000200)) socket(0x10, 0x3, 0x0) socket$kcm(0x10, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f0000000100)) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x50, 0x0, &(0x7f0000000780)=[@increfs, @transaction={0x40406300, {0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x70, 0x18, &(0x7f0000000500)={@ptr={0x70742a85, 0x1, &(0x7f0000000440)=""/178, 0xb2, 0x2, 0x26}, @fda={0x66646185, 0xa, 0x2, 0x30}, @ptr={0x70742a85, 0x0, &(0x7f0000000900)=""/234, 0xea, 0x0, 0x2d}}, &(0x7f00000001c0)={0x0, 0x28, 0x48}}}, @enter_looper], 0x0, 0x0, 0x0}) dup3(r2, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x11, 0x5, &(0x7f00000002c0)=ANY=[@ANYBLOB="1805000000000000000000004b64ffec8500000075000000040000000700000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000240)={&(0x7f00000003c0)='sched_switch\x00', r4}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpgid(0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) openat$proc_mixer(0xffffffffffffff9c, &(0x7f0000000000)='/proc/asound/card0/oss_mixer\x00', 0x2002, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r6, 0x0, 0x2a, 0x0, 0x190) socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, 0x0, 0x845) socket$nl_audit(0x10, 0x3, 0x9) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x24}}, 0x2000c004) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) 4m51.37046187s ago: executing program 0 (id=3206): r0 = socket$netlink(0x10, 0x3, 0x0) (async) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=ANY=[], 0x50}}, 0x20040000) (async) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x238, 0x0, 0xa, 0x148, 0x108, 0x60, 0x1a0, 0x2a8, 0x2a8, 0x1a0, 0x2a8, 0x3, 0x0, {[{{@ip={@loopback, @dev={0xac, 0x14, 0x14, 0x31}, 0xffffff00, 0x0, 'bond_slave_0\x00', 'rose0\x00'}, 0x0, 0xc0, 0x108, 0x0, {0x200003ae, 0x7f00}, [@inet=@rpfilter={{0x28}, {0x8}}, @common=@unspec=@cpu={{0x28}, {0x3, 0x9}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x1, 0x2, 0x2, 'syz1\x00', {0x6}}}}, {{@ip={@empty, @multicast1, 0x0, 0x0, 'batadv0\x00', 'veth0_to_team\x00', {}, {0xff}, 0x0, 0x0, 0x44}, 0x0, 0x70, 0x98}, @common=@unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x20000000, 0x1}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x298) (async, rerun: 64) sendmsg$nl_route(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001000810500"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000280012800a00010063616e"], 0x48}}, 0x0) (rerun: 64) 4m51.094343564s ago: executing program 0 (id=3209): r0 = openat$cgroup_type(0xffffffffffffffff, 0x0, 0x2, 0x0) r1 = gettid() timer_create(0x1, &(0x7f0000000800)={0x0, 0x21, 0x4, @tid=r1}, &(0x7f0000000000)) dup3(r0, r0, 0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x3ed4, 0x5}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001e40)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a14000000060a0b04000000000000000007000008fc000000050a030900000000000000000a000004b8000c0034b6f3178462116750cc201cbaf9dcd779328416fb39b531c1f407a628e9dcbd5ffa7b6a8c5f56b99f0c7d8300ac2b945701c1770aa8622173f19ad189f77eaf22364f80f83d01414e16fff2cc1e0aafe0e00355ce9b1a36ec2ae5bb717da864b03b7ded2c0a041a17ae9ae75ef874cc6ae31654ae285d8e80613ab03366c238d4ec2d5f278c74c97e9055128d07096ea258f021d00b43005d3894501e8bfff06bfee610b6d919ac0a26077234dc9de0ca2643750900010073797a30000000000900010073797a30000000000900030073797a31000000000900030073797a3000000000941400000c0a0300000000000000000005000005080004400000000358140380100000800c0004400000000000000080b8040080100007800a0001006d61746368000000dc020a80100002800900020073797a300000000021000100fc1cf539b0cb744d977b98c4f960390800aa5c6cfc2c5f43a0342ef27800000075000100ae7e5a0c72174f22d2e23c596dc8dd25d2d410718e3f7d2f7cb5ba63ad762fa98a62440110c8b5fe7695a93971ef5e043191f4493730ca5282e8b4185f1de84268603d30b0b466bef465741d5955a53b9796f75b31e33a2e33343815dddc64c8cc262d8b61011cc7dcc37c4f8cb6d19610000000f20001007a71c9114b5bc7d474429423b690226fe432a7b4b87015ecf0d782628e89141ea9b342b1f122e6dc6fe8f0ac5c088ab027a19acab0b41e1841c2ece61408a3d74d190f7c639c26c2b63a8ac31234b108c3539fa1ab7ab6daa1250231df8713b7f0ffbcaccab5ed06022bea2077f938767abd7d15c090cc5875faf94e8007849a6509da47d21977ab691ae5e39e6b23f70a28b8d336ebafdcd9be8c6b89dd410dc38b1b8829e393dfcb0499bd386af9935aff39ea7156c5fb91bbf2b311222d83afda4e0edbbe88eb98b96253e851dd58b32f3f48af93c9a9479922004aad34b512ea89bc76dfd0604e9eb80ae8f50000440002800800034000000002080003400000000408000180fffffffd08000340000000030900020073797a30000000000900020073797a31000000000800034000000002e7000100b16f3db11b17b730103d22a0d5ef2384c34a1fa959c1634c097b7b4aaddd9cd0e794ea19a6e6e5603469c7eff0398569411a20e16ddeb74f429292dcb12c7a4adb13d01eb8e1993661c7d2c47cc17414307ace8e318519e9e25171305a6702d59926c984be35c866d1cdd2bd9370c1a6f3d353a5e885397aa1b8b65063dc8c5c02517c116c388f65076d73bb3442876601a99dc547a83b8717db68e45794e5c19789860c4b2b28d5d427e73a57c6f42f7361fd5687f426e22a3ebcf63222ae2a98287332e8e7684604e594075f050e0f840d405245d07ac5154db1e5b6ffa5907c000c00028008000180fffffffd2c0007800b00010072656a65637400001c0002800500020000000000050002000700000008000140000000000c0005400000000000000001140007800e000100627974656f72646572000000f0000b80100001800a00010072616e6765000000100001800b000100736f636b6574000010000180090001006d61737100000000300001800700010063740000240002800800014000000010080002400000000a0800024000000010080002400000000a3c0001800a00010072656469720000002c00028008000140000000110800014000000000080002400000001d0800034000000032080001400016000e240001800b000100736f636b6574000014000280080001400000000108000240000000042c0001800b00010074756e6e656c00001c000280080002400000000b080003400000000008000140000000018c0002800800010056c8240d3c0002800900020073797a30000000000900020073797a3100000000080003400000000208000180ffffffff08000340000000020800034000000004380002800900020073797a32000000000900020073797a310000000008000340000000010900020073797a310000000008000340000000020c000280080003400000000198070080700002805d00010080d86720af17c79742aa2942c0823d137588e90bd25f12bfe139021211abf73f3fc6fd6ad12c93419731b98a2550605a58461c1e1e087c0d81648728e23711a22706c186d9461185156849b8bac9cf77d898681bf731ec838f0000000c00028008000180fffffffb780102804400028008000340000000010900020073797a30000000000900020073797a310000000008000340000000030800034000000004080003400000000208000340000000011800028008000340000000030900020073797a30000000003800028008000340000000010800034000000002080003400000000108000180fffffffe0900020073797a31000000000800034000000004dd0001001c18d384b10b30f6db1eab52b25f94d459bbb68a6691db743a2ac563171c5bda84179d9c724c59d407242ed359b92bdaa400fe78204dadc73489ce618a7d1d0008711154117cac0bfa3b43f951273f0ed246f98876bc86b8be83cd560908a499f99c06a446ddf4b22bd44ff196bc68d2fac9663a98a67221402d4bc633d4df11f89b1dee5743dfd8201d00e444293af4f9a3e6ba84cad390ae2f2e3151b996c9165a07f5567b2129c8d1137e5346c9866ff4ff49f72f46e7f43d0f50a1ee764bd25c574b38fb75f77152fc6d4d7d05636105f116e0e304073c000000d7000640887125b2f6e4f083beb0de3aada9a1613fafb7401b2fe149413b8d33750435399fe0cc59d7deaaa723d55558bb5544e863549bcc9ff872695e1ae4d52a89c26d71072ec4c124327c3d7845cd8cef7125643bd51d1b03e548df95db552837c75cf3edb60f1938197f6639a1a37680e0d831042844444da46486b9d46452835a30055ad5cf4699f785df67b400e3d8bf9a7175727136495d8eda17e71cc32a40e68459a02280a2a5b473a86be58239fe5ca4c79e5464ee8867b99f0df8b2cc910b02b1b6b656208db4091a6921fdcbbb42246604000c000540fffffffffffffff7bc030a80ec0001007867da8a4e9ef719e047eedbfd6030f5d0a69d75f4f6b1867cb63b33374b3847951d1b0e8c79e59824742610ca0887f45e8a21428ef7fb830dae68d5954949e8df17cb558181722a796e405acfc1881896ea48a15c042badaa2c4b1a18bdfcf8fa0e75918ede15ae1ff36b897404c71419c7061d6cdb99fd8ad690741f06b614d0ee398f3d348d5b08cdaa7962598bbcd44a4ad84c50787abf8f54658a3d341f1f63f9f717e54ea9bd0e39e59696354909715f5b9dfcc38e84fb755c0cbdce47785a7730e89442c2c1c328b906d20668570900003ff1c66beef34a526e2174aa4f9f3181b9e0de1bc3000100386e74d9ede3bd12be021b99d25f88025bb611d3e47a827f9a88797aaf67d486711d28a5b3a0bd227e08117b64dd32413f0915eea782b91d31a57f1f9cf5b7011fc9f6c54b4c604510aeae7e7b1c674529b0bd309ea096d4c081f301aeb2cdc58f30dc1c261bf670f7bdfcd6c58c93ca368089e9e7b5efd90a8e0eaf1d61fafcc2043546c3b3648968c97c61c5f4fa99b6bef80a4bc5cd4a1546a62c37cf23d646d244b1387bcacb67025f3d074a5a2eb3639b7ef26dada2a933d00478b7ba001400028008000340000000030800034000000003e6000100dbe94a5da356c6c3e96bfa89201ba6bce120a07089d740e0943ceccfcc7c579766b9f8f304b83b8e44319f2529cb75578e7f086c5fcd4b7112a2dadb3443d4fb7392006e61bf91699c5db3ba6033c075a8f1bfcd5a2649290700410fd809a5d195a4f79e566121c716e371112b9fa76eb875ea84795567ca670d7a69c09f826b2b2845451b61d14c5371ca203e8eb1c8ad0798b6a674baed89d804ebb1c3ecc4bf0727265edbaca05f86444ae255ad3344572151554f2c49218c3da27290fc828d14491a4dd9bcc9ce22f50e01cd196dbf26e90f06b9fc3df5e071a098d60be3464a0000dc0001004f535f1b1f9175b71f04e18d245b3627aada6b9f09efafb4d974bf75595a786ce054260e6b40e04ff6abd784ede08b541ff138a40382753278b56aeb49d528b85b54cc403556b98bb6861df1eb1c9d8937023fd80ac061aaa198f067c7fcca0e00979d50384101a343ebec789f4953d42b5d21dc736605c7ddfffb31d499180f95f6f48c62472b197be54429200f41ffe3e0dc382bad5edfdc2c4fd767366826cd82a74cc848a2de213dfb2ac09de06cd5ccec7988121522e5d6ad4b57649638f69a5369c8e4042cced4f5cfa818f9dd46dea6e13f9a56cc300002800900020073797a31000000000800018000000000080003400000000408000180fffffffe08000180f9e80efc0c010b80100001800c00010062697477697365008c0001800a00010072616e67650000007c000280080001400000000b70000480440002800900020073797a30000000000800034000000003080003400000000408000180fffffffe08000180fffffffc0900020073797a320000000008000180fffffffd2800028008000340000000010900020073797a3200000000080003400000000208000180fffffffd1800018008000100647570000c0002800800024000000014100001800900010068617368000000002c0001800b00010072656a65637400001c0002800800014000000001050002000500000008000140000000021800018011000100666c6f775f6f66666c6f6164000000005c0000800c000440000000000000000340000b80140001800e000100627974656f726465720000002800018008000100647570001c000280080002400000000208000240444492f808000240000000010c0004400000000000000005b00500800c00044000000000000000000900090073797a31000000002c000b802800018008000100647570001c00028008000240000000120800024000000010080002400000001180000180240002800900020073797a32000000000900020073797a310000000008000340000000032c0002800900020073797a3200000000080003400000000408000180000000000900020073797a30000000002c0002800900020073797a310000000008000180ffffffff0900020073797a300000000008000340000000049e000640663e4aa251fd29f805ceda8e697547947c175d82aa4d1b1ee14e2069a64dff45be343e5ba0aa0a22f566aa8ee88029f74b0cac4a445688aac8d535e7878797b7b862bfa4a6b092743b33d54c5650bf9f9a71901b7760f3f2f0938aff4bf3b63ca4c8a5199062d349372528c9c49263a462f012e49cc52a1d15e96f9e9d9034991f30b06cc056dd0abb4668e26a8814324155e57313ee1c4c11ab000014000b80100001800a0001007265646972000000080003400000000144010b80300001800b0001006f626a726566000020000280080005400000000208000340000000150900020073797a3200000000540001800b0001006c6f6f6b75700000440002800800044000000003080004400000000108000540000000000800044000000001080005400000000108000440000000010800054000000000080003400000000b0c000180070001007274000060000180080001006475700054000280080002400000000c0800014000000001080002400000001008000140000000080800024000000012080002400000000a080001400000000b080001400000000408000140000000120800024000000013100001800b0001007461726765740000300001800d00010073796e70726f7879000000001c000280080003400000000806000140000e00000800034000000004100001800c000100636f756e74657200e8020a806400010074374a4ee8f0115af03813665406910be7474a0a1cc351d5cf826ba2066959072c54751835ecd49a1dbb59ee73eae0dfdf10ed22364ccacb3781acf24fdbefc262c3b9f8340780fafe4f86df05c07a9c35192b743ce5fe334e0a819d70fdef95140001003a752402e6f810133ce831d750d3451c6400028008000180fffffffb08000180fffffffc0900020073797a300000000008000180000000000900020073797a32000000000900020073797a30000000000900020073797a32000000000800034000000004080003400000000208000180fffffffcd800010051aad8161783f02c36aedf38862dd7b8c051ce0c6496ccf22160c85b32494bf92a7bf3e8290bacd4da04bdfee146d9c09055861d243760c9afdaa53b6e7b117d890796ddf36560422408f91199c31514f09370203e9b17af4b7725b8dd4029bc0f8f97820eb57cf5e4afa46a3277d8b9445c7d11db2a4eacf55adb8ce7ff45319043d94f64b289ba46f24ed9c222b7f5a3a975aecc12aaf6db7289452bdff72e950025912c82bcbb39480b56ca85e2691adfb447af6b4c79bac1f65fe921bdec73b7651b32aacc0685d51249b9a176d448ee2c351c000280080003400000000208000180fffffffb08000180fffffffb1800028008000180000000000900020073797a3000000000f9000100d8c1c4c29ed27bfb99765cf6e50a0e9788259b8e5f6afb44ca0031b813a165c97a933ddd9853164057c0b0f7810eb7289694236c40947faa21e0165123e24c52393157542c63927bd26908cd2d549f1a5e3e193865a348cfcb66930ae445e6c28135115a286f95c25fcf45223a0d3937c2c55df7f8a03e638543de1edb3a5154deef10b4efc919c426c10594da3eeb1c12f0090afe7b40d8f9f141e58e4d9700ae799938068feb33af1031527df82b64a39dc308539f278e4b5d67dcf7432ab4583e996507410af40d8fbf7e0919c9b3a0c65a28f4ecb0c87baced9a2f3315febb595e5187726f1a8670ea50fd33d39b03e7909224000000d8010080580001800c00028008000180fffffffc27000100cda11dd9e0cb269ce43ae756c83f079e481d0d44ee2fe1700be0bc941c021a287f1168002000028008000340000000030900020073797a300000000008000180fffffffe7c010a80580002800800018000000000080003400000000408000180fffffffe0900020073797a300000000008000180ffffffff0900020073797a310000000008000180fffffffe0900020073797a3100000000080003400000000404000100a20001006b8dc1bdbd0931ba1544672993c0d6bcb06f031ee8fa41192fca753b41b84369df4270e6e98272b56bf394af53810d57cb3c81a8446fcfd6c0fe5abe561e77e05a120c2c515983e3b3f52cd6bfb8f6a6c8b9b6051dc644dad3fdf4655b283133cf30410c679033ce4b20c2600abc118e48f23dc66cbbcd5305255ee8c2d788fe21358ee4525e928ec9062b01ce180355bafce6c3c3948fd41aacd9e710a60000770001007eb5ee039b9d30d2bb9e7a8adec3eb10eb4d7a03e53f7ff904fefdf2144c0a9c6dadef513f0f0414f3a5dafecbe008c4f98949575891d20347325611d844eaa81bbf5b7795c7f87f42864266a69cf09329bc230a245e00e30f19f753458e5f3e493be81d730ce2be1c4e4dac852d0ff7cf183100100000800900090073797a32000000000900020073797a310000000008000440000000010900020073797a3200000000140000001100010000000000000000000900000a0000"], 0x15cc}}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000180)={'vxcan0\x00', 0x0}) setsockopt$SO_TIMESTAMPING(r4, 0x1, 0x25, &(0x7f0000000000)=0x2, 0x4) sendmsg$can_raw(r4, &(0x7f0000000240)={&(0x7f0000000780)={0x1d, r5}, 0x10, &(0x7f0000000480)={&(0x7f0000000040)=@can={{0x3, 0x0, 0x1}, 0x0, 0x2, 0x0, 0x0, "11e97f5d0c1f526b"}, 0x10}, 0x1, 0x0, 0x0, 0x2}, 0x20044850) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r3}, './file0\x00'}) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000300)={0x0, 0x2, 0x1, 0x0, 0x3}) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000280)={0xffffffffffffffff}, 0x106, 0x2}}, 0xfe5e) write$RDMA_USER_CM_CMD_SET_OPTION(r3, &(0x7f0000000080)={0xe, 0x18, 0xfa00, @id_afonly={&(0x7f0000000000)=0x1, r7, 0x0, 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND(r3, &(0x7f0000000140)={0x14, 0x88, 0xfa00, {r7, 0x30, 0x0, @ib={0x1b, 0x0, 0x0, {"00000000000000000000000000000001"}, 0x2000000000001005, 0x19dff}}}, 0x90) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) fgetxattr(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f755e84888003000000"], 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) 4m50.292102964s ago: executing program 0 (id=3214): sched_setaffinity(0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000300)='./file0/../file0\x00', 0x0, 0x2151090, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000440)='./file0\x00', r0, 0x0, 0x143) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = syz_open_dev$swradio(&(0x7f0000000140), 0x0, 0x2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000080), 0x800, &(0x7f00000003c0)=ANY=[@ANYRES8=0x0, @ANYRESHEX, @ANYRESDEC=0x0, @ANYRES16=r1, @ANYRESDEC=0x0]) read$FUSE(0xffffffffffffffff, &(0x7f0000004100)={0x2020}, 0x2020) r4 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') read$FUSE(r8, &(0x7f0000002640)={0x2020}, 0x2020) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4800000010000104000000000007000000000000", @ANYRES32=r7, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x10) 4m48.906851273s ago: executing program 0 (id=3220): r0 = socket(0xa, 0x5, 0x0) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in6={0xa, 0x4e24, 0xf1, @loopback, 0x19f49a9}], 0x1c) sendmsg$inet_sctp(r0, &(0x7f00000000c0)={&(0x7f0000000000)=@in6={0xa, 0x4e24, 0xff, @loopback, 0x5}, 0x1c, &(0x7f0000000040)=[{&(0x7f0000000100)="e6", 0x1}], 0x1, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000e803008400000007000000ac1414aa000000002000000000000000840000000800000020"], 0x38, 0x4855}, 0x24000052) 4m48.58181961s ago: executing program 0 (id=3223): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000400)=[{0x6, 0xff, 0x2, 0x7fff7ffc}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000100850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r4}, &(0x7f0000000080), 0x0}, 0x20) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r5, r7, 0x25, 0x2}, 0x14) syz_emit_ethernet(0x7a, &(0x7f0000000580)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a81000000000800410073697700140033006c6f00"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) 4m48.455802895s ago: executing program 42 (id=3223): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x22803) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0xf3, 0x1b1c07, 0xfffffffa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8}) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x4) sched_setaffinity(r1, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x1, &(0x7f0000000400)=[{0x6, 0xff, 0x2, 0x7fff7ffc}]}) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000009c0000000b"], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e"], 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000010000000000000000000000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000100850000003300000095"], &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000300)={{r4}, &(0x7f0000000080), 0x0}, 0x20) r6 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000002c0)={r5, r7, 0x25, 0x2}, 0x14) syz_emit_ethernet(0x7a, &(0x7f0000000580)=ANY=[], 0x0) setsockopt$inet_tcp_TCP_REPAIR(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="38000000031401002dbd7000000000000900020073797a81000000000800410073697700140033006c6f00"/56], 0x38}, 0x1, 0x0, 0x0, 0x854}, 0x0) 2m12.935511176s ago: executing program 7 (id=3767): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r0, 0x400454c9, 0xba98575a95aeb70d) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000500)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETSTEERINGEBPF(r2, 0x800454e0, 0x0) write$cgroup_devices(r2, &(0x7f0000000280)=ANY=[@ANYBLOB="1e030600bc5cb60128876360864666702c1ffe80000000000000", @ANYRESDEC], 0xffdd) 2m10.477028428s ago: executing program 7 (id=3808): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000002a00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r0}, 0x10) bpf$PROG_LOAD(0x23, 0x0, 0x0) 2m10.391959189s ago: executing program 7 (id=3811): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000000)="d8000000100081044e81f782db44b904021d080006000000e8fe55a1180015000600142603600e120800110000000401a8001600050001400300", 0x3a}], 0x1}, 0x44010) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="563d00001a00599c6d0e000091d028ef80"], 0xfe33) 2m10.256721386s ago: executing program 7 (id=3816): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00'}, 0x10) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4083, 0xff3}], 0x1}, 0x102) 2m10.152249287s ago: executing program 7 (id=3822): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) mkdir(&(0x7f0000001a80)='./file0\x00', 0x18b) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mount$bpf(0x0, &(0x7f0000000340)='./file0/../file0\x00', 0x0, 0x100000, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f00000000c0)={0x0, 0xffffffffffffffff, 0x0, 0x1c, &(0x7f0000000000)='//sys\x00\x00\x00\x00\x00\x00\x80\x004\x00\x00s/\x92ync_\x93\x96\xff\x92\xaf\x00Se\xf44.