last executing test programs: 32.010905826s ago: executing program 2 (id=1552): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r1, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x7a, &(0x7f0000000340)={r2, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) r3 = dup(r0) setsockopt$SO_BINDTODEVICE(r3, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f0000000600)={0x0, @in6={{0xa, 0x4e23, 0x7, @empty, 0x2001}}, 0x6, 0x6}, 0x90) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r3, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in6={{0xa, 0x4e60, 0xfffffff2, @empty, 0x3}}, 0x7, 0x31, 0xffff1896, 0x3, 0xe, 0x400, 0x1b}, 0x9c) r4 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$netlink(r4, &(0x7f000000a580)={0x0, 0x0, &(0x7f000000a4c0)=[{&(0x7f0000008940)=ANY=[], 0x10}], 0x1, &(0x7f000000a540)=[@cred={{0x1c, 0x1, 0x2, {0x0, 0x0, 0xee01}}}], 0x20, 0x80}, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0a000000020000000110000007"], 0x50) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x21) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000161000/0x18000)=nil, &(0x7f0000005700)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r8, 0x4080aebf, &(0x7f0000005740)={{0x0, 0x0, 0x80}, "cb31455c9ea4288a70a2a6bb8068fd95dd041cf5b177a3bffe992dfbbdf959487337b92336ce1de32e7695c411c0bf9f852d2d71192f33001fd51f5b396a55cb98699a09d21648c4cb30d9d7e3e397c7a3c041c76c72385a46c48c5302848c3696facce956952c2a85822ddf20434ccee5806294ed563ff3a972cddf6ef16ddace933d8a5adea40cd3ad40c9873c29368838e815ff59723519154856b2d5cd9cd79a97dc2fa08dada1175817886e5f9e7aa3dca783a44c667a4806826570ec6acb57d65efc313a384e11fb633dee17ee600145f2cb3103384606140021be766fcb7fa029f0513bbb466177ca1068192550bbf4e6f5694aec747a16e27688a988fa595bca1761b8e88a7dbcaeaf97a8b7b53058b1faf880dd6f1b6eb4c7beb0582b4007f1a67db1352407adbe1456bf762c94fd825b9419d74f63cdeb6c6976de1890d773f0c8088d2bd48a838cf5b87f5ddf926352960fb978874b0f175acfa55ddfe84de3fc9f75b58bf7a35f33d3c43ed5e3224e92751fa1b43f94f64b681163ef1360a3f3bb7403afc67a188b2104b45c5814aaa9e218552498bf85f4b221d9acc32a331f5f8c109cc9f335ff4e418ab30b54b99d5376cd928c431fc8211fcbaf64716afdc4b6d0417e04d5723e4675d282b36bef3a3a19e855029ec7c33830a6df19332b63e9d8a0f22d96ac230c67657a4e7f7afab91dc0ce751b68980e5a4f6d9d6d9b98802ba9d8576640eea61b8c308a1745df61560e56108bececa3016d93246fdc8b768634e8319b1ffde103c07378f8f4927baba05e992a4b5af0958a7e495e7ce53f7917451d15a963ca14f5cdc4563775688b6533a4b97e0f84b0a33c30077b20805c1f42cc7815efada97ad59ac486bc9e0ee386b49cb97b47fbf8f919f06c75a49636795054b5ebee3e91602c90d7f4db49220affe56d56b96e4f662b2bf36dae482ffc7ba21cbc55e21b73309d6b7aa5509defcb77c236e43b579c61eae5c8d8f8fa71ad876b96069f2e4352c8aaf16e299d21edf5434c0cd9b25cdc9210fb0de759b1dd3fc7fe4c7118bbde72a5617dff21f7a5036448fba7fe41aaee0c289cd076d757e47b0713b236f6f141ba0112c9312b3ec853aabafdf1eb2cbb517d2d7352725f557214d27d9a340af0128fc960a4ea64c933b0d8dd226b6e024471aaac8a7074b2a8695ab990fabba5bf315d246fbfe4260f1fffe54814e33b6235c5b4095437298858909bcbd40a8a286d1bedb06b7b1775bce0a5bca19b0a5c2fa8dbf87b55ae0a43c5086422e5bacb94047e150451f5996420b0d4a697f59decb49900b2b9c13aade536933e14d672c21a35cb68572c3de02f3147414eff4b8674b91f7aebf35f056a8d388f67f8ef7cfaf6b28fe745831ef41def1839791647016932c70685752851327f1837d2f1e9d8f93443eefed2317119c8152ca451a5d3aeb253fb484283f52e5db9f61f059ae66017a860ee0571d254483501b00699208c7fa5571cf58b9715c954115bc2db0af28361938bb95ced7370c8cbb6141ef62fdbf369dfc4eccd98ab9886d79a52cbf91a27dd0f4b29940492e860fb94654dea54fad6290570760e3b59a0cf28053732472dc313b5fedfc583fc702a880971dc61286370aaf167810455cce7654dc4325a41d9d1944abcdc4d81378f1e96a8f94cd95b886a01f086e379601504219d57d531ba34e1ba0905785fb629c61f6b940a652cdee9dbef12b7fcde087b92816db3386a5769049ba00788e31de4ddbb8b56de1fbe3a5e671728effda7cfd0b650cf5df2faf22470812efbbb548e47cbf36c64e05a7877820f08948ceedb35e12a4a143ee0101a7bf0a00a4062b50c39020669700adf739a6f75352a45fd1373d3e85c3867170373f0c7a794d8590f4c22ae62d438ec365b0f6a15cb2ffe0fc6f57185e1760761bd4370027c01dfad0502f00b6898115df3c533e4c881cf5843a975a97f92a7833527887c79fa8eec82b9526a15c6c5f2972083ce8aec735810580ffa4ea2cef4823aee044dd70927f7c07bba18b930006aa86ae7399ac6b4c24bc9d6a6ab0c5b428d7255d4d983eadf97e10c1b00867da29ac981acb453073a37236e7ae808e7759b2e0cffc3ec43afb1e95cd090a7d4b9225a0e3cbebfe49b93846ab603891e2da7d85a04bf42d12d16a97c965bc4911d3ba7a9ca505794d8744fef00a436089de67aa8b480070230dfb002eb91edaff428d4908a87afae418dff7ca59aefe1ad8f6935f309fe7985c2310881659c60a66a5e50242497ba1cd5d2bd79496ccd0500fd901afc6622829cb3701caa50f96e09e3b23bfa3181b74ec7dae2e42c9caab43e49ae1d922a1a1eb3682de026323d9215fcec42c54401a1af81450830a4b784ed1c7922734bf3632409147680dd3fabcef296353705bb5c0e650e12905a05db1e7923923a96ddc783fc1ed46e2010416c37d9d149ad73e808bd6e4464f62893024a8501803b6c88fc55c8bbc1da7cbf580b5a81fb7c61455ae3a8aaec303fba12e0f2b51ed5e8bd31db40e8bdbd00e7b1ddd364766c974d813d86fc88a27bf82bba60c62e5f0f6af6bda3390f8e72a2811baf3d6325e70d9a3b59cab1abe95290ecb87985567e1243504c038de9d4d100ea64eec45208cd8d2474e646f7d81eed6d59b8b0859552b6fc088d874cde3e75ee30243dc9d88ed5b577851a5bd9e2a453287025777fcac19ac33e1c94b4ad272f1055b16b842a6bd6168fb45f1f74ed2467020df5431068a5f2cbeaa6ac1841308c7c9f752aa06927f91fdf18ef9d9e942367e5ecac0abf4d3b8fc7b80238c0e7faf2ea7d3f5271028fc558a44799bde63168becc67c5531e843336fb16ab618d37f95a91937b824bf896b044146bc3a5e264a8f23ddd00729cd9aa56d9a9a24b7ab96ae021b193d8874d43ff4b723d86b7564e550378599c3e0c7a2b3d447ad76eb4cd699733d970a5ab218429a1af81df9c8013d6d16a6bcb019f6ace4461cdaa785d20ea027cfa53d521bb91ad2c04aaa6c0f268b14924803977633280c7b7beb14c88fae542b7a13e96253259e7296e37276da88891c14664340e84ae732edbd71e67047e476735b220ca231de31a380ece372db632eccde1ee5e990ea0aaa95c2df39e2111dd1185d14a194e22d34fda8f54e99d3a73e5a231682c726d40816e048c1d059bf3bb9ee2b5f895365d95aa28f6adbf6e16469926b4d8ee7f04c7dbafaa444df5b88596c17874f0efe35e5ada1a69634f4b430f852d33b032f823c5deb54f47a7a4adb1adf56d5440b7a917580004c13e0b36c8e0a203a2be3f8fffd9efef3af19389a12c67859d4381ac0a02da18e25931b41216b731de25e1245482c84d45de1cddbce2109322a3428bff692012573fe9efd02109dbf35c5d3a287dec105cf3f1a2e5f0b1cc08c7b4759766d25d0f7b42c3ea8bf8101e61159a2ba7602e9c7947cf936ac39bf59b24084709fd61d704bbdba7d282aac778b7ec1dcaf984527c8112d56e75ab774d1598d9816abc77b0e693880beca5f330c626774ab5cb6967fb0ea8e14efce120947092c3b6f8a22f07cad22e971418092481fcad36ecf0cfd6bc3864115b8507c13554584f1f6fee5ee07eb6a091638d8e7781c1c006166e0f987f9f4de535e9f3df1db8c9328e9a19a73c76059ab4edfe9eda7f16cc6b869229bafb179d194e20ccc6f9338183b673de8138ddab9a0907278f6eaacc55bf59a450ebc10e0b88c82d9f0deca86ff771f46509250fde94e0c94256b77616d099862ddc9b341838d634a9dc4b55a88fcc6248901135f6aa76365433e7e534e0e5ae8eec2a63df62c3e244a40481189ff54122698c7e2da2c829b2eec9efc9894ee05be04ae6dd48406eaace17827e38bf38b414059aded0343e0711a8d864ff41a8d9ed40fb2aa1a3f4014f691cd0e8af62445a021820ff03afa8a192ee255862f306851df1de96ce36cafb6a60b7069db7aa96fd1ffb2fb01e6247f770304dffe4b1c8d0eeb336dd6806d6ab5d418953b1cae7cbbf53766b61e4aad5cfce8255b78af26f9bd11283a9c7d12cd63b82cd2b506fd4061d1e16fc7c713d80763c3b0aa0faadcd9b7d676101aad80e1ca00369297e1f714003ab8d0b545c335014a522a25a767950963ef821425b79b521076166d0df3ef358c7d60d99cc85463c186e8faf16af79785680382e4cc93f6594f8c4461e0988c08717640df24a5f357db22432fcae21702dc792d201212fb3791e0164bb3d433a8268ec96df73766fdba42965e00e619246cba5d96eb853a7c22c34d2fe5e5d3f3ccf9c627d069517b743cd07f6f7b444074bb9a50269f2e03309c58930e56a9583eb00c37fbcdd391972261f41756c10c8899fcd036e2017e088ef9e6ec31f795d55b3bba214c53c98fc9318e4ade0e7e6fd259aa277fed54c27e5210787a5f6937f56fdbe1da5113f059061ca590ddf536a55cb91ac6ed41cb9c0418b115b29f5e823c1b0ee7c2b3982087763545b34e2c945d587ebce69bbe299a7f52b674f351977370fc700474bc15d7e6ef98c14258ecf401a4f3bba1a9aa76c5ab0b8819fe6efe3fba1899909e5e48554299150ee272451b56142d12ae2bb4942db430239701d494917f2c939a6fb9d98d4751a6f2c4537ec870342d223343a9bd7b8d8c99aff8cbfa298395551185f35dec120228073a1e496a58b59d9ac5986249a7c6db9398395cbf341c08ee910700e2daa042dba1846fef59c72ce872bba2046a14fcf9a47a5686d62bfba76309a9865c26e5fa41dd872fc749fdc57953105ace4978f9eb788c8d061c853ad0313e51e732c5d7bc05e752443c8e99b8e81c688befdb5b14c3cc2f96eb8ce8290303e483992fcbece1ff278d0dc036ad437b6cbc695c7741ba4556e242146d40843c73deaf8fceba40e4a4acd739b3031848b17a210a1ff0dc1908b77c4bb94543af52e1fe2a090c8f217428d02336303f7952c3ddefa7c81850676e7f4cc3d32c3937281fa5ab279c3fe39f92ba077dadb8c2c3df17cc511bd33c41cb161d24aea154f0f5902c94b56fe072d321a983668bd9f4838878e66ec44cb233d7d0ca908a794c844ff8b3ba4c57f6c5fc2f3a54db448b013f0c4998bbc6ed0409b3368391cb28c6df4a909fff90f308ff38c758ff7d8a2920bc221236d89b3b76de44e8ce649b32f5135a0217ba9036a8edddee97d7ba15f2c21fb7d3cae3eb6ef09dd03eed650489c83b5ba5dd9daf7a86cf0544fb8a58e46b860e3e42e10cd6f1c4f81179eb2c3ba611793a32abb4c0768db90e8bdd1694efaa9c2b45c89d203fdfb8b926b6a0d666d91b93065a83107000000961f2308056241b66f427c0f0aabc75852c90f0624cf036d537032ca8d73325d2ae2a79a7292c240c34584bb881fe5d468a051cbc0bde061f9eddfb758cd2dfba296eef549e5c4ede097111216a0ec60f90e8d6f5dd843c82e15f505f8c74e854ba9cd386249d552978eb8135a5f8c79c3ceb8dd5828b0218ffe40f375d6cf3ff2f47c276c8169ab98336582a852c1535018fb2306aca6b8c9f9e38d64c66a722762b76c69d4ca6c14bd6992549e4eec17287fce194467f972d9200c3d1ac4fd4a8f2620e2e4281d28c099946ed90789ba122705326390d3e058ceed24044e542efb36416272eadf6304f30efa0b7bc1ae5be92fe50e591ee6f725726e917ec113506920beb2aa53b39f1d76b31500", "cfb220c7d481332f3f1f8079dfe27e23185fd67a407358db7892789f96b7fa9b14daa48617a10d8a91b820ecbaa470ec0bb1f3cbce7f70ec70b19a4cad082229c2788f8611d7dc306d9a45761a97828c36ed87ebde5d4a3e1609c1422a8ae2f7cca428ebdb0dd38b90b9598a353b18a600bf35a369e6e3e5abb0a1c5c0c0e48e014e7ef1b7d768b3c5657f1adfbb7ff2985082b16c99eb83ec3660990dcf1106efa6b7f8a4798fec811c2c85faec0235c83b7093b3d02367421abc40a554e0b0d7fc1bcaece4222c594f8d20e368fe625ca433c75486fe5c94103cd17291349ee12b877602936688666f82ecd8f4f83d50bb1650e08b96cd25ad147c4c956c98649806a3736d072c8d97c6e3a46a7c18535df8d828b86662400d8e9cc861fa1dd5dc193892d3168396c499e07b279fb76c7e289f2fd955691363bc1de74536dc571817615c88b0d594a136966c129e424ccb7ef1c7c7461eac7ca5f03d72ea4c9c3d1156ee4cb1bb70e097357588b5c49f6716bbae1bd118104b42786f09a3b9f7cb80f383cadfd0c462096ff2bb637b7cf79764b6a4b7ffc5d87c1f063fb48e7f08ad5af534c70079f12f28e8921abbd4280801cdf6101ea494768b1274afd0eea5939843d56022a83590920fe446d52dfe699c33977d5592dbf7e0e236b8175d7faae06e0c50f7402174023ce4b996564e945c416fa823f2f9c3213ac50b20bd1fd55bb8d9fe70ee31ea2f404ae0fcbf857bebcc9196c8c622059fea2e248e4058905b69fb98be312d3193ea1d8ff653173e8c2371371b77a5bea45b3cd6fba19b6336f94ec04c8f86d24e9ca959874577d7ca0baf3c4ff30b554bc3ccc06df46d925373fbf7863e2cf684d3bc9603ab72b851ca4728294de87f2dec6f23ca9e43ed2e5cbba662d13137fc1ce0f6ae6a0b974f72f4b750825fafb67715e425f40c7da83b92d4249a0a4e96b789cceb7b07f38cb83f72dd093a345ab3cb8ae760fc14e40ea182a0d7fe1facc62a1ab0902349fd7e27bb0cd349fb5053f4734823abf020739b4b43bb11f5d69b61295068df31177959903c2ea1bb82d24eeaa93d0d4738d5d15b2a401e7ebe0d3cfbd45b2db2882cdb41408aaa718f8320fbb7f9da4f68d0eebeef175442e807e9908132731fe5e268582dcf6dffa4251ebb7121db8e412089fa9d8af9919799547a26b6b8eb44c28f1ce5f9a3021fe30841be204c1b4b3813dccae6baeef9b53fe413cbec46bb0cd95d3793cdc9bfe6cdd96ce0c4aa4a25e1cbbeeee6c9fa558b279048c7e31d07b125bac68d4e1f4253bd4dc7824cf3d722c94cf2b8f61bc8155731f072fd447082b181a13ffb8c08a1d568298c5de2d969fae2bea070a9e2688f294e76b8c200dfb993ec19778eb56ae3127c1116ccc85ef8806fdcb9ee0cb66ff03fbb0fa6c52b9b101b3830fc1650efa859163a264b4059092e5dc9a415ec09bfd1460f142fe5ef00beb6aa9032bd0de97aefc6f65e8cfeea761b3d8174caf528b6627682ff4d4450cb0f34251fc000ed01dd538ef13260984f44703b89dfb511bfb538d0b1c8aded964e1bcc5ca57437468b14a31ec0000a17e4d24369c40500449c37e7dccedba3eceb59d827dace246b5c48afb6a5988e64c560b3dc76c32d831f51cdbc5cfc4364ac8b25372b87c92bacfedc6bc8feb44098dbebc89cda03c59e4c58a31372bd574704b9e788834b9f83c6703f6709efad97c4ce499ea580dae1de282a019247cb3dce5c1906322e6d3ca5157ea6428bc42416936fac194efe136089c07faf7adf1e923003f1dc63fcbc634b389a4f351a6acee785e23c6bb04ca2f265be1e634362b87c6f9fd369bbe62a1db6b286c7ffde6370bb4d6e9e27c3ec451e1a99d134726c9075e71319d3a683e91e4b900061c0e6d086481069cd32f4cde7816f8e3a0ac6428a7488f31f06ee0da10df3ed0c150d29085879d064f914407f60018bb588735663647bfeda930407d69abef3f72fd461c2b85b00988b412a180fd267fc646a86d297e7e40912607157b6fa873df6442579b1523d8117f0c06c87adf75843b8bff30a5bfb4fe1e9846b7fdd58774641baf9cc9c4e38e53ed24a9d9e9dbc7657aa9b220a8545852b0409f5c0812e953823e841967bf55059acc7a4600818134359e72cfae0d04a0738ac8acca133d6395a455b22cdd6f901d4cdea1cf17415f7d7895a4b65f80d2f7c5c60a0dc04b40c9ae5ffc922e074a82afd704673e1766d19db9f60eab0238fb4a3169a08aded607847e5d752d4e24c4914b95bac3892bcfc2076f16a7f07583f0d418b9dec03afdb2e93335a392e1b1ef2910eb2a4b6a63fe61641f3c02bef73cd7e4a77a6f30ae821598c3160511603541bea89022b54f321c2a55cdeeb19335d78a821ab6ca0f36588a9a79a41e2123905a491d658c2a1caeee998c995bb0f816c92c5dc2b862183f80b9f9786c9c5524723c944d11f6894c7f008ab8194f577e22c03631d2a33205f508ea49653e7600639242dbaba704f700ac227f32dc575c559a0a1f4fe0cf6c22fbf7e1ca2ab4b1e4724e8379021e3c9a7c1509c6a413bd7d9c98938e440762eda2546d636597defa86c1ad31126a1182d365f858927d140fb0a97f80adcc5f4ed5efe11ac503453917a263f1d64692348d30f382e85e464ef7616067a42df5de1a1b622fabefe2ca4ceffa4801f7a02fdef40644cd1d079590d900727628d54b44db7ac700d8d664f7eea12837fcf347360d8e43a354fe51b4c49e8fcda3c322b738ed2b800b5cc06e22c72af2a67ee7bc8ae894e841f2cf2b0a7e381caf944bf4e91ded63b6f82f7474e4f81e986fff7e5339b8e9f60103a1af81833e120f0c88893ecabac044a4a2867cda4fdcb084459a00507aa9e5a8e761a72df3322a1ae8cd918b4994c23bdb1e459b4f21651bd7fa067a00e2a2877bf6b29f289ed8018e0a78f6fb4ded9749640e0e37f6381b320ab72da404f3d70d60152f6fa6738932387b83250cb3148141edb52f109bfd4bda8054959db01f4c550609a63c08cf01ecd110cfc6f0055638c0dde039d2ac2daafe59e561f9f08a8830c3f661e4325de63e98f4a4216ec3b83fd200201ed3f647147611424286ffc6c4a8aca64a6874743242d4feeaa9153de06e51c512d9cab7ae712c6424069f3e5db4ddebe9b48b5f6caa741162edf97674d2368e03a387f798951a4b9b9fa9e3a5838a343133158364a9fe3bb4b9a3c464c0c54a4c64ca774ad200925ac6bf59508c10a8574afde9b821741af43ec64cedc13aa220b39772195283506dfe899dd6a7b37eb21f154056a2df3564ef2bb918a928651de88c3613b84e7960bddd7b46b1304deb30f57b6fe5a3b4788629e91bcc2456a72fabb16b47da71624d2e9081de748b3387f52da4bb094782326dcfde0827e2d674e41bb375247d749cade9c704e5431785009b0e53f1b45c70b237c9432e07e4c7a8464ed11608a3d2184338dd9e6f6ef4b3d751e979667b6a3953c89aff4eead7a978071a912b3de21a85a5849c57933cf53cd74a610f3e60f699766fbc7e0bb8a891a429c77bb6f3b6f9f8eb0b1bd9588ef2ce98fdf0a0838e4b0bed807d8b673093c717feec8d697e32542274887d039db7a2daed5d52c8e9767443229f8003c5d67e907376ea2f393484fa70deee159cb56f8d097b8fe2736e95f540137e20725f0940a8d049068ead4c46bb3771a671bb00de88931e03445a55868de0c220db05cbda9f996d5fe7c1070efe5e718fed4d4cb4ecacad3d6b643bc0ffe9a71b720ba7b5adbbdefe29106ef6a6ffe4547f5d02bec312147df0abe80efb2d5e598fc7c8b268e58b59e0d75728e9a18126f013c963ddc92d251405f857fe3a5cbacf443be7772975b7bf4f6d7ed6f80dfcc47a88c6d19120942adb5385be6ef3c0d7e396bcac5affc8f9276d6cd1a0b069aed72a98cde8ea7aabe6cc091b19efcfaf9368dfeb3087a05a42e3b893dae5ffeb72e6ac06e995a2a75ea0b5f7876247bb4c38cf3f0153f1f7473b522f1c440b632270e2b1d654d3a5ae16cb788482760d34ca79c8951b29c628e21029715683a3e6f8f77c5d89ecdae37e0190f79c4c1dbc9d0160e359cd6c94d6662ed53bb01a83374ff593c823acc59241b11f020902069fc0054a9b26cb320bef4fb1f8cc5bd8ae76eb029afab731b9876bc4e8708a8315512823cff1f9375d284ce66e53d4efad6c76d17bb532fc938b8f80c13ce86b5ba3e540164bc5a5d47cd321c241d8740f453ef95bd3878d578561ad6ce20877ffbd44062dce8df1d048d8d5e4045be647886108cbb1f0b26a8b74b66858afedb830a161bb02bde4c46a688a0ea3a7018ce24666aab0f422ede2f78ea29f77e28d87c744cba0285ce33d0d9ac45774829699de6d725a9b6db6e7d03ad4ec9d075c386e68ca0bcd9e9911d741ed0168cbddb87a7918a964d206629da4e887277b0ef7d3f9c7082f3f15f29a0dfb39f3b0877a5ec3ac4343e0d808f5aee8f1869923aab6dfc3016821c013109f34aece6183994b853d0e9561375c02cdd26b1b55194757341929a8038864cedd6b5a3b8b51ade44637044c4ebddb190f173969a0ca4cf5d42153763a0b91da0110ae7a25204850927d81b00176d4568a3d444d8029bd010df784e3f673fe855601ec4f1b26b2df58841e6a65f0db66373f63cc14a8b07dfc52ac9957eb542d05ed687c79519609de96df18b63cb294b534ddf7d2e8f41bcc1e5a006191c4db057b6709f0a96f18e7e8f67b8be2a19c015b9c4b0b3f42e4de366b71f8da8888809473c3c7a02a1158e375f29997a43bc7118ca4d1abb8f8f21972fc589aaa3d73a4d40a1e1705e169ac6e56cff50d89fc45b6863c8fc67bb2b5939a7f33072539ba4c24077be5711ba368bf7efd4897931531d388eb5c2e56bef337777150dd59518652145c9594e110e41d2615196c6b197916c88cc2814e13a3a922b4ecb044bf31cc90e0bfe0ce07de29188bbcb0ec1a12b509f52582fbb948c3cbe0c6964f46991cec0704bfac08aec6ad8ddfc36dc68c7f547c5ee6af4a8d55c79e3dc1c49b045379811f81e9a185a92cd37ae4ee32c5d3c82d36d6202a6c84fd231fe467071d42072827fd77afa5d757e6f37247f783ef09bdfd7536b666e84bc4bb878005b7829293a04ba090272dec844f4ef0e934617c08518bdc6b915ac6f3f03e4a6ab88e21c3f21f93b31d95ea3b9228e0031cb69795de5abd19c4cb4a0cf2984e53ca391cc66e33ee0d510151670331fa264753704fea5e4b1760f74890c49a74a47e0da13155c5470013d53dea0f05b5e088f1511c209f5be940232318af2757951d399e32eb862d915784713baa8ba93645caf04ba78fa3cf600ff92b9c5be58ad87438a340bac00a5ea9fb17e39478ba61fe36335e48d8c5a0b25f024cbd2ec7f217d0f260951da396dc13a2a74cd90df4b52db686e3b34d27cfa4cebd7bf59cbcfaf4007dc943a1da6e0bd1799a21ab449d7bb42935e50c839c5b567c59742436af15bc8d46095520dcd9273ae2b6f3c1cc2b4311ac9e5d297f0940b1552c5955adb302022022bb7457978998b56328629b7725dfbe3dedb37f37af0697a4471d1d6ff6bec633a38540adeba903f3eaaec5785fbb3c6a598f49dbd9ff93c67dea1ef39a614331b119fa8efccc8bac01595fb95a2a57eec9fc6c6fe82782aa89ea971866fd9a3bca4010182092ab6d1e2b49b964be9e3bb13bd6b77850e435f55bdd46e5bcb3330c7edefd31c33f61275e516"}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000156000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="65660fc736b9230200000f320fc5b0040040000f0f10970fe8fa6466baf80cb82cf59b88ef66bafc0cb000eec4e21d4501c744240000000000c74424021c320000c744240600000000c4e17de69222ad2eec0fc76e04b8200fae8266bafc0c66ba004066ef66b8296c", 