\x00'/49}, 0x30) mount$bpf(0x200000000000, &(0x7f0000000200)='./file0\x00', 0x0, 0x206002, 0x0) 2m9.98121516s ago: executing program 7 (id=3825): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) 1m54.047860298s ago: executing program 43 (id=3825): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xc, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000008500000072000000850000005000000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_route(0x10, 0x3, 0x0) 1m19.273928993s ago: executing program 8 (id=4010): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$kcm(0x11, 0x2, 0x300) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000480)=ANY=[@ANYBLOB='-', @ANYRESDEC=r0], 0x27) 1m19.030285688s ago: executing program 8 (id=4012): syz_usb_connect(0x6, 0x1ed, &(0x7f0000000780)={{0x12, 0x1, 0x250, 0xb8, 0x0, 0x51, 0x8, 0x1410, 0xa007, 0x3e68, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1db, 0x3, 0xe, 0x0, 0x30, 0x3, [{{0x9, 0x4, 0x3, 0x9, 0x2, 0x7f, 0x54, 0xcc, 0x0, [], [{{0x9, 0x5, 0x2, 0x4, 0x400, 0x4, 0x4, 0x3, [@generic={0x71, 0x1, "09661bede31b6d40ffd5a6457d3483a7c64a2cf09c6b30e3afe9caf13ed9a2924ed053d2b4b24aedb4035d4212c8a5f7df3b67916187c245f81035efe9b53a8d79988d4b00a8aa5926f8b9103fd0e543cebd14ca5d0825146c7ff12ef0b8fe612538542d6f5c9fdc7894374795b8cc"}]}}, {{0x9, 0x5, 0x4, 0x10, 0x40, 0x5, 0x2, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2, 0x400}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0x1, 0x7}]}}]}}, {{0x9, 0x4, 0x5b, 0x6, 0xc, 0x31, 0x71, 0x35, 0x6, [], [{{0x9, 0x5, 0x5, 0x10, 0x8, 0x6, 0x0, 0xd3, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x2}]}}, {{0x9, 0x5, 0x6, 0x10, 0x20, 0x80, 0xff, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x6, 0x2}]}}, {{0x9, 0x5, 0x0, 0x10, 0x400, 0x9, 0x4, 0x1}}, {{0x9, 0x5, 0x4, 0x10, 0x40, 0xab, 0x0, 0x5}}, {{0x9, 0x5, 0x5, 0x2, 0x20, 0x6, 0xd, 0xd, [@generic={0x48, 0x66, "42bc0201de8fa807c3b757b1c182c0f4c59af7c59293e1bc41956912be0eafd96bdf03aa6117bc3e50fbee59a6e5dfc7206516e091fce94c0c778a134b5368d1af31d240535b"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x2, 0x1}]}}, {{0x9, 0x5, 0xb, 0x8, 0x400, 0x1, 0xa9, 0x5, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x32, 0xbf6}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x6, 0x15ac}]}}, {{0x9, 0x5, 0x2, 0x14, 0x0, 0xc7, 0x7, 0xe}}, {{0x9, 0x5, 0x1, 0x4, 0x200, 0x8, 0x5, 0x80}}, {{0x9, 0x5, 0x5, 0x10, 0x200, 0x8, 0x2, 0xae, [@uac_iso={0x7, 0x25, 0x1, 0x103, 0xfb, 0xff}]}}, {{0x9, 0x5, 0x0, 0x10, 0x40, 0x8, 0x0, 0x3}}, {{0x9, 0x5, 0xc, 0x4, 0x200, 0x3, 0xd, 0x7, [@generic={0x41, 0xf, "8c1ea652c620acd24cbf2bfeb921dfc3f2c147f7c05a53e4f7db6742a64c76fe8d2f319387c80165b1ad6b9054e93ae7385d785e1c040f2c4e5c2388ef8791"}]}}, {{0x9, 0x5, 0x9, 0x0, 0x20, 0x1, 0x8, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x4, 0x6}]}}]}}, {{0x9, 0x4, 0xf5, 0x1, 0x0, 0xf, 0xd4, 0xdf, 0x3}}]}}]}}, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r1, @ANYBLOB="00000000000000001c001a800800028008000200080000003e127a51080002"], 0x44}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[], 0xa0}}, 0x0) r2 = socket(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f0000000000), 0x4000000000001f2, 0xfff0) 1m18.663670403s ago: executing program 4 (id=4013): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000580)=@newtaction={0x84, 0x30, 0x1, 0xe501, 0x0, {}, [{0x70, 0x1, [@m_police={0x6c, 0x1, 0x0, 0x0, {{0xb}, {0x40, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0x81000000, 0x800, 0x0, 0x0, {0x0, 0x1}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x8}, 0x8001}}]]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x84}}, 0x0) 1m18.55984725s ago: executing program 4 (id=4015): r0 = fanotify_init(0x2, 0x0) fanotify_mark(r0, 0x201, 0x0, 0xffffffffffffffff, 0x0) (async) r1 = fsopen(&(0x7f0000000080)='nfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) syz_init_net_socket$ax25(0x3, 0x5, 0xca) (async) ioctl$SIOCAX25ADDUID(r1, 0x89e1, &(0x7f0000000040)={0x3, @null}) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f00000000c0)={0x3, &(0x7f0000000400)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x28, 0x0, 0x0, 0xfffff024}, {0x6, 0x4, 0x0, 0x5}]}, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffffe) keyctl$search(0xa, r3, &(0x7f00000000c0)='keyring\x00', &(0x7f0000000100)={'syz', 0x2}, 0x0) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x964af7b4d61139e1, 0x0) ioctl$SG_BLKTRACESTOP(r4, 0x1275, 0x0) 1m18.481448814s ago: executing program 4 (id=4018): openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000000)="180c4552", 0x4) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000400)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x204, 0x0, 0x0, 0x0, 0xc, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d9600010000000000000000000000000000000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f30600301a0f4bdf7ffffffffffffff00"}}) 1m17.844816322s ago: executing program 8 (id=4020): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0xfe33) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000007000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002300000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r2}, 0x10) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4083, 0xff3}], 0x1}, 0x102) 1m17.758814308s ago: executing program 4 (id=4021): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$kcm(0x11, 0x2, 0x300) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r0, &(0x7f0000000480)=ANY=[@ANYBLOB='-', @ANYRESDEC=r0], 0x27) 1m17.721415338s ago: executing program 4 (id=4022): ioctl$COMEDI_DEVCONFIG(0xffffffffffffffff, 0x40946400, &(0x7f0000000140)={'dac02\x00', [0x3, 0x3, 0x7ffffff7, 0x884e1, 0x2f, 0x2007, 0x7, 0x8, 0x80ffe, 0x1, 0x4, 0x8500, 0x1003, 0x1000004, 0xb, 0xffff, 0xffffffa8, 0x7ffffffd, 0x1ff, 0x10000, 0x10, 0x40000, 0x8, 0xe2df, 0xf46f, 0x8, 0x5, 0x3, 0x0, 0x4, 0x7fff]}) syz_usb_connect$uac1(0x0, 0xa9, &(0x7f0000000100)=ANY=[], 0x0) 1m16.925759395s ago: executing program 8 (id=4026): r0 = socket$unix(0x1, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000040)=@newlink={0x34, 0x10, 0x401, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0x20878, 0x1a201}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipip={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x80d0}, 0x0) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$printer(r2, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r2, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="1e000000000000000800000006"], 0x50) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000001740)={r3, 0x0, &(0x7f0000001700)=""/53}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000001740)={r3, 0x0, &(0x7f0000001700)=""/53}, 0x20) bind$unix(r0, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000440)={&(0x7f0000000300)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000340)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSETELEM={0x2c, 0xc, 0xa, 0x101, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x54}, 0x1, 0x0, 0x0, 0x1}, 0x1) listen(r0, 0x2) r5 = socket$unix(0x1, 0x1, 0x0) connect$unix(r5, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000980)=[{{0x0, 0x0, &(0x7f0000000900)=[{&(0x7f0000000100)="01e5", 0x2}], 0x1, &(0x7f0000000240)=[@rights={{0x14, 0x1, 0x1, [r5]}}], 0x18, 0x24048001}}], 0x1, 0x44080) ioctl$FS_IOC_FSSETXATTR(r0, 0x401c5820, &(0x7f0000000040)={0x3, 0x3ff, 0xfa18, 0x6, 0x8}) r6 = syz_open_dev$evdev(&(0x7f0000000200), 0x5, 0xcc100) ioctl$EVIOCGMASK(r6, 0x80104592, &(0x7f00000002c0)={0x5, 0x28, &(0x7f0000000280)="00fc87a6753fdf799ea6d4c2ec0ec65f9252ab2c6cc885e73c3a42761b4d6ea0765bc55aaede38c0"}) accept4(r0, 0x0, 0x0, 0x80800) prlimit64(0x0, 0x8, &(0x7f0000000000)={0xfffffffffffffffb, 0xfffffffffffffffc}, 0x0) mlockall(0x7) 1m14.654641081s ago: executing program 4 (id=4037): r0 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r0, &(0x7f0000000100)=ANY=[@ANYBLOB], 0xfe33) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000580)=ANY=[@ANYBLOB="05000000050000000200000004"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000900)={0x11, 0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b703000000000000850000007000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000002300000095"], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000004c0)={&(0x7f0000000300)='tlb_flush\x00', r2}, 0x10) recvmsg(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000840)=""/4083, 0xff3}], 0x1}, 0x102) 1m13.671948502s ago: executing program 8 (id=4042): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x0, '\x00', 0x0, 0x0}, 0x48) socket$kcm(0x11, 0x2, 0x300) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000480)=ANY=[@ANYBLOB='-', @ANYRESDEC=r1], 0x27) 1m13.09587345s ago: executing program 8 (id=4046): r0 = syz_open_dev$dri(0x0, 0x1, 0x0) (async) r1 = socket(0x1d, 0x2, 0x6) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_DEL(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) (async) prlimit64(0x0, 0xd, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$DRM_IOCTL_GET_SAREA_CTX(r0, 0xc010641d, 0x0) (async) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$inet_sctp(r1, 0x0, 0x4) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket(0x2b, 0x1, 0x1) listen(r3, 0x0) (async) prlimit64(0x0, 0xe, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x1, 0x0) r4 = syz_io_uring_setup(0x10b4, &(0x7f0000000380)={0x0, 0x60d1, 0x400, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) (async) io_uring_enter(r4, 0x47ba, 0x0, 0x28, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000900)='./file0\x00', 0x2000284) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r8 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) (async) setrlimit(0x7, &(0x7f0000000400)) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r7, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r7, 0xffffffffffffffff) 57.160392347s ago: executing program 44 (id=4046): r0 = syz_open_dev$dri(0x0, 0x1, 0x0) (async) r1 = socket(0x1d, 0x2, 0x6) bind$can_j1939(0xffffffffffffffff, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_DEL(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x80) (async) prlimit64(0x0, 0xd, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$DRM_IOCTL_GET_SAREA_CTX(r0, 0xc010641d, 0x0) (async) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) sendmsg$inet_sctp(r1, 0x0, 0x4) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r3 = socket(0x2b, 0x1, 0x1) listen(r3, 0x0) (async) prlimit64(0x0, 0xe, 0x0, 0x0) (async) sched_setscheduler(0x0, 0x1, 0x0) r4 = syz_io_uring_setup(0x10b4, &(0x7f0000000380)={0x0, 0x60d1, 0x400, 0x0, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) (async) io_uring_enter(r4, 0x47ba, 0x0, 0x28, 0x0, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000900)='./file0\x00', 0x2000284) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) ioctl$IOMMU_IOAS_ALLOC(0xffffffffffffffff, 0x3b81, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r8 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) (async) setrlimit(0x7, &(0x7f0000000400)) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r7, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, r8, r7, 0xffffffffffffffff) 36.668652116s ago: executing program 6 (id=4096): ioctl$VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, 0x0) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000040), 0x5, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0xb4, 0x6a, 0x2c, 0x10, 0x7b4, 0x10a, 0x102, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0xd6, 0x2, 0x2, 0x2b, 0x57, 0x33, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x10, 0x0, 0xfa}}, {{0x9, 0x5, 0x81, 0x2, 0x40, 0x0, 0x3d, 0x1}}]}}]}}]}}, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f00000002c0)={0x10000000, 0x40000c, 0xd229}) socket$nl_generic(0x10, 0x3, 0x10) setreuid(0x0, 0x0) syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000080)={{0x12, 0x1, 0x111, 0x0, 0x0, 0x0, 0x40, 0xc45, 0x760b, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x0, 0x3, 0x80, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x3, 0x3, 0x0, 0x1, 0xfd, {0x9, 0x21, 0x100, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0xff, 0x0, 0x9}}, [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x3, 0x5, 0x6}}]}}}]}}]}}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r1, 0x6, 0x5, &(0x7f0000000040)=0x24, 0x5) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x48000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x30, 0xffffffffffffffff, 0x0) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, 0x0) 33.397444459s ago: executing program 1 (id=4098): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="09000000030000000400"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000000400000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) close(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x9}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r3}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000800)='blkio.bfq.avg_queue_size\x00', 0x26e1, 0x0) 33.326018505s ago: executing program 6 (id=4099): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000340)='svcrdma_post_recv\x00', r0}, 0xfffffd95) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x0, &(0x7f0000000180)}) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@cgroup, 0x14, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) (async) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000800)={@cgroup, 0x14, 0x1, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) socket$igmp6(0xa, 0x3, 0x2) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) creat(&(0x7f0000000000)='./file0\x00', 0x135) openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/locks\x00', 0x0, 0x0) (async) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/locks\x00', 0x0, 0x0) close_range(r1, r2, 0x0) r4 = socket$kcm(0x2, 0x2, 0x0) setsockopt$sock_attach_bpf(r3, 0x1, 0xf, &(0x7f00000003c0), 0x4) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{0x0, 0x4, 0x0, 0x3}, 'syz1\x00', 0x4b}) (async) ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000080)={{0x0, 0x4, 0x0, 0x3}, 'syz1\x00', 0x4b}) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) (async) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x3) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800001000088}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpgrp(0x0) (async) r6 = getpgrp(0x0) sched_setaffinity(r6, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, r6, 0x2, 0x0) getpid() (async) r7 = getpid() sched_setscheduler(r7, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r8 = syz_clone(0x80000, 0x0, 0x0, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r8, 0x1, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) (async) r9 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r9, &(0x7f000000c300)=""/102393, 0x18ff9) (async) read$msr(r9, &(0x7f000000c300)=""/102393, 0x18ff9) ioctl$UI_DEV_CREATE(r5, 0x5501) (async) ioctl$UI_DEV_CREATE(r5, 0x5501) socket$inet6(0xa, 0x2, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0}}, 0x20000000) sendmsg$inet(r4, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) 33.325453446s ago: executing program 2 (id=4100): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfffffffc, 0x1}, &(0x7f00000007c0)=0x0, &(0x7f00000001c0)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) 33.301096984s ago: executing program 1 (id=4101): r0 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(0xffffffffffffffff, 0x0, 0x1) fchdir(r1) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000380)={0x5, r0, 'id0\x00'}) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000480)={{0x1}, &(0x7f0000000400), &(0x7f0000000440)='%pK \x00'}, 0x20) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000540)={{0x1}, &(0x7f00000004c0), &(0x7f0000000500)='%pI4 \x00'}, 0x20) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x129c81, 0x0) ppoll(&(0x7f0000000280)=[{r3, 0x6200}], 0x1, 0x0, 0x0, 0x0) write$binfmt_aout(r3, &(0x7f0000000080)=ANY=[], 0xff2e) ioctl$TCSETS(r3, 0x40045431, &(0x7f00000000c0)={0x0, 0x0, 0x7f, 0x4000006, 0x1, "42341f9b1000007e4f00"}) r4 = syz_open_pts(r3, 0x103100) dup3(r4, r3, 0x0) splice(r3, 0x0, r2, 0x0, 0x7ffff000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1f, 0xd, &(0x7f00000006c0)=ANY=[@ANYBLOB="186e0000100000000000000002000000185b0000100000000000000000000000184b00000200000000000000000000001833000002000000000000000000000018120000", @ANYRES32, @ANYBLOB="0000000000000000b7030000c07544a5f24a6b7b5def50fcfbc3f00000000065ccf400"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0xa0, '\x00', 0x0, @fallback=0x8, r1, 0x8, &(0x7f00000002c0)={0x6, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, r0, 0x0, &(0x7f0000000100), 0x0, 0x10, 0xa83}, 0x94) openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x20, &(0x7f0000000000)=[0xffffffffffffffff], 0x1) write$binfmt_format(0xffffffffffffffff, &(0x7f0000000300)='1\x00', 0x2) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x50) r7 = creat(&(0x7f0000000580)='./file1\x00', 0x0) r8 = fanotify_init(0xf00, 0x1) fanotify_mark(r8, 0x105, 0x40009975, r7, 0x0) fallocate(r6, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r6, 0x0) 31.88831731s ago: executing program 2 (id=4102): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x3, 0xc, &(0x7f00000005c0)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000610000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000110b0008850000001000000095"], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xc, '\x00', 0x0, @sched_cls=0x37, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff81}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r0, 0x0, 0xb, 0x0, &(0x7f00000008c0)="c1188e19b9fef922b91287", 0x0, 0x254, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 29.421217674s ago: executing program 6 (id=4103): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000480)=ANY=[@ANYBLOB='-'], 0x27) 29.381900931s ago: executing program 2 (id=4104): prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_io_uring_setup(0x110, 0x0, &(0x7f00000007c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000100)=@IORING_OP_READ=@use_registered_buffer={0x16, 0x20, 0x6000, @fd_index, 0x7, 0x0, 0x0, 0x1e, 0x1}) io_uring_enter(r3, 0x47f6, 0x0, 0x0, 0x0, 0x0) 28.947766895s ago: executing program 1 (id=4105): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000000000)={0x8, 0xffffffffffffffff, 0x1}) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r1, 0x80047210, &(0x7f0000000080)) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) userfaultfd(0x80001) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r3, 0xc004500a, &(0x7f0000001340)) syz_open_dev$media(&(0x7f0000000040), 0x1723, 0x440) connect$netrom(0xffffffffffffffff, 0x0, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x2c, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="2800000035000701feffffff00000000027c00000c0001"], 0x28}, 0x1, 0x0, 0x0, 0x48895}, 0x8000) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='coredump_filter\x00') ioctl$MON_IOCX_MFETCH(r4, 0xc0109207, &(0x7f0000000200)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x6, 0xfffffc00}) write$cgroup_int(r4, &(0x7f0000000300)=0x9, 0x12) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_tcp_int(r4, 0x6, 0x4, &(0x7f0000000240)=0x9, 0x4) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r5, 0x84, 0x7, &(0x7f00000000c0)={0x8}, 0x4) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=ANY=[@ANYBLOB="5000000020000103feffffff000000be4a1f38a69deb0002000000000000000400010008003f761c63a7e80641496a0a000008090000001e72924900b37b8017fa1ec39824f2a6932e246587af0397db04f739a98ab75776a085ee1be9997c3ab96a6ef86d53ce6934c8f601cb0d263cd1cd8d02c16307f17361c8fad53363bc3711b18e82b7c7fee82f15b9e47069118c1dbc7ed9e902a2cac205c3d45789698f609c94ded41b7efc3d6bb6b5787b4f954e36b42e7982ed170a8c5724bd50295f48966c3838daa898563a0468edf5c1d0f1b01365866a6c0346cb3f16e75f214983ed2e04439a3944344d1f4660567f577667ac01bbd53ab5b75ef6ba6f8ceaa4dc03c3333b315773b8c69f21216792c15e194ae9417c0d108a8730dfacea5d66c7ee97d3a444123dae535d6f0ce0c82fad0ee3cda2ce"], 0x50}}, 0x4000850) 28.851607832s ago: executing program 6 (id=4106): r0 = socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$inet_sctp(r0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="20000000000000008400000005"], 0x20, 0x40000}, 0x80) 28.426367279s ago: executing program 2 (id=4107): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="010008020000001800006600000008000300", @ANYRES32=r2, @ANYBLOB="08002600940900160800b70099"], 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 28.234967651s ago: executing program 6 (id=4108): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.bfq.idle_time\x00', 0x275a, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c"], 0x130}, 0x1, 0x0, 0x0, 0x8000}, 0x8880) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x1200, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000c9ffffff00", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x2000000000001]}}) 28.23199978s ago: executing program 2 (id=4109): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0x1]}, 0x8, 0x0) ppoll(&(0x7f00000001c0)=[{r3, 0x88}], 0x1, 0x0, 0x0, 0x0) syz_open_dev$radio(0x0, 0x3, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000640)={{{@in6=@local, @in=@multicast1}}, {{@in=@local}, 0x0, @in=@private}}, &(0x7f0000000380)=0xe8) getuid() r5 = openat$urandom(0xffffffffffffff9c, 0x0, 0x991843, 0x0) writev(r5, 0x0, 0x0) r6 = syz_open_procfs(0x0, &(0x7f0000000080)='net/snmp6\x00') ioctl$AUTOFS_IOC_SETTIMEOUT(0xffffffffffffffff, 0x80049367, 0x0) pread64(r6, &(0x7f0000000100)=""/253, 0xfd, 0xadc) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r6, r8, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x6, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) 27.936944897s ago: executing program 1 (id=4110): syz_open_dev$cec(&(0x7f0000000340), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) openat(0xffffffffffffff9c, &(0x7f0000000180)='./cgroup.net/devices.allow\x00', 0x2, 0x48) r0 = syz_open_procfs(0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'gretap0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x20004804) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) gettid() r4 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x80, 0x0) shmget$private(0x0, 0x4000, 0x800, &(0x7f0000007000/0x4000)=nil) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) r5 = socket(0x10, 0x3, 0x0) readv(r4, &(0x7f0000000080)=[{&(0x7f0000000200)=""/100, 0x64}], 0x1) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x24040880}, 0x800) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x2000000) ioctl$SNDRV_PCM_IOCTL_HWSYNC(0xffffffffffffffff, 0x4122, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), r0) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000340)={'wlan1\x00'}) futex(&(0x7f000000cffc)=0x3, 0x5, 0x1, 0x0, 0x0, 0x5000000) 27.833997845s ago: executing program 6 (id=4111): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000200)={0xb, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x800, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x3f, &(0x7f0000000040), 0x4) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000000340)={'bond0\x00'}) mkdir(0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000001c0)) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x20000000, 0x40800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000180)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000840000/0x14000)=nil, &(0x7f00001a5000/0x1000)=nil, 0x14000, 0x0, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x1c080, 0x0) 26.858263347s ago: executing program 1 (id=4112): openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000300)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x91eb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x82}, 0x50) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000100)="c2", 0x1}], 0x1}, 0x80) unlink(&(0x7f0000000000)='\x13\x13w\xc5\xfc5\xd4\x14T\xd5\xd4\x1d)\xad\x1a`)Y\x81F\xe6\xbe\x16nA\xad\r\xbd@T\x03<\x9f3\xbb\xda\x82$\xa2\xf3\xd7r\xe7cnH\xb3<\xbfp\x83r\xe8\xf1\xb9\x93>\xc5\x12wC\xbe\"\x06 \x9e\xf0-\xf9\xcb\xf2\xf6\xe8\x80\xd38//file0\x00') bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0}, 0x90) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd6317ce22000000"], 0xfdef) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x4, &(0x7f0000000000)='%', 0x0, 0xd01, 0x80040000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 26.053139196s ago: executing program 2 (id=4113): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0x0, 0xfffe}, 0x0, [0x0, 0x0, 0xfffffffe, 0x9, 0x80, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40006, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1cc], [0x0, 0x0, 0x8, 0xb16, 0x0, 0x200000, 0x9, 0x0, 0xa, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0xc1a5, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0xd, 0x1000, 0x0, 0xf, 0x4, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x1, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffd, 0x0, 0xfffffffa, 0x0, 0x80000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb51, 0x0, 0xe], [0x80000007, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xddc, 0x0, 0x0, 0xfffffffc, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x5f78, 0x0, 0x0, 0xfffffffc, 0x0, 0xb, 0x4], [0xfffffffc, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xc045, 0x0, 0x0, 0x0, 0x1000, 0x2, 0x80, 0x0, 0x3, 0x9cac, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xdb9, 0xb50, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0xfffd, 0xd}, 0x4d, [0x400, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004, 0x0, 0xfffffffe, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x2, 0x120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0xffffffff, 0x3, 0x3, 0x1, 0x0, 0x6, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0x400000, 0x1, 0xfffffffd, 0xfffffffc, 0xfffffffe, 0x0, 0x4, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd5], [0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200000, 0x0, 0x0, 0x3, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x7fffffc, 0x0, 0x0, 0x7fff, 0x0, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x11000000, 0x6, 0x2], [0x5, 0x0, 0x405d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xd5f5, 0x0, 0x0, 0x100, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0xfc2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xe58b, 0xe, 0x0, 0x3, 0x0, 0x1, 0x1ff, 0x3]}, 0x45c) 21.552643271s ago: executing program 1 (id=4114): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000480)=ANY=[@ANYBLOB='-'], 0x27) 322.6531ms ago: executing program 45 (id=4113): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x5) write$uinput_user_dev(r0, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0x0, 0xfffe}, 0x0, [0x0, 0x0, 0xfffffffe, 0x9, 0x80, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x3, 0x5, 0x1, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40006, 0x0, 0x0, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1cc], [0x0, 0x0, 0x8, 0xb16, 0x0, 0x200000, 0x9, 0x0, 0xa, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x2, 0x0, 0x9, 0x20, 0x0, 0x0, 0x0, 0xc1a5, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0xffffffff, 0xd, 0x1000, 0x0, 0xf, 0x4, 0x2, 0x0, 0x0, 0x0, 0xfffffffe, 0x4, 0x1, 0x0, 0x0, 0x0, 0xfffffffd, 0xfffffffd, 0x0, 0xfffffffa, 0x0, 0x80000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xcb51, 0x0, 0xe], [0x80000007, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xddc, 0x0, 0x0, 0xfffffffc, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0xe, 0x1, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x5f78, 0x0, 0x0, 0xfffffffc, 0x0, 0xb, 0x4], [0xfffffffc, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xc045, 0x0, 0x0, 0x0, 0x1000, 0x2, 0x80, 0x0, 0x3, 0x9cac, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x3, 0x0, 0x0, 0xfffffffe, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0xdb9, 0xb50, 0x0, 0x4, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r0, 0x5501) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0xfffd, 0xd}, 0x4d, [0x400, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20004, 0x0, 0xfffffffe, 0x3, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x2, 0x120, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], [0xffffffff, 0x3, 0x3, 0x1, 0x0, 0x6, 0x0, 0xfffffffb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0x400000, 0x1, 0xfffffffd, 0xfffffffc, 0xfffffffe, 0x0, 0x4, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfd5], [0x0, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x200000, 0x0, 0x0, 0x3, 0x0, 0x10000000, 0x0, 0x0, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7ff, 0x3, 0x7fffffc, 0x0, 0x0, 0x7fff, 0x0, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x11000000, 0x6, 0x2], [0x5, 0x0, 0x405d30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0xd5f5, 0x0, 0x0, 0x100, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0xffffffff, 0x2, 0x0, 0x0, 0xfc2, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xe58b, 0xe, 0x0, 0x3, 0x0, 0x1, 0x1ff, 0x3]}, 0x45c) 145.193246ms ago: executing program 46 (id=4114): mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_int(r0, &(0x7f0000000880)='cgroup.max.depth\x00', 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000480)=ANY=[@ANYBLOB='-'], 0x27) 0s ago: executing program 47 (id=4111): prlimit64(0x0, 0xe, &(0x7f0000000300)={0x0, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000200)={0xb, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/custom1\x00', 0x800, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x3f, &(0x7f0000000040), 0x4) ioctl$sock_inet_SIOCGIFBRDADDR(0xffffffffffffffff, 0x8919, &(0x7f0000000340)={'bond0\x00'}) mkdir(0x0, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000001c0)) syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) r3 = syz_open_dev$dri(&(0x7f0000000040), 0x20000000, 0x40800) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000000)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000080)) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000180)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000840000/0x14000)=nil, &(0x7f00001a5000/0x1000)=nil, 0x14000, 0x0, 0x2}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='sys_enter\x00', r1}, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) waitid(0x0, 0x0, 0x0, 0x4, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x1c080, 0x0) kernel console output (not intermixed with test programs): usb 5-1: New USB device found, idVendor=0763, idProduct=201a, bcdDevice=61.14 [ 1024.078342][ T5933] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1024.087599][T20465] usb 3-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1024.098042][ T5933] usb 5-1: config 0 descriptor?? [ 1024.103027][T20465] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1024.111247][T20465] usb 3-1: Product: syz [ 1024.118099][T20465] usb 3-1: Manufacturer: syz [ 1024.124060][T20465] usb 3-1: SerialNumber: syz [ 1024.137469][T20465] usb 3-1: config 0 descriptor?? [ 1024.471643][T21109] sctp: [Deprecated]: syz.6.3485 (pid 21109) Use of int in max_burst socket option. [ 1024.471643][T21109] Use struct sctp_assoc_value instead [ 1025.215078][T20465] f81534 3-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1025.260354][T20465] f81534 3-1:0.12: f81534_find_config_idx: read failed: -71 [ 1025.287694][T20465] f81534 3-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1025.316479][T20465] f81534 3-1:0.12: probe with driver f81534 failed with error -71 [ 1025.367250][T20465] usb 3-1: USB disconnect, device number 63 [ 1025.454674][T21116] lo speed is unknown, defaulting to 1000 [ 1025.484061][T21116] virt_wifi0 speed is unknown, defaulting to 1000 [ 1025.547922][T21116] lo speed is unknown, defaulting to 1000 [ 1025.618008][T21119] loop3: detected capacity change from 0 to 1 [ 1025.626084][T21119] Dev loop3: unable to read RDB block 1 [ 1025.632431][T21119] loop3: unable to read partition table [ 1025.647050][T21119] loop3: partition table beyond EOD, truncated [ 1025.653263][T21119] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1025.712794][T21123] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3489'. [ 1025.872765][T20337] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1026.189560][T21125] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3489'. [ 1026.565898][T21130] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3490'. [ 1026.905803][T20337] usb 2-1: config 0 has no interfaces? [ 1026.917719][ T89] usb 5-1: USB disconnect, device number 59 [ 1026.925267][T20337] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1026.939740][T20337] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1027.106384][T20337] usb 2-1: Product: syz [ 1027.110648][T20337] usb 2-1: Manufacturer: syz [ 1027.116183][T20337] usb 2-1: SerialNumber: syz [ 1027.125515][T20337] usb 2-1: config 0 descriptor?? [ 1027.213896][T21141] 9p: Bad value for 'rfdno' [ 1027.222006][T21141] netlink: 'syz.7.3493': attribute type 23 has an invalid length. [ 1027.856120][T21157] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3496'. [ 1027.934311][T21158] siw: device registration error -23 [ 1028.290900][T20465] usb 2-1: USB disconnect, device number 23 [ 1028.347286][T21161] lo speed is unknown, defaulting to 1000 [ 1028.358512][T21161] virt_wifi0 speed is unknown, defaulting to 1000 [ 1028.467693][T21161] lo speed is unknown, defaulting to 1000 [ 1028.533680][ T89] usb 3-1: new low-speed USB device number 64 using dummy_hcd [ 1028.661158][T21166] xt_SECMARK: invalid mode: 2 [ 1028.703874][ T89] usb 3-1: Invalid ep0 maxpacket: 64 [ 1028.794029][T20465] usb 8-1: new full-speed USB device number 14 using dummy_hcd [ 1028.833702][ T89] usb 3-1: new low-speed USB device number 65 using dummy_hcd [ 1028.945508][T20465] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1028.955360][T20465] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1028.981692][T20465] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1028.993674][ T89] usb 3-1: Invalid ep0 maxpacket: 64 [ 1029.001266][ T89] usb usb3-port1: attempt power cycle [ 1029.012048][T20465] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1029.252069][T20465] usb 8-1: usb_control_msg returned -32 [ 1029.258121][T20465] usbtmc 8-1:16.0: can't read capabilities [ 1029.715244][ T89] usb 3-1: new low-speed USB device number 66 using dummy_hcd [ 1029.745511][ T89] usb 3-1: Invalid ep0 maxpacket: 64 [ 1029.883747][ T89] usb 3-1: new low-speed USB device number 67 using dummy_hcd [ 1029.904884][ T89] usb 3-1: Invalid ep0 maxpacket: 64 [ 1029.910697][ T89] usb usb3-port1: unable to enumerate USB device [ 1030.027579][T21184] loop3: detected capacity change from 0 to 1 [ 1030.039441][T21184] Dev loop3: unable to read RDB block 1 [ 1030.045541][T21184] loop3: unable to read partition table [ 1030.056362][T21184] loop3: partition table beyond EOD, truncated [ 1030.276727][T21184] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1030.332726][T21189] netlink: 'syz.4.3507': attribute type 5 has an invalid length. [ 1030.695612][T21194] netlink: 216 bytes leftover after parsing attributes in process `syz.1.3508'. [ 1030.705989][T21194] netlink: 40 bytes leftover after parsing attributes in process `syz.1.3508'. [ 1031.756788][ T24] usb 8-1: USB disconnect, device number 14 [ 1032.197213][T21209] netlink: 'syz.7.3513': attribute type 1 has an invalid length. [ 1032.226658][T21208] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3512'. [ 1032.306251][ T30] audit: type=1400 audit(1032.273:1050): avc: denied { create } for pid=21207 comm="syz.7.3513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1032.331014][ T30] audit: type=1400 audit(1032.293:1051): avc: denied { write } for pid=21207 comm="syz.7.3513" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_iscsi_socket permissive=1 [ 1032.356321][T21209] bond1: entered promiscuous mode [ 1032.382530][T21209] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1032.502451][T21209] bond1: (slave ipvlan2): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1032.536935][T21209] bond1: (slave ipvlan2): The slave device specified does not support setting the MAC address [ 1032.566118][T21209] bond1: (slave ipvlan2): Setting fail_over_mac to active for active-backup mode [ 1032.944104][T21219] lo speed is unknown, defaulting to 1000 [ 1032.956503][T21219] virt_wifi0 speed is unknown, defaulting to 1000 [ 1032.969695][T21219] lo speed is unknown, defaulting to 1000 [ 1033.116644][T21230] netlink: 'syz.6.3516': attribute type 4 has an invalid length. [ 1033.135212][ T89] usb 5-1: new high-speed USB device number 60 using dummy_hcd [ 1033.395706][ T89] usb 5-1: config 0 has no interfaces? [ 1033.406351][ T89] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1033.458493][ T89] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1033.466604][ T5933] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1033.485803][ T89] usb 5-1: Product: syz [ 1033.526507][ T89] usb 5-1: Manufacturer: syz [ 1033.537222][ T89] usb 5-1: SerialNumber: syz [ 1033.566716][ T89] usb 5-1: config 0 descriptor?? [ 1033.697718][ T5933] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1033.718018][ T5933] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1033.842866][ T5933] usb 2-1: New USB device found, idVendor=0b0e, idProduct=ffff, bcdDevice= 0.00 [ 1033.867116][T21219] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1033.877128][ T5933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1033.925290][ T5933] usb 2-1: config 0 descriptor?? [ 1033.951639][T20465] usb 5-1: USB disconnect, device number 60 [ 1034.080847][T21243] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3522'. [ 1034.100995][T21243] netlink: 36 bytes leftover after parsing attributes in process `syz.7.3522'. [ 1034.111989][T21243] veth0_to_batadv: entered allmulticast mode [ 1034.257028][T21248] netlink: 'syz.7.3525': attribute type 10 has an invalid length. [ 1034.560488][T21248] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1035.005566][T21258] netlink: 'syz.7.3527': attribute type 1 has an invalid length. [ 1035.013390][T21258] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3527'. [ 1035.102445][T20465] usb 5-1: new full-speed USB device number 61 using dummy_hcd [ 1035.430061][T20465] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1035.486723][T21260] netlink: 'syz.2.3528': attribute type 8 has an invalid length. [ 1035.519289][T20465] usb 5-1: not running at top speed; connect to a high speed hub [ 1035.558824][T21260] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3528'. [ 1035.653184][T21261] netlink: 'syz.2.3528': attribute type 8 has an invalid length. [ 1035.671975][T20465] usb 5-1: config 14 has an invalid interface number: 21 but max is 0 [ 1035.735954][T21261] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3528'. [ 1035.758082][T20465] usb 5-1: config 14 has an invalid descriptor of length 144, skipping remainder of the config [ 1035.866633][T20465] usb 5-1: config 14 has no interface number 0 [ 1035.899697][T20465] usb 5-1: config 14 interface 21 altsetting 251 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1035.961001][T20465] usb 5-1: config 14 interface 21 has no altsetting 0 [ 1036.055267][T20465] usb 5-1: New USB device found, idVendor=c880, idProduct=760e, bcdDevice=35.fc [ 1036.079618][T21260] bond0: entered promiscuous mode [ 1036.104125][T21260] bond_slave_0: entered promiscuous mode [ 1036.133618][T20465] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1036.141642][T20465] usb 5-1: Product: syz [ 1036.164594][T20465] usb 5-1: Manufacturer: syz [ 1036.169204][T20465] usb 5-1: SerialNumber: syz [ 1036.182596][ T5933] usbhid 2-1:0.0: can't add hid device: -71 [ 1036.221244][T21260] bond_slave_1: entered promiscuous mode [ 1036.233074][ T5933] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1036.240955][T21260] dummy0: entered promiscuous mode [ 1036.251371][T21260] team0: entered promiscuous mode [ 1036.256478][T21260] team_slave_0: entered promiscuous mode [ 1036.262231][ T5933] usb 2-1: USB disconnect, device number 24 [ 1036.268281][T21260] team_slave_1: entered promiscuous mode [ 1036.276119][T21260] debugfs: 'hsr1' already exists in 'hsr' [ 1036.281842][T21260] Cannot create hsr debugfs directory [ 1036.287370][T21260] hsr1: entered promiscuous mode [ 1036.478189][T20465] usb 5-1: Quirk or no altset; falling back to MIDI 1.0 [ 1036.490297][T20465] usb 5-1: MIDIStreaming interface descriptor not found [ 1036.505354][T21269] netlink: 'syz.7.3532': attribute type 8 has an invalid length. [ 1036.533570][T21269] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3532'. [ 1036.533860][T20465] usb 5-1: USB disconnect, device number 61 [ 1036.559860][T21269] bond0: entered promiscuous mode [ 1036.566092][T21269] bond_slave_0: entered promiscuous mode [ 1036.580142][T21269] bond_slave_1: entered promiscuous mode [ 1036.588005][T21269] dummy0: entered promiscuous mode [ 1036.595117][T21275] netlink: 'syz.7.3532': attribute type 8 has an invalid length. [ 1036.596335][T21269] team0: entered promiscuous mode [ 1036.608462][T21275] netlink: 4 bytes leftover after parsing attributes in process `syz.7.3532'. [ 1036.621947][T21269] team_slave_0: entered promiscuous mode [ 1036.628580][T21272] netlink: 'syz.2.3533': attribute type 1 has an invalid length. [ 1036.629206][T21269] team_slave_1: entered promiscuous mode [ 1036.642924][T21276] netlink: 216 bytes leftover after parsing attributes in process `syz.6.3531'. [ 1036.652356][T21276] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3531'. [ 1036.665467][T21269] debugfs: 'hsr1' already exists in 'hsr' [ 1036.671243][T21269] Cannot create hsr debugfs directory [ 1036.677613][T21269] hsr1: entered promiscuous mode [ 1036.744528][ T5933] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1036.763494][T21272] bond1: entered promiscuous mode [ 1036.790055][T21272] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1036.836438][T21277] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1036.843363][T21277] bond1: (slave wireguard0): The slave device specified does not support setting the MAC address [ 1036.864228][T21277] bond1: (slave wireguard0): Setting fail_over_mac to active for active-backup mode [ 1036.899726][T21284] netlink: 'syz.7.3534': attribute type 10 has an invalid length. [ 1036.961511][ T5933] usb 2-1: Using ep0 maxpacket: 32 [ 1036.963454][T21277] bond1: (slave wireguard0): making interface the new active one [ 1036.979637][T21277] wireguard0: entered promiscuous mode [ 1036.992469][ T5933] usb 2-1: config 0 interface 0 altsetting 128 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1037.008967][T21277] bond1: (slave wireguard0): Enslaving as an active interface with an up link [ 1037.011588][ T5933] usb 2-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1037.050894][T21284] batadv0: left allmulticast mode [ 1037.056831][T21286] netlink: 'syz.7.3534': attribute type 10 has an invalid length. [ 1037.064719][T21286] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3534'. [ 1037.077485][T21284] bridge0: port 3(batadv0) entered disabled state [ 1037.111381][ T5933] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1037.154404][ T5933] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 1037.270219][ T5933] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1037.286101][T21286] batadv0: entered allmulticast mode [ 1037.302802][T21286] bridge0: port 3(batadv0) entered blocking state [ 1037.320540][T21286] bridge0: port 3(batadv0) entered disabled state [ 1037.328737][ T5933] usb 2-1: config 0 descriptor?? [ 1037.350819][ T5933] usbhid 2-1:0.0: can't add hid device: -22 [ 1037.361000][T21286] bridge0: port 3(batadv0) entered blocking state [ 1037.362030][ T5933] usbhid 2-1:0.0: probe with driver usbhid failed with error -22 [ 1037.367560][T21286] bridge0: port 3(batadv0) entered forwarding state [ 1037.397686][T21292] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20003 [ 1040.123320][T20386] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 1040.278991][ T24] usb 2-1: USB disconnect, device number 25 [ 1040.302579][T20386] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1040.334120][T20386] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 1040.336593][T21328] __nla_validate_parse: 2 callbacks suppressed [ 1040.336607][T21328] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3546'. [ 1040.401250][T21330] lo speed is unknown, defaulting to 1000 [ 1040.411084][T21330] virt_wifi0 speed is unknown, defaulting to 1000 [ 1040.422871][T21330] lo speed is unknown, defaulting to 1000 [ 1040.589013][T20386] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 1040.600004][T20386] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 1040.610343][T20386] usb 7-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 1040.621428][T20386] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.687730][T20386] usb 7-1: config 0 descriptor?? [ 1040.793736][ T5933] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 1040.930965][T20386] hdpvr 7-1:0.0: firmware version 0x0 dated [ 1040.973887][T20386] hdpvr 7-1:0.0: untested firmware, the driver might not work. [ 1041.033687][ T5933] usb 8-1: Using ep0 maxpacket: 16 [ 1041.052300][ T5933] usb 8-1: config 0 has no interfaces? [ 1041.064535][ T5933] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1041.081131][ T5933] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1041.333997][T21343] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1041.383861][ T30] audit: type=1400 audit(1041.273:1052): avc: denied { audit_read } for pid=21340 comm="syz.4.3549" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1041.543235][ T5933] usb 8-1: Manufacturer: syz [ 1041.573671][T21343] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1041.595933][ T5933] usb 8-1: config 0 descriptor?? [ 1041.633002][T21343] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1041.725548][ T30] audit: type=1400 audit(1041.693:1053): avc: denied { append } for pid=21314 comm="syz.6.3542" name="ppp" dev="devtmpfs" ino=709 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ppp_device_t tclass=chr_file permissive=1 [ 1041.856242][T17818] netdevsim netdevsim4 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1041.939501][T17818] netdevsim netdevsim4 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1042.034040][T17818] netdevsim netdevsim4 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1042.061022][T17818] netdevsim netdevsim4 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1042.072953][T21315] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1042.156433][T21315] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1042.186315][T21350] loop8: detected capacity change from 0 to 8 [ 1042.337255][T21350] Dev loop8: unable to read RDB block 8 [ 1042.349053][T21350] loop8: unable to read partition table [ 1042.370753][T21350] loop8: partition table beyond EOD, truncated [ 1042.392297][T21350] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 1043.719565][T20386] hdpvr 7-1:0.0: Could not setup controls [ 1043.735500][T20386] hdpvr 7-1:0.0: registering videodev failed [ 1043.773043][T20423] usb 8-1: USB disconnect, device number 15 [ 1043.775287][T20386] hdpvr 7-1:0.0: probe with driver hdpvr failed with error -71 [ 1043.791262][T20386] usb 7-1: USB disconnect, device number 65 [ 1045.158589][T21379] lo speed is unknown, defaulting to 1000 [ 1045.237431][T21379] virt_wifi0 speed is unknown, defaulting to 1000 [ 1045.283164][T21382] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3561'. [ 1045.410713][T21379] lo speed is unknown, defaulting to 1000 [ 1045.511227][T21387] erofs (device nbd2): cannot find valid erofs superblock [ 1045.530561][T21387] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3561'. [ 1045.693995][T20423] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 1046.413703][T20423] usb 8-1: Using ep0 maxpacket: 16 [ 1046.544497][T20423] usb 8-1: config 0 has no interfaces? [ 1046.544558][T21389] netlink: 'syz.1.3560': attribute type 10 has an invalid length. [ 1046.559729][T20423] usb 8-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1046.584428][T20423] usb 8-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1046.622877][T20423] usb 8-1: Manufacturer: syz [ 1046.708227][T20423] usb 8-1: config 0 descriptor?? [ 1047.083833][T20423] usb 5-1: new high-speed USB device number 62 using dummy_hcd [ 1047.413702][T20423] usb 5-1: Using ep0 maxpacket: 8 [ 1047.990255][T20423] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1048.024798][T20423] usb 5-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 1048.034256][T20423] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1048.050725][T20423] usb 5-1: config 0 descriptor?? [ 1048.063062][T21411] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3569'. [ 1048.241006][T21413] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3568'. [ 1048.413863][T21417] erofs (device nbd6): cannot find valid erofs superblock [ 1048.510026][T21414] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3569'. [ 1048.524880][T21419] erofs (device nbd2): cannot find valid erofs superblock [ 1048.577205][T21420] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3568'. [ 1049.427833][T21431] netlink: 'syz.6.3574': attribute type 10 has an invalid length. [ 1049.442710][T20386] usb 8-1: USB disconnect, device number 16 [ 1049.487534][T21432] netlink: 'syz.6.3574': attribute type 10 has an invalid length. [ 1049.543199][T21432] netlink: 40 bytes leftover after parsing attributes in process `syz.6.3574'. [ 1049.656269][T21432] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20003 [ 1050.014195][T20386] usb 8-1: new full-speed USB device number 17 using dummy_hcd [ 1050.151899][T20423] usbhid 5-1:0.0: can't add hid device: -71 [ 1050.398856][T20386] usb 8-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1050.418712][T20386] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.437550][T20386] usb 8-1: Product: syz [ 1050.447085][T20386] usb 8-1: Manufacturer: syz [ 1050.452521][T20386] usb 8-1: SerialNumber: syz [ 1050.457444][T20423] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1050.483887][T20423] usb 5-1: USB disconnect, device number 62 [ 1050.682232][T21435] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1050.691773][T21435] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1050.700733][T21443] lo speed is unknown, defaulting to 1000 [ 1050.729519][T20386] usb 8-1: 2:1 : format type 0 is detected, processed as PCM [ 1050.734730][T21443] virt_wifi0 speed is unknown, defaulting to 1000 [ 1050.748153][T20386] usb 8-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1050.755162][T20465] usb 2-1: new high-speed USB device number 26 using dummy_hcd [ 1050.757423][T20386] usb 8-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1050.781647][T21443] lo speed is unknown, defaulting to 1000 [ 1050.853183][T20386] usb 8-1: USB disconnect, device number 17 [ 1050.959722][T20465] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1050.998334][T20465] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1051.044038][ T5827] Bluetooth: hci4: command 0x0406 tx timeout [ 1051.134249][T20465] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1051.147813][T20465] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1051.340656][T20465] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1051.363168][T20465] usb 2-1: config 0 descriptor?? [ 1051.403507][T21453] 9p: Bad value for 'rfdno' [ 1051.408736][T21453] netlink: 'syz.4.3579': attribute type 23 has an invalid length. [ 1051.430207][T21457] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3581'. [ 1051.567104][T21459] netlink: 'syz.7.3580': attribute type 10 has an invalid length. [ 1051.607575][T21459] bridge0: port 3(batadv0) entered disabled state [ 1051.672124][T21461] erofs (device nbd2): cannot find valid erofs superblock [ 1051.723479][T21462] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3581'. [ 1052.092852][T20465] plantronics 0003:047F:FFFF.002A: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1052.106310][T21463] netlink: 'syz.7.3580': attribute type 10 has an invalid length. [ 1052.114177][T21463] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3580'. [ 1052.187127][T21463] bridge0: port 3(batadv0) entered blocking state [ 1052.207602][T21463] bridge0: port 3(batadv0) entered disabled state [ 1052.242852][T21463] bridge0: port 3(batadv0) entered blocking state [ 1052.249427][T21463] bridge0: port 3(batadv0) entered forwarding state [ 1052.330768][T21469] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3583'. [ 1052.438914][ T24] usb 5-1: new high-speed USB device number 63 using dummy_hcd [ 1052.462425][T21466] IPVS: set_ctl: invalid protocol: 59 127.0.0.1:20003 [ 1052.560374][T21474] erofs (device nbd6): cannot find valid erofs superblock [ 1052.574737][T21474] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3583'. [ 1053.012708][ T5825] Bluetooth: hci4: unexpected event for opcode 0x2035 [ 1053.055116][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 1053.081561][ T24] usb 5-1: no configurations [ 1053.088437][ T24] usb 5-1: can't read configurations, error -22 [ 1053.167107][T20465] usb 2-1: USB disconnect, device number 26 [ 1053.299966][ T24] usb 5-1: new high-speed USB device number 64 using dummy_hcd [ 1053.526996][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 1053.539156][ T24] usb 5-1: no configurations [ 1053.544138][ T24] usb 5-1: can't read configurations, error -22 [ 1053.551513][ T24] usb usb5-port1: attempt power cycle [ 1053.894081][ T24] usb 5-1: new high-speed USB device number 65 using dummy_hcd [ 1053.919761][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 1053.934103][ T24] usb 5-1: no configurations [ 1053.939025][ T24] usb 5-1: can't read configurations, error -22 [ 1053.978725][T21488] fuse: Bad value for 'user_id' [ 1053.984789][T21488] fuse: Bad value for 'user_id' [ 1054.008333][T10944] Process accounting resumed [ 1054.099130][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.114323][ T24] usb 5-1: new high-speed USB device number 66 using dummy_hcd [ 1054.186953][ T24] usb 5-1: Using ep0 maxpacket: 32 [ 1054.202702][ T24] usb 5-1: no configurations [ 1054.209730][ T24] usb 5-1: can't read configurations, error -22 [ 1054.217618][ T24] usb usb5-port1: unable to enumerate USB device [ 1054.603666][T20423] usb 7-1: new full-speed USB device number 66 using dummy_hcd [ 1054.634217][ T24] usb 3-1: new full-speed USB device number 68 using dummy_hcd [ 1054.757418][T20423] usb 7-1: config 8 has an invalid interface number: 102 but max is 0 [ 1054.777087][T20423] usb 7-1: config 8 has no interface number 0 [ 1054.783235][T20423] usb 7-1: config 8 interface 102 has no altsetting 0 [ 1054.789333][ T24] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1054.790308][T20423] usb 7-1: New USB device found, idVendor=07b0, idProduct=0007, bcdDevice=df.60 [ 1054.808233][T20423] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1054.810068][ T24] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1054.855781][ T24] usb 3-1: Product: syz [ 1054.865878][ T24] usb 3-1: Manufacturer: syz [ 1054.880644][ T24] usb 3-1: SerialNumber: syz [ 1055.023936][T20423] usb 7-1: string descriptor 0 read error: -71 [ 1055.035363][T20423] HFC-S_USB 7-1:8.102: probe with driver HFC-S_USB failed with error -5 [ 1055.054615][T20423] usb 7-1: USB disconnect, device number 66 [ 1055.086908][T21499] netlink: 'syz.1.3592': attribute type 8 has an invalid length. [ 1055.097583][T21499] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3592'. [ 1055.112819][ T24] usb 3-1: 2:1 : format type 0 is detected, processed as PCM [ 1055.122680][ T24] usb 3-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1055.131672][ T24] usb 3-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1055.148731][T21501] netlink: 'syz.1.3592': attribute type 8 has an invalid length. [ 1055.178641][ T24] usb 3-1: USB disconnect, device number 68 [ 1055.184947][T21501] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3592'. [ 1055.341502][T21504] 9p: Bad value for 'rfdno' [ 1055.347326][T21504] netlink: 'syz.7.3593': attribute type 23 has an invalid length. [ 1057.413114][ T5825] Bluetooth: hci4: Controller not accepting commands anymore: ncmd = 0 [ 1057.426983][ T5825] Bluetooth: hci4: Injecting HCI hardware error event [ 1057.438205][ T5825] Bluetooth: hci4: hardware error 0x00 [ 1057.647336][T21519] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3597'. [ 1057.920371][T21529] erofs (device nbd2): cannot find valid erofs superblock [ 1057.933883][T21529] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3597'. [ 1058.700720][ T30] audit: type=1400 audit(1058.663:1054): avc: denied { getopt } for pid=21538 comm="syz.6.3603" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 1060.043870][T20423] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 1060.819424][ T5825] Bluetooth: hci4: Opcode 0x0c03 failed: -110 [ 1060.913676][T20423] usb 8-1: Using ep0 maxpacket: 8 [ 1061.164306][T20423] usb 8-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1061.177201][T20423] usb 8-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 1061.186597][T20423] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1061.237827][T21564] loop8: detected capacity change from 0 to 8 [ 1061.254621][T21564] Dev loop8: unable to read RDB block 8 [ 1061.260248][T21564] loop8: unable to read partition table [ 1061.354537][T21564] loop8: partition table beyond EOD, truncated [ 1061.354966][T20423] usb 8-1: config 0 descriptor?? [ 1061.366274][T20423] usb 8-1: can't set config #0, error -71 [ 1061.386662][T21564] loop_reread_partitions: partition scan of loop8 (þ被xü^>Ñà– ) failed (rc=-5) [ 1061.804730][T20465] usb 7-1: new full-speed USB device number 67 using dummy_hcd [ 1061.820053][T20423] usb 8-1: USB disconnect, device number 18 [ 1062.034235][T20386] usb 3-1: new high-speed USB device number 69 using dummy_hcd [ 1062.065215][T20465] usb 7-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 1062.076018][T20465] usb 7-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1062.085834][T20465] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1062.414447][T20423] usb 8-1: new high-speed USB device number 19 using dummy_hcd [ 1062.496501][T20465] aiptek 7-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 1062.565890][T20386] usb 3-1: config 0 has an invalid interface number: 183 but max is 0 [ 1062.575812][T20386] usb 3-1: config 0 has no interface number 0 [ 1062.687901][T20386] usb 3-1: config 0 interface 183 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 1062.714066][T20386] usb 3-1: New USB device found, idVendor=067b, idProduct=331a, bcdDevice=9d.94 [ 1062.736645][T21587] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3614'. [ 1062.822756][T20386] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1062.835202][T20423] usb 8-1: Using ep0 maxpacket: 32 [ 1062.861685][T20423] usb 8-1: config 0 interface 0 has no altsetting 0 [ 1062.871799][T20423] usb 8-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 1062.881425][T20423] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1062.881537][T20386] usb 3-1: config 0 descriptor?? [ 1062.889725][T20423] usb 8-1: Product: syz [ 1062.889743][T20423] usb 8-1: Manufacturer: syz [ 1062.889757][T20423] usb 8-1: SerialNumber: syz [ 1062.891773][T20423] usb 8-1: config 0 descriptor?? [ 1062.929274][T20423] gs_usb 8-1:0.0: Required endpoints not found [ 1062.932095][ T24] usb 7-1: USB disconnect, device number 67 [ 1062.951574][T21570] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1062.967703][T20386] pl2303 3-1:0.183: required endpoints missing [ 1063.398973][T21598] input: syz0 as /devices/virtual/input/input74 [ 1063.437418][T20386] usb 8-1: USB disconnect, device number 19 [ 1063.512223][T21602] ubi31: attaching mtd0 [ 1063.521239][T21602] ubi31: scanning is finished [ 1063.526722][T21602] ubi31: empty MTD device detected [ 1063.671454][T21602] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 1063.679109][T21602] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 1063.687142][T21602] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 1063.694684][T21602] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 1063.702206][T21602] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 1063.709158][T21602] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 1063.717662][T21602] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2320703728 [ 1063.727940][T21602] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 1063.740254][T21604] ubi31: background thread "ubi_bgt31d" started, PID 21604 [ 1064.574036][T20423] usb 3-1: USB disconnect, device number 69 [ 1064.910256][T21622] FAULT_INJECTION: forcing a failure. [ 1064.910256][T21622] name failslab, interval 1, probability 0, space 0, times 0 [ 1064.934385][T21622] CPU: 1 UID: 0 PID: 21622 Comm: syz.6.3623 Tainted: G L syzkaller #0 PREEMPT(full) [ 1064.934412][T21622] Tainted: [L]=SOFTLOCKUP [ 1064.934419][T21622] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1064.934429][T21622] Call Trace: [ 1064.934435][T21622] [ 1064.934442][T21622] dump_stack_lvl+0x16c/0x1f0 [ 1064.934471][T21622] should_fail_ex+0x512/0x640 [ 1064.934496][T21622] ? __kmalloc_cache_noprof+0x5f/0x800 [ 1064.934516][T21622] should_failslab+0xc2/0x120 [ 1064.934539][T21622] __kmalloc_cache_noprof+0x80/0x800 [ 1064.934556][T21622] ? uprobe_register+0x177/0xb60 [ 1064.934577][T21622] ? uprobe_register+0x177/0xb60 [ 1064.934591][T21622] ? shmem_mapping+0xd/0x50 [ 1064.934608][T21622] uprobe_register+0x177/0xb60 [ 1064.934629][T21622] bpf_uprobe_multi_link_attach+0x9a5/0x12e0 [ 1064.934662][T21622] ? __pfx_bpf_uprobe_multi_link_attach+0x10/0x10 [ 1064.934684][T21622] ? __fget_files+0x20e/0x3c0 [ 1064.934713][T21622] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1064.934736][T21622] __sys_bpf+0x3862/0x4980 [ 1064.934765][T21622] ? __pfx___sys_bpf+0x10/0x10 [ 1064.934787][T21622] ? find_held_lock+0x2b/0x80 [ 1064.934817][T21622] ? find_held_lock+0x2b/0x80 [ 1064.934847][T21622] ? __mutex_unlock_slowpath+0x161/0x790 [ 1064.934885][T21622] ? fput+0x70/0xf0 [ 1064.934901][T21622] ? ksys_write+0x1ac/0x250 [ 1064.934920][T21622] ? __pfx_ksys_write+0x10/0x10 [ 1064.934943][T21622] __x64_sys_bpf+0x78/0xc0 [ 1064.934963][T21622] ? lockdep_hardirqs_on+0x7c/0x110 [ 1064.934984][T21622] do_syscall_64+0xcd/0xf80 [ 1064.935081][T21622] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1064.935103][T21622] RIP: 0033:0x7f8348d8f749 [ 1064.935118][T21622] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1064.935133][T21622] RSP: 002b:00007f8349c4f038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1064.935148][T21622] RAX: ffffffffffffffda RBX: 00007f8348fe5fa0 RCX: 00007f8348d8f749 [ 1064.935159][T21622] RDX: 0000000000000040 RSI: 0000200000000180 RDI: 000000000000001c [ 1064.935169][T21622] RBP: 00007f8349c4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1064.935179][T21622] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1064.935188][T21622] R13: 00007f8348fe6038 R14: 00007f8348fe5fa0 R15: 00007ffc1db2f818 [ 1064.935212][T21622] [ 1065.684175][T20423] IPVS: starting estimator thread 0... [ 1066.188747][T21627] IPVS: using max 48 ests per chain, 115200 per kthread [ 1066.637498][T21643] Bluetooth: MGMT ver 1.23 [ 1067.120483][T21650] input: syz0 as /devices/virtual/input/input75 [ 1068.724067][ T5825] Bluetooth: hci0: Opcode 0x0c1a failed: -110 [ 1068.770232][ T5825] Bluetooth: hci0: command 0x0c1a tx timeout [ 1071.574687][T21702] team_slave_0 (unregistering): left promiscuous mode [ 1071.592907][T21702] team0: Port device team_slave_0 removed [ 1071.787139][ T5827] Bluetooth: hci0: command 0x0c1a tx timeout [ 1095.551571][T21724] netlink: 'syz.4.3651': attribute type 8 has an invalid length. [ 1095.581596][T21724] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3651'. [ 1095.726211][ T89] usb 8-1: new full-speed USB device number 20 using dummy_hcd [ 1095.945437][ T89] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1096.009710][ T89] usb 8-1: New USB device found, idVendor=056e, idProduct=00e6, bcdDevice= 0.00 [ 1096.019512][ T30] audit: type=1400 audit(1095.953:1055): avc: denied { ioctl } for pid=21730 comm="syz.4.3652" path="socket:[72651]" dev="sockfs" ino=72651 ioctlcmd=0x7436 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1096.045711][ T89] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.079790][ T30] audit: type=1400 audit(1095.953:1056): avc: denied { override_creds } for pid=21730 comm="syz.4.3652" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1096.529850][ T89] usb 8-1: config 0 descriptor?? [ 1096.995689][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.014182][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.047794][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.054803][T20386] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1097.093606][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.108394][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.133604][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.148786][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.163604][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.183608][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.203729][ T89] elecom 0003:056E:00E6.002B: unknown main item tag 0x0 [ 1097.204088][T20386] usb 2-1: Using ep0 maxpacket: 8 [ 1097.222504][T20386] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1097.237931][ T89] elecom 0003:056E:00E6.002B: hidraw0: USB HID v0.00 Device [HID 056e:00e6] on usb-dummy_hcd.7-1/input0 [ 1097.540182][T21749] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3648'. [ 1097.595881][T20386] usb 2-1: New USB device found, idVendor=05ac, idProduct=027d, bcdDevice= 0.00 [ 1097.636360][T20386] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1097.679736][T20386] usb 2-1: config 0 descriptor?? [ 1097.799801][T21735] syz.4.3652 (21735): drop_caches: 1 [ 1098.270812][T21766] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3665'. [ 1098.428091][T21774] netlink: 'syz.6.3669': attribute type 23 has an invalid length. [ 1098.437081][T21774] netlink: 'syz.6.3669': attribute type 21 has an invalid length. [ 1098.447915][T21774] IPv6: NLM_F_CREATE should be specified when creating new route [ 1099.144563][ T30] audit: type=1400 audit(1099.113:1057): avc: denied { unmount } for pid=10136 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bpf_t tclass=filesystem permissive=1 [ 1099.648855][T20337] usb 8-1: USB disconnect, device number 20 [ 1099.666077][T21827] netlink: 4595 bytes leftover after parsing attributes in process `syz.7.3692'. [ 1099.709290][T21827] netlink: 4595 bytes leftover after parsing attributes in process `syz.7.3692'. [ 1099.752224][T21827] netlink: 4595 bytes leftover after parsing attributes in process `syz.7.3692'. [ 1099.764541][T20386] usbhid 2-1:0.0: can't add hid device: -71 [ 1099.770927][T20386] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1099.796118][T20386] usb 2-1: USB disconnect, device number 27 [ 1100.056197][T21847] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3701'. [ 1100.083687][T21847] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3701'. [ 1100.114259][T21847] netlink: 60 bytes leftover after parsing attributes in process `syz.4.3701'. [ 1100.234777][T21858] openvswitch: netlink: IP tunnel attribute has 4 unknown bytes. [ 1100.245041][T21858] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1100.572047][T21882] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3718'. [ 1100.594936][ T30] audit: type=1400 audit(1100.553:1058): avc: denied { name_bind } for pid=21876 comm="syz.4.3716" src=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 1100.646786][ T30] audit: type=1400 audit(1100.593:1059): avc: denied { name_connect } for pid=21876 comm="syz.4.3716" dest=16 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=sctp_socket permissive=1 [ 1101.446631][T21932] openvswitch: netlink: IP tunnel dst address not specified [ 1101.547971][T21937] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3744'. [ 1101.610846][T21937] : entered promiscuous mode [ 1101.905693][T21947] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3748'. [ 1102.533911][T21986] syzkaller0: entered promiscuous mode [ 1102.539440][T21986] syzkaller0: entered allmulticast mode [ 1102.547059][ T5946] syzkaller0: tun_net_xmit 48 [ 1102.558299][ T30] audit: type=1400 audit(1102.513:1060): avc: denied { relabelfrom } for pid=21985 comm="syz.7.3767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1102.589603][ T30] audit: type=1400 audit(1102.523:1061): avc: denied { relabelto } for pid=21985 comm="syz.7.3767" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1102.615145][T21986] syzkaller0: tun_chr_ioctl cmd 2147767520 [ 1102.636480][T21986] syzkaller0: tun_net_xmit 1280 [ 1102.641940][T21986] syzkaller0: create flow: hash 650880209 index 1 [ 1102.786756][T22008] netlink: 65047 bytes leftover after parsing attributes in process `syz.1.3777'. [ 1102.800441][T21985] syzkaller0: delete flow: hash 650880209 index 1 [ 1104.758962][T22049] netlink: 60 bytes leftover after parsing attributes in process `syz.1.3798'. [ 1104.975458][T22090] netlink: 'syz.7.3811': attribute type 21 has an invalid length. [ 1104.996791][T22090] netlink: 'syz.7.3811': attribute type 1 has an invalid length. [ 1105.014730][T22095] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3814'. [ 1105.027533][T22098] netlink: 16222 bytes leftover after parsing attributes in process `syz.2.3812'. [ 1105.261704][T22120] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3823'. [ 1105.290246][T22116] can: request_module (can-proto-4) failed. [ 1105.304182][T22120] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3823'. [ 1105.322650][T22120] netlink: 16 bytes leftover after parsing attributes in process `syz.6.3823'. [ 1105.635456][T22134] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3831'. [ 1105.679277][T22136] netlink: 'syz.4.3832': attribute type 10 has an invalid length. [ 1106.196588][T22154] netlink: get zone limit has 8 unknown bytes [ 1106.764842][T20386] usb 2-1: new full-speed USB device number 28 using dummy_hcd [ 1106.958526][T20386] usb 2-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 1106.984908][T20386] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1106.996489][T20386] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1107.010823][T20386] aiptek 2-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 1107.215612][ T5933] usb 2-1: USB disconnect, device number 28 [ 1107.996668][T22180] comedi comedi0: dac02: I/O port conflict (0x3,8) [ 1108.362454][ T5933] usb 5-1: new high-speed USB device number 67 using dummy_hcd [ 1108.743639][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 1108.804756][T20337] usb 7-1: new full-speed USB device number 68 using dummy_hcd [ 1109.025982][T20337] usb 7-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 1109.039397][ T5933] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1109.050277][ T5933] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1109.062884][ T5933] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1109.107088][ T5933] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1109.221804][ T5933] usb 5-1: config 1 interface 1 has no altsetting 0 [ 1109.306195][ T5933] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1109.357189][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1109.410071][ T5933] usb 5-1: Product: syz [ 1109.436043][ T5933] usb 5-1: Manufacturer: syz [ 1109.452425][ T5933] usb 5-1: SerialNumber: syz [ 1109.744549][T22193] __nla_validate_parse: 1 callbacks suppressed [ 1109.744581][T22193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3853'. [ 1110.032645][T20337] usb 7-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1110.042980][T20337] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1110.102955][ T5933] usb 5-1: USB disconnect, device number 67 [ 1110.209277][T20337] aiptek 7-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 1110.388024][T22202] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3857'. [ 1110.597548][T22204] erofs (device nbd2): cannot find valid erofs superblock [ 1110.613687][ T89] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1111.004861][ T5933] usb 7-1: USB disconnect, device number 68 [ 1111.153717][ T89] usb 2-1: Using ep0 maxpacket: 16 [ 1111.160902][ T89] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1111.173263][ T89] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1111.184561][ T89] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1111.194557][ T89] usb 2-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1111.207769][ T89] usb 2-1: config 1 interface 1 has no altsetting 0 [ 1111.306567][ T89] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1111.315699][ T89] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.326421][ T89] usb 2-1: Product: syz [ 1111.330611][ T89] usb 2-1: Manufacturer: syz [ 1111.337900][ T89] usb 2-1: SerialNumber: syz [ 1111.433719][ T5933] usb 5-1: new high-speed USB device number 68 using dummy_hcd [ 1111.617791][T22212] netlink: 'syz.2.3860': attribute type 1 has an invalid length. [ 1111.626055][T22212] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3860'. [ 1111.853670][ T5933] usb 5-1: Using ep0 maxpacket: 32 [ 1112.374617][ T5933] usb 5-1: config 0 has an invalid interface number: 219 but max is 0 [ 1112.382876][ T5933] usb 5-1: config 0 has no interface number 0 [ 1112.389176][ T5933] usb 5-1: New USB device found, idVendor=0763, idProduct=201a, bcdDevice=61.14 [ 1112.399250][ T5933] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1112.420632][ T89] usb 2-1: USB disconnect, device number 29 [ 1112.421305][ T5933] usb 5-1: config 0 descriptor?? [ 1112.612942][T22222] lo speed is unknown, defaulting to 1000 [ 1112.632834][T22222] virt_wifi0 speed is unknown, defaulting to 1000 [ 1112.652517][T22222] lo speed is unknown, defaulting to 1000 [ 1113.687814][ T5933] usb 5-1: string descriptor 0 read error: -71 [ 1113.703246][ T30] audit: type=1400 audit(1113.213:1062): avc: denied { append } for pid=22205 comm="syz.4.3858" name="sg0" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1113.711126][ T5933] usb 5-1: unknown interface protocol 0xae, assuming v1 [ 1113.734491][ T5933] usb 5-1: cannot find UAC_HEADER [ 1113.778194][ T5933] snd-usb-audio 5-1:0.219: probe with driver snd-usb-audio failed with error -22 [ 1113.783601][ T30] audit: type=1400 audit(1113.233:1063): avc: denied { map } for pid=22205 comm="syz.4.3858" path="/dev/sg0" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1113.815911][ T30] audit: type=1400 audit(1113.233:1064): avc: denied { execute } for pid=22205 comm="syz.4.3858" path="/dev/sg0" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1113.864095][T20386] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 1113.864101][ T5933] usb 5-1: USB disconnect, device number 68 [ 1114.314638][T20386] usb 7-1: config 0 has no interfaces? [ 1114.331278][T20386] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1114.343488][T20386] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1114.352856][T20386] usb 7-1: Product: syz [ 1114.360353][T20386] usb 7-1: Manufacturer: syz [ 1114.373590][T20386] usb 7-1: SerialNumber: syz [ 1114.433479][T20386] usb 7-1: config 0 descriptor?? [ 1115.106664][T20337] usb 7-1: USB disconnect, device number 69 [ 1115.528146][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1118.033654][ T5933] usb 5-1: new high-speed USB device number 69 using dummy_hcd [ 1118.176605][T22292] lo speed is unknown, defaulting to 1000 [ 1118.183721][T22292] virt_wifi0 speed is unknown, defaulting to 1000 [ 1118.192561][T22292] lo speed is unknown, defaulting to 1000 [ 1118.233038][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 1118.315471][ T5933] usb 5-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 1118.326420][ T5827] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1118.336823][ T5827] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1118.346015][ T5827] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1118.361973][ T5827] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1118.362107][ T5933] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1118.380822][ T5827] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1118.430663][T22294] lo speed is unknown, defaulting to 1000 [ 1118.437652][ T89] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1118.483949][ T5933] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1118.521822][ T4613] netdevsim netdevsim2 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1118.535557][ T5933] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1118.564772][ T4613] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1118.584293][ T5933] usb 5-1: config 1 interface 1 has no altsetting 0 [ 1118.594487][ T5933] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1118.604527][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1118.630255][ T5933] usb 5-1: Product: syz [ 1118.634528][ T89] usb 2-1: Using ep0 maxpacket: 16 [ 1118.646812][ T89] usb 2-1: config 0 has no interfaces? [ 1118.652752][T22294] virt_wifi0 speed is unknown, defaulting to 1000 [ 1118.662747][ T89] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1118.679472][ T5933] usb 5-1: Manufacturer: syz [ 1118.687785][ T89] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1118.702846][ T5933] usb 5-1: SerialNumber: syz [ 1118.714013][ T89] usb 2-1: Manufacturer: syz [ 1118.723436][ T4613] netdevsim netdevsim2 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1118.780412][ T89] usb 2-1: config 0 descriptor?? [ 1118.803243][ T4613] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1118.844122][T22294] lo speed is unknown, defaulting to 1000 [ 1118.957623][ T5933] usb 5-1: USB disconnect, device number 69 [ 1119.022791][ T4613] netdevsim netdevsim2 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1119.055264][ T4613] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1119.467208][T22294] chnl_net:caif_netlink_parms(): no params data found [ 1119.652242][T22314] netlink: 'syz.4.3892': attribute type 1 has an invalid length. [ 1119.660934][T22314] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3892'. [ 1120.404250][ T5827] Bluetooth: hci2: command tx timeout [ 1120.498547][T22318] 9p: Bad value for 'rfdno' [ 1120.508811][T22318] netlink: 'syz.6.3893': attribute type 23 has an invalid length. [ 1121.257993][ T89] usb 2-1: USB disconnect, device number 30 [ 1121.636168][ T5825] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1121.649275][ T5825] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1121.662617][ T5825] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1121.672413][T22323] syzkaller0: entered promiscuous mode [ 1121.678635][ T5825] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1121.687262][ T5825] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1121.709598][T22323] syzkaller0: entered allmulticast mode [ 1121.794160][ T1140] syzkaller0: tun_net_xmit 48 [ 1121.799866][ T4613] gretap0: left allmulticast mode [ 1121.805761][ T4613] gretap0: left promiscuous mode [ 1121.817313][ T4613] bridge0: port 4(gretap0) entered disabled state [ 1121.848518][ T4613] bridge0: port 3(batadv0) entered disabled state [ 1121.877218][ T4613] bridge_slave_1: left allmulticast mode [ 1121.900478][ T4613] bridge_slave_1: left promiscuous mode [ 1121.907807][ T4613] bridge0: port 2(bridge_slave_1) entered disabled state [ 1121.931207][ T4613] bridge_slave_0: left allmulticast mode [ 1121.937181][ T4613] bridge_slave_0: left promiscuous mode [ 1121.942932][ T4613] bridge0: port 1(bridge_slave_0) entered disabled state [ 1122.484380][ T5825] Bluetooth: hci2: command tx timeout [ 1122.686422][ T4613] bond0 (unregistering): left promiscuous mode [ 1122.692745][ T4613] bond_slave_0: left promiscuous mode [ 1122.698450][ T4613] bond_slave_1: left promiscuous mode [ 1122.704203][ T4613] dummy0: left promiscuous mode [ 1122.710504][ T4613] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1122.721313][ T4613] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1122.732608][ T4613] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1122.742202][ T4613] bond0 (unregistering): Released all slaves [ 1123.348847][ T4613] bond1 (unregistering): (slave wireguard0): Releasing backup interface [ 1123.358331][ T4613] wireguard0: left promiscuous mode [ 1123.367700][ T4613] bond1 (unregistering): Released all slaves [ 1123.796344][ T5825] Bluetooth: hci3: command tx timeout [ 1124.476878][ T89] usb 5-1: new full-speed USB device number 70 using dummy_hcd [ 1124.565689][ T5825] Bluetooth: hci2: command tx timeout [ 1124.647877][ T5933] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 1124.724818][ T89] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1124.734195][ T89] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1124.742152][ T89] usb 5-1: Product: syz [ 1124.746498][ T89] usb 5-1: Manufacturer: syz [ 1124.757096][ T89] usb 5-1: SerialNumber: syz [ 1124.870328][ T5933] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1124.879688][ T5933] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1124.894526][ T5933] usb 7-1: Product: syz [ 1124.904644][ T5933] usb 7-1: Manufacturer: syz [ 1124.909272][ T5933] usb 7-1: SerialNumber: syz [ 1124.927212][ T5933] usb 7-1: config 0 descriptor?? [ 1125.011494][ T89] usb 5-1: 2:1 : format type 0 is detected, processed as PCM [ 1125.019158][ T89] usb 5-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1125.032666][ T89] usb 5-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1125.071159][ T89] usb 5-1: USB disconnect, device number 70 [ 1125.146565][T20337] usb 7-1: USB disconnect, device number 70 [ 1125.679869][T22294] bridge0: port 1(bridge_slave_0) entered blocking state [ 1125.687158][T22294] bridge0: port 1(bridge_slave_0) entered disabled state [ 1125.694506][T22294] bridge_slave_0: entered allmulticast mode [ 1125.701821][T22294] bridge_slave_0: entered promiscuous mode [ 1125.711569][ T4613] tipc: Left network mode [ 1125.714556][T22294] bridge0: port 2(bridge_slave_1) entered blocking state [ 1125.734120][T22294] bridge0: port 2(bridge_slave_1) entered disabled state [ 1125.741340][T22294] bridge_slave_1: entered allmulticast mode [ 1125.759902][T22294] bridge_slave_1: entered promiscuous mode [ 1125.843790][ T5825] Bluetooth: hci3: command tx timeout [ 1125.995992][T22329] lo speed is unknown, defaulting to 1000 [ 1126.004440][T22294] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1126.027793][T22373] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3910'. [ 1126.049957][T22329] virt_wifi0 speed is unknown, defaulting to 1000 [ 1126.059919][T22294] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1126.088160][T22329] lo speed is unknown, defaulting to 1000 [ 1126.174470][T22294] team0: Port device team_slave_0 added [ 1126.643736][ T5825] Bluetooth: hci2: command tx timeout [ 1126.715923][T22294] team0: Port device team_slave_1 added [ 1127.200178][ T4613] team0: left promiscuous mode [ 1127.217916][ T4613] team_slave_0: left promiscuous mode [ 1127.223401][ T4613] team_slave_1: left promiscuous mode [ 1127.276467][ T4613] hsr_slave_0: left promiscuous mode [ 1127.325317][ T4613] hsr_slave_1: left promiscuous mode [ 1127.331062][ T4613] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1127.350353][ T4613] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1127.482701][ T4613] veth1_macvtap: left promiscuous mode [ 1127.498463][ T4613] veth0_macvtap: left promiscuous mode [ 1127.506178][ T4613] veth1_vlan: left promiscuous mode [ 1127.515701][ T4613] veth0_vlan: left promiscuous mode [ 1127.521621][T22384] 9p: Bad value for 'rfdno' [ 1127.528089][T22384] netlink: 'syz.6.3912': attribute type 23 has an invalid length. [ 1128.015355][ T5825] Bluetooth: hci3: command tx timeout [ 1128.468866][T20386] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 1128.480504][ T4613] team0 (unregistering): Port device team_slave_1 removed [ 1128.531083][ T4613] team0 (unregistering): Port device team_slave_0 removed [ 1128.694663][T20386] usb 7-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1128.738740][T20386] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1128.790976][T20386] usb 7-1: Product: syz [ 1128.810345][T20386] usb 7-1: Manufacturer: syz [ 1128.830635][T20386] usb 7-1: SerialNumber: syz [ 1128.900987][T20386] usb 7-1: config 0 descriptor?? [ 1129.158878][T20386] usb 7-1: USB disconnect, device number 71 [ 1129.311180][T22294] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1129.325389][T22294] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1129.356252][T22294] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1129.398593][T22294] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1129.439564][T22294] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1129.473161][T22294] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1129.520689][T22404] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3920'. [ 1129.671610][T22294] hsr_slave_0: entered promiscuous mode [ 1129.733641][T22407] erofs (device nbd4): cannot find valid erofs superblock [ 1130.137356][ T5825] Bluetooth: hci3: command tx timeout [ 1130.139424][T22294] hsr_slave_1: entered promiscuous mode [ 1130.166595][T22294] debugfs: 'hsr0' already exists in 'hsr' [ 1130.172680][T22294] Cannot create hsr debugfs directory [ 1130.715193][T22416] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3922'. [ 1130.815659][T22420] netlink: 216 bytes leftover after parsing attributes in process `syz.4.3923'. [ 1130.871054][T22420] netlink: 40 bytes leftover after parsing attributes in process `syz.4.3923'. [ 1130.893229][T22329] chnl_net:caif_netlink_parms(): no params data found [ 1131.025007][ T5886] usb 7-1: new high-speed USB device number 72 using dummy_hcd [ 1131.224246][ T5886] usb 7-1: Using ep0 maxpacket: 8 [ 1131.277161][ T5886] usb 7-1: config 0 has an invalid interface number: 193 but max is 1 [ 1131.317294][ T5886] usb 7-1: config 0 has an invalid interface number: 4 but max is 1 [ 1131.348483][ T5886] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1131.402675][ T5886] usb 7-1: config 0 has no interface number 0 [ 1131.429325][ T5886] usb 7-1: config 0 has no interface number 1 [ 1131.455641][ T5886] usb 7-1: config 0 interface 193 altsetting 147 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1131.469726][ T5886] usb 7-1: config 0 interface 4 altsetting 2 endpoint 0x6 has invalid wMaxPacketSize 0 [ 1131.484073][ T5886] usb 7-1: config 0 interface 4 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1131.497408][ T5886] usb 7-1: config 0 interface 193 has no altsetting 0 [ 1131.504985][ T5886] usb 7-1: config 0 interface 4 has no altsetting 0 [ 1131.515991][ T5886] usb 7-1: New USB device found, idVendor=1f38, idProduct=0001, bcdDevice=7d.6a [ 1131.530965][ T5886] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1131.540932][ T5886] usb 7-1: Product: syz [ 1131.546402][ T5886] usb 7-1: Manufacturer: syz [ 1131.551040][ T5886] usb 7-1: SerialNumber: syz [ 1131.558984][ T5886] usb 7-1: config 0 descriptor?? [ 1131.590972][T22329] bridge0: port 1(bridge_slave_0) entered blocking state [ 1131.604179][ T4613] IPVS: stop unused estimator thread 0... [ 1131.621560][T22329] bridge0: port 1(bridge_slave_0) entered disabled state [ 1131.645678][T22329] bridge_slave_0: entered allmulticast mode [ 1131.666163][T22329] bridge_slave_0: entered promiscuous mode [ 1131.702328][T22329] bridge0: port 2(bridge_slave_1) entered blocking state [ 1131.717903][T22329] bridge0: port 2(bridge_slave_1) entered disabled state [ 1131.739226][T22329] bridge_slave_1: entered allmulticast mode [ 1131.758416][T22329] bridge_slave_1: entered promiscuous mode [ 1131.994794][ T4613] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.161388][T22329] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1132.173774][T22329] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1132.267850][ T4613] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.289125][T22329] team0: Port device team_slave_0 added [ 