0x69}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b70400000000000085000000c300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) syz_usb_connect$uac1(0x1, 0x8d, &(0x7f0000002c80)=ANY=[@ANYBLOB="12010003000000086b1d010140000102030109027b0003010000070904000000010100000a2401ff7f070201020c240206050202060400fb03082404060729d73b082408047f000abd0904010000010200000904010101010200000905010900049f0d0e0100000000000000040200000102000009040201010102000009058209200004d30907250100080a00"], &(0x7f0000003080)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) r9 = socket$inet_udplite(0x2, 0x2, 0x88) sendmmsg$inet(r9, &(0x7f0000002bc0)=[{{&(0x7f0000001200)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10, 0x0}}, {{&(0x7f00000013c0)={0x2, 0x4e22, @multicast2}, 0x10, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0300"/14], 0x18}}], 0x2, 0x4000000) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000500)={r10}, 0xc) fsopen(&(0x7f0000000000)='cgroup\x00', 0x1) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) open(&(0x7f00000001c0)='./file1\x00', 0x14927e, 0x20) openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) 29.819172243s ago: executing program 2 (id=1557): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=ANY=[], 0xfc}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) r0 = socket$pppoe(0x18, 0x1, 0x0) futex(&(0x7f0000000000)=0xfff2, 0xc, 0x1, 0x0, 0x0, 0x1) connect$pppoe(r0, &(0x7f0000000040)={0x18, 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, 'ip_vti0\x00'}}, 0x1e) sendmmsg(r0, &(0x7f0000002340)=[{{0x0, 0x0, 0x0}}], 0x3e8, 0x0) r1 = socket$nl_generic(0x11, 0x3, 0x10) r2 = socket(0x2, 0x2, 0x1) bind$unix(r2, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4e22}, 0x6e) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@link_local, @random="a538ae464632", @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x7, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, {0x12, 0x0, 0x0, @multicast1}}}}}, 0x0) sendmsg(r1, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) 28.866709669s ago: executing program 2 (id=1558): openat$sysctl(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/mm/ksm/run\x00', 0x1, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'batadv_slave_1\x00', 0x0}) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000000), 0xfffffecc) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@bloom_filter={0x1e, 0x8040008, 0x4, 0x400, 0x0, 0x1, 0x4, '\x00', r1, r2, 0x3, 0x3, 0x5, 0xe}, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) socket$inet6_sctp(0xa, 0x1, 0x84) r3 = syz_create_resource$binfmt(0x0) openat$binfmt(0xffffffffffffff9c, r3, 0x42, 0x1ff) r4 = inotify_init() inotify_add_watch(r4, &(0x7f0000000200)='.\x00', 0x449) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x80000000005, 0x100000001000087}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x14, &(0x7f0000000040)=0x6) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) openat$dir(0xffffffffffffff9c, 0x0, 0xc0, 0x61) mount(&(0x7f0000000500)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000040)='udf\x00', 0x8007, 0x0) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1008, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) ioctl$INOTIFY_IOC_SETNEXTWD(r4, 0x40044900, 0x200) r7 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r7, 0x89f1, &(0x7f0000000440)={'ip_vti0\x00', 0x0}) 27.38572494s ago: executing program 2 (id=1564): gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @thr={&(0x7f0000000080)="b25b21a05f58035fc4c2bba01b0f28e57fe43ff1f95a1548dd31066ac346757fdec4e63e5d1883e6f5fc404601928e67b8a082e6372c9d65fd77576c5c1429d8eb57cb28d0aaebc97df02f63a0f492f77b92716b6865b8ec22d6796ab88aa557252f07800be4a75c5b43c1454534b55a47d06e2ad4df06793d69197b6782c45e9656b243555990b7d1427b5d4598499ab7eba74b9ee917f2a4b71ae67e8e5b54f77688e3c92054433f", &(0x7f0000000140)="1fa303d6dfee26f5d7b74c6e546c65c5cb7220b0b78cc3a285fb223c9d12572999919f156e330dd61f62a10a46a7498a9fa6b6f7503015a37e9a223a6b5e724ca7ba9d18fcbbcfff4465d08cc5b0bb7fa010c714b86451941ffec64dd61c66c9ebe96f24c15b305b639bdb7df7b93b50f0271a03958e05caec7122764a3edea656fa6bc177cda19a744b0e6aa84e1b4bd43e410bd635c07f0d0e877a9681873a4529c2561740156bfc7d1bedbc4f4ad2fc8d2ea39590a92f043e97ec6c0e0469bbdf465e580918ae52020b2b0f52201876d5f702ec2747b7"}}, &(0x7f0000000400)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000540)=0x4) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x24, r2, 0x1, 0x70bd23, 0x0, {}, [@NLBL_CIPSOV4_A_DOI={0x8, 0x1, 0x3}, @NLBL_CIPSOV4_A_MTYPE={0x8, 0x2, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x48804}, 0x4000000) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) read$FUSE(0xffffffffffffffff, &(0x7f0000000880)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) prlimit64(r3, 0x1, &(0x7f0000000000)={0x8, 0xd87f}, &(0x7f0000000040)) rseq(&(0x7f0000000400)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) socket(0x2, 0x3, 0xff) syz_emit_ethernet(0x6a, &(0x7f00000002c0)={@local, @empty, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x1, 0xb, 0x5c, 0x66, 0x0, 0x5, 0x1, 0x0, @remote, @remote}, @redirect={0x5, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, {0x10, 0x4, 0x0, 0x24, 0x6, 0x65, 0x4c0, 0x31, 0xff, 0x9, @dev={0xac, 0x14, 0x14, 0x3e}, @dev={0xac, 0x14, 0x14, 0x1d}, {[@timestamp_prespec={0x44, 0x2c, 0x12, 0x3, 0x4, [{@private=0xa010101, 0x1}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@rand_addr=0x64010100, 0x9}, {@remote, 0x12000000}, {@dev={0xac, 0x14, 0x14, 0x1a}, 0x5}]}]}}}}}}}, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000200)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x2042, 0x0) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) mlock(&(0x7f0000ffc000/0x2000)=nil, 0x2000) r6 = userfaultfd(0x1) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000240)={0xaa, 0x50}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000180)={{&(0x7f0000ffc000/0x3000)=nil, 0x3000}, 0x3}) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r7 = accept(r4, 0x0, 0x0) sendmmsg$alg(r7, &(0x7f0000000740)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000001c0)="564004c6852da7a299e4c397614090d1a6e12edf1767f157", 0x33a77c20f21f5ff8}], 0x1, &(0x7f0000000480)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x0) recvmsg(r7, &(0x7f000000b680)={0x0, 0xfffffe58, &(0x7f000000b600)=[{&(0x7f000000b4c0)=""/5, 0x4}, {&(0x7f000000b500)=""/153, 0xfb7b}], 0x2}, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) 26.271045344s ago: executing program 2 (id=1570): r0 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r0, &(0x7f0000000940)=ANY=[@ANYBLOB="340200007d01000005f300000000040000000000000004000000000000000000001000000000000000000000000000fe00001f00046e6f6465767b6376666f7825ffffff8102000000000031ffcebc920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500003b595fcb14034354b9fd9ef196a51cd5157adc8105b494e11200cfc2001000000000000000000000f313f6005700f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabbf20f9c1cbe36f4fd1a4cc280e8d489da649a37000e472c016f6465762d6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f937e52e043a0959cfae09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f399f061f75b7797ce1fe11ea919609d51a41dd3de304bd7c7ed0a456f0ae12516105c9ce887df5a6e0b6a77d596cf88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff00000000000000000000000000000000001f52345f47e59efaeb104d"], 0x234) 26.124352674s ago: executing program 2 (id=1571): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r1, 0x0, 0x8}, 0x18) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') writev(r7, &(0x7f0000000440)=[{&(0x7f0000000280)='2', 0x1}, {&(0x7f0000000a00)="eb0206", 0x3}], 0x2) sendto$packet(0xffffffffffffffff, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r6}, 0x14) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r5, 0x29, 0x37, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) epoll_create1(0x80000) 11.627195611s ago: executing program 3 (id=1609): r0 = socket$xdp(0x2c, 0x3, 0x0) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) r2 = dup(r1) write$UHID_INPUT(r2, &(0x7f0000000080)={0xc, {"a2e3ad21ed0d52f91b5d520987f70e06d038e7ff7fc6e5539b3247298b089b0708356d090890e0878f0e1ac6e7049b3350959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b31070d074b0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db871953330271c4aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd55acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r0, 0x0) r3 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) preadv(r3, &(0x7f00000019c0)=[{&(0x7f0000002fc0)=""/140, 0x8c}], 0x1, 0x80000001, 0x100) ioctl$IOCTL_GET_NCIDEV_IDX(r3, 0x0, &(0x7f00000000c0)=0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r6) r7 = syz_open_procfs(0x0, &(0x7f0000000200)='net/ipv6_route\x00') pread64(r7, &(0x7f000001a240)=""/102400, 0x19000, 0x100008) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r8, 0xfffffffc) syz_usb_connect$cdc_ecm(0x4, 0x70, &(0x7f00000010c0)={{0x12, 0x1, 0x110, 0x2, 0x0, 0x0, 0x0, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5e, 0x1, 0x1, 0x65, 0x40, 0x5, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x98, {{0xa, 0x24, 0x6, 0x0, 0x0, "6e1b8b48bb"}, {0x5, 0x24, 0x0, 0x4}, {0xd, 0x24, 0xf, 0x1, 0x2, 0x7ff, 0x7fff, 0x52}, [@mbim_extended={0x8, 0x24, 0x1c, 0x0, 0x8, 0x5f6d}, @country_functional={0xa, 0x24, 0x7, 0x6a, 0x31eb, [0x9, 0x3]}, @country_functional={0xc, 0x24, 0x7, 0x1, 0x8, [0xccd, 0x6, 0x1]}]}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x80, 0x74, 0xa0}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x1, 0x7, 0xf9}}}}}]}}]}}, &(0x7f0000001300)={0xa, &(0x7f0000001140)={0xa, 0x6, 0x0, 0x9, 0x0, 0xc0, 0x40, 0x7f}, 0x2c, &(0x7f0000001180)={0x5, 0xf, 0x2c, 0x2, [@ptm_cap={0x3}, @ssp_cap={0x24, 0x10, 0xa, 0x5, 0x6, 0xc, 0x11f00, 0x4, [0x3f00, 0xc0, 0x0, 0xffc180, 0xff3f60, 0xc0]}]}, 0x2, [{0xcf, &(0x7f00000011c0)=ANY=[@ANYBLOB="cf03b59898e972b8a91a12b0977469f024222d2f1448d2c57e416d75b685f14badc1256bffb73a1e246034ff9513a02b937db001920f476702b770407ef08b1d6cc71ebc4ff89ba2242f43b3df2e67aee7a6c0c58caf30553a015408a0247842a58e1890600ddf52ca0d88423f52dc228d04380924d2b72fe5892b0b02995dd381f9228e3c0d1531a00a0acf19081ebe2af49938ba59c6d2371824020be0bd0db88e7101ef34940bcaabc4e46d43fda31453335974cf6b21d94bfc72b59b33277ddcaf656377cb1663d44fb4883999"]}, {0x34, &(0x7f00000012c0)=@string={0x34, 0x3, "41c26636f2f9cf6c702cacc9a00f6b3103c016f0a0a3cf28a8be588912b52cfafdec30a4cce9806f21be047d27d593229ad8"}}]}) r9 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r9, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r10, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)={0x30, r11, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x6}]}]}, 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r12, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x28, r13, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1a}]}]}, 0x28}}, 0x0) r14 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r15 = syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r14) sendmsg$NFC_CMD_DEV_UP(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r15, @ANYBLOB="010028bd7000070000000200000008000100", @ANYRES32=r4], 0x1c}, 0x1, 0x0, 0x0, 0x40089}, 0x8004) 11.229215628s ago: executing program 4 (id=1612): prlimit64(0xffffffffffffffff, 0xe, &(0x7f0000000340)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x1c1601, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000080)=0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) getsockopt$sock_buf(r2, 0x1, 0x1c, &(0x7f0000000540)=""/102, &(0x7f00000006c0)=0x66) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) getsockopt$inet_sctp_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, &(0x7f0000000280)={0x0, 0xff00}, &(0x7f00000002c0)=0x8) ptrace(0x10, r3) ptrace$poke(0x4, r3, &(0x7f0000001040), 0x282d) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x8002) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89ff, &(0x7f0000001440)={'bridge0\x00', 0x0}) r5 = open(&(0x7f0000000240)='./bus\x00', 0x262d42, 0x54) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000012c0)=ANY=[], 0x1c}}, 0x890) lseek(r5, 0x0, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001008c000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) 10.157881282s ago: executing program 32 (id=1571): r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r1, 0x0, 0x8}, 0x18) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000400)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet6(0xa, 0x3, 0x6) socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) r7 = syz_open_procfs(0x0, &(0x7f0000000000)='coredump_filter\x00') writev(r7, &(0x7f0000000440)=[{&(0x7f0000000280)='2', 0x1}, {&(0x7f0000000a00)="eb0206", 0x3}], 0x2) sendto$packet(0xffffffffffffffff, &(0x7f0000000180)="0b0312002e0064000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r6}, 0x14) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r5, 0x29, 0x37, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) write$dsp(r0, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) epoll_create1(0x80000) 7.795439591s ago: executing program 4 (id=1615): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2382, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000280), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0xc0189436, &(0x7f0000000140)) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000001c0)={0x2, 0x8000}, 0x4) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000400000004"]) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000002240)) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010102, @local}, {{0x4001, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x1, 0x0, 0x0, {[@md5sig={0x13, 0x12, "473ecfd2106a00000000000000000001"}]}}}}}}}, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000280)) r8 = fsopen(&(0x7f0000000040)='f2fs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000800)=ANY=[@ANYBLOB="b400000018000100000000000000000002000000fc000009000000000600150002000000900016808c00088088000180840003008fd498249133df36da6ee26a0cb5e066cc93ceb97a0a6b2de0bd82ffa9cbedc9120835e49ed02221ad4f0227c6a5891da800000000000039e355a0a184e3cb8256125a995964771b66f17cf2284697e095dbc322d0df13e673132e2542a4f9b34c29123004ea8acc955eacde969eb114a60300"/180], 0xb4}}, 0xa890) 6.559069016s ago: executing program 3 (id=1617): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'erspan0\x00'}) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000140)={0x2, 0x4, 0x759c2e06, 0x80080, 0xffffffffffffffff}) close_range(r0, r1, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000), 0x4) syz_open_dev$usbfs(&(0x7f0000000040), 0x20000007d, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r2, 0x8b23, &(0x7f0000000040)) 6.34060365s ago: executing program 3 (id=1619): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0a000000040000000600000023"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000c80)={0x0, 0x0, &(0x7f0000000b00), &(0x7f0000000300), 0x55, r0}, 0x38) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000007c0)={0x11, 0x15, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x20}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r2, 0x0, 0x2000}, 0x10) 6.251479414s ago: executing program 1 (id=1620): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r0 = syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x1, @pix={0x0, 0x0, 0x20493859, 0x0, 0x0, 0x0, 0x5, 0xfeedcafe, 0x3, 0x7, 0x2}}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000002000)=""/102400, 0x19000) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r2, 0x400448e7, 0x0) r3 = socket(0x2a, 0x2, 0x0) select(0x40, &(0x7f0000000400)={0x9, 0x3, 0x80000000, 0x0, 0x7, 0x7, 0x100000}, 0x0, 0x0, &(0x7f0000000100)={0x0, 0xea60}) close(0x3) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x302, 0x0) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f00000020c0), 0x400, &(0x7f00000002c0)=ANY=[@ANYRES64=r4, @ANYRESHEX=r2, @ANYRES32=r2]) syz_fuse_handle_req(r5, &(0x7f00000022c0)="de98ee653502c564abeb97fc678bde22efebcf99c2d89952950acc703a3c6268a54c8b1bd1ee165c82980cd315b55a070dc41deeb2d4c1842d936a0bcde5fd7ed6031fdd9cb58ebfe8261528f097f309813b5722c24a1af8e6bc6ddaef7e85d2659690154bc5e6ee73c3fe7176509ad7b30e1098fc9873db91d3c1816825e710374de8d40693578b598922d9c523cfff93a630f121251d17ad40bce021d7fd57945fe2a186618a40b5f3995a9f0ceaa3e22b57e4f68e53fffeb5474fb83afaf5cde6b0aaf5cf0313ede442ddf1df6c280921e43d80dddfd005969272e1719b37fd8f749fcde83f8201826b4cf5b1c1da394568aa7d8833dd11309f46422b0152ede5ab29b17bc1ae80147346155b20a98d6fc2650bec3fe73327c45cad1b38f7c983cd070556a8f8ed5d58e1052f6436fad905099d18fb3e62c2c36a1c2209a94c820e30e5234e77be3beb4cd183015d281e7bf39cdcf0f1e541211c75d64a49b55ba4c2c444bef36d98df66bea814bab91ed65386d6a491a6295c24dbaf752a5e7a856e0dfe46a6f9e718ca3919c6f8978b0fd65c9e389114e5afd8e9e2a575b854463b63f46d08795f0f1d0d48d6d610fd74e9238de32ee3fa2ffef550336341803c083ac1d749be6c5440bbe4bd3bc3015bcde2b4e2160ba266d281a9641f74d9348fb6fa8550d1e8a8362999452e40b75c412cfa77ab8e1aaf1a9e83c855ec9b7ada38690f0d2e59f67a1f3babbcda8011595ea720816c24726b833beaca0a9d11e7b99373601d27d18c9e29940503d3a121e7712eb853df19f2b4b886e08d61629288ff16c2597d7fae5bfc8b41f92fc325ffe0f61683b1f661409bdd7c3d88a854f8393484f4669b5d9654fd3a0819a32110b9064539a7419c332629b3fc71da35b783ef7c693842ce83733a63f2e6af37989cfcb768ab8cea5d21b82a0e9f6fdcec26b0107708867dec54c4e739fe9b931b3c6da013bfa54f28e672511938a0ad9d681d7feebc65a2f5f588abd66261393f3ba02d7b2cf650a9f7c6a4ca55b4d41132908dc9c90e26f0da8e2259e3a2b63b2d9e27754e278827ab80438070698c690ec375a9aeb4193079a28a2a062961ba0e65af01644af063f3ebefda92c4986379f7b099b2fd3960929578736f09887fc5816cb1b982e5b121b79662d1674dd0c6e82627cf8c63e576e5c1eb0af9415ddc10ff880e8ae3ce8c4fb87b8f9d364974c2a1d8eba4e04bc2bc018bfabc435683b2551c0e4908570b930c4fd7c03ddb95e9ec1d1994e3df0305fdac4e5b914641ae25b0c469b194c0bb78ab04887cdc4262da465aeca34ef8a7b04dd55a43f39996529a23804e054655c5ba8661f7c02737e7539650364928d62b9b8d80988232009acb54214f06640e9bc6614c0ce02e4a22dc8b91a0aad711e4fd01d7020b7c7185e41e27ce266b9f5aec682cbd4bba3240d6277b17b564937254f37afe580cba0b78c6b0cc81830eaf10d7cc1f7e918d49e935629fe6c24b4368a04af1b99f6981340ee031874f3d4b3a9ebc31719b3b775bfe1fdfa0460a3820bff6f61b49b11ac2ca00836a0c4a74aed92a619f34231196669b942e761538e64f965d23d4f7814256e876263fe5307985c4e6eb69c974f66276764e80ab1de3f5c55e7b2cfdb78dd183a85473e968918ad73f29a266c818b9bf9f62eed86df25b2577bb6d98e3996e94f5bdf119b869541a94eb3536c979c3d77cc0df7c0c48a902ca2f03f5ba5a8ef9431cf95f6fc89744e8440e1d5ebb837e30ef7541fbc27672c31566ac3676a173cb9e466a2d206ba1ebc2b985eddcd6ff937375fbc8415eba46f5ec68cfa9f3a669d41b078867dd9f5160ba45fa4719f32cf877d4b7a6d77c977533659f7c7ac22c68f5e93c1df6c2a3d45b55a4afd3355680aed864f6bbe13da2da28a4851f73c88e555f3bb1c34a21fc45ab6c28287902e8b5fcae6899c804f364cd878a8d1734462bb075cb7bc709cc2c5d7747c4c29a2fa9259752301c26b852b7993adf889d45dbe39094c9b7b168756e5b939ed10bb6df57b8f5e14352cfc7d8b03cda5b978b06cf2430af5db17177b1ef664bc4b00307f970c4fc606a6bab72125f62b0f59655c35b104da7af188a953cfc09b3aa0785abf330830fefedcc8bf9a11d5dc4b5642f679d45cb44fe61ab1d906345c1c345f6b8027bae9585580c20115d2504d9c83ab54ea2557b6d2dd3bc65fa29f091aa46a215e77621836154104e6969fa9107139a19f2e45cc6bf55422a0e1a6d037ad9e63df5f9cd2045e13ac2d6a15bc12008c4cd23782df7d41bfecc0037292d22c7b42f2cc1a22db7502332d9f4fa85f7640c8635b9469681adb6bcec2dfdf6926f1815156d80a835ae918527f549ea6df45f350f618dc1f3ca139759be28e35013034f8bbfd3fa1a8f302594213c18015305911f42e287f2d86f17d76f8a0ea03fb574c60c808669f9f4454fc2eaf0e93873f688e34bd3341f6874d5d8fe754172a751d6ab23dc1642220e7fb1071df0ee3c7e07c338915494a3b360bdc0b38ed221c2c2bc86b29744448b255802b3ddfe600c1d0f9acabb2185e4e9dae5e456d5825f516c857f63e72e4a5f3d45eaf11a0e3a5ad0ba30a0bf0f94cc99586fd202d6118bb6f9c272f6cbe39dd9b8b36ea7fa51dfe0bb87a633be11c16a14d1bce8492387696e195fa3c5f172690b4434aa2e91ce7d225d73b1983d2605ec725aae0ae402cd2f79fc202a307f1896f3dfcf8c0fd8b841dcfeda5d65bb7d76f7c2d2eb1b164c0368e9984f320a224d7d438bc5c699acbc18a587b7589e960af114afbc9f59243646557962fc2e0cb5b5bf160a312f1c7f1a9c9ca88d08e9f19415808aa312ae9c9e8bcd5a47fc721eda59d10670088714984a71d5c0df8b68e675a8e31ec15a92ff6a04d17e0ef849c782b302d11f742efe6486ab904fd65c0aac4ec25c6d877b453dce80e894de703aa8b1e5d00701850f149fe437fd0944cb95e54a924a49bd86bb9a602cf2904fbd9e399f1cdcd0b45b6d8f872e285f9dfeaa26aa760074651393c6451b36c643dd0b7236ec7803d69cec1b09bf1b63fbb68ad7c01507f00083b184ff01a62096f386f4c8fdc85e93eecf3f4b384aec1c10ccc60d8109a6d887bd389c3406163f9600879f0e944443d783e8644f69344f6f44f7bbf1883cda7369c9b9904d991c01552135f158a0bbb7f40c354f292c034824d82c209ebc770f5b756768ae51d45f8875b59904a07090689e65b40625566eed5d209130db812f287b966ae21ba46a3a7a3a0360a4e284d8d91ba9ed9806ea063827c8dda0fa98f758cbfa523ac645421f444a40b95bb065a64256c19354b1ad5002bb7b2add9b5236ad64e9052734b9d263515683db121b5e4dc1eab244dd8fc0fc62d962834ba0b21aad872b127afc0a33c7869a3f213519aa2ef51bab9ab28ed18859fd8239841a6668fc614dedd099121ae6c220a143c119cb9bff9068f65d0554b4c12105e59a22e91203a08ab8c718ec62c42d7ebb7b495e9e1be8fb7e4aab2777025da37b48d9d7b97578841a73898a6eab994e250106e096390c77b0600537be881ab7d81e3cb468bf1fe318b1e804d8df9875e9b8da22e6244997317391cce608085a28b8d070d654a29afab324ba3eecf427b6dfd43501ec0db919f71a932897eb37fe3bd64ab5a34ec60011696298b74ddd7a3710d3e444cedcc5cdc357f9dd58e67dc0ed3fc8df6dad82b3c00b4290c3280c28f78df052ec9cdd9df025abe8834616eddd5bb93379c69092911cd60761e7d14b426a83e335bfc8bf67a14e01df7cefb6023f0c6556534b975ed889de0d96d968526372402ce3d21a2c5c64a449dc3ba4ee0b5ceabc2fa29679e225681c8e946dc94b48af024bb1633e1860c7d8c14500967f24e2f8f46db537232a4e9f4abf8408f53bb52b035bdb89917a6f2f4bd22403ad002c2d936b785ecd965177e9f6235787a185d0eca92532f1aab16756ae86ece13925ba4a1fd08125102ae08c428d073aa426c4e792b5a4acf618605df1707021ce1eed62da4ee87334e34edf43338a0076b8ec739e2c31071e10c6a853e19fbf25b8a356527a67c8f7696dc184e374f4641f4e5b0aa345f1e6c4bfeba3a392d9a994bc271717a051c98d6c5b1f3296caf4c01d80ffb75b6fbdd0a0583f9d4695a44a2878df0c09a85aaab14522320cc3d2611603a34e52da03677a60cc87cc3c68997506b5366c82e040b6643b8865d8bea0c84cef9ff85245a8b4bc41af1a50775b29fe55e42ac4b29fe80ddaf02e8c9bd07cab823f3d9021ac88236525ec045688a2fc9c6df66f549b10720cebf09ead919524f071cd128fb7575c84190c698b420f89b3c11195b5d83022d1f7e48afc21203995caf8f9286dcd5bd51b65c1af1caadf5a1b3f12579066855ff851075adb959dc3e086a7fb4e9a27fe80e8f3c0959b042486310ae7b785b0612e0385e36f50d4cae3474dd000c3957955534b4907b9480e2e5d83dedbeb76cb78d893c5b64dd51e31abc8e8b4c56b96f67c4b6e43861d91681af3270aae1a8f50712bd97326ee46a2640285b2902f051071d5a3400e99b76459956ac6908688c314bd8e54365383a65b186a6386cc5218e41e0b386759de81bccf5aa68f8608831a9d33ad1af2bdbd8579c5921cd8c3dd2f3bf1f123c742e118c76e2f43618bb7885e44826b7417c9ca5a139d774c16fbf74c8969c038ba6a54f27bab46ecc94d6455188d8dc1edf1da715c8d9976226877096df4158eeecced2248c7b88de0dd11a076db1f06bae4adba8286dc39aa62a55233886e011622ae1cf97238914a55078a78908145295777dbbc4e0d34364e0f3daa9eba6fa54c085777b18c0523818ff8710dee4bfeb3db549c3f38dde73b99a7b1b219282407a4e0ab3794089e21f6f2045ab6254ac3703903edb302fb2f0f97e47cca7969ad6b5b6cf27314137a04d5f4f29c193c9cbd514a7b4d6b23f724a5d7bfa6ffe8e3d9de29b8661139f179a0fafecf234f19bee75c25faffc765e02377d83e0ad0a0029c08f5c71595bc1b2fe88f0fe958f3f1f8ba6821ab834cab9bc902b2d47bd4b5ed52b5b0d7b3bc999b2f68879be39ddcb0428ce3a617b68c11459b746651f413d9e9a098cd2b5c0fcfd0ea1db2cde1672818d7bc73b053015692f9e9259a0153e3c9ac5e73e3343dd350cfbcaa57be93cc881a35063aec2db4ed71df2b1bd90b5ecbd84f399d4530c5450d622188423e151cec49673dc633e501c497d53843f4824750dc09abae9f2f465e92888715b6879f5edbab7bcd58f0899e1430ffb5f3063450945cb0fb3b5c3088ed6966c54dddae3aab489a80341b45a17cac02ae62749f209a7e16ecdfd86b43569c7b34511c65474acf2b2c18834e158e20957bf2320e4a6b9d63caea93b3a7dd4f7ba54443aba1ac2b6f2b27e1bf6f17d3fd1582462e0debc7069bb70e219654cbb99adfed54ab94329382163f2ab6710bb581d189cb3449a02c917c1f2d1d5f51958ce605fdb0e37ae5f3cb3f123276d43b2c26ea948dee863e0b679ecddf0fe41ce78bbca30167c9c7d6b0e9193c98090facd7205a490727e12c49bb4d639348a32546007459c61c27bf8df87dd2ed3f3228b8193422a72d15f848bac13c6ffa7b8a767cf04866feb7c7a81267d7a8e890128d4709e4873223578aa7febdd562403c6092c0a3f6e0650772ede935ab6ef95e375bcbfa395e23ef1d73532388b845a95f158dc845a123f798176c73e177926d39abd38a910d40653006375110be2f2c5f6efc87b31908be36dd07c8ba5853519a37dfc4dea981af855293f49a3270bb67cdc17b780fbf2a418fcec8953dae927909a6bbbdce230d23113efad9c02474682dafc63311050cb4f3f86c282ff29728eefac5c678360122b4ce221bcec82d24e053b63972d2e9a631a180b48bb8d2d4de7254d91a856071df51a1d87ca7eb5d19ac3def1fdd6ebd8f57c2c9e43cb6ff2fa00d27f279368f5ee29a84ba219a51d1f0f1965781164edbb3aa6209fbce6d40284fbb4a33f59bf9e1248100a623de16613eebc11f510b7718dde9f13b4c9b2b6a10dd932696cdb7fa4b5733b0377453471462762457d42038ebf8c0fb392ca7656ad1f050c326de75fffc698c48f5d809ae360ddb9856b9a54b811073233294bf91e46414441b6665f432201da12e49718b0d7929b6cbcbf310a09ce0d22f07ee5cfa8ffb9f03acd224641171ffafdf50f18be8fa3c907226cc1a6f3b16a776781a6396dbf09f689ad6bba4d537dad490a6f036a45ee3e224e6f519e44b7352ee3e7d3f0d89f8c7c8f54b6d2698c0298a07866c9d9ca09c96c2ac8efd7974294df6dd1bb0598debadb6135e7123bbfddf84870de54476a291586fc0e64784e65fdf78d462e8b51cbac38e7ff1878b11418f188220e3deb5367a2d90ad7d44395f6965cc6d680c59daac268c16814d1085302d0453b48e4a8ae78f8a5b6951a875ef42776f6d11955da7e5734a72b61cefcc6889b8f8d58db51ee78d7b1a8ffebd90e15a64654054767aaec24dd3b5f338b572496c8731049c10622b7f54fdfa43aaea316946291fee7bc9e64640e8bccf33fd1e8693b67020b49cf77faaaa8269e2fecc4e2b43c8c3378a4a9b9b85a4fe2c346c5512cda631542e0ff5706eba996f4f72e629b076d6be1966d44b1835ce664e3c6a4f18c68f5e32f900a0a167e547d5aa79c0aede966f83d00366a623ef8107e328654c8558d5e606f69a12b6c2a6fcbe0e08f945c4ad2738ed0b28d79c98514abe0819569c6e4f4751c665fd651aaa9ee392c330560ef6d57c0a97f0764f88433b2bf7641ba391634316b0ee1dac23a63be21270e50ea1ac24ac3b429a0b46c38dbd48c540bfb1e141b8b3df6caa179c7e54f2b7b1371e8eb05a30f13da95200ab70dc58325f6bea0ee9fe1f04154998df393f2b4ff4431363f3a7450fa5210e883d67620ae63cc41f72e74e26a0244de1ac722b6f1c1d293f7483b331a0efda65a4e4e9144547fe6dce2f4535e29048b07079329b63754bb124b9e046a6e97929b1f4a387765bf93804530791c9f649db6efbebebf46fa4f9af7ff2587130d0e70a32d4aab1dfbee6aadd1f3e5317e3d4c8cde75b1479bc3dd16ea35db3dca11cf1eb1d2bbac60b83605e171619d85fd4b6d0e24be8db76df12efef05eb87473b832e59f3039df44ef034e5e7546b399cc817a41b2f020286ff139072a5b909ebb185a3c955cf88f4a9929b2112e0a9ab43da0288ce3ea268ccc9f46f852d387f5d0a2831dfc8cb0bf593905ba376c069b8c9b70558ec826c5bf9835031199c4c6d84c913da7e9e7db49c1d34511d917b9ad3c40af0598737d58fd61b8f2adc46b73a284957a99943cf73414412fa5440a5f85b63c20794d122c267fba72bfcd0e2741642fd8ff5a0ae1ffd8b30d852c053d0e31f505ca13a21c0223a8ee77cdd92de1b9f87ebee4ea332e9d4573d7efb2ad3f50c35fb7a596c4edb4b72bf6df5a16ffe3c8a236f2cab8c0712ac26c2cbcc68c1dc45209b579c952c7d645642aeed7d60407ee2dc168179d536da950108e962c5c976d3a05bf5142466ee38939ee94e707a0135f99c99b5d6376f63c711e4f64950f08dbc931c812f34735d9eb1c5997770d8159068cdca2e0f192311ca438d613728b544d6a3e50ae0e4e6b1eb611ce55a96bb2f991d49173073d8547f5ede69d8b587a34bb8f637297a15ab4fc45f1384bbd19b3feab5fb81322ba831386eeb6067e55af374c1b1eb9613a6c41dfe2bbbcfad157dd042c67c44400b350f0dc40a8611f2e947f32ea3ac3f609027b5dbc95b157c13216fe7c35edcc82950bd4e38bcb02b63d2576489c331a222e013e73b5333694889b184bedbbb6fdd6fd40a62b1d5d494e68cd2aefc264f74bf70ef38373e599faaa326f574ae32b1aad86854af22db8c9673d14666aa7c0c3bbe0d76a835ba4b391552777ed20c5c6cd0aa84f3be73ca0a3c128914107fb8fc02220317fb111cf13398480cd3325582a7e55f4c4ef5a258bcd01a97615e95f89c8064d41d04340b88cd5f4b1d827a030637145d98422facadbbbce97dc3060402a7bfa73d7b4dde53184a0923c0ee29c6e8e2c35e396808df2481af6aab053b619fcb2833f14f87051c5461567c5f8dd40383a7521971775493f896e18c78bad8219f88258ea686652780c03ebafb63ecbfcb23e24d52a2f88a77ed3b2280637807010000000000000076841772471a3b77aa42e8058c0af1ac2be9d88b5152851708f1a77582b3e31702864ee6a244a38f3f95d9797a60cddeb54cf08cc48fc677f03f9e717ebe7f472883e5a6a7df31ca4272228f26991460c537ebc800cb6a0c34a763eb1f57124fbfafd6db4c21bedf6723b252aeb21eb1fd9f4f811fd3e2e764422964761b2ef3aaaf986a48f7be66f6387578f9492feebc97dfbc6bc97380394a5635dbe582e52a1fb18ea8fc4e53974c63d198cf0d878ba8a8d58688a037c0f753c7073337ef3da4c134ef939c98c8806d09943591e6013a1342de7c722f993fd7eb36ba8e8407d1ea60eb5724b0d6262c70469dbd8ea1956b8d7f5a77707a9cbe2137079e7abda3966c5bee4fd86e8a3c4969bc88ff328a2adc8f4546f647575866d5ced16df06bf40d9a5f178f9d19e490bd76e187c441e7de0e571f6cea5512ec000048903d91a519dc82defe34a06b0244d623090b5a250786bbc66c1e76db6b18d81ed33c81a7c93782d5cdbe0a7cf7d1ab29c04be6ff4a9bbc10f716a67d52fd52d91425abd2002cf83c3797861db5fbeaec745a552ca4a50604340f2cf2c1b10e9ba76c8ea43b283c73f774f8be213f17f70cf93b9f6a8bab1f516a935e80c3cc6756945edafd572e6e00840eedf61fc40351869f03562d8c13006de585a1141c02f1311fbc8e45e4b3878c32810698e4764a6e8495f165eefee35714a1794f9ab50897c5565ab745425933d9d6272a172c1f2a274f9ca7bc8e1b01a27b8bd06fd9dc61880789696348c99e9a70c9dd2a62ca04d1f86dc87380b618c2a78b16229d614702fce242fa17ea90cda2648f9375bf7e78b4267d558983e08a9566d95871998d23cc6d22c23370ae067b677609844abc140df81cbd9addbf657fffaab5c22c479acca18f3e4b508cf01ff7b2ca308ff116389790f26f2c7635f89c747a5bc66f61de575653069349a89