1132.305839][T22329] team0: Port device team_slave_1 added [ 1132.352740][ T4613] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1132.370039][T22329] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1132.377608][T22329] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1132.404821][T22329] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1132.425973][T22329] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1132.432995][T22329] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1132.460397][T22329] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1132.484929][T22294] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1132.495817][T22294] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1132.520646][T22294] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1132.523708][ T5933] usb 5-1: new high-speed USB device number 71 using dummy_hcd [ 1132.564193][T22294] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1132.581820][T22329] hsr_slave_0: entered promiscuous mode [ 1132.589864][T22329] hsr_slave_1: entered promiscuous mode [ 1132.596204][T22329] debugfs: 'hsr0' already exists in 'hsr' [ 1132.601926][T22329] Cannot create hsr debugfs directory [ 1132.684391][ T5933] usb 5-1: Using ep0 maxpacket: 16 [ 1132.691625][ T5933] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1132.704054][ T5933] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1132.715541][ T5933] usb 5-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1132.727601][ T5933] usb 5-1: config 1 interface 2 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1132.752413][ T5933] usb 5-1: config 1 interface 1 has no altsetting 0 [ 1132.774526][ T4613] bridge0: port 3(batadv0) entered disabled state [ 1132.785049][ T5933] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1132.785827][ T4613] bridge_slave_1: left allmulticast mode [ 1132.794301][ T5933] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1132.794322][ T5933] usb 5-1: Product: syz [ 1132.794336][ T5933] usb 5-1: Manufacturer: syz [ 1132.794350][ T5933] usb 5-1: SerialNumber: syz [ 1132.823214][ T4613] bridge_slave_1: left promiscuous mode [ 1132.896341][ T4613] bridge0: port 2(bridge_slave_1) entered disabled state [ 1132.908528][ T4613] bridge_slave_0: left allmulticast mode [ 1132.914528][ T4613] bridge_slave_0: left promiscuous mode [ 1132.920270][ T4613] bridge0: port 1(bridge_slave_0) entered disabled state [ 1133.068059][ T5933] usb 5-1: USB disconnect, device number 71 [ 1133.213670][T20423] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1133.277307][ T4613] bond0 (unregistering): left promiscuous mode [ 1133.283487][ T4613] bond_slave_0: left promiscuous mode [ 1133.290039][ T4613] bond_slave_1: left promiscuous mode [ 1133.295953][ T4613] dummy0: left promiscuous mode [ 1133.301884][ T4613] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1133.312651][ T4613] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1133.323128][ T4613] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1133.333018][ T4613] bond0 (unregistering): Released all slaves [ 1133.376825][T20423] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1133.398008][T20423] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1133.416951][T20423] usb 2-1: Product: syz [ 1133.421195][T20423] usb 2-1: Manufacturer: syz [ 1133.432225][T20423] usb 2-1: SerialNumber: syz [ 1133.439448][T20423] usb 2-1: config 0 descriptor?? [ 1133.479111][ T4613] bond1 (unregistering): Released all slaves [ 1133.638625][ T5886] usb 7-1: unknown interface protocol 0x4f, assuming v1 [ 1133.653131][ T5886] usb 7-1: 193:2 : does not exist [ 1133.660203][ T5933] usb 2-1: USB disconnect, device number 31 [ 1133.673508][ T5886] usb 7-1: unknown interface protocol 0x5, assuming v1 [ 1133.696550][ T5886] usb 7-1: 4:2 : does not exist [ 1133.888718][ T5886] usb 7-1: USB disconnect, device number 72 [ 1134.094768][T22329] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1134.113253][T22450] netlink: 32 bytes leftover after parsing attributes in process `syz.6.3931'. [ 1134.167091][T22294] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1134.236333][T22329] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1134.379975][T22457] erofs (device nbd6): cannot find valid erofs superblock [ 1134.863410][T22329] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1134.892191][ T4613] team0: left promiscuous mode [ 1134.898967][ T4613] team_slave_0: left promiscuous mode [ 1134.905444][ T4613] team_slave_1: left promiscuous mode [ 1134.932185][ T4613] hsr_slave_0: left promiscuous mode [ 1134.940557][ T4613] hsr_slave_1: left promiscuous mode [ 1134.955291][ T4613] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1134.963092][ T4613] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1134.976946][ T4613] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1134.987682][ T4613] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1135.013679][ T4613] veth1_macvtap: left promiscuous mode [ 1135.029519][ T4613] veth0_macvtap: left promiscuous mode [ 1135.035186][ T4613] veth1_vlan: left promiscuous mode [ 1135.040563][ T4613] veth0_vlan: left promiscuous mode [ 1136.652748][ T4613] team0 (unregistering): Port device team_slave_1 removed [ 1136.696328][ T4613] team0 (unregistering): Port device team_slave_0 removed [ 1137.082134][T22486] 9p: Bad value for 'rfdno' [ 1137.087951][T22486] netlink: 'syz.1.3941': attribute type 23 has an invalid length. [ 1137.229217][T22329] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1137.268798][T22294] 8021q: adding VLAN 0 to HW filter on device team0 [ 1137.308019][T10429] bridge0: port 1(bridge_slave_0) entered blocking state [ 1137.315193][T10429] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1137.411503][T10429] bridge0: port 2(bridge_slave_1) entered blocking state [ 1137.418678][T10429] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1137.588421][T22294] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1137.599859][T22294] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1137.819026][T22495] netlink: 32 bytes leftover after parsing attributes in process `syz.4.3944'. [ 1137.840475][T22329] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1137.854218][ T4613] IPVS: stop unused estimator thread 0... [ 1137.877509][T22329] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1137.898017][T22329] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1137.929527][T22329] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1138.072255][T22503] erofs (device nbd4): cannot find valid erofs superblock [ 1138.978366][T22294] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1139.533674][T20423] usb 2-1: new full-speed USB device number 32 using dummy_hcd [ 1139.545199][T22294] veth0_vlan: entered promiscuous mode [ 1139.558595][T22329] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1139.571323][T22294] veth1_vlan: entered promiscuous mode [ 1139.585632][T22329] 8021q: adding VLAN 0 to HW filter on device team0 [ 1139.598058][T12431] bridge0: port 1(bridge_slave_0) entered blocking state [ 1139.605136][T12431] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1139.623368][ T4613] bridge0: port 2(bridge_slave_1) entered blocking state [ 1139.630610][ T4613] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1139.705238][T20423] usb 2-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 1139.730816][T20423] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1139.761359][T20423] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1139.776190][T22294] veth0_macvtap: entered promiscuous mode [ 1139.882707][T20423] aiptek 2-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 1139.908241][T22294] veth1_macvtap: entered promiscuous mode [ 1139.934181][T20386] usb 5-1: new full-speed USB device number 72 using dummy_hcd [ 1140.337746][ T5886] usb 2-1: USB disconnect, device number 32 [ 1140.351452][T20386] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1140.355008][T22294] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1140.369812][T20386] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1140.378895][T20386] usb 5-1: Product: syz [ 1140.380946][T22294] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1140.383187][T20386] usb 5-1: Manufacturer: syz [ 1140.398481][T20386] usb 5-1: SerialNumber: syz [ 1140.403508][ T6773] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.417929][ T6773] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.427572][ T6773] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.440846][ T6773] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1140.528161][ T6773] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1140.542286][ T6773] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1140.581678][ T6774] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1140.644286][ T6774] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1140.672178][T22329] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1140.811637][T22542] netlink: 28 bytes leftover after parsing attributes in process `syz.6.3952'. [ 1140.823187][T22542] openvswitch: netlink: Flow key attr not present in new flow. [ 1141.271411][T22329] veth0_vlan: entered promiscuous mode [ 1141.311139][T22329] veth1_vlan: entered promiscuous mode [ 1141.329667][T22554] 9p: Bad value for 'rfdno' [ 1141.335680][T22554] netlink: 'syz.2.3955': attribute type 23 has an invalid length. [ 1141.412363][T22329] veth0_macvtap: entered promiscuous mode [ 1141.445437][T22329] veth1_macvtap: entered promiscuous mode [ 1141.551915][T22329] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1141.562628][T22558] netlink: 'syz.6.3956': attribute type 1 has an invalid length. [ 1141.598908][T22329] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1141.607667][T22558] netlink: 8 bytes leftover after parsing attributes in process `syz.6.3956'. [ 1141.787657][T20386] usb 5-1: 2:1 : format type 0 is detected, processed as PCM [ 1141.810955][T20386] usb 5-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1141.821382][ T6769] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1141.830834][ T6769] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1141.841710][ T6769] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1141.854863][ T6769] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1141.859502][T20386] usb 5-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1141.894604][T20386] usb 5-1: USB disconnect, device number 72 [ 1142.108157][ T6769] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1142.118253][ T6769] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1142.175128][ T143] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1142.183470][ T143] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1143.019773][T22579] netlink: 'syz.6.3961': attribute type 4 has an invalid length. [ 1143.227657][T22585] 9p: Bad value for 'rfdno' [ 1143.236622][T22585] netlink: 'syz.8.3894': attribute type 23 has an invalid length. [ 1143.897141][T22590] netlink: 28 bytes leftover after parsing attributes in process `syz.8.3962'. [ 1143.914165][T22590] openvswitch: netlink: Flow key attr not present in new flow. [ 1144.261953][T22596] netlink: 32 bytes leftover after parsing attributes in process `syz.8.3966'. [ 1144.461946][T22598] erofs (device nbd8): cannot find valid erofs superblock [ 1145.767465][T22606] netlink: 'syz.2.3969': attribute type 1 has an invalid length. [ 1145.782946][T22618] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3974'. [ 1145.797494][T22606] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3969'. [ 1146.001178][T20423] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 1146.043161][ T5827] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1146.106931][T22626] 9p: Bad value for 'rfdno' [ 1146.113977][T22626] netlink: 'syz.8.3973': attribute type 23 has an invalid length. [ 1146.310176][T20423] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1146.440713][T20423] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1146.457421][ T5827] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1146.466883][ T5827] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1146.527409][ T5827] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1146.536596][ T5827] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1146.588696][T20423] usb 2-1: Product: syz [ 1146.592898][T20423] usb 2-1: Manufacturer: syz [ 1146.599079][T20423] usb 2-1: SerialNumber: syz [ 1147.149031][T22623] lo speed is unknown, defaulting to 1000 [ 1147.157967][T22623] lo speed is unknown, defaulting to 1000 [ 1147.570286][ T4613] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1147.593912][ T4613] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1147.617866][T20423] usb 2-1: 2:1 : format type 0 is detected, processed as PCM [ 1147.636360][T20423] usb 2-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1147.644210][ T89] usb 3-1: new high-speed USB device number 70 using dummy_hcd [ 1147.649275][T22623] chnl_net:caif_netlink_parms(): no params data found [ 1147.651984][T20423] usb 2-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1147.686350][T20423] usb 2-1: USB disconnect, device number 33 [ 1147.737955][ T4613] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1147.751183][ T4613] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1147.793929][ T89] usb 3-1: device descriptor read/64, error -71 [ 1147.837710][ T4613] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1147.848393][ T4613] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1147.887658][T22623] bridge0: port 1(bridge_slave_0) entered blocking state [ 1147.896958][T22623] bridge0: port 1(bridge_slave_0) entered disabled state [ 1147.907871][T22623] bridge_slave_0: entered allmulticast mode [ 1147.915505][T22623] bridge_slave_0: entered promiscuous mode [ 1147.941281][T22623] bridge0: port 2(bridge_slave_1) entered blocking state [ 1147.951263][T22623] bridge0: port 2(bridge_slave_1) entered disabled state [ 1147.961558][T22623] bridge_slave_1: entered allmulticast mode [ 1147.969137][T22623] bridge_slave_1: entered promiscuous mode [ 1147.998373][T22623] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1148.012446][T22623] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1148.050097][T22623] team0: Port device team_slave_0 added [ 1148.053614][ T89] usb 3-1: new high-speed USB device number 71 using dummy_hcd [ 1148.071179][T22623] team0: Port device team_slave_1 added [ 1148.163272][T22623] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1148.173058][T22623] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1148.208438][ T24] usb 5-1: new full-speed USB device number 73 using dummy_hcd [ 1148.218007][T22623] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1148.245215][T22623] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1148.252321][T22623] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1148.278770][ T89] usb 3-1: device descriptor read/64, error -71 [ 1148.285531][T22655] netlink: 32 bytes leftover after parsing attributes in process `syz.8.3983'. [ 1148.292952][T22623] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1148.353446][T22623] hsr_slave_0: entered promiscuous mode [ 1148.360945][T22623] hsr_slave_1: entered promiscuous mode [ 1148.367462][T22623] debugfs: 'hsr0' already exists in 'hsr' [ 1148.373944][T22623] Cannot create hsr debugfs directory [ 1148.414040][ T89] usb usb3-port1: attempt power cycle [ 1148.467588][ T24] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1148.477066][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1148.485836][ T24] usb 5-1: Product: syz [ 1148.486654][ T4613] gretap0: left allmulticast mode [ 1148.490034][ T24] usb 5-1: Manufacturer: syz [ 1148.552543][T22659] erofs (device nbd8): cannot find valid erofs superblock [ 1148.683636][ T5827] Bluetooth: hci0: command tx timeout [ 1148.982085][ T24] usb 5-1: SerialNumber: syz [ 1149.039833][ T4613] gretap0: left promiscuous mode [ 1149.045504][ T4613] bridge0: port 4(gretap0) entered disabled state [ 1149.055241][ T4613] bridge_slave_1: left allmulticast mode [ 1149.060970][ T4613] bridge_slave_1: left promiscuous mode [ 1149.067374][ T4613] bridge0: port 2(bridge_slave_1) entered disabled state [ 1149.081562][ T4613] bridge_slave_0: left allmulticast mode [ 1149.087438][ T4613] bridge_slave_0: left promiscuous mode [ 1149.093148][ T4613] bridge0: port 1(bridge_slave_0) entered disabled state [ 1149.303650][ T89] usb 3-1: new high-speed USB device number 72 using dummy_hcd [ 1149.324086][ T89] usb 3-1: device descriptor read/8, error -71 [ 1149.339780][T22657] netlink: 'syz.1.3984': attribute type 1 has an invalid length. [ 1149.362345][T22657] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3984'. [ 1149.885281][ T89] usb 3-1: new high-speed USB device number 73 using dummy_hcd [ 1149.930896][ T89] usb 3-1: device descriptor read/8, error -71 [ 1150.077401][ T24] usb 5-1: 2:1 : format type 0 is detected, processed as PCM [ 1150.089187][ T24] usb 5-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1150.096721][ T24] usb 5-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1150.128191][ T89] usb usb3-port1: unable to enumerate USB device [ 1150.173198][T22670] 9p: Bad value for 'rfdno' [ 1150.182591][T22670] netlink: 'syz.1.3986': attribute type 23 has an invalid length. [ 1150.546930][ T24] usb 5-1: USB disconnect, device number 73 [ 1151.045278][T22678] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3988'. [ 1151.054265][ T5827] Bluetooth: hci0: command tx timeout [ 1151.071978][T22678] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3988'. [ 1151.084217][T22565] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 1151.155583][T22682] netlink: 32 bytes leftover after parsing attributes in process `syz.2.3991'. [ 1151.258606][T22565] usb 9-1: config 17 has an invalid descriptor of length 0, skipping remainder of the config [ 1151.274885][ T5879] IPVS: starting estimator thread 0... [ 1151.404232][T22685] IPVS: using max 44 ests per chain, 105600 per kthread [ 1152.342328][T22565] usb 9-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1152.360223][T22565] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1152.382888][T22565] aiptek 9-1:17.0: interface has no int in endpoints, but must have minimum 1 [ 1152.441828][ T4613] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1152.454567][ T4613] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1152.465106][ T4613] bond0 (unregistering): Released all slaves [ 1152.477789][ T4613] bond1 (unregistering): Released all slaves [ 1152.509060][ T4613] bond2 (unregistering): Released all slaves [ 1152.530032][ T4613] bond3 (unregistering): Released all slaves [ 1152.726876][ T4613] tipc: Left network mode [ 1152.796229][ T89] usb 9-1: USB disconnect, device number 11 [ 1153.314741][ T5827] Bluetooth: hci0: command tx timeout [ 1153.878441][T22714] 9p: Bad value for 'rfdno' [ 1153.887308][T22714] netlink: 'syz.2.3998': attribute type 23 has an invalid length. [ 1154.273655][T20423] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 1154.429777][T20423] usb 5-1: device descriptor read/64, error -71 [ 1154.995067][T20423] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1155.106583][ T4613] hsr_slave_0: left promiscuous mode [ 1155.128972][ T4613] hsr_slave_1: left promiscuous mode [ 1155.150478][ T4613] veth1_macvtap: left promiscuous mode [ 1155.157615][ T4613] veth0_macvtap: left promiscuous mode [ 1155.163298][ T4613] veth1_vlan: left promiscuous mode [ 1155.181991][ T4613] veth0_vlan: left promiscuous mode [ 1155.206479][T20423] usb 5-1: device descriptor read/64, error -71 [ 1155.324127][T20423] usb usb5-port1: attempt power cycle [ 1155.366126][ T5827] Bluetooth: hci0: command tx timeout [ 1155.503743][ T89] usb 3-1: new high-speed USB device number 74 using dummy_hcd [ 1155.663931][T20423] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1155.674157][ T89] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1155.685677][ T89] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1155.695829][ T89] usb 3-1: New USB device found, idVendor=044f, idProduct=b65d, bcdDevice= 0.00 [ 1155.705133][ T89] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1155.714438][T20423] usb 5-1: device descriptor read/8, error -71 [ 1155.722656][ T89] usb 3-1: config 0 descriptor?? [ 1155.741201][T22732] tipc: Invalid UDP bearer configuration [ 1155.741245][T22732] tipc: Enabling of bearer rejected, failed to enable media [ 1155.847237][T22735] FAULT_INJECTION: forcing a failure. [ 1155.847237][T22735] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1155.862266][T22735] CPU: 0 UID: 0 PID: 22735 Comm: syz.1.4008 Tainted: G L syzkaller #0 PREEMPT(full) [ 1155.862292][T22735] Tainted: [L]=SOFTLOCKUP [ 1155.862297][T22735] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1155.862306][T22735] Call Trace: [ 1155.862313][T22735] [ 1155.862319][T22735] dump_stack_lvl+0x16c/0x1f0 [ 1155.862350][T22735] should_fail_ex+0x512/0x640 [ 1155.862380][T22735] _copy_from_user+0x2e/0xd0 [ 1155.862405][T22735] copy_msghdr_from_user+0x98/0x160 [ 1155.862425][T22735] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1155.862458][T22735] ___sys_sendmsg+0xfe/0x1d0 [ 1155.862477][T22735] ? __pfx____sys_sendmsg+0x10/0x10 [ 1155.862526][T22735] __sys_sendmsg+0x16d/0x220 [ 1155.862545][T22735] ? __pfx___sys_sendmsg+0x10/0x10 [ 1155.862579][T22735] do_syscall_64+0xcd/0xf80 [ 1155.862604][T22735] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1155.862621][T22735] RIP: 0033:0x7f2c3c78f749 [ 1155.862635][T22735] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1155.862650][T22735] RSP: 