fd7e3dd785266b7bccf16eb8b4a8a86751de60d33e17d64f6e4e0f9d13a16d243ad7364114db7ad011f094c4debf20a39e35e7eeb440bbe8811db2857b965edd1e2675ceb1bc9a1691f123dedb341962fbbe539485d2241b0409adce2587d035187a0dd5a62076ac4eb5c3e2f4455569b6eac0fc16155da1774cbe505dc92e2087585a7846bae699bef32e3c5ec2356dd4433ed29d4b03ff7b38f7b3cb96b92874eefda6c2e0e326214e40f14cc2ef80e1cd3fe226257a423b8ff5bb368b87ac7066c5136487775b5b122a858334c37f6a3f53d758c3c866e2e79daf9aeab36a59eddbae2fa5b6d20973014196ef0a4cde1373c7297833e6f1e46828f4a42eebd829dd4f17999abe285218ed5dc6007b21bceb588a213b29dbb1ab1a79b41a12df26fe35f0cf6a310c9e50cf10d71ad5960626e4efec211032ec4ae52512001362ba4108d86eb774d2d4d0364cbb1dae68f03a774e328c2dc09899ee80c05ac2a8e3ba905b0b3b7a08a3df20b505901123e7dc0a15db48d09c84189ca4345c23c2010c12cc35287fad30211cab9631e148a7c1e8bfab61ced30e098d1c3cf7b6a7fbd8288dfdc48044d0d47c17f129f6b5d751af1984d395ab1b08ccca3e7309a89a8a36dfc3fb82d2a4269bffc32571438d04a7b98137b46ae1fea1bd9ea64f99e2f0c5f12ed84886b10bbd511993b0447036c4e57b9dae6d5bdad6aa3f2d12e62471194e43111613b8b6944c2baf1f539ea14dd76c356bfef7e3d4b6fb91f6d321a796a4bce5a4c6a5caaf0f3eccd914dea21ae909be7ba486075ff6139e7e351fdd7e98013ba51ff0248852398c734f245ffd7fde8cacfa4805496ad7350b1c96d7bf9da9be492f2f414e973937ac9109b6e8b8315aa9b81840f2c21239caf85a28f0e590bb6ad12148e75bd4d7ea69a9ffb053781db98d5fb5aca30a734017be7683a559c203c006ecd4b135afe3650b906e0aa208c889f2af09f3f8263260c3bd07cf8021124b6f0e0d021f9839e47996905c3d7562df810484552de3bcc9ae054b62a01af6a7991e4d63f30c7a92d8b58e01052e53818e64d7540a3208af321709a5d891ceecae5d27a999b00ed01616a73ec8854ca61973ed1fd3d82f8628b215c55eb7908e297d77098a7b0c362709005a7d13c89c54556589b2a926c6e08cc1c22febc7eeb5d7ae4ef0507c91b8e706e6dbf83d898819192c812554ad1c6377871a8ca50f1325630f7b5266b807ef61d0c8d399fada49cb02a14c16d39f4fa7b81272573808e761c9dce7cfd12f4f18dd06b0ee471c166e095bf84aa4aaa2d82f1afcf09e5d960257c0a8dc404225b4b62187829c59e57da50bf848d72fabfb69362c117c6843541f84095a2a4ccdd2d30860cd96640bb2315e435a4af08c62c584ad129300adb02a871f3c548b96c4f6c47efdf4a1163a8a5ba9b4766b01437bc5957324660a8cd87df0f7e000d1309e896e3ce9f57b17562c9368a95a4cf66b3a5b57f0cca563b045452bbc8ad07b96fd0322728ccb3b05bfda14e811a67f2d62ed970db5723d6e4e4913c98c81ed6c03469112c23549f7e20be6401c6544db9078f34e6a4ad3cc868bace2e7ec6ea17225986f9e941ec67d9a3fc57958f9df8a60f585aa38b1769e26ed3f68dd85685b2cefae9dd72a18abc0de6b94689785df377ef4a812a6abc7f738a396f0e99ccbc5731801c36e746ab6b1dda88ca6ecb899528e18543cb3dfd439cd5be566594f01a4533da3638e6331fedf5b67870938ad044aa0dfdae33e3a6258ad40baadd726eacb1f3c1eb8d83ef4e185d7603a4f1eb006d90bf5849e2f65d37ffe750eb061bbad08a0c0cfabb9abf7f27d36ee5687d23feaa923e09d2ae905410a9193f21ed9b1d6331bb1f3babb90da2f2e023a6ceda4b4fe0f5d864738ee7f65a0b136021fbe076b4adf2d3af760e1361bad7ae35cb7ca010ddf4488255a2d3c492d0b26a1a5643f998b5d04a52a59f176d9bda85c916ff901329f09fe953b030b92f6415172476ad89d3e8cdcb4eda7dde5d4fcd5d6a584a312563558e784b0f9bcea7c53d26c3f2d3350c70a5e06a67c4c0373dd6279e29c320e6580fba6777df3039c289235c066af1b07dd112f25b25e292020f36c1aba246cba4e054d64b38f53ed57a712dffad7d3dc97f86af511638a2779107fc55da63b6498ea5f3ae36883163e5bf2324211a61a9889278f828e58daae797fdba9218d322da7aa23db7a48a000000000000000000000000000000000000000000000000000900", 0x2000, &(0x7f0000007a80)={&(0x7f0000006400)={0x50, 0x0, 0x1ff, {0x7, 0x29, 0xfffffffe, 0xdb0078e66880d4ef, 0xdcf, 0x4005, 0xb, 0x800, 0x0, 0x0, 0x2, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(r5, &(0x7f00000042c0)="0d9ec529eb18ec94a35378619cb10ff8c913f67139447b7ee0cca809e36c363ba1d3975a7446b70c6bdd99e2cff540eda7589ea89efeb498df568916036f0848ede5f089bf502b483c67c0432c34b98b1bc085a99e2981103397e0b0eed2ec64c1075798b56a42ea532091f5326c97622a47c53fbf42e71c3ed4b954c559424b49a13598c6c63ef65b62384b038b3e6e98ebecd178289831eaecd986a01c751e8cca7a57c009f2b5310fe9dd8a63b91c4b5b13d1c44d2b874b32ae3e961b9e96a511ffaa3ed20248dfb470460d305e44ffcd287b355380319fd31f7538c6d00de06ddb8f72b3a59c4699c94d7379e1e190c6dd7786e12096f9e963a038b6b4375535047135ecc07b16035ceeb27ed09d77f52b6eae27a03071e060b05bf347b9ba44a984e5db346d230ae9c5324ecfd4e7725bc5019a9f4d20237c820359d73b82f9c668ae71f6b85d5350140a16f988bb2b8010effb52636e0b728be1b1ed37c1b8868ec67edd52951dbf65b479aa25e92667a98c755d88995e6303a48a64317bd4b201fc6dea59381abfb5e0fb1035bbd32a97a6324b08f404fe3991879a0c6362032864031737941d9cc534697da61a43c8723ecd1062906b65c504d86383cdf9631f228372b13aee64f8ea8db00dffc37fa092ab5daeb7431dab37091c44f91c9202df60876a6e06ceee3e6a095406fe5cc1f83de1a4adf36fbef5a94a622132cc85e56fb53a9cff67bc69a24d8c259ccfe19b1925061f0cad95d6b4158c1394b8acfa9a8f52a566c6cb4e0b14dd30c85b309289a5f395e01d981735f6fce6ab30994643d70b2f322b7a233a339e621ea2eb00a0082a175c231b330a58062680546c28db8ff5b7e66c0e3df0a9b74ab72abfd241fcbe1e3d27a2d1eab44cf88180dcef4482c866324133f9e4780b891a7c5000b005cab0c131c225e944fd1aab5de9e8d17b8770b4472b6e4a13b6cce90ba152e5144acf74cd8a9821ce3eae72dc7ddc81b76482226098329c3a8ecb923822610aa0b086f44329522dd8f9ae355b4666d1a1b911ef8e21377578b42fe6ee0b2a77917157488d6e0bb388951f80551dcaebf212b396d1f922aec595bd340390d310f6006c4b3efdd80838f39d25470db39d6205ba8f52bac634f8145a3c10ed007acc2f25c5dbfe911f18f44a0c57cee33725eb8c5f2d9112f91787c2c323b67b67d9d1f593d26430d77189d4678fd8d7c11c1f2d744ad59a03a8cffc52ee0293c90b00d61897c80184aa63fcf43c109b06af20c808035af0a0bf9cbe544681768f92a2ebe3b4458dd020fb0550822bc2f769631e00d63bd91e7100299bbc4ce53a35e993e24028dc5c81d46f5377d21f2f38a9688ed981044346b865161b68f3390a50c2e625052396cdb6637e9434904c63d8ca45aa2325626293cdd9cd0179b1d995be10281fa8d281db16320f520e42af268ff30dc2d8885aa3d9e7f294eadb4d827d195cd5d18632928f2153261345c231efd143288b881638b61dc5dab8114c1948d83b8ac4e278f131ec3eef4e87e43a36f4b41a699a741ef3a7cd4f0bc5dbd2dffb1d223a5c5b38b98e49092631a176d15c4f3c077d639726a3482bf2fdc73c2bdb09208aaf90bc64b5fee89d231bb1679de3e5d31662db2c5824ce9941f94500e5a11b8fe79da548efed8cc44e9bc1d5175dd77fc16f8219a83b83ccca2181bf411b0945312598817e08e5277530eccffff17d198613cc8c991349141ced56e79031ab6cb98f3f39e5f20bac76017083041a1ee99ca257d0e0cf95e59617139afb08cf0c6a607d3f2ac2b5d3f4394a4a063c9769bb884ec522d46138228c7e9b5c7ea5e3a6c70815b565ce15a13fd0a5deb28e710c15fe25c744b430b4f6482532fb96566381c56e12632cab5acb5e08d6f973003c96a7d81ff76966e0f93c83c462bfcef230939e48c4983bfed78f68b0f540d1fff2196cbd1f1c1a1c310ec10f5a2745407000bc6db1fcc8540282cc7e96cf5582c4eaf874a2fe6369534176429b7505eb0aade883260806be2d86a42e76b315a76e5f686ca669f49e1f9054a77b8eaff14a43e9a9801244e8e94ff50a17b60dee0122ea70819bae3375070466c7f202c4ea0fc0c9aaae50c43cb65febea224c2b554e937f67689b3e18ed543749a7ef0997a7a7530b918c4ef935137137e1ee7e6a8919fb76a8f008ddcc2d8b2e18f3eb90f7a13cf4f49170ccf50c75de82e92a5e2d1f311e59071ff202b6cae4d6243fc3787cb9fbd401938cc18dcf5620f8b8f74e9e3b13dcde85ef896f31f5a2458118addae77206ab1506882f91873b4828950a7b91ddae74888155a9c486c7c60492813ac0e33362dc4e21e00538e5b05b78271d82486a0d156d4a5a07085bb1cd74f5d63763f18648a489352b5d05107909fe54b5d332cde2900c82c150b11071e028eeb275cc9a9614f1eda4e4830b128870e732d473100c24152aff2aa1659daa65d7e9591ebfcae5dca4e84c9a0965a01668e59843ef4a093d9b01067a0ae9d09e3d810c2cb63600ee05b10fc8685e8cb150e2d6d75baecfb8762f7a7d131417eb0721e19e1d21f5adcc1e09489f06b81d91b48608107fc7b3853e214a3c786a9812113ccbcf09907506d0e9cd72c79793584b4fe06a18a627bd969f628a5936367961f1e7d117d03a8fabc85f5ecdd0ddcfae49aa293893a2e5ae376be11031abc0e05ff250b35926345b52f8d3dc02b7497f7513e759247353db9b8e493120e73981aef4c4d9747621537a089848754c14cda1cad18084274e98ea2bf7400ca846184e0e31a571f9bd770222b1038a4ce60dcf8fe9cca4d60048cc29c37c1345de992e9dc7128ef093c1ce80232a88a3da7ae8bc87120c5b1f405d5186141288998fed9e021cd0ad6b12b51c217849390be3ea00cbd6c755958140bfb9b2a2765ad1f51ac045fdc5c28ee5886b1436015b88bd90d19328f91394110b0d891678e63b63d6cc4d35279f6f616d7692c6fe177a79d80ae8f7e4ad5078d8d7096f3ee664dcdb2f634eba98f4788de1f5e34f32ef09e2f0aee4fdc5bec4bc4aeec5721ac3a2da1bf52da017c3312095403d50dcde39671242b610f11832773796557f71455376a7741ab242a9fc94464180bf224d5e8c79b462e3a816f6c08ab0f5503386d34ddfd808b4b8d5d333548d4b873923c6c297b2fa1abe433ec9264385c50dca40316c37ed85db382e7c853ba331c727043cb3345de9f89b1c804e98205eda3d6b6e042c9c41877d456dcb8f12663e6dc1ba809229536fbcc4c58d01a137eb80af8596dfc7b5fa7a044cd141238aa82e440526e55a28c4ed2f4b26157a0eebb4a77c5ab66fcce2602e1a70aea07e5e7e7e5321d58ad128a5ea6b574730037f24a7300e0ad6fc96bd18e03763bbbf21bd3c388aff1cc5ea13728ba2f8e1eb70148d2603e55bb01cce0763c2020b5627a0ccb35ae3a9b3df380e6d9800d9506219a90971a3b8bde1dae6a43fce2aaecbc026be8f4e9bd749e10c87ed7d78f92014342fa449eef28e7175548e5a8ec4fe7d31fc86737aee63ef40b54485380b6898161676f0d82f76113b12a529fbce4482dd278a90aa416077c677aea623ddb3761bc81527ab7e3d73a3b4c8c3e4352c7c083cee8953ebd972a83caed837587e8d7cf360f28ce6ca71de75c9174e8744ba1098513bb6c7fdc6a3c7c8e5870223d6cc0b18b5d6edea926d5376aeb85488d3712e8f67128f0d3fb2b42f82363a0d4c1c806ff283f6e4ddc10ce4a0803be66a247207d6606c7dd67cd293dada159016d7fd7e88c4df53d09bdd9fd9fa3c732da45fb92bdf6f442eda15edd97bf1928a7699008f0b482240a684ff5efef0cadbf1b4f16888650d59b2bdaeae0d1112a79c5522dd0933ccc16fed7cd0ccabe929f625de8947b3b1532dc04253cca988a1584df2b31492b19410d6f681d614eaa20029592c00c948a98973a9fba86c1397f8859ba543edeb5c0b0db92f65462a1103947d780b539433332d65bd1418bc00c9e815f73e0cc0aca5fcc9f95f707c455013a55a0c4a29093b05b94edc5b5284ec7ccf3ec091002b4229036c174e2927127f40769ece890612bbeb960d9392f442765a2ca8990c52ad7d4441e975a7cf079d139945f2b2a8a34f0e85d76cbc96efbb52cf8b5ae681234e14b6648244d41cfee2d9b189cd831cc2f31ae7e5f11aaaff1629f8c2cf73494ac38e58da7010dd986f8b6134ee0dabfdcb30617d15720cffbec7651f22253aea21696d2ece4fe026543ea2f3473e4c12e65dbb3cbf764ffa0b3a396382b9b7f0c24eaaf3495554b2319b66f3cabf01a8d6cfd1382d94ab71cd11eae2a42e4dc841d4a9732c395688d3377c8ccff7e3f88a3129855a5f41a7de6b6a9ac40a87c288f4821295edfc4f5b8fe5a1fc0162e9820205c809935cc6047e8a835c651be02fb41c21de30ac770d7a7f2108c6a3f1cf2649cac444f028a6ebf4db422cbbdb7fd0cb39109a3130ffae17810bb58f5c557c99670224c2678fa07f1064911e6c665c0d1c26cd2f40f7089789208a48eb339bb8885910e035b4b8c69b1c3ad79270ac6e70b963493a6628b90501822878cdfac866268d914d8af2814612b0198f9e4c6b48e739e414d61f34e2f69ff7cdc4fc7ffe45a64c5faf191ef6c4e31cecebe09a2f6a63d60926ebaa7e925ccea5c93e403c7ec0ee55423ce4893471440006d4c09c141e489dda5577f73b57ecfc764ee5bc1bc88f7866dc6a494e3ee560c956dc12ae51842030251f1cedf2caca15549d0bb4ee3bef03702197350cd7586b5916ef6a0abcb5f30548d22ce5d8c4dbd82030b8d7b5481c51676b7d14d35c20346c74dcc7d96ea0b13f890f755a219993e88739da8246283ebbd82eb1b15956b5ec16ad523768c19ceba9199f97d7bb43b85fa11349ff7fb89a97b463b34c584ae9e2af6c8f20ab528750a22ff6c2297e400065fbd9a4660ec2c658afff6db9b67070352d2aa5e6cfe534eeb5ff271575b828dfd7f537e3627a1a6419ed0c84297fc3d362a52f3860a2eb7ae0a50f06d3c68c4a1463ec331ead7af2dba792332218b04d5b585de1a471d296df6e10316852d50f211e07643f749a1d75410e66e47db40bfcefe4b708d0b2879a50ccbd85939b89fe4b905a6a89a2d5a4e28d18c048e66108a06d8b6a64ec5737b5ae283d914484167c8ac7dde7ec007aad1999854c4d6a0e5f887f99de3662610d5e8d49bac7d41d6fb7d90b4b04939638e2151ba67e75362aded50edfb7d9919b345b5b7df6a909193ce64b20470e3480c68bd764968f4d8a5779ffd9a35e58558272a214ae26a094360b9f2ec97c5e0a7693f4b7509b962cd8537e90ce7be70b54e9531e7295f894b94566df49c50c2265842392dff50e17ed3f7beb9ba4ad0520a73db1d8d3b39759e7fffcbf26517316bc74437fef944fc915ec24affc1a53748cfc883e3ddea9e25063ea8383b06f0d5c9db13a0ff335f52699226b391543060ae5e2c25b585b9efdd5ff9495a4873cac58b5feff5f08717b04e81bfea349accc58fcc6a6505de3aa6ff4985d9c38bb83e8daa663ccb356df3ed52343ed7723687e416816f987c565eae22c7548c1d6b56a5b6819583da0ddf92739f65e604e37b3275a6cb1252d4ef7a515c4b1e9068d714be80066bf0d422f1e4d2ce6f95c9eac081d6e4596a6a8e16a57b732b575b7de16f176ff0e34e84b293d3fd77fa30a7b7cf12a1edd54170e56bf7f2d40620ad56acbc5cc615556300ff9e95ce3dda93c8333f23f0d97a5da12a0fe58f95d6b911f614563d343ac6e4f9fee1d149c94fc75a97ac839b6d8d7b27c5efb870d2bfc6dbe6b688490b23597d83982d7858215c59011042b1957a0b386842621c72f89a9b524008794ffa0c179753ab48d0f73e5ff13624b3b90287edaf6a5367dcfe4094a21ffad3e881b428b77ccac6924d5bde9c781d4189654d8f29885fbde07e6334c6406dd3ece359c6ac7c6147f5c4906e56764e9980a669bfdddd9eb780e7f9988630d1eb098b3e4fd4c795f11441fb6d0ff7cf086eb291b1ec8d90092e1eaf9722ccdcd15408617cdb8c49043bf71a6ea0ee6b7e840344fbcd377b995bfb1faf22754fcb363f6c630501b619bbd87cc13d5df0948a176771d2d69236eb50dd313817d9687967e7d71f854db6bff803f4501d999dfe3da37ccfdf894a7914c4c113fa7a18c3468a52d646a5070614a6f02b7ff21c9f6927f5de55be85ba815f4bb9e29f26a94423c58338947c804e0627d69bc5a6e93fc5fe8cae851700253f2d494622c6127b4d77bf54a1ac27957234628cbe2fea1729ec53be7d90806d510ccddfd76fab1b9bf1207db8b05c3eaa88fa4c0a5db13cec9310f4e02c1d8114705446fd6649df3829aa12786b8d10b4540d8c1f1c8208c4b41998435e3fa1ec5199cb2d3d0c5c04c5e0b3ffd69112252106bb39333ff23b38d167a9b45ad1bdabf434c8695e2676d461b34c5f048e70b67a44d824baa090c8be13a22ef0d0970cc7a94ed4b77bfc3a40427c6c11abd2b415817243f6801d535a3adc9924a1671b645100e822a0c1876a37d9c9e230e3d762f1cfbb89a8b28255ba4cc5b46cb1635cf185578fa068b68bac93991982b48e7faacc09745a7e33bb12de6b25a2342a7e03cff06dde29b4d05de84e56c78fc6d9dcd180438da3136767d5846bfe7168faeac5b9434394bd747126c5c1ecc6621d10817ce9b6540433828a3bb8f6da0cd8f2b54a47cd5473f6bc3dc1234bd115a6890aa678d1bce7840d7a4559cda556740860079e46217c20e45ee59b8b7078d9b70cb6a249eb2e5e4071d044f456fb61649f261689b8d7a532afaf88eb30041242ce491fb7e654a1f06add370e2706f75c2fe1afe8e065804414c660ec4d96f496b1ad87592de8b7d04baa7ab142f580f262c64c57fce8ef933f18904f001809cfdf94eb679c9eced5d125b4f1d0064ca2ccf5eaf61bb7841bd408ae213deeb15d860f7ee7224b9d2dd38ee9f6c3fca6590335715c218db8f8c98e6339a6944817a1ce2e115ae984699861631b9893c143f594d6dde0895a0c7edb9912fe9cd8fd0765227b3963033306d15711387044bc373ac10d7be73cd80f1a79cf1ea0989ea9ae8a0dbbd1227bc33df652792a6bd95f1d21c6497c4c35b9a1eadc0217e322285a2eb832753aae74ef42fc983e58a126b7c23e4b0bac16f0de1eff7d41477bb25052f32cc9cc956ebd209d6b945b1fa9182857e180672a6be7edeb5234830668b1ea749d0a0dd3a244684d4dd76221c3bdf98c2f1eacb7a6dcccafd249b0ba2592c88790de40895799ea4dfb045cc2392dbb623bfe420b24e5a425b84a4b24d787a68bbec9db363ac4e9453df597f0224d8b7b21629e1989e53accbae97e189cf9b59ebf8bb89591fe3fda450af548ffc46eff98b5216e238a9246e2fb95810f8f4d89504633a6d223484a765b9e6e5497159b31c51fa6cc10641bafa81b10c5ab853f3136fa1b4334bcbde99cb4689f077ca3c29c2f1aca2a05762943073d5992aac4d9b0d411ba25905c34fd02b8eb7b9db375a6f6516446cc195eb55eda1e007e26328e9e2642a9c4e90c56440cc60a1db77713860a56820901b3022d55c621e9d54f759dd17fc5b59331c63cf30e07081bf0cdee6cc94ddfe8c6179e7ed86607d4ba7d5f1e97fbc1139b43ae5fd04c1c715f4600f028d0852a421d472b1b48e591b6edfebcd86be3db2caf967b06776096e14f0deffc9bb126ec329c49ada996b963e942d9c404967dc23bdbd0eee951b2879f2ef7ae224d4ff25edac4ddeb2c0b8e579af283e87c625d3fae5286fa855930e45207af7054763937a9247dc38e37e6dee2e325b617280846012e463707b6ccfa2fc399a66e534221a45626cd18c79d46f5c77c2d359e19ea870cd230709b5e33cd52fd43388ef91dea0a1e0df6c72688d9fd32bb67f489a3618604ef1dfa0d7f569d40cc68e39994e4edab4007c988998f59485ce4723c1eeb7c72f7e833418bab47735a91c7ab24e8555d2ccf3a812b6c634c0c3a68271ec8b536aaa442e056945feca6fb4e54d2cf60a0334f494b2bdb6fbd597de0ce9d2cf03333a0c7121e086aa4c657360fbfb60f3ce0fc0d90ff12b03464e8ff0e5e546ff79735c5c800a0f9b680a478c772f60173a760e280d8287681986038444f2103e2894d5809d062cfe8380e34bca86475da3d7634131c2a8cdc98c5927bc137db61f94eaf9a74f87cc85072c201766eae17fbd5b732859fb1b1c980b36e377aa41a95bca18ccea529420e742899af7b968c1fb9c0d181da9f86358dbeea877c3e9123a9289c362fa61d96c707ac94b427318a1e5f21078aa9d1fd7a52704e0d73e527f3ca65b7b459734dd30db5335c450f1dbcc1e4259d657d13b6d6b4adddc3d0eae034d1878cd0aa1825991d75f8e6b5b4c0d6d17e8ce709b19ff794a8ef856abdfac65cd13631f1b66b20f2ebf2f3122d18e03cbfff88206a5998fc3cb2b40634fcecdb8f5bdbfe044dbf169ccd2cd60f7bf033272f38f587943fcc75d2d65d9028c02891c8415706c2b2459b7a3c5cc82b0446088d3b3bcc033ad453136afd4ac