002b:00007f2c3d6f0038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1155.862665][T22735] RAX: ffffffffffffffda RBX: 00007f2c3c9e5fa0 RCX: 00007f2c3c78f749 [ 1155.862676][T22735] RDX: 0000000024000058 RSI: 0000200000000540 RDI: 0000000000000003 [ 1155.862687][T22735] RBP: 00007f2c3d6f0090 R08: 0000000000000000 R09: 0000000000000000 [ 1155.862696][T22735] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1155.862706][T22735] R13: 00007f2c3c9e6038 R14: 00007f2c3c9e5fa0 R15: 00007ffc34db7398 [ 1155.862729][T22735] [ 1155.880245][T22623] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1155.963598][T20423] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1156.050129][T22623] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1156.057588][T22737] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1156.077599][T22623] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1156.094658][T20423] usb 5-1: device descriptor read/8, error -71 [ 1156.106759][T22623] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1156.146587][T22732] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1156.194316][T22732] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1156.204020][T20423] usb usb5-port1: unable to enumerate USB device [ 1156.228747][ T89] usb 3-1: string descriptor 0 read error: -71 [ 1156.511419][ T89] usbhid 3-1:0.0: can't add hid device: -71 [ 1156.543445][ T89] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 1156.555382][ T89] usb 3-1: USB disconnect, device number 74 [ 1156.566953][T22623] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1156.592695][ T4613] IPVS: stop unused estimator thread 0... [ 1156.596320][T22623] 8021q: adding VLAN 0 to HW filter on device team0 [ 1156.620316][T12434] bridge0: port 1(bridge_slave_0) entered blocking state [ 1156.627415][T12434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1156.671607][ T5959] bridge0: port 2(bridge_slave_1) entered blocking state [ 1156.678783][ T5959] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1156.996758][T22772] loop3: detected capacity change from 0 to 1 [ 1157.015602][T22772] Dev loop3: unable to read RDB block 1 [ 1157.021165][T22772] loop3: unable to read partition table [ 1157.108529][T22772] loop3: partition table beyond EOD, truncated [ 1157.431924][T22623] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1157.455004][T22772] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1157.848027][ T5921] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1157.866455][T22623] veth0_vlan: entered promiscuous mode [ 1157.909110][T22623] veth1_vlan: entered promiscuous mode [ 1157.984273][ T5921] usb 5-1: device descriptor read/64, error -71 [ 1158.026820][T22623] veth0_macvtap: entered promiscuous mode [ 1158.050027][T22623] veth1_macvtap: entered promiscuous mode [ 1158.056240][ T24] usb 2-1: new high-speed USB device number 34 using dummy_hcd [ 1158.073234][T22623] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1158.086716][T22623] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1158.099830][ T4613] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1158.110230][ T4613] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1158.120467][ T4613] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1158.129889][ T4613] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1158.196955][T17818] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1158.205392][T17818] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1158.213938][ T24] usb 2-1: Using ep0 maxpacket: 32 [ 1158.220340][ T24] usb 2-1: config 0 has an invalid interface number: 184 but max is 0 [ 1158.228609][ T5921] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1158.249961][T17818] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1158.250373][ T24] usb 2-1: config 0 has no interface number 0 [ 1158.258480][T17818] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1158.266085][ T24] usb 2-1: config 0 interface 184 has no altsetting 0 [ 1158.289589][ T24] usb 2-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1158.303786][ T89] usb 3-1: new high-speed USB device number 75 using dummy_hcd [ 1158.304118][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1158.334198][ T24] usb 2-1: Product: syz [ 1158.338393][ T24] usb 2-1: Manufacturer: syz [ 1158.342994][ T24] usb 2-1: SerialNumber: syz [ 1158.351342][ T24] usb 2-1: config 0 descriptor?? [ 1158.359046][ T24] smsc75xx v1.0.0 [ 1158.394217][ T5921] usb 5-1: device descriptor read/64, error -71 [ 1158.455114][ T89] usb 3-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.32 [ 1158.464484][ T89] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1158.476755][ T89] usb 3-1: config 0 descriptor?? [ 1158.494725][ T89] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 1158.504004][ T5921] usb usb5-port1: attempt power cycle [ 1158.654572][T22565] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1158.720601][ T89] gp8psk: usb in 128 operation failed. [ 1158.804128][T22565] usb 9-1: device descriptor read/64, error -71 [ 1158.844166][ T5921] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1158.882690][ T5921] usb 5-1: device descriptor read/8, error -71 [ 1158.978589][T22808] loop2: detected capacity change from 0 to 7 [ 1158.986609][T22808] Dev loop2: unable to read RDB block 7 [ 1158.992940][T22808] loop2: unable to read partition table [ 1159.000316][T22808] loop2: partition table beyond EOD, truncated [ 1159.006900][T22808] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1159.027190][ T24] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1159.038695][ T24] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1159.054205][T22565] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1159.145037][ T5921] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1159.164835][ T5921] usb 5-1: device descriptor read/8, error -71 [ 1159.194080][T22565] usb 9-1: device descriptor read/64, error -71 [ 1159.274309][ T5921] usb usb5-port1: unable to enumerate USB device [ 1159.304439][T22565] usb usb9-port1: attempt power cycle [ 1159.547323][ T89] gp8psk: usb in 146 operation failed. [ 1159.552948][ T89] gp8psk: failed to get FW version [ 1159.558674][ T89] gp8psk: usb in 149 operation failed. [ 1159.568417][ T89] gp8psk: failed to get FPGA version [ 1159.574285][ T89] gp8psk: usb in 138 operation failed. [ 1159.581146][ T89] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1159.591225][ T89] dvbdev: DVB: registering new adapter (Genpix SkyWalker-1 DVB-S receiver) [ 1159.609635][ T89] usb 3-1: media controller created [ 1159.648315][ T89] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1159.732399][T22565] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1159.752235][ T89] gp8psk_fe: Frontend attached [ 1159.774826][T22565] usb 9-1: device descriptor read/8, error -71 [ 1159.867987][ T89] usb 3-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)... [ 1159.877480][ T89] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered. [ 1159.939550][T22822] 9p: Bad value for 'rfdno' [ 1159.944804][T22822] netlink: 'syz.2.4035': attribute type 23 has an invalid length. [ 1159.961520][ T89] gp8psk: usb in 138 operation failed. [ 1159.969084][ T89] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully initialized and connected. [ 1159.978882][ T89] gp8psk: found Genpix USB device pID = 203 (hex) [ 1159.988686][ T89] usb 3-1: USB disconnect, device number 75 [ 1160.014260][T22565] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1160.038929][T22565] usb 9-1: device descriptor read/8, error -71 [ 1160.056252][ T89] dvb-usb: Genpix SkyWalker-1 DVB-S receiver successfully deinitialized and disconnected. [ 1160.106425][T22824] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4036'. [ 1160.204250][T22565] usb usb9-port1: unable to enumerate USB device [ 1160.326706][T22826] erofs (device nbd6): cannot find valid erofs superblock [ 1160.376106][T22827] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4036'. [ 1160.592838][ T24] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1160.608579][ T24] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1160.622429][ T24] smsc75xx 2-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1160.647536][ T24] smsc75xx 2-1:0.184: probe with driver smsc75xx failed with error -71 [ 1160.679764][ T24] usb 2-1: USB disconnect, device number 34 [ 1161.913932][T22848] FAULT_INJECTION: forcing a failure. [ 1161.913932][T22848] name failslab, interval 1, probability 0, space 0, times 0 [ 1161.926768][T22848] CPU: 0 UID: 0 PID: 22848 Comm: syz.2.4043 Tainted: G L syzkaller #0 PREEMPT(full) [ 1161.926797][T22848] Tainted: [L]=SOFTLOCKUP [ 1161.926803][T22848] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1161.926814][T22848] Call Trace: [ 1161.926820][T22848] [ 1161.926826][T22848] dump_stack_lvl+0x16c/0x1f0 [ 1161.926854][T22848] should_fail_ex+0x512/0x640 [ 1161.926879][T22848] ? fs_reclaim_acquire+0xae/0x150 [ 1161.926904][T22848] should_failslab+0xc2/0x120 [ 1161.926926][T22848] __kmalloc_noprof+0xeb/0x910 [ 1161.926952][T22848] ? tomoyo_encode2+0x100/0x3e0 [ 1161.926980][T22848] ? tomoyo_encode2+0x100/0x3e0 [ 1161.927000][T22848] tomoyo_encode2+0x100/0x3e0 [ 1161.927026][T22848] tomoyo_encode+0x29/0x50 [ 1161.927047][T22848] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1161.927072][T22848] ? tomoyo_profile+0x47/0x60 [ 1161.927100][T22848] tomoyo_path_number_perm+0x245/0x580 [ 1161.927119][T22848] ? tomoyo_path_number_perm+0x237/0x580 [ 1161.927141][T22848] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1161.927162][T22848] ? find_held_lock+0x2b/0x80 [ 1161.927210][T22848] ? find_held_lock+0x2b/0x80 [ 1161.927233][T22848] ? hook_file_ioctl_common+0x144/0x410 [ 1161.927265][T22848] ? __fget_files+0x20e/0x3c0 [ 1161.927293][T22848] security_file_ioctl+0x9b/0x240 [ 1161.927317][T22848] __x64_sys_ioctl+0xb7/0x210 [ 1161.927338][T22848] do_syscall_64+0xcd/0xf80 [ 1161.927363][T22848] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1161.927379][T22848] RIP: 0033:0x7f63dbb8f749 [ 1161.927393][T22848] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1161.927409][T22848] RSP: 002b:00007f63d9db4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1161.927426][T22848] RAX: ffffffffffffffda RBX: 00007f63dbde6180 RCX: 00007f63dbb8f749 [ 1161.927437][T22848] RDX: 0000200000000b00 RSI: 00000000c0285700 RDI: 0000000000000003 [ 1161.927448][T22848] RBP: 00007f63d9db4090 R08: 0000000000000000 R09: 0000000000000000 [ 1161.927457][T22848] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1161.927467][T22848] R13: 00007f63dbde6218 R14: 00007f63dbde6180 R15: 00007ffd1e5943a8 [ 1161.927492][T22848] [ 1162.143174][T22848] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1162.300710][ T5825] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1162.324623][ T5825] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1162.334295][ T5825] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1162.341843][ T5825] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1162.356926][ T5825] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1162.400873][T22855] lo speed is unknown, defaulting to 1000 [ 1162.717351][ T5872] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1162.755991][T22866] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4050'. [ 1162.958864][T22874] erofs (device nbd2): cannot find valid erofs superblock [ 1163.008965][T22875] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4050'. [ 1163.299217][ T5872] usb 2-1: device descriptor read/64, error -71 [ 1163.553594][ T5872] usb 2-1: new high-speed USB device number 36 using dummy_hcd [ 1164.145731][ T5872] usb 2-1: device descriptor read/64, error -71 [ 1164.153032][T22883] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4053'. [ 1164.162504][T22883] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4053'. [ 1164.176087][T22883] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4053'. [ 1164.186645][T22883] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4053'. [ 1164.214542][T17813] netdevsim netdevsim4 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.279082][T22855] chnl_net:caif_netlink_parms(): no params data found [ 1164.366341][ T5872] usb usb2-port1: attempt power cycle [ 1164.394317][T17813] netdevsim netdevsim4 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.405630][ T5827] Bluetooth: hci5: command tx timeout [ 1164.499644][T22888] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4055'. [ 1164.712711][T17813] netdevsim netdevsim4 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.736212][ T5872] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1164.784279][ T5872] usb 2-1: device descriptor read/8, error -71 [ 1164.822948][T17813] netdevsim netdevsim4 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1164.928423][T22855] bridge0: port 1(bridge_slave_0) entered blocking state [ 1164.935838][T22855] bridge0: port 1(bridge_slave_0) entered disabled state [ 1164.948616][T22855] bridge_slave_0: entered allmulticast mode [ 1165.088760][ T5872] usb 2-1: new high-speed USB device number 38 using dummy_hcd [ 1165.146472][ T5872] usb 2-1: device descriptor read/8, error -71 [ 1165.166581][T22855] bridge_slave_0: entered promiscuous mode [ 1165.192945][T22855] bridge0: port 2(bridge_slave_1) entered blocking state [ 1165.210313][T22855] bridge0: port 2(bridge_slave_1) entered disabled state [ 1165.229635][T22855] bridge_slave_1: entered allmulticast mode [ 1165.245540][T22855] bridge_slave_1: entered promiscuous mode [ 1165.463943][ T5872] usb usb2-port1: unable to enumerate USB device [ 1165.638201][T22855] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1165.671237][T22855] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1165.824592][T22906] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4062'. [ 1166.166374][T22910] erofs (device nbd2): cannot find valid erofs superblock [ 1166.216217][T22911] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4062'. [ 1166.484804][ T5827] Bluetooth: hci5: command tx timeout [ 1166.555134][ T5872] usb 2-1: new full-speed USB device number 39 using dummy_hcd [ 1166.589308][T22855] team0: Port device team_slave_0 added [ 1166.745896][T22855] team0: Port device team_slave_1 added [ 1166.758698][ T5872] usb 2-1: not running at top speed; connect to a high speed hub [ 1166.815247][ T5872] usb 2-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1166.863830][ T5872] usb 2-1: config 1 has no interface number 1 [ 1166.885700][ T5872] usb 2-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1169.254118][ T5827] Bluetooth: hci5: command tx timeout [ 1169.266913][ T5872] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1169.344837][ T5872] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1169.357200][T22855] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1169.366389][T22855] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1169.392296][ T5872] usb 2-1: Product: syz [ 1169.393797][ T9] usb 7-1: new high-speed USB device number 73 using dummy_hcd [ 1169.397889][T22855] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1169.415904][ T5872] usb 2-1: Manufacturer: syz [ 1169.419054][T22855] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1169.425207][ T5872] usb 2-1: SerialNumber: syz [ 1169.427938][T22855] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1169.464407][T22855] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1169.480189][T17813] bridge_slave_1: left allmulticast mode [ 1169.486435][T17813] bridge_slave_1: left promiscuous mode [ 1169.492056][T17813] bridge0: port 2(bridge_slave_1) entered disabled state [ 1169.508251][T17813] bridge_slave_0: left allmulticast mode [ 1169.518014][T17813] bridge_slave_0: left promiscuous mode [ 1169.524168][T17813] bridge0: port 1(bridge_slave_0) entered disabled state [ 1169.573683][ T9] usb 7-1: Using ep0 maxpacket: 32 [ 1169.590800][ T5872] usb 2-1: can't set config #1, error -71 [ 1169.620588][ T9] usb 7-1: too many configurations: 214, using maximum allowed: 8 [ 1169.661441][ T5872] usb 2-1: USB disconnect, device number 39 [ 1169.674547][ T9] usb 7-1: config index 0 descriptor too short (expected 1828, got 36) [ 1169.686419][ T9] usb 7-1: config 4 has an invalid interface number: 192 but max is -1 [ 1169.711933][ T9] usb 7-1: config 4 contains an unexpected descriptor of type 0x1, skipping [ 1169.769714][ T9] usb 7-1: config 4 descriptor has 1 excess byte, ignoring [ 1169.877148][ T9] usb 7-1: config 4 has 1 interface, different from the descriptor's value: 0 [ 1169.973619][ T9] usb 7-1: config 4 has no interface number 0 [ 1170.016408][ T9] usb 7-1: too many endpoints for config 4 interface 192 altsetting 71: 111, using maximum allowed: 30 [ 1170.031159][ T9] usb 7-1: config 4 interface 192 altsetting 71 has 0 endpoint descriptors, different from the interface descriptor's value: 111 [ 1170.047394][ T9] usb 7-1: config 4 interface 192 has no altsetting 0 [ 1170.160016][T22930] netlink: 32 bytes leftover after parsing attributes in process `syz.6.4070'. [ 1170.448063][T22936] erofs (device nbd6): cannot find valid erofs superblock [ 1170.807513][ T9] usb 7-1: unable to read config index 1 descriptor/start: -71 [ 1170.953607][ T9] usb 7-1: can't read configurations, error -71 [ 1171.476407][ T5827] Bluetooth: hci5: command tx timeout [ 1172.892283][T22948] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4073'. [ 1178.103826][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1178.123796][T19919] IPVS: starting estimator thread 0... [ 1178.213643][T22949] IPVS: using max 41 ests per chain, 98400 per kthread [ 1178.301919][ T5825] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1178.314809][ T5825] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1178.322550][ T5825] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1178.331927][ T5825] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1178.339962][ T5825] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1178.522477][T22957] 9p: Bad value for 'rfdno' [ 1178.527679][T22957] netlink: 'syz.2.4075': attribute type 23 has an invalid length. [ 1178.615991][T17813] bond0 (unregistering): left promiscuous mode [ 1178.623691][T17813] bond_slave_0: left promiscuous mode [ 1178.631926][T17813] bond_slave_1: left promiscuous mode [ 1178.643301][T17813] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1178.658919][T17813] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1178.676800][T17813] bond0 (unregistering): Released all slaves [ 1178.776855][T22855] hsr_slave_0: entered promiscuous mode [ 1178.784744][T22855] hsr_slave_1: entered promiscuous mode [ 1178.822446][T22953] lo speed is unknown, defaulting to 1000 [ 1178.997065][T22953] chnl_net:caif_netlink_parms(): no params data found [ 1180.601366][ T5825] Bluetooth: hci6: command tx timeout [ 1180.666557][T17813] : left promiscuous mode [ 1182.653567][ T5825] Bluetooth: hci6: command tx timeout [ 1184.795683][ T5825] Bluetooth: hci6: command tx timeout [ 1186.958292][ T5825] Bluetooth: hci6: command tx timeout [ 1191.784931][T22953] bridge0: port 1(bridge_slave_0) entered blocking state [ 1191.792060][T22953] bridge0: port 1(bridge_slave_0) entered disabled state [ 1191.803738][T22953] bridge_slave_0: entered allmulticast mode [ 1191.810335][T22953] bridge_slave_0: entered promiscuous mode [ 1191.822780][T22953] bridge0: port 2(bridge_slave_1) entered blocking state [ 1191.829977][T22953] bridge0: port 2(bridge_slave_1) entered disabled state [ 1192.312526][T22953] bridge_slave_1: entered allmulticast mode [ 1192.334502][T22953] bridge_slave_1: entered promiscuous mode [ 1193.354262][T23007] netlink: 'syz.1.4087': attribute type 5 has an invalid length. [ 1193.667827][T23012] netdevsim netdevsim6: Direct firmware load for lookup_extent_enter failed with error -2 [ 1193.680998][T23012] netdevsim netdevsim6: Falling back to sysfs fallback for: lookup_extent_enter [ 1193.977476][ T30] audit: type=1400 audit(1193.647:1065): avc: denied { firmware_load } for pid=23009 comm="syz.6.4086" scontext=system_u:system_r:kernel_t tcontext=system_u:system_r:kernel_t tclass=system permissive=1 [ 1194.017296][T22953] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1194.098783][T22953] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1194.317664][T17813] team0: left promiscuous mode [ 1194.322514][T17813] team_slave_1: left promiscuous mode [ 1194.337268][T17813] hsr_slave_0: left promiscuous mode [ 1194.351767][T17813] hsr_slave_1: left promiscuous mode [ 1194.370773][T17813] veth1_macvtap: left promiscuous mode [ 1194.376451][T17813] veth0_macvtap: left promiscuous mode [ 1196.783632][ T5879] usb 2-1: new full-speed USB device number 40 using dummy_hcd [ 1196.954295][ T5879] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1196.965136][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1197.009741][ T5879] usb 2-1: Product: syz [ 1197.014962][ T5879] usb 2-1: Manufacturer: syz [ 1197.019631][ T5879] usb 2-1: SerialNumber: syz [ 1197.539549][ T5879] usb 2-1: 2:1 : format type 0 is detected, processed as PCM [ 1197.581521][ T5879] usb 2-1: 2:1 : sample bitwidth 205 in over sample bytes 18 [ 1197.650895][ T5879] usb 2-1: 2:1 : unsupported sample bitwidth 205 in 18 bytes [ 1197.791219][ T5879] usb 2-1: USB disconnect, device number 40 [ 1197.810264][T17813] team0 (unregistering): Port device team_slave_1 removed [ 1198.545919][T23049] netlink: 'syz.1.4095': attribute type 1 has an invalid length. [ 1198.581952][T23049] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4095'. [ 1198.646818][T22953] team0: Port device team_slave_0 added [ 1198.673344][T22953] team0: Port device team_slave_1 added [ 