4678320fc17288dbfa1c5180ad57508a2a298ed4ebc716ede34fded574d9779be5d56517d4dd40f197312390c488f46914b0927b13901ce70c1684801f2811168fab533998a1fdabbb6e683abfa021f6b80077f19455c34cecf5dbdb2fa6e3930eb5940cb14504050cc74249424310dff81116b8f2076b8ebece84c302e758fa90af5a1888aa8a5a2bff4aeb7ebd1c7a216bdbb84bf9c021caf3c8efbfdc5d3aede46381bcda372a5398c89868ad57287736fec2a7e8ed638974fde5875eafa506a6bd7f772d2b221f4bde4920fe0c56f8e0847e2a7e8387c64ddef4203d77a526c46d7871befe0c5f9128bd67319acd963fc040185aac4e7815f728bbd7ffd8f3d125e63320182f202fa9a52505be9585556a5d1308c118ccdf01978027cbace7ab339d6f53d15e795b7f3fedae4f86c3f257ed80ee634375dc2333ceed1ccaeab1b6be7a9611ff33d79dccdec2007558c06dfc06612d56d37882e5f1de340cf05f4fffbe1a5def6d045bc5bdaf633f07360f9028cedd103bf03fec8beb9fdbf8c5fc684d12efae1859c53e2cc3e2f508a9cd0410ec036648d3760dd591f7ae04e4cdd61a2566319c943f0b63d87e422dfe5c0d1edcb2dc515778a0d7bb2c93ced3b1435adbc51d3fdca9c13679397bc4490093d64869998d6a28bb862ead0fa411585289cc00dc199eac6c607b8a84123dad3be80dd8fd86aa202113131046336352235f34c05f5ea6d5265adda98edbbfd11d6839c5b1bfe4fad4e688558d633d4a281df44d9c0a35abd464e01f8ab01a1e272cc8cd155a40b8aca4c6b1dc894c0fdc02f15a8f67ce94c7f99b6fcc0e4a3a8a71365645ad7809d47bb26f46ed8bd02f6e8f3d277224f82f3d41695f367e343ac6d507413f4bdacf9e344a49156c4de36d68c075415f8004748055b38b8a4110f869fafcc59cdae5663eda72a05be365a50e98bfd4b00e35aef687afae7bd6622cdd725326776f6fb1476c8cf8c20a0e5223e2bea494a1bbe4e79b25a5e48ba34bc66a84ecc4a0aba98e74ca2b1f61893e61a29498d855a778a2a9ce7b7fcaa44b4aedcbd0e28d6c49bdb6776975bf69161f372b964e4288ce6a3b877c3126f90c4c9749d45b8c5c840983b035993e484a945be5fc9d2d1bd3f3de4e6de7bc74a7a07b13e9e82acc11db85454f1d928fe52ad42ca783fd20dd3e94471b498c2736af40d2a45ff74f9ef874639e33306daa8a667674571e2ed93a48f49b57e9e3382fa8090774bc795609ee510b6a1ca48d9833819cbe8ac77eeebb0e3b6c59ced2d1ab355264934ff1914a3f654249bba60a692dd36368b8a866b333320e57e9c7d3646c375696ff14e303780ffd7b957d89ccdf57823d2d1e158773c2075233dd2f331eafe3802da683c293eaa24cd8b63a7582ddb202cd6f8c837c74f823727641c7eb680fe52a396f51adb34956e4cab17b8a5f10edf144c700e376c682dd46c8fc89830fee1a44fafe0a5a2e7581d5d16ad6267d1dc2d5be8547f9352d1591b42de94f2559b44a80038360c6394541a77d95b196558a479b609882fc597b9cbe285ad7c7a41133ed85c8ab6e6dec5bf70f9e787985512d48865022705098a6703b255a6f2b05b62fc7ab32e67f06d785ccb33fb348205a76939e6c2991486c5aae8ec1556b2f8e30ca445a4a495cbf2c601304e62b8cea615e58899fccbbf1fc4f17a6dc37e46b17ada0be033dc67904fbd7903086d3417e423af64338426a84ca0c2a3252db62695f9cdf10ebc09b9da5747d30e7f4adfb374e1d2bb24542b0373b1fb897690b49fe24d8575ec9800f019c9c76459421c11f002989ac82c13c04a202cf7f9f38b053f9a680d4d5012887a11d25cad201df20a4eee6d2c0474055579ac729c7514a88b1675bbf6b773448c6c1a5ccd157f44f7e032a6b848f2e734d773f029e48fd13c90d41666f9bd4e9bea91950737b6e7502f9d2677938f240e3f905d6095bb0f8bbe961b99b2d025538c3888bfff8957e3592ee5b26a75399b59c697f59fcdfbbe3bcffb8777340875611bf75486d2378e68de771800bfffe0572fb36ca855ec5fc8cb90c76455773c36ec40b101fb30c48f8a8e775f5220e024b4da9dddc2fcf4da413e7c5db9e0567cbb5fad0c91d779a0939debd9247d3f7d8107fd986f73a9c9067e6594fabde0b9e887040cfbe7d31332f41259de57b38f33275597725392efea51f290b8e1b5c243ffd9eb4c0231600f9b4b204344736849d527156c4720a463bbe88fbbdc333099d949853d5c6fda98bcd35ad3f1fb1d5a7d00541a8a202c8590e35360bb9d25d6431476649e1898f901fad37975d6dce9833956e7a78d0306f533d4aa3c9676017c7abc7e1f8f2f117774a4f5beba55d1c3cd580fb18defccc349cce24e94a4cf1f4c6f45d783ee0167a55369c9b5e1eb6d0a836f3eb2354fad3cd771a9d777ff84c63120baee86ddc52b3e6817dce339ac9c240e75f3e2f77afbffbc1d54eb5936d045370ce3b77365c5320892dc7bc36e488019461d2e552969de9f25bd8de049d693be450c43c5d22d7569fc384e8d56ddb577c5f3c3471f5ba2998bc0c697a06b6d8ba5f2f7236e78aaed69b468e761a5f07145c0326ebb94f50aaa8c5666c92006d8d139036f981003933f8e2eba106a0e251fa9f5407544e44aedbbb271a3bf1c660a9cb8c74dbd0713aaebba2dd046af8b9428709646521d6bf387a92996b35748e1e67b602309b7da0fb642e89de19f550925f4db082ef7e9821ac4b2aee93c9cf791c086751c4cb4172608a4f903dc40727858046851529205b45786e294c17abf5e5f6bc730cbfb8fd977c5501a8140ac7984a267880b53cb94157be9ac157be1cf12d8a9e5612947772b734ed6ae30e548a3b2faecf94a7e03f86317f52ac797aefb957d2a29de8f8ced414ce22c800e0dc7e49d3672fca633248f3e68c", 0x2000, &(0x7f0000000f80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x78, 0x0, 0x1, {0x3, 0x6, 0x0, {0x5, 0x7, 0x0, 0x80000001, 0x3, 0x8001, 0x3, 0x35741061, 0x10000, 0x8001, 0x9e7, 0xffffffffffffffff, 0x0, 0x40, 0x6}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x48080, 0x60) setxattr$security_capability(&(0x7f0000000000)='./file0\x00', &(0x7f0000000040), &(0x7f0000000080)=@v2={0x2000000, [{0xfffffff3, 0x2}, {0xfffffffa, 0x3}]}, 0x14, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000400)={0x0}}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) accept4$x25(r3, 0x0, &(0x7f0000000480), 0x80800) socket$netlink(0x10, 0x3, 0x0) 5.995163821s ago: executing program 3 (id=1622): mkdir(&(0x7f0000000300)='./bus\x00', 0x36) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=@can_newroute={0x34, 0x18, 0x1, 0x0, 0x0, {}, [@CGW_MOD_AND={0x15, 0x1, {{{}, 0x0, 0x0, 0x0, 0x0, "7d7408e707adb5a5"}, 0x5}}, @CGW_CS_XOR={0x8, 0x5, {0x1, 0x0, 0xfffffffffffffffb}}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) mkdir(&(0x7f0000000580)='./file0\x00', 0x41) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) setresuid(0x0, 0xee00, 0x0) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r1, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) ioctl$SNDCTL_DSP_SYNC(r1, 0x5001, 0x0) io_uring_setup(0x405237, &(0x7f0000000280)={0x0, 0x0, 0x10, 0x0, 0x3}) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000080)=0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x85}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) rseq(&(0x7f0000001780)={0x0, 0x0, 0x0, 0x4}, 0x20, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x104) close_range(r1, 0xffffffffffffffff, 0x0) openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000080), 0x80301, 0x0) capset(&(0x7f0000000500)={0x20080522}, &(0x7f0000000200)={0x200002, 0x200003, 0x801, 0x4, 0x7}) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3, 0x59032, 0xffffffffffffffff, 0x0) userfaultfd(0x801) 5.964725496s ago: executing program 4 (id=1623): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES64, @ANYBLOB="3999b9fcfa4d092b8d698c653d5de01e1228620613b9c4188cbf1198cbfb8c5d5114743e3f8e04ed627eebbd", @ANYBLOB="0000800000000000180034"], 0x38}, 0x1, 0x300}, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fddbdf250b000000180005"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$bt_l2cap(r3, &(0x7f0000000140)={0x1f, 0x0, @fixed, 0x3ff}, 0xe) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000200)={@remote, @empty, 0x0, "e798888beab3af341dbec4427a73b0fbda814c5f5cd6f92215f46e0b091038f9"}, 0x3c) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000054000000060a010400000000000000000100000008000b40000000002c0004802800018007000100637400001c000280080001400000000008000240000000090500037c010000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xa8}}, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x27fd}, 0x8) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r7, 0x11, 0xa, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, 0x0, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="140000001300015b993dde440113e90005"], 0x14}], 0x1}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000002fc0)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x2f, 0x6, 0x40, 0x5, 0x8, @mcast1, @private2, 0x1, 0x10, 0xe1, 0x4}}) r10 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)=@generic={0x0, 0x0, 0x38}, 0x18) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r12}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0x4, &(0x7f0000000900)=ANY=[@ANYRES64, @ANYRES64=r11, @ANYRES32=r4, @ANYRES32, @ANYRES16, @ANYRES64=r10, @ANYRES16=r6, @ANYRESHEX=r11, @ANYRES32=r7], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_smc(0x2b, 0x1, 0x0) 5.928602258s ago: executing program 1 (id=1624): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x1000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x9}, 0x40040) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d0301000000000095000000000000006926000000000000bf67000000000000570600000fff07006706000002000000270600000ee60000bf250000b0ff000073350000000000006507000002001000070700004c0000001f75000000000000bf54000000000000070400004400f9f0ad32010000000000950000000000000005000000000000009500000000000000debfa255e44e4cc39f211fb04d7f202e6a53bd86bde99b679b4e6d24b8125690361eec3b181dcfd7c2fb2d1f8975b579a085bee32d414c1f3ab987a9de6385ae8021f4ca33b9b35fe817e98beb9cefe7f40fd6f0ea3affbdaaa897c70fb01d270a7b00d36fb5ab8fa92ac014a106e3e4decc68652503ca54fcef437d96c8a05d59ddcc8abf09cd77e93e940207b03189c5d4661e43df6f1f036c8d85a2ad7615a021f8cbe507ef94fb9f33315366e9ae080000001b532226b63b460d68808a67529637bf7f6731ad0cf1718bae3c8b9d2f89050cb496fe791381af6fab290900000000000000d640a5fde1f7d5eaa97cd25523fbd77300000000000000d67559b0c848aa3e7091f33e2dfc351e903ce85488fb25691249545bcf877011847df184bae6d3f5d0c016ec7d581d5b2fcb494d8c2df1929398ec5c3675ed16c27fff46a695eed7f50c531a612d5677b5e949ee4f16d10e41074702c4e89ee401ec2ec65f38f64189f1fa2cc0a42add3119025764759de2f093c26fe51d2f7635bb06bdf0b97d4a96cb0813e084232421c6026629fbf4c81954d11e154659b54fcf3468577295c700000000000000000000000000000000fe31e1e02dd54ac3c7af2b3d76a63b79ca6f9a20b26761254aee1352ad08118a58802cc8f107852b8f5382f0871255ce5c0b31e39637850330f520d03ed2aa076efa8401613537585d45bd27454beccdc32645cfe67921df3f2bbf88cacc83f82e916f0ee19ad20cdf5ce3b2ee147f78c1caf8b8024bac9809015b2210d7c2471dfd73f6eb"], &(0x7f0000000100)='GPL\x00'}, 0x48) 5.851383481s ago: executing program 0 (id=1625): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x80401, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000340)={&(0x7f0000000700)=ANY=[@ANYBLOB="59c310ceef0b00013cee33718fa173b72f58e81430038bd2d38be96eb739e6e35d322143f9a04176faebe810956f75efde2e98838497eb5cac7df32ee4e6e392c8cca188afafa9ee7f61e8af7a97ce80b210c532064978bf9cd06688f9710e0596af48c12b687bf33c243e5c9d35355cf9981bc11245445ee1ef56851dcaa9cfbe250285ce1b4336334a06b18a4a690452a7ecc8fe1752a1844b943ad32f7bf04e55e7cdb324416cb9bb5ec1e4200cde0452ed5aabb56e625ceb2bfcd82d605bcbf889035034811a39277b070e385618127c793c00087ba1b44bfa91320a7f838d545453606ada85242500839de0ff94490e01d0c57ac3aff518d47b163c33e4eaf17e3d67507ae9835405bbf5dbaaef5d54797e48e31c0129b48d73eccdd8117515e475e7da5d1f1cd3011e813a6dc1c44f3174e97bdc96134b35fa81a735d6ba67034f7c044c3c8f56a429a3cc7d14ff5f2a59e4cb12a5908213a1ed670170a5e8cb4fe03ef1b57f8b801c8ff00425d3fc6b9976e488d95183d34cba1decab501f06cb899d563e1a092fecd9e5c257cd", @ANYRES16=0x0, @ANYBLOB="000425bd7000fddbdf2514000000080006000600000005000c00000000000800130001000000080016000000010008001000050000000800050001000000080009000800000008000800020000000800110002000000"], 0x5c}, 0x1, 0x0, 0x0, 0x8000}, 0x20000081) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000080)=0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) getsockopt$sock_buf(r2, 0x1, 0x1c, &(0x7f0000000540)=""/102, &(0x7f00000006c0)=0x66) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$poke(0x4, r3, &(0x7f0000001040), 0x282d) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x8002) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89ff, &(0x7f0000001440)={'bridge0\x00', 0x0}) r5 = open(&(0x7f0000000240)='./bus\x00', 0x262d42, 0x54) r6 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r7, &(0x7f00000000c0)={0x0, 0x4c, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYRESHEX=r7, @ANYRES16=r6, @ANYRESOCT=r7], 0x1c}, 0x1, 0x0, 0x0, 0xd1}, 0x0) lseek(r5, 0x0, 0x4) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001700)=ANY=[@ANYBLOB="1800000024000103000000000000000001008c000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) 4.910765829s ago: executing program 1 (id=1626): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000018c0)=ANY=[@ANYBLOB="0a000000d2cf00003d36000002"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100), &(0x7f0000000180), 0x3, r0}, 0x38) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000380)={r0, &(0x7f0000001940), &(0x7f00000002c0)=""/187}, 0x20) r1 = syz_usb_connect(0x0, 0x3c, &(0x7f0000000380)=ANY=[@ANYBLOB="120101000814c910be0632a2f333010203010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) mount(0x0, &(0x7f0000000000)='.\x00', &(0x7f00000000c0)='virtiofs\x00', 0x0, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='fdinfo/3\x00') read$eventfd(r2, &(0x7f0000000100), 0x1becf0939177d4ff) fspick(r2, &(0x7f0000000080)='./file0\x00', 0x0) syz_usb_control_io$printer(r1, 0x0, 0x0) r3 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) timerfd_create(0x2, 0x100000) read(r3, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r4) 4.208198032s ago: executing program 4 (id=1627): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x40000, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0xd}, {0xe, 0x10}}, [@TCA_RATE={0x6}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x11, {0x0, 0x0, 0xfffc, 0x0, 0x0, 0xfff, 0xfffffffd, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000808}, 0x0) (async) fcntl$setsig(r0, 0xa, 0x4) 4.023320792s ago: executing program 0 (id=1628): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'erspan0\x00'}) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000140)={0x2, 0x4, 0x759c2e06, 0x80080, 0xffffffffffffffff}) close_range(r0, r1, 0x2) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000), 0x4) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r2, 0x8b23, &(0x7f0000000040)) 3.941005748s ago: executing program 4 (id=1629): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) timer_create(0x2, 0x0, &(0x7f0000000540)=0x0) timer_settime(r2, 0x1, &(0x7f0000000180)={{}, {0x77359400}}, &(0x7f0000000480)) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$kcm(0x2, 0x3, 0x2) ioctl$TUNGETFILTER(r1, 0x801054db, &(0x7f0000000080)=""/203) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r6, &(0x7f0000000240), 0x0, 0x10123, 0x0) r8 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e20, 0x9c000000, @ipv4={'\x00', '\xff\xff', @remote}, 0x1df}}, 0x80, 0x0, 0x0, &(0x7f0000001240)=[{0x18, 0x110, 0x1, "dc"}], 0x18}, 0x40) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000080)="c11303", 0x3}], 0x1) ioctl$FBIOPUT_VSCREENINFO(0xffffffffffffffff, 0x4601, &(0x7f0000000940)={0x60, 0x21, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, {}, {}, {}, {0x9}, 0x0, 0x1, 0x0, 0xfffffffd}) connect$unix(r3, 0x0, 0x0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) 3.830456424s ago: executing program 0 (id=1630): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r1 = socket$l2tp(0x2, 0x2, 0x73) setsockopt$IPT_SO_SET_ADD_COUNTERS(r1, 0x0, 0x41, &(0x7f0000000140)=ANY=[@ANYBLOB="7261770000a67d65c700000000000000000000000000000000000000000000000300"/88], 0x58) r2 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xc}}}, 0x24}}, 0x0) getsockname$packet(r2, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000500)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000540)=@newqdisc={0x2c, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xe}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=@newtfilter={0x48, 0x2c, 0xd2f, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x5, 0xfff1}, {}, {0x7}}, [@filter_kind_options=@f_flower={{0xb}, {0x18, 0x2, [@TCA_FLOWER_KEY_CT_LABELS={0x14, 0x61, "6cd70bf602accef1c1ee4d748dc7d2a8"}]}}]}, 0x48}, 0x1, 0x0, 0x0, 0xc044}, 0x40) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r5 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r5, 0x40045532, &(0x7f0000000100)) r6 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) r7 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r7, &(0x7f0000000000)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$inet6_IPV6_PKTINFO(r7, 0x29, 0x32, &(0x7f00000000c0)={@remote}, 0x14) write$snddsp(r6, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_DRAIN(r6, 0x4144, 0x0) r8 = syz_io_uring_setup(0x9ee, &(0x7f0000000300)={0x0, 0xa5e9, 0x100, 0x3, 0xfffffffe}, &(0x7f00000000c0)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x10, 0x0, @fd=r6, 0x0, 0x0, 0x0, {0x4c8}}) io_uring_enter(r8, 0x7ffa, 0xba1c, 0x40, 0x0, 0x39) ioctl$SNDCTL_DSP_GETODELAY(r0, 0x80045017, 0x0) 3.671442433s ago: executing program 1 (id=1631): r0 = socket(0x10, 0x803, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}}, 0x0) getsockname$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0xffffffffffffff2b, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) mmap(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x3000008, 0x12, 0xffffffffffffffff, 0xabb35000) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32e27d04000000288a", 0x10) r4 = accept$alg(r3, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000600), 0xfec8) recvmmsg(r4, &(0x7f00000008c0)=[{{&(0x7f00000000c0)=@pptp={0x18, 0x2, {0x0, @initdev}}, 0x80, &(0x7f00000005c0)=[{&(0x7f00000001c0)=""/200, 0x6}, {&(0x7f0000000140)=""/9, 0xa}, {&(0x7f0000000300)=""/225, 0x2}, {&(0x7f0000000400)=""/41, 0xfeb2}, {&(0x7f0000000440)=""/123, 0x7b}, {&(0x7f00000004c0)=""/203, 0xcb}], 0x6, &(0x7f0000000640)=""/123, 0x7b, 0x2000000}}, {{&(0x7f00000006c0), 0x80, &(0x7f0000000840), 0x0, &(0x7f0000000880)=""/24, 0xffffffffffffffe0}}], 0x2, 0xcb, &(0x7f0000008000)={0x0, 0x989680}) 2.552601862s ago: executing program 0 (id=1632): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r0 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) brk(0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xa, 0x0, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x107, 0xd, &(0x7f0000000040)=@req3={0x10000, 0x100000001, 0x10000, 0x1, 0x0, 0xda, 0x3}, 0x1c) openat$dsp1(0xffffffffffffff9c, 0x0, 0xaa802, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r1, 0x3, &(0x7f0000000000)=0x6) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) write$UHID_DESTROY(r4, &(0x7f0000000240), 0x4) fsetxattr$security_ima(r0, &(0x7f0000000040), &(0x7f0000000080)=ANY=[@ANYBLOB='\'Q'], 0x2, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x6000, 0x0) r5 = openat$btrfs_control(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount$bind(0x0, &(0x7f0000000180)='./file0/file0\x00', 0x0, 0x0, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r5, 0x50009405, &(0x7f0000000340)) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) recvmsg(r6, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x59}, 0x1f00) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000300)='./file0/file0/file0\x00', &(0x7f0000000280)='debugfs\x00', 0x104004e, 0x0) r7 = inotify_init1(0x0) inotify_add_watch(r7, &(0x7f00000000c0)='./file0\x00', 0x60004ce) socket$nl_generic(0x10, 0x3, 0x10) 2.381462487s ago: executing program 3 (id=1633): r0 = socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = openat$kvm(0x0, &(0x7f0000000080), 0x2382, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x10) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000380)={[0x0, 0x100000000, 0x0, 0x81, 0x100000, 0x0, 0x2004c8, 0x8000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x200}) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.freeze\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000280), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r3, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0xc0189436, &(0x7f0000000140)) setsockopt$packet_fanout(r3, 0x107, 0x12, &(0x7f00000001c0)={0x2, 0x8000}, 0x4) ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000400000004"]) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x2) ioctl$KVM_CAP_HYPERV_SYNIC2(r4, 0x4068aea3, &(0x7f0000002240)) ioctl$KVM_IRQ_LINE_STATUS(r2, 0xc008ae67, &(0x7f0000000180)={0x4, 0x2007}) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000080)={@local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010102, @local}, {{0x4001, 0x0, 0x41424344, 0x41424344, 0x0, 0x6, 0xa, 0x0, 0x1, 0x0, 0x0, {[@md5sig={0x13, 0x12, "473ecfd2106a00000000000000000003"}]}}}}}}}, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r7, 0x8933, &(0x7f0000000280)) r8 = fsopen(&(0x7f0000000040)='f2fs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000800)=ANY=[@ANYBLOB="b400000018000100000000000000000002000000fc000009000000000600150002000000900016808c00088088000180840003008fd498249133df36da6ee26a0cb5e066cc93ceb97a0a6b2de0bd82ffa9cbedc9120835e49ed02221ad4f0227c6a5891da800000000000039e355a0a184e3cb8256125a995964771b66f17cf2284697e095dbc322d0df13e673132e2542a4f9b34c29123004ea8acc955eacde969eb114a60300"/180], 0xb4}}, 0xa890) 1.551438441s ago: executing program 1 (id=1634): sendmsg$NLBL_UNLABEL_C_STATICADDDEF(0xffffffffffffffff, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=ANY=[@ANYRES8, @ANYBLOB="010026bd7000fddbdf2506000000140002002001000000000000000000000000000114000300fe88000000000000000000000000010108000400ac1414bb2b00070073797374656d5f753a6f626a6563745f723a7373685f"], 0x70}, 0x1, 0x0, 0x0, 0x4}, 0xc8a0) bpf$PROG_LOAD(0x5, &(0x7f0000003780)={0x3, 0x16, &(0x7f0000000280)=ANY=[@ANYBLOB="7912b8000000000061138c0000000000bf2000000000000015000000080063033d030100000000009500003a000000006916000000000000bf6700000000000066060500fcff03006706000002000000760300000ee60060bf050000000000003c6500bf000000006507f9ff01000000070700004cdfffff1e75040000000000bf54000000000000070400000400f9ffad43010000000000d5000000000000000500000000000000950000000000000032410000000000000054bb12dc8c27df8ecfc7bdd2d17f2f1754558f22dd399703d6c4f6f3be0b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fe9de56c9d8a814261bdb94a05000000c6c60bf7a13ba1fcf1111ce4fc0d742a81762bab8395fa64810b5b40d893ea8fe0ffffff7f1b546cad3f1d5af65706fd4f68795cce6cf16ab689b555202da2e0ec2871a51445dc8da39e5b0ab71ca9b901627b562ed84b026002d4519af619e3cca4d69e0dee080006774a8f3e691700ec88158f02001b0000c81c8b297dff0445a13d0045fb3cda32a673a6bb55d8c80800dce431e56723888fb126a1403d2b63f16fb2ad9bc117aba7cbebe174aba210d739a018f9bbec63222d20cedbc4d03723f1c932b3a6aa57f1ad2e99e0e67a993716d20000009f0f53acbb40b401e3738270b3156268784f2af9e4bcf8b07a10d6735154be1602f9dd1d7d4301e00000000000460bcc5989ec85e3cbcb6bcfaf0000000000000000bc00f674629709e7e78f4ddc211bc3ebf0bd9d42ca019dd5d0861cd64722cf74686ebfbe2562671cd47840f81d2a8f8f9be3bcd19dc6840aa7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7eab049b1bd47287cd31cc43ea0ffb567b40407d000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls}, 0x94) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000017000000540006803c00040067636d28616573290000000000000000000000000000000000000000000000001c000000e3de3d7b4cd07ec3ee777de774fc7987cca41989140003"], 0x68}, 0x1, 0x0, 0x0, 0x4}, 0x4008014) 1.427873422s ago: executing program 0 (id=1635): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x5) r1 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_int(r1, 0x6, 0x9, &(0x7f0000000180)=0x1, 0x4) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0600000004000000990000000d"], 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000e00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000c300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x12, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r3}, 0x10) openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r7, 0x4020aed2, &(0x7f0000000140)={0x80a0000}) r8 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[], 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000600)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000001c0)='sched_switch\x00', r9, 0x0, 0x6}, 0x18) r10 = syz_io_uring_setup(0x23c, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000180), &(0x7f0000000040)) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) r12 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x6, 0x5004, 0x7, 0x1}, 0x48) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r12, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000d00008500000001000000850000002a00000095"], &(0x7f0000000180)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$AUTOFS_IOC_FAIL(r13, 0x9361, 0x5) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r13}, 0x10) io_uring_enter(r10, 0x7f5f, 0x4000000, 0x0, 0x0, 0x0) shutdown(r11, 0x1) 967.350168ms ago: executing program 1 (id=1636): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES64, @ANYBLOB="3999b9fcfa4d092b8d698c653d5de01e1228620613b9c4188cbf1198cbfb8c5d5114743e3f8e04ed627eebbd", @ANYBLOB="0000800000000000180034"], 0x38}, 0x1, 0x300}, 0x0) socket(0x10, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000640), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010027bd7000fddbdf250b000000180005"], 0x2c}, 0x1, 0x0, 0x0, 0x800}, 0x4000) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) connect$bt_l2cap(r3, &(0x7f0000000140)={0x1f, 0x0, @fixed, 0x3ff}, 0xe) r4 = socket$kcm(0x10, 0x2, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000200)={@remote, @empty, 0x0, "e798888beab3af341dbec4427a73b0fbda814c5f5cd6f92215f46e0b091038f9"}, 0x3c) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000054000000060a010400000000000000000100000008000b40000000002c0004802800018007000100637400001c000280080001400000000008000240000000090500037c010000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xa8}}, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, &(0x7f0000000000)={0x1, 0x27fd}, 0x8) r7 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r7, 0x11, 0xa, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, 0x0, 0x0) r9 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000002740)=ANY=[@ANYBLOB="140000001300015b993dde440113e90005"], 0x14}], 0x1}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000002fc0)={'ip6tnl0\x00', &(0x7f0000000180)={'syztnl0\x00', 0x0, 0x2f, 0x6, 0x40, 0x5, 0x8, @mcast1, @private2, 0x1, 0x10, 0xe1, 0x4}}) r10 = bpf$OBJ_GET_PROG(0x7, &(0x7f0000000100)=@generic={0x0, 0x0, 0x38}, 0x18) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0, r12}, 0x18) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x10, 0x4, &(0x7f0000000900)=ANY=[@ANYRES64, @ANYRES64=r11, @ANYRES32=r4, @ANYRES32, @ANYRES16, @ANYRES64=r10, @ANYRES16=r6, @ANYRESHEX=r11, @ANYRES32=r7], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x3, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet_smc(0x2b, 0x1, 0x0) 755.498969ms ago: executing program 3 (id=1637): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x80401, 0x0) ioctl$TIOCSETD(r1, 0x5423, 0x0) ioctl$EXT4_IOC_CHECKPOINT(r0, 0x4004662b, &(0x7f0000000080)=0x1) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)={0xffffffffffffffff}) getsockopt$sock_buf(r2, 0x1, 0x1c, &(0x7f0000000540)=""/102, &(0x7f00000006c0)=0x66) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r3) ptrace$poke(0x4, r3, &(0x7f0000001040), 0x282d) getpeername$packet(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$sg(0x0, 0x0, 0x8002) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r4, 0x89ff, &(0x7f0000001440)={'bridge0\x00', 0x0}) open(&(0x7f0000000280)='./bus\x00', 0x101001, 0x54) r5 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0x2, 0x0, 0x1}, 0x48) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000004c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000700)={r7, 0xe0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000000400)=[0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, &(0x7f0000000500)=[{}], 0x8, 0x0, 0x0, 0x0, 0x0, 0x60, 0x8, 0x0, 0x0}}, 0x10) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000012c0)=ANY=[@ANYBLOB="1c00000009727a735956835706d9e6fdd35c5840f58b4d7b698b808d666ef4b34e5b7ab388c7ed918de51c3ffb4f2dea948d88fe7118a0298d9f6a1e32c884ac8bcaf174114e1ac924c58281119b8e8dd5f8cb916a330c68c49095186ae35e36c0561d36ba95dc48a4209e2dc8b560d35801adc82b22c77acfa9d2e7c88a417e1f959fdc5a480e864c2af3ad065a02778debcf9c623e19bb69e1d3fecb9ebbf6d40b8fcb7157bc4a86a5e7048bf34aae015f3090c353913488044bdd2faa97a25a6654768f85d49744a3d0ff", @ANYRES16=r5, @ANYBLOB="0100fdffffff001000000700000008000b0000000000"], 0x1c}}, 0x890) 157.366201ms ago: executing program 4 (id=1638): ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r1, 0x7a5, &(0x7f00000001c0)={{@host, 0xb}, 0x1, 0x2, 0x3}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@getchain={0x24, 0x66, 0x1, 0x78bd27, 0xa6, {0x0, 0x0, 0x0, r3, {0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mremap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000, 0x3, &(0x7f0000ffe000/0x1000)=nil) bind$rds(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$loop(0x0, 0x1, 0x698200) read$FUSE(0xffffffffffffffff, 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r7, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r7, 0x84, 0x75, &(0x7f0000000340)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r7, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r7, &(0x7f0000000780)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x4, @loopback, 0x3}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x3404c8d4) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r7, 0x84, 0x77, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0, @ANYBLOB="f7480000"], 0x8) socket$nl_route(0x10, 0x3, 0x0) 0s ago: executing program 0 (id=1639): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000005c0)={0x11, 0x3, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000f9ffffff00000000002000019500000000000000"], &(0x7f0000000300)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r0}, 0x10) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$inet(r1, &(0x7f0000001540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$F2FS_IOC_SEC_TRIM_FILE(r3, 0x4018f514, &(0x7f0000000000)={0xff, 0x6, 0x3}) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000000040)={0x3, &(0x7f0000000100)=[{0x20, 0x0, 0xf5, 0xfffff010}, {0x8011, 0x0, 0x0, 0xfffff024}, {0x9, 0x4, 0xfd}]}, 0x10) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x400, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) openat$kvm(0xffffffffffffff9c, 0x0, 0x8a200, 0x0) connect$unix(r6, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = msgget$private(0x0, 0x3a9) msgrcv(r7, 0x0, 0x0, 0x0, 0x800) rseq(&(0x7f0000000300)={0x0, 0x0, 0x0, 0x2}, 0x20, 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) preadv(r5, &(0x7f0000001cc0)=[{&(0x7f0000000200)=""/126, 0x7e}], 0x1, 0x0, 0xa3) kernel console output (not intermixed with test programs): d USB device number 19 using dummy_hcd [ 338.911932][ T9531] netlink: 20 bytes leftover after parsing attributes in process `syz.4.981'. [ 338.989488][ T9532] netlink: 'syz.4.981': attribute type 10 has an invalid length. [ 339.022245][ T9532] team0: Port device wlan1 added [ 339.039355][ T5897] usb 1-1: Using ep0 maxpacket: 32 [ 339.049491][ T5897] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 339.057626][ T5897] usb 1-1: config 0 has no interface number 0 [ 339.556619][ T5897] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 339.607545][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 339.632336][ T51] Bluetooth: hci4: command tx timeout [ 339.644442][ T5897] usb 1-1: Product: syz [ 339.649402][ T5943] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 339.764970][ T5897] usb 1-1: Manufacturer: syz [ 339.776832][ T5897] usb 1-1: SerialNumber: syz [ 339.792186][ T5897] usb 1-1: config 0 descriptor?? [ 339.818623][ T5897] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 339.837549][ T5943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 339.858089][ T9540] netlink: 16 bytes leftover after parsing attributes in process `syz.2.982'. [ 339.859303][ T5897] dvb-usb: bulk message failed: -22 (2/0) [ 339.867275][ T5943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 339.883056][ T9540] netlink: 4 bytes leftover after parsing attributes in process `syz.2.982'. [ 339.899080][ T5943] usb 4-1: New USB device found, idVendor=28de, idProduct=1142, bcdDevice= 0.00 [ 339.924465][ T5943] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 339.933658][ T5897] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 339.938236][ T5943] usb 4-1: config 0 descriptor?? [ 339.952671][ T5897] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 340.031576][ T9545] netlink: 28 bytes leftover after parsing attributes in process `syz.2.982'. [ 340.136092][ T5897] usb 1-1: media controller created [ 340.167560][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 340.198613][ T5897] cxusb: set interface failed [ 340.204915][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 340.211673][ T64] batman_adv: batadv0: Removing interface: dummy0 [ 340.224673][ T64] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 340.240354][ T64] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 340.312940][ T5897] DVB: Unable to find symbol lgdt330x_attach() [ 340.319170][ T5897] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 340.438542][ T5943] hid-steam 0003:28DE:1142.0002: unknown main item tag 0x0 [ 340.464611][ T5897] rc_core: IR keymap rc-dvico-portable not found [ 340.467409][ T5943] hid-steam 0003:28DE:1142.0002: : USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 340.472610][ T5897] Registered IR keymap rc-empty [ 340.488191][ T5920] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 340.512039][ T5897] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 340.544495][ T5897] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input25 [ 340.561367][ T5943] hid-steam 0003:28DE:1142.0002: Steam wireless receiver connected [ 340.574406][ T5943] hid-steam 0003:28DE:1142.0002: No HID_FEATURE_REPORT submitted - nothing to read [ 340.575861][ T5897] dvb-usb: schedule remote query interval to 100 msecs. [ 340.593044][ T5943] hid-steam 0003:28DE:1142.0003: unknown main item tag 0x0 [ 340.605600][ T5897] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 340.654777][ T5920] usb 3-1: config 252 has an invalid interface number: 107 but max is 0 [ 340.666933][ T5943] hid-steam 0003:28DE:1142.0003: hidraw0: USB HID v0.00 Device [HID 28de:1142] on usb-dummy_hcd.3-1/input0 [ 340.678710][ T5920] usb 3-1: config 252 has no interface number 0 [ 340.695484][ T5920] usb 3-1: config 252 interface 107 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 340.712809][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 340.716045][ T5920] usb 3-1: config 252 interface 107 altsetting 0 endpoint 0x8A has invalid wMaxPacketSize 0 [ 340.732460][ T5943] usb 4-1: USB disconnect, device number 10 [ 340.785246][ T5920] usb 3-1: New USB device found, idVendor=10f0, idProduct=2002, bcdDevice=d7.67 [ 340.797519][ T5943] hid-steam 0003:28DE:1142.0002: Steam wireless receiver disconnected [ 340.806437][ T5920] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 340.825941][ T5920] usb 3-1: Product: syz [ 340.826787][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 340.842706][ T5920] usb 3-1: Manufacturer: syz [ 340.847512][ T5920] usb 3-1: SerialNumber: syz [ 340.952545][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.008842][ T64] team0 (unregistering): Port device team_slave_1 removed [ 341.054158][ T64] team0 (unregistering): Port device team_slave_0 removed [ 341.061479][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.078073][ T30] kauditd_printk_skb: 10 callbacks suppressed [ 341.078090][ T30] audit: type=1804 audit(1755891974.135:827): pid=9543 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.2.982" name="/newroot/204/cgroup.controllers" dev="tmpfs" ino=1099 res=1 errno=0 [ 341.107720][ T30] audit: type=1800 audit(1755891974.135:828): pid=9543 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.2.982" name="cgroup.controllers" dev="tmpfs" ino=1099 res=0 errno=0 [ 341.179900][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.290251][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.419679][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.542386][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.650847][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.700390][ T51] Bluetooth: hci4: command 0x041b tx timeout [ 341.769348][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 341.879863][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 342.004190][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 342.130546][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 342.273601][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 342.399768][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 342.453952][ T9505] chnl_net:caif_netlink_parms(): no params data found [ 342.464928][ T5943] usb 3-1: USB disconnect, device number 11 [ 342.518264][ T5920] usb 1-1: USB disconnect, device number 19 [ 342.519466][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 342.590181][ T5920] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 342.844913][ T9571] netlink: 4 bytes leftover after parsing attributes in process `syz.3.988'. [ 342.932617][ T9568] netlink: 12 bytes leftover after parsing attributes in process `syz.4.987'. [ 343.178445][ T9580] netlink: 72 bytes leftover after parsing attributes in process `syz.2.989'. [ 343.227098][ T9505] bridge0: port 1(bridge_slave_0) entered blocking state [ 343.315231][ T9581] overlayfs: failed to resolve './file1': -2 [ 343.779577][ T5836] Bluetooth: hci4: command 0x041b tx timeout [ 344.128463][ T9505] bridge0: port 1(bridge_slave_0) entered disabled state [ 344.479745][ T9505] bridge_slave_0: entered allmulticast mode [ 344.497018][ T9505] bridge_slave_0: entered promiscuous mode [ 344.551764][ T9505] bridge0: port 2(bridge_slave_1) entered blocking state [ 344.580048][ T9505] bridge0: port 2(bridge_slave_1) entered disabled state [ 344.610084][ T9505] bridge_slave_1: entered allmulticast mode [ 344.618022][ T9505] bridge_slave_1: entered promiscuous mode [ 344.900064][ T9505] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 344.918319][ T9505] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 345.218615][ T5920] usb 3-1: new high-speed USB device number 12 using dummy_hcd [ 345.569791][ T5920] usb 3-1: Using ep0 maxpacket: 32 [ 345.587209][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 345.619058][ T5920] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 345.634285][ T9505] team0: Port device team_slave_0 added [ 345.644025][ T5920] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 345.668070][ T9505] team0: Port device team_slave_1 added [ 345.674100][ T9594] netlink: 20 bytes leftover after parsing attributes in process `syz.4.993'. [ 345.696361][ T5920] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 345.727140][ T5920] usb 3-1: config 0 descriptor?? [ 345.756232][ T9597] netlink: 'syz.4.993': attribute type 10 has an invalid length. [ 345.833360][ T9505] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 345.849702][ T9505] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 345.875794][ T51] Bluetooth: hci4: command 0x041b tx timeout [ 345.890535][ T9505] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 345.909089][ T9505] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 345.930445][ T9505] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 346.037731][ T9505] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 346.171786][ T9505] hsr_slave_0: entered promiscuous mode [ 346.198630][ T9505] hsr_slave_1: entered promiscuous mode [ 346.203659][ T5920] usbhid 3-1:0.0: can't add hid device: -71 [ 346.215047][ T5920] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 346.226157][ T5920] usb 3-1: USB disconnect, device number 12 [ 346.233359][ T9604] netlink: 96 bytes leftover after parsing attributes in process `syz.4.996'. [ 346.464922][ T9606] block device autoloading is deprecated and will be removed. [ 346.789531][ T5943] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 346.979792][ T5943] usb 1-1: Using ep0 maxpacket: 8 [ 347.015081][ T5943] usb 1-1: unable to get BOS descriptor or descriptor too short [ 347.073605][ T5943] usb 1-1: too many endpoints for config 4 interface 0 altsetting 102: 65, using maximum allowed: 30 [ 347.128770][ T5943] usb 1-1: config 4 interface 0 altsetting 102 has 0 endpoint descriptors, different from the interface descriptor's value: 65 [ 347.266908][ T5943] usb 1-1: config 4 interface 0 has no altsetting 0 [ 347.482404][ T5943] usb 1-1: string descriptor 0 read error: -22 [ 347.488761][ T5943] usb 1-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 347.501698][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 347.527029][ T5943] usb 1-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 347.536939][ T5943] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 347.552439][ T5943] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 347.562558][ T5943] usb 1-1: media controller created [ 347.616797][ T5943] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 347.725730][ T9623] netlink: 4 bytes leftover after parsing attributes in process `syz.2.999'. [ 347.835347][ T9623] gretap0: left allmulticast mode [ 347.841215][ T9623] gretap0: left promiscuous mode [ 347.846608][ T9623] bridge0: port 3(gretap0) entered disabled state [ 347.868063][ T9623] bridge_slave_1: left allmulticast mode [ 347.894815][ T9623] bridge_slave_1: left promiscuous mode [ 347.900776][ T9623] bridge0: port 2(bridge_slave_1) entered disabled state [ 347.916256][ T9623] bridge_slave_0: left allmulticast mode [ 347.922578][ T9623] bridge_slave_0: left promiscuous mode [ 347.932143][ T9623] bridge0: port 1(bridge_slave_0) entered disabled state [ 347.949588][ T5836] Bluetooth: hci4: command 0x041b tx timeout [ 348.074326][ T9626] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1000'. [ 348.135740][ T9629] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1001'. [ 348.257581][ T9630] overlayfs: failed to resolve './file1': -2 [ 348.742390][ T9605] usb 1-1: dvb_usb_au6610: wlen=0, aborting [ 348.988813][ T5943] zl10353_read_register: readreg error (reg=127, ret==0) [ 349.259137][ T9505] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 349.273782][ T9505] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 349.286118][ T9505] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 349.298788][ T9505] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 350.030328][ T5836] Bluetooth: hci4: command 0x041b tx timeout [ 350.267583][ T5943] usb 1-1: USB disconnect, device number 20 [ 350.313863][ T9650] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1006'. [ 350.376455][ T9505] 8021q: adding VLAN 0 to HW filter on device bond0 [ 350.426856][ T9658] netlink: 'syz.4.1006': attribute type 10 has an invalid length. [ 350.439156][ T9505] 8021q: adding VLAN 0 to HW filter on device team0 [ 350.467908][ T1009] bridge0: port 1(bridge_slave_0) entered blocking state [ 350.475137][ T1009] bridge0: port 1(bridge_slave_0) entered forwarding state [ 350.511799][ T1009] bridge0: port 2(bridge_slave_1) entered blocking state [ 350.518991][ T1009] bridge0: port 2(bridge_slave_1) entered forwarding state [ 350.623678][ T9662] netlink: 96 bytes leftover after parsing attributes in process `syz.0.1008'. [ 351.120194][ T5943] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 351.140516][ T9672] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1011'. [ 351.336758][ T5943] usb 3-1: Using ep0 maxpacket: 32 [ 351.361438][ T9678] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1013'. [ 351.362885][ T5943] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 351.401887][ T9505] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 352.382552][ T5943] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 352.436696][ T5943] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 352.454299][ T5943] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.483649][ T5943] usb 3-1: config 0 descriptor?? [ 352.498178][ T9505] veth0_vlan: entered promiscuous mode [ 352.537087][ T9505] veth1_vlan: entered promiscuous mode [ 352.815820][ T9688] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 352.828206][ T9688] autofs: Bad value for 'fd' [ 353.386631][ T9505] veth0_macvtap: entered promiscuous mode [ 353.409043][ T9505] veth1_macvtap: entered promiscuous mode [ 353.541981][ T9505] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 353.556295][ T9505] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 353.580112][ T9505] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.588889][ T9505] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.615474][ T5943] usbhid 3-1:0.0: can't add hid device: -71 [ 353.629943][ T5943] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 353.658890][ T9505] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.670453][ T9505] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 353.679470][ T5943] usb 3-1: USB disconnect, device number 13 [ 354.720623][ T9695] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.730171][ T9695] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.740116][ T9695] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.753481][ T9695] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 354.829981][ T8458] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 354.875113][ T8458] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 355.442709][ T3474] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 355.472576][ T3474] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 355.575115][ T9712] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1021'. [ 355.636804][ T9714] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1022'. [ 355.742665][ T9716] overlayfs: missing 'lowerdir' [ 355.767179][ T9718] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1023'. [ 355.862832][ T9722] netlink: 'syz.2.1023': attribute type 10 has an invalid length. [ 355.943706][ T9722] team0: Port device wlan1 added [ 356.102614][ T9727] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1025'. [ 358.625152][ T9736] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 358.634565][ T9736] autofs: Bad value for 'fd' [ 359.161935][ T9757] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1034'. [ 359.219581][ T5949] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 359.275182][ T9761] overlayfs: missing 'lowerdir' [ 359.324562][ T9762] netlink: 48 bytes leftover after parsing attributes in process `syz.4.1035'. [ 359.439382][ T5949] usb 4-1: Using ep0 maxpacket: 32 [ 359.452828][ T5949] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 359.484325][ T5949] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 359.603338][ T5949] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 359.645498][ T5949] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 359.719358][ T5949] usb 4-1: config 0 descriptor?? [ 359.763533][ T9776] usb usb2: Requested nonsensical USBDEVFS_URB_ZERO_PACKET. [ 360.037328][ T9783] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1041'. [ 360.893924][ T5949] usbhid 4-1:0.0: can't add hid device: -71 [ 361.036750][ T5949] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 361.055712][ T5949] usb 4-1: USB disconnect, device number 11 [ 362.391474][ T9798] FAULT_INJECTION: forcing a failure. [ 362.391474][ T9798] name failslab, interval 1, probability 0, space 0, times 0 [ 362.404554][ T9798] CPU: 0 UID: 0 PID: 9798 Comm: syz.2.1043 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 362.404581][ T9798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 362.404593][ T9798] Call Trace: [ 362.404603][ T9798] [ 362.404613][ T9798] dump_stack_lvl+0x189/0x250 [ 362.404640][ T9798] ? __pfx____ratelimit+0x10/0x10 [ 362.404662][ T9798] ? __pfx_dump_stack_lvl+0x10/0x10 [ 362.404682][ T9798] ? __pfx__printk+0x10/0x10 [ 362.404713][ T9798] ? __pfx___might_resched+0x10/0x10 [ 362.404740][ T9798] should_fail_ex+0x414/0x560 [ 362.404765][ T9798] ? io_sqe_buffers_register+0x133/0x8d0 [ 362.404790][ T9798] should_failslab+0xa8/0x100 [ 362.404814][ T9798] __kvmalloc_node_noprof+0x161/0x5f0 [ 362.404835][ T9798] ? io_sqe_buffers_register+0x133/0x8d0 [ 362.404867][ T9798] io_sqe_buffers_register+0x133/0x8d0 [ 362.404894][ T9798] ? __se_sys_io_uring_register+0x1e1/0x11b0 [ 362.404932][ T9798] ? __fget_files+0x2a/0x420 [ 362.404955][ T9798] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 362.404981][ T9798] ? __fget_files+0x2a/0x420 [ 362.405001][ T9798] ? __fget_files+0x3a0/0x420 [ 362.405020][ T9798] ? __fget_files+0x2a/0x420 [ 362.405044][ T9798] ? io_is_uring_fops+0xd/0x50 [ 362.405077][ T9798] __se_sys_io_uring_register+0xb85/0x11b0 [ 362.405107][ T9798] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 362.405129][ T9798] ? ksys_write+0x22a/0x250 [ 362.405150][ T9798] ? __pfx_ksys_write+0x10/0x10 [ 362.405165][ T9798] ? rcu_is_watching+0x15/0xb0 [ 362.405192][ T9798] ? do_syscall_64+0xbe/0x3b0 [ 362.405217][ T9798] do_syscall_64+0xfa/0x3b0 [ 362.405238][ T9798] ? lockdep_hardirqs_on+0x9c/0x150 [ 362.405259][ T9798] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.405277][ T9798] ? clear_bhb_loop+0x60/0xb0 [ 362.405301][ T9798] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.405320][ T9798] RIP: 0033:0x7f44b018ebe9 [ 362.405338][ T9798] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 362.405355][ T9798] RSP: 002b:00007f44b0fce038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 362.405376][ T9798] RAX: ffffffffffffffda RBX: 00007f44b03b6180 RCX: 00007f44b018ebe9 [ 362.405390][ T9798] RDX: 00002000000002c0 RSI: 0000000000000000 RDI: 0000000000000005 [ 362.405402][ T9798] RBP: 00007f44b0fce090 R08: 0000000000000000 R09: 0000000000000000 [ 362.405414][ T9798] R10: 100000000000011a R11: 0000000000000246 R12: 0000000000000001 [ 362.405427][ T9798] R13: 00007f44b03b6218 R14: 00007f44b03b6180 R15: 00007ffe53cebce8 [ 362.405459][ T9798] [ 364.079570][ T9800] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 364.235443][ T9800] autofs: Bad value for 'fd' [ 365.192803][ T9816] overlayfs: missing 'lowerdir' [ 365.450939][ T9822] smc: net device bond0 applied user defined pnetid SYZ2 [ 366.599888][ T9843] FAULT_INJECTION: forcing a failure. [ 366.599888][ T9843] name failslab, interval 1, probability 0, space 0, times 0 [ 366.612788][ T9843] CPU: 1 UID: 0 PID: 9843 Comm: syz.1.1057 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 366.612812][ T9843] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 366.612824][ T9843] Call Trace: [ 366.612833][ T9843] [ 366.612842][ T9843] dump_stack_lvl+0x189/0x250 [ 366.612870][ T9843] ? __pfx____ratelimit+0x10/0x10 [ 366.612891][ T9843] ? __pfx_dump_stack_lvl+0x10/0x10 [ 366.612912][ T9843] ? __pfx__printk+0x10/0x10 [ 366.612943][ T9843] ? __pfx___might_resched+0x10/0x10 [ 366.612970][ T9843] should_fail_ex+0x414/0x560 [ 366.612996][ T9843] should_failslab+0xa8/0x100 [ 366.613019][ T9843] __kmalloc_noprof+0xcb/0x4f0 [ 366.613037][ T9843] ? do_syscall_64+0xfa/0x3b0 [ 366.613057][ T9843] ? io_cache_alloc_new+0x40/0x100 [ 366.613086][ T9843] io_cache_alloc_new+0x40/0x100 [ 366.613112][ T9843] io_rsrc_node_alloc+0x172/0x280 [ 366.613143][ T9843] io_sqe_buffer_register+0xf2/0x2280 [ 366.613195][ T9843] ? __pfx_io_sqe_buffer_register+0x10/0x10 [ 366.613228][ T9843] ? rcu_is_watching+0x15/0xb0 [ 366.613248][ T9843] ? io_sqe_buffers_register+0x133/0x8d0 [ 366.613281][ T9843] ? trace_kmalloc+0x1f/0xd0 [ 366.613296][ T9843] ? __kvmalloc_node_noprof+0x331/0x5f0 [ 366.613316][ T9843] ? iovec_from_user+0x1ba/0x250 [ 366.613347][ T9843] io_sqe_buffers_register+0x3b4/0x8d0 [ 366.613387][ T9843] ? __pfx_io_sqe_buffers_register+0x10/0x10 [ 366.613414][ T9843] ? __fget_files+0x3a0/0x420 [ 366.613435][ T9843] ? __fget_files+0x2a/0x420 [ 366.613458][ T9843] ? io_is_uring_fops+0xd/0x50 [ 366.613493][ T9843] __se_sys_io_uring_register+0xb85/0x11b0 [ 366.613518][ T9843] ? irqentry_exit+0x74/0x90 [ 366.613539][ T9843] ? __pfx___se_sys_io_uring_register+0x10/0x10 [ 366.613584][ T9843] do_syscall_64+0xfa/0x3b0 [ 366.613604][ T9843] ? lockdep_hardirqs_on+0x9c/0x150 [ 366.613623][ T9843] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.613642][ T9843] ? clear_bhb_loop+0x60/0xb0 [ 366.613666][ T9843] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 366.613685][ T9843] RIP: 0033:0x7f443e78ebe9 [ 366.613702][ T9843] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 366.613719][ T9843] RSP: 002b:00007f443f559038 EFLAGS: 00000246 ORIG_RAX: 00000000000001ab [ 366.613739][ T9843] RAX: ffffffffffffffda RBX: 00007f443e9b6180 RCX: 00007f443e78ebe9 [ 366.613754][ T9843] RDX: 00002000000002c0 RSI: 0000000000000000 RDI: 0000000000000005 [ 366.613767][ T9843] RBP: 00007f443f559090 R08: 0000000000000000 R09: 0000000000000000 [ 366.613779][ T9843] R10: 100000000000011a R11: 0000000000000246 R12: 0000000000000001 [ 366.613791][ T9843] R13: 00007f443e9b6218 R14: 00007f443e9b6180 R15: 00007ffeb86735c8 [ 366.613824][ T9843] [ 369.072257][ T9848] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 369.393963][ T9854] program syz.4.1060 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 370.336716][ T9860] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 371.854304][ T9870] ptrace attach of "./syz-executor exec"[5832] was attempted by "./syz-executor exec"[9870] [ 372.100000][ T5836] Bluetooth: hci0: command 0x0c1a tx timeout [ 372.306587][ T9886] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1069'. [ 372.409408][ T5897] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 373.227459][ T5897] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 373.269256][ T5897] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 373.291648][ T5897] usb 2-1: Product: syz [ 373.295835][ T5897] usb 2-1: Manufacturer: syz [ 373.481175][ T5897] usb 2-1: SerialNumber: syz [ 373.715543][ T5897] usb 2-1: config 0 descriptor?? [ 373.917144][ T9893] warning: `syz.3.1072' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 374.014332][ T9904] overlayfs: missing 'lowerdir' [ 375.444076][ T9924] overlayfs: missing 'lowerdir' [ 375.550344][ T9930] netlink: 'syz.2.1077': attribute type 23 has an invalid length. [ 375.594518][ T9924] FAULT_INJECTION: forcing a failure. [ 375.594518][ T9924] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 375.617970][ T9924] CPU: 1 UID: 0 PID: 9924 Comm: syz.3.1078 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 375.617998][ T9924] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 375.618011][ T9924] Call Trace: [ 375.618019][ T9924] [ 375.618027][ T9924] dump_stack_lvl+0x189/0x250 [ 375.618054][ T9924] ? __pfx____ratelimit+0x10/0x10 [ 375.618076][ T9924] ? __pfx_dump_stack_lvl+0x10/0x10 [ 375.618102][ T9924] ? __pfx__printk+0x10/0x10 [ 375.618126][ T9924] ? __might_fault+0xb0/0x130 [ 375.618158][ T9924] should_fail_ex+0x414/0x560 [ 375.618184][ T9924] _copy_from_iter+0x1db/0x16f0 [ 375.618220][ T9924] ? policy_nodemask+0x27c/0x720 [ 375.618240][ T9924] ? __pfx__copy_from_iter+0x10/0x10 [ 375.618271][ T9924] ? set_page_refcounted+0xa0/0x1e0 [ 375.618292][ T9924] ? page_copy_sane+0x4e/0x280 [ 375.618318][ T9924] copy_page_from_iter+0xdd/0x170 [ 375.618348][ T9924] tun_get_user+0x1c4d/0x3ce0 [ 375.618377][ T9924] ? tun_get_user+0x693/0x3ce0 [ 375.618420][ T9924] ? __pfx_tun_get_user+0x10/0x10 [ 375.618453][ T9924] ? __lock_acquire+0xab9/0xd20 [ 375.618485][ T9924] ? ref_tracker_alloc+0x318/0x460 [ 375.618504][ T9924] ? __lock_acquire+0xab9/0xd20 [ 375.618522][ T9924] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 375.618548][ T9924] ? tun_get+0x1c/0x2f0 [ 375.618578][ T9924] ? tun_get+0x1c/0x2f0 [ 375.618599][ T9924] ? tun_get+0x1c/0x2f0 [ 375.618624][ T9924] tun_chr_write_iter+0x113/0x200 [ 375.618650][ T9924] vfs_write+0x54b/0xa90 [ 375.618673][ T9924] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 375.618699][ T9924] ? __pfx_vfs_write+0x10/0x10 [ 375.618727][ T9924] ? __fget_files+0x2a/0x420 [ 375.618759][ T9924] ksys_write+0x145/0x250 [ 375.618780][ T9924] ? __pfx_ksys_write+0x10/0x10 [ 375.618798][ T9924] ? rcu_is_watching+0x15/0xb0 [ 375.618819][ T9924] ? trace_sys_enter+0x25/0x120 [ 375.618842][ T9924] do_syscall_64+0xfa/0x3b0 [ 375.618862][ T9924] ? lockdep_hardirqs_on+0x9c/0x150 [ 375.618882][ T9924] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.618901][ T9924] ? clear_bhb_loop+0x60/0xb0 [ 375.618925][ T9924] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 375.618943][ T9924] RIP: 0033:0x7f4ecf78d69f [ 375.618962][ T9924] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 375.618979][ T9924] RSP: 002b:00007f4ed05de000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 375.619000][ T9924] RAX: ffffffffffffffda RBX: 00007f4ecf9b5fa0 RCX: 00007f4ecf78d69f [ 375.619015][ T9924] RDX: 000000000000004a RSI: 0000200000000080 RDI: 00000000000000c8 [ 375.619028][ T9924] RBP: 00007f4ed05de090 R08: 0000000000000000 R09: 0000000000000000 [ 375.619040][ T9924] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000001 [ 375.619052][ T9924] R13: 00007f4ecf9b6038 R14: 00007f4ecf9b5fa0 R15: 00007ffc4023d368 [ 375.619082][ T9924] [ 376.294367][ T9940] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 376.369612][ T9940] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 376.439950][ T9943] netlink: 'syz.2.1081': attribute type 1 has an invalid length. [ 376.499601][ T9943] 8021q: adding VLAN 0 to HW filter on device bond0 [ 376.803969][ T9950] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1080'. [ 376.916554][ T5943] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 377.079726][ T5943] usb 1-1: Using ep0 maxpacket: 16 [ 377.163912][ T5943] usb 1-1: config 1 has an invalid descriptor of length 254, skipping remainder of the config [ 377.275162][ T5943] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 377.343982][ T9943] bond0: (slave veth1): Enslaving as an active interface with a down link [ 377.430705][ T5943] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 377.443407][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 377.465600][ T9947] bond0: (slave veth0_to_bond): Enslaving as an active interface with a down link [ 377.475119][ T5943] usb 1-1: Product: syz [ 377.479474][ T5943] usb 1-1: Manufacturer: syz [ 377.492032][ T5943] usb 1-1: SerialNumber: syz [ 377.629670][ T5921] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 378.570089][ T5921] usb 3-1: Using ep0 maxpacket: 16 [ 378.588162][ T5921] usb 3-1: config 0 has an invalid interface number: 49 but max is 0 [ 378.598614][ T5921] usb 3-1: config 0 has no interface number 0 [ 378.607489][ T5921] usb 3-1: too many endpoints for config 0 interface 49 altsetting 50: 51, using maximum allowed: 30 [ 378.634214][ T9946] netlink: 'syz.0.1082': attribute type 1 has an invalid length. [ 378.761069][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.767851][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.899313][ T5943] usb 1-1: 0:2 : does not exist [ 379.120486][ T5921] usb 3-1: config 0 interface 49 altsetting 50 has 0 endpoint descriptors, different from the interface descriptor's value: 51 [ 379.133833][ T5921] usb 3-1: config 0 interface 49 has no altsetting 0 [ 379.143425][ T5921] usb 3-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 379.152812][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 379.160950][ T5921] usb 3-1: Product: syz [ 379.165888][ T5921] usb 3-1: Manufacturer: syz [ 379.170628][ T5921] usb 3-1: SerialNumber: syz [ 379.179403][ T5921] usb 3-1: config 0 descriptor?? [ 379.284081][ T5943] usb 1-1: 5:0: failed to get current value for ch 0 (-22) [ 379.399946][ T9943] No source specified [ 379.434018][ T9943] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.509803][ T5943] usb 1-1: USB disconnect, device number 21 [ 379.577831][ T9943] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.671686][ T9943] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.788209][ T9943] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 379.892647][ T9974] overlayfs: missing 'lowerdir' [ 379.948282][ T9976] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 379.983369][ T9976] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 380.036752][ T9943] netdevsim netdevsim2 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.069527][ T9943] netdevsim netdevsim2 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.096799][ T9943] netdevsim netdevsim2 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.141721][ T9943] netdevsim netdevsim2 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 380.219287][ T5943] usb 1-1: new full-speed USB device number 22 using dummy_hcd [ 380.279422][ T5921] dvb_usb_dtv5100 3-1:0.49: probe with driver dvb_usb_dtv5100 failed with error -71 [ 380.300743][ T5921] usb 3-1: USB disconnect, device number 14 [ 380.474088][ T5943] usb 1-1: config 0 has an invalid interface number: 251 but max is 0 [ 380.483779][ T5943] usb 1-1: config 0 has no interface number 0 [ 380.509375][ T5943] usb 1-1: New USB device found, idVendor=0b95, idProduct=172a, bcdDevice=f7.f4 [ 380.585918][ T9982] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1091'. [ 380.604079][ T9982] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1091'. [ 380.737656][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 380.853167][ T5943] usb 1-1: Product: syz [ 380.857589][ T5943] usb 1-1: Manufacturer: syz [ 380.910357][ T5943] usb 1-1: SerialNumber: syz [ 381.001822][ T5943] usb 1-1: config 0 descriptor?? [ 381.029921][ T927] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 381.229573][ T927] usb 5-1: Using ep0 maxpacket: 8 [ 381.422516][ T927] usb 5-1: unable to get BOS descriptor or descriptor too short [ 381.750324][ T927] usb 5-1: config 1 has an invalid interface number: 4 but max is 2 [ 381.762715][ T927] usb 5-1: config 1 has no interface number 1 [ 381.770221][ T927] usb 5-1: too many endpoints for config 1 interface 4 altsetting 16: 195, using maximum allowed: 30 [ 381.786655][ T927] usb 5-1: config 1 interface 4 altsetting 16 has 0 endpoint descriptors, different from the interface descriptor's value: 195 [ 381.808446][ T9994] overlayfs: missing 'lowerdir' [ 381.816119][ T927] usb 5-1: config 1 interface 4 has no altsetting 0 [ 381.828802][ T927] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 381.855396][ T927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 381.878667][ T927] usb 5-1: Product: syz [ 381.886551][ T927] usb 5-1: Manufacturer: syz [ 381.896709][ T927] usb 5-1: SerialNumber: syz [ 382.635382][ T5943] asix 1-1:0.251 (unnamed net_device) (uninitialized): Invalid PHY address 0x39 [ 383.737510][ T927] usb 5-1: 2:1 : sample bitwidth 247 in over sample bytes 4 [ 383.813555][ T927] usb 5-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 384.093794][ T927] hub 5-1:1.4: Invalid hub with more than one config or interface [ 384.148862][ T5921] usb 1-1: USB disconnect, device number 22 [ 384.164961][ T927] hub 5-1:1.4: probe with driver hub failed with error -22 [ 385.209770][ T