1198.789729][T22953] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1198.800067][T22953] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1198.826878][T22953] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1201.805054][ T89] usb 7-1: new high-speed USB device number 75 using dummy_hcd [ 1201.805707][T22953] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1201.819850][T22953] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1201.846669][T22953] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1201.897238][T22855] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1202.114761][T22855] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1203.420288][T22953] hsr_slave_0: entered promiscuous mode [ 1205.556965][T22953] hsr_slave_1: entered promiscuous mode [ 1205.854826][T22953] debugfs: 'hsr0' already exists in 'hsr' [ 1205.885365][T22953] Cannot create hsr debugfs directory [ 1205.912007][T22855] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1206.211963][T22855] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1206.288614][T17813] IPVS: stop unused estimator thread 0... [ 1206.734574][T23094] netlink: 'syz.1.4105': attribute type 1 has an invalid length. [ 1206.749432][T23094] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4105'. [ 1207.175524][T22855] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1207.226383][T22855] 8021q: adding VLAN 0 to HW filter on device team0 [ 1207.238898][T12438] bridge0: port 1(bridge_slave_0) entered blocking state [ 1207.246004][T12438] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1207.288708][T23105] loop2: detected capacity change from 0 to 7 [ 1207.321679][T23105] Dev loop2: unable to read RDB block 7 [ 1207.353589][T23105] loop2: unable to read partition table [ 1207.368594][T23105] loop2: partition table beyond EOD, truncated [ 1207.375911][T23105] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1207.641381][T12438] bridge0: port 2(bridge_slave_1) entered blocking state [ 1207.648463][T12438] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1207.659928][ T30] audit: type=1326 audit(1207.627:1066): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23108 comm="syz.6.4111" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0127d8f749 code=0x0 [ 1213.776477][T23134] input: syz0 as /devices/virtual/input/input81 [ 1235.383945][T22953] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1235.466282][T22953] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1235.783189][T22953] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1235.801093][ T5827] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1235.827111][ T5827] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1235.835179][T22297] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1235.835234][ T5827] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1235.845659][T22297] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1235.850663][ T5827] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1235.857650][T22297] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1235.863896][ T5827] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1235.877412][ T5827] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1235.941611][ T5827] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1235.963428][T22953] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1236.024153][T22298] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1236.035867][T22298] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1236.044175][T22298] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1236.051666][T22298] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1236.063975][T22298] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1236.303936][T23149] lo speed is unknown, defaulting to 1000 [ 1236.334537][ T5827] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1236.340010][T23150] lo speed is unknown, defaulting to 1000 [ 1236.348591][ T5827] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1236.357098][ T5827] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1236.364867][ T5827] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1236.372402][ T5827] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1236.930074][T23155] lo speed is unknown, defaulting to 1000 [ 1237.245633][ T6772] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1237.473125][T23162] lo speed is unknown, defaulting to 1000 [ 1238.127616][ T5825] Bluetooth: hci9: command tx timeout [ 1238.133562][ T5827] Bluetooth: hci7: command tx timeout [ 1238.154935][T22298] Bluetooth: hci8: command tx timeout [ 1238.573155][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1238.580559][T22298] Bluetooth: hci10: command tx timeout [ 1240.163684][ T5827] Bluetooth: hci7: command tx timeout [ 1240.193129][ T5825] Bluetooth: hci9: command tx timeout [ 1240.201522][T22298] Bluetooth: hci8: command tx timeout [ 1241.116431][T22298] Bluetooth: hci10: command tx timeout [ 1242.403828][ T5825] Bluetooth: hci9: command tx timeout [ 1242.409381][ T5825] Bluetooth: hci7: command tx timeout [ 1242.420618][T22298] Bluetooth: hci8: command tx timeout [ 1242.438545][ T6772] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1243.157330][ T5825] Bluetooth: hci10: command tx timeout [ 1243.838836][ T6772] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1244.483714][ T5827] Bluetooth: hci7: command tx timeout [ 1244.483723][T22297] Bluetooth: hci9: command tx timeout [ 1244.605047][ T5825] Bluetooth: hci8: command tx timeout [ 1244.639178][ T5825] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1244.649876][ T5825] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1244.658055][ T5825] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1244.670945][ T5825] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1244.678487][ T5825] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1245.373505][ T5827] Bluetooth: hci10: command tx timeout [ 1245.703812][ T5827] Bluetooth: hci3: command 0x0406 tx timeout [ 1245.948765][ T6772] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1246.735510][T22298] Bluetooth: hci0: command tx timeout [ 1246.826802][T23195] lo speed is unknown, defaulting to 1000 [ 1246.884496][T23149] chnl_net:caif_netlink_parms(): no params data found [ 1247.093122][T23150] chnl_net:caif_netlink_parms(): no params data found [ 1249.007847][T22298] Bluetooth: hci0: command tx timeout [ 1251.203749][T22298] Bluetooth: hci0: command tx timeout [ 1251.375300][T23149] bridge0: port 1(bridge_slave_0) entered blocking state [ 1251.402921][T23149] bridge0: port 1(bridge_slave_0) entered disabled state [ 1251.411750][T23149] bridge_slave_0: entered allmulticast mode [ 1251.428930][T23149] bridge_slave_0: entered promiscuous mode [ 1251.436207][T23155] chnl_net:caif_netlink_parms(): no params data found [ 1251.508088][T23149] bridge0: port 2(bridge_slave_1) entered blocking state [ 1251.520389][T23149] bridge0: port 2(bridge_slave_1) entered disabled state [ 1251.528943][T23149] bridge_slave_1: entered allmulticast mode [ 1251.541824][T23149] bridge_slave_1: entered promiscuous mode [ 1251.915312][T23150] bridge0: port 1(bridge_slave_0) entered blocking state [ 1251.922415][T23150] bridge0: port 1(bridge_slave_0) entered disabled state [ 1251.930593][T23150] bridge_slave_0: entered allmulticast mode [ 1251.948715][T23150] bridge_slave_0: entered promiscuous mode [ 1253.281019][T23150] bridge0: port 2(bridge_slave_1) entered blocking state [ 1253.288128][T22298] Bluetooth: hci0: command tx timeout [ 1253.294436][T23150] bridge0: port 2(bridge_slave_1) entered disabled state [ 1253.303824][T23150] bridge_slave_1: entered allmulticast mode [ 1253.311047][T23150] bridge_slave_1: entered promiscuous mode [ 1253.354656][ T6772] bridge_slave_1: left allmulticast mode [ 1253.360303][ T6772] bridge_slave_1: left promiscuous mode [ 1253.367386][ T6772] bridge0: port 2(bridge_slave_1) entered disabled state [ 1253.383911][ T6772] bridge_slave_0: left allmulticast mode [ 1253.389549][ T6772] bridge_slave_0: left promiscuous mode [ 1253.400530][ T6772] bridge0: port 1(bridge_slave_0) entered disabled state [ 1257.103952][ T6772] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1257.116758][ T6772] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1257.135525][ T6772] bond0 (unregistering): Released all slaves [ 1257.186007][T23149] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1257.245839][T23149] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1258.355534][T23150] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1258.372468][T23155] bridge0: port 1(bridge_slave_0) entered blocking state [ 1258.386532][T23155] bridge0: port 1(bridge_slave_0) entered disabled state [ 1258.483905][T23155] bridge_slave_0: entered allmulticast mode [ 1258.491329][T23155] bridge_slave_0: entered promiscuous mode [ 1258.578787][T23149] team0: Port device team_slave_0 added [ 1258.584540][T23195] chnl_net:caif_netlink_parms(): no params data found [ 1258.596283][T23150] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1275.746393][T23155] bridge0: port 2(bridge_slave_1) entered blocking state [ 1275.756857][T23155] bridge0: port 2(bridge_slave_1) entered disabled state [ 1275.770436][T23155] bridge_slave_1: entered allmulticast mode [ 1275.785399][T23155] bridge_slave_1: entered promiscuous mode [ 1275.961793][T23149] team0: Port device team_slave_1 added [ 1276.099207][ T6772] hsr_slave_0: left promiscuous mode [ 1276.104924][ T6772] hsr_slave_1: left promiscuous mode [ 1276.110525][ T6772] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1276.118006][ T6772] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1276.151306][ T6772] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1276.159893][ T6772] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1276.197684][ T6772] veth1_macvtap: left promiscuous mode [ 1276.203224][ T6772] veth0_macvtap: left promiscuous mode [ 1276.208826][ T6772] veth1_vlan: left promiscuous mode [ 1276.214725][ T6772] veth0_vlan: left promiscuous mode [ 1276.560223][ T6772] team0 (unregistering): Port device team_slave_1 removed [ 1276.598900][ T6772] team0 (unregistering): Port device team_slave_0 removed [ 1276.964077][T23150] team0: Port device team_slave_0 added [ 1277.008977][T23155] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1277.031016][T23149] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1277.039692][T23149] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1277.066188][T23149] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1277.092564][T23162] chnl_net:caif_netlink_parms(): no params data found [ 1277.109121][T23150] team0: Port device team_slave_1 added [ 1277.133143][T23149] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1281.153519][T23149] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1301.653849][ T1298] ieee802154 phy1 wpan1: encryption failed: -22 [ 1301.754286][T23149] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1301.984821][ T5827] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1301.999919][ T5827] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1302.033973][ T5827] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1302.045506][ T5827] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1302.058513][T23155] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1302.069995][ T5827] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1302.276095][ T5827] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 1302.288415][ T5827] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 1302.301392][ T5827] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 1302.309020][ T5827] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 1302.316375][ T5827] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 1302.591050][ T5825] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1302.626617][ T5825] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1302.638237][T23195] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wg1": -EINTR [ 1302.653708][ T5825] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1302.680160][ T5825] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1302.690142][ T5825] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1302.730530][ T5827] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1302.863541][ T5827] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1302.872940][ T5827] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1302.881085][ T5827] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1302.888382][ T5827] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1304.386843][T22298] Bluetooth: hci2: command tx timeout [ 1304.413576][T22298] Bluetooth: hci4: command tx timeout [ 1304.421243][ T5825] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1304.510733][ T5825] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1304.520175][ T5825] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1304.527976][ T5825] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1304.535480][ T5825] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1304.758304][T23278] lo speed is unknown, defaulting to 1000 [ 1304.806223][T23299] lo speed is unknown, defaulting to 1000 [ 1304.853509][T23294] lo speed is unknown, defaulting to 1000 [ 1304.869191][T23282] lo speed is unknown, defaulting to 1000 [ 1304.923627][T23290] lo speed is unknown, defaulting to 1000 [ 1304.967391][ T5825] Bluetooth: hci6: command tx timeout [ 1304.976560][ T5827] Bluetooth: hci5: command tx timeout [ 1306.405473][ T5825] Bluetooth: hci2: command tx timeout [ 1306.485020][ T5825] Bluetooth: hci4: command tx timeout [ 1306.563551][ T5825] Bluetooth: hci8: command tx timeout [ 1307.043496][ T5827] Bluetooth: hci5: command tx timeout [ 1307.555609][ T5825] Bluetooth: hci6: command tx timeout [ 1308.808444][ T5825] Bluetooth: hci2: command tx timeout [ 1308.813918][ T5825] Bluetooth: hci8: command tx timeout [ 1308.820967][ T5827] Bluetooth: hci4: command tx timeout [ 1309.194974][ T5827] Bluetooth: hci5: command tx timeout [ 1309.219174][ T6772] IPVS: stop unused estimator thread 0... [ 1309.322236][T23278] chnl_net:caif_netlink_parms(): no params data found [ 1310.367877][ T5827] Bluetooth: hci6: command tx timeout [ 1310.486711][T23282] chnl_net:caif_netlink_parms(): no params data found [ 1310.607982][T23294] chnl_net:caif_netlink_parms(): no params data found [ 1310.700211][T23290] chnl_net:caif_netlink_parms(): no params data found [ 1310.724373][T23299] chnl_net:caif_netlink_parms(): no params data found [ 1310.765467][T23278] bridge0: port 1(bridge_slave_0) entered blocking state [ 1310.772566][T23278] bridge0: port 1(bridge_slave_0) entered disabled state [ 1310.782259][T23278] bridge_slave_0: entered allmulticast mode [ 1310.790395][T23278] bridge_slave_0: entered promiscuous mode [ 1310.838840][T23278] bridge0: port 2(bridge_slave_1) entered blocking state [ 1310.847310][T23278] bridge0: port 2(bridge_slave_1) entered disabled state [ 1311.621994][T22297] Bluetooth: hci5: command tx timeout [ 1311.635908][T23278] bridge_slave_1: entered allmulticast mode [ 1311.643615][ T5827] Bluetooth: hci4: command tx timeout [ 1311.644120][ T5825] Bluetooth: hci2: command tx timeout [ 1311.654514][T22298] Bluetooth: hci8: command tx timeout [ 1311.660293][T23278] bridge_slave_1: entered promiscuous mode [ 1312.039377][ T31] INFO: task syz.8.4046:22860 blocked for more than 147 seconds. SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1312.433463][ T30] audit: type=1400 audit(1312.397:1067): avc: denied { write } for pid=5797 comm="syz-executor" path="pipe:[4748]" dev="pipefs" ino=4748 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 1312.443751][ T5825] Bluetooth: hci6: command tx timeout [ 1312.472538][ T31] Tainted: G L syzkaller #0 [ 1312.504110][ T31] Blocked by coredump. [ 1312.508716][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1312.565591][ T31] task:syz.8.4046 state:D stack:26888 pid:22860 tgid:22850 ppid:22329 task_flags:0x400448 flags:0x00080004 [ 1312.594239][ T31] Call Trace: [ 1312.597532][ T31] [ 1312.600439][ T31] ? __schedule+0x10b9/0x6150 [ 1312.706344][ T31] __schedule+0x1139/0x6150 [ 1312.710913][ T31] ? __pfx___schedule+0x10/0x10 [ 1312.723530][ T31] ? find_held_lock+0x2b/0x80 [ 1312.728347][ T31] ? schedule+0x2d7/0x3a0 [ 1312.732686][ T31] schedule+0xe7/0x3a0 [ 1312.978066][ T31] schedule_timeout+0x257/0x290 [ 1312.982948][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1313.005795][ T31] ? rcu_is_watching+0x12/0xc0 [ 1313.010609][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1313.017167][ T31] __wait_for_common+0x2fc/0x4e0 [ 1313.022289][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1313.033666][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 1313.039151][ T31] ? find_held_lock+0x2b/0x80 [ 1313.047074][ T31] ? io_wq_put_and_exit+0x22a/0x8a0 [ 1313.063617][ T31] io_wq_put_and_exit+0x271/0x8a0 [ 1313.068658][ T31] ? __pfx_xa_find_after+0x10/0x10 [ 1313.079480][ T31] ? __pfx_io_wq_put_and_exit+0x10/0x10 [ 1313.092021][ T31] ? __pfx___might_resched+0x10/0x10 [ 1313.098048][ T31] ? io_uring_del_tctx_node+0x27f/0x360 [ 1313.138622][ T31] io_uring_clean_tctx+0x10d/0x190 [ 1313.144193][ T31] ? __pfx_io_uring_clean_tctx+0x10/0x10 [ 1313.149905][ T31] ? percpu_counter_add_batch+0x180/0x200 [ 1313.157759][ T31] ? irq_work_queue+0xce/0x100 [ 1313.233700][ T31] io_uring_cancel_generic+0x69c/0x9a0 [ 1313.253836][ T31] ? __pfx_io_uring_cancel_generic+0x10/0x10 [ 1313.259844][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1313.273552][ T31] ? rcu_is_watching+0x12/0xc0 [ 1313.278349][ T31] ? io_uring_unreg_ringfd+0xbc/0x130 [ 1313.285409][ T31] do_exit+0x2ce/0x2bd0 [ 1313.303525][ T31] ? lock_acquire+0x179/0x330 [ 1313.308722][ T31] ? find_held_lock+0x2b/0x80 [ 1313.313408][ T31] ? __pfx_do_exit+0x10/0x10 [ 1313.318216][ T31] ? find_held_lock+0x2b/0x80 [ 1313.323070][ T31] do_group_exit+0xd3/0x2a0 [ 1313.339198][ T31] get_signal+0x2671/0x26d0 [ 1313.343881][ T31] ? finish_task_switch.isra.0+0x210/0xbd0 [ 1313.349705][ T31] ? rcu_is_watching+0x12/0xc0 [ 1313.354526][ T31] ? __pfx_get_signal+0x10/0x10 [ 1313.359384][ T31] arch_do_signal_or_restart+0x8f/0x7e0 [ 1313.366721][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1313.374273][ T31] ? exc_page_fault+0x64/0xc0 [ 1313.379327][ T31] exit_to_user_mode_loop+0x8c/0x540 [ 1313.387357][ T31] do_syscall_64+0x4ee/0xf80 [ 1313.391963][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1313.400462][ T31] RIP: 0033:0x7f7f2838f749 [ 1313.407709][ T31] RSP: 002b:00007f7f291760e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1313.416928][ T31] RAX: fffffffffffffe00 RBX: 00007f7f285e6188 RCX: 00007f7f2838f749 [ 1313.428315][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f7f285e6188 [ 1313.446973][ T31] RBP: 00007f7f285e6180 R08: 0000000000000000 R09: 0000000000000000 [ 1313.687034][ T5825] Bluetooth: hci8: command tx timeout [ 1313.696191][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1313.707158][ T31] R13: 00007f7f285e6218 R14: 00007fffc025cd30 R15: 00007fffc025ce18 [ 1313.723550][ T31] [ 1313.743536][ T31] [ 1313.743536][ T31] Showing all locks held in the system: [ 1313.751297][ T31] 1 lock held by khungtaskd/31: [ 1313.756572][ T31] #0: ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1313.803560][ T31] 2 locks held by getty/5574: [ 1313.808283][ T31] #0: ffff8880322c00a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1313.818661][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x1510 [ 1313.829874][ T31] 6 locks held by kworker/u8:19/6772: [ 1313.835492][ T31] #0: ffff88801badc948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 [ 1313.883535][ T31] #1: ffffc9000b757c90 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 [ 1313.964609][ T31] #2: ffffffff9012bb50 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x830 [ 1313.975557][ T31] #3: ffff8880739600e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x12c/0x2b0 [ 1313.991258][ T31] #4: ffff888073962250 (&devlink->lock_key#22){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x136/0x2b0 [ 1314.037406][ T31] #5: ffffffff90142328 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_net_dev_lock+0x146/0x360 [ 1314.048193][ T31] 3 locks held by kworker/u8:32/12431: [ 1314.056524][ T31] #0: ffff88813ff69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 [ 1314.097799][ T31] #1: ffffc9000b8efc90 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 [ 1314.119738][ T31] #2: ffffffff90142328 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 [ 1314.143599][ T31] 3 locks held by syz-executor/23278: [ 1314.148971][ T31] #0: ffffffff8f4d9bc8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 1314.169306][ T31] #1: ffffffff90142328 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5f6/0x1f50 [ 1314.183714][ T31] #2: ffffffff8e3d4df8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 [ 1314.253101][ T31] 1 lock held by syz-executor/23282: [ 1314.273248][ T31] #0: ffffffff8e3d4df8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 1314.303537][ T31] 2 locks held by syz-executor/23290: [ 1314.308972][ T31] #0: ffffffff9088f8a8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 1314.318635][ T31] #1: ffffffff90142328 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5f6/0x1f50 [ 1314.345776][ T31] 2 locks held by syz-executor/23294: [ 1314.351151][ T31] #0: ffffffff9088f8a8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0 [ 1314.363761][ T31] #1: ffffffff90142328 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x5f6/0x1f50 [ 1314.372834][ T31] 2 locks held by syz-executor/23299: [ 1314.378223][ T31] #0: ffffffff8f4d9bc8 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x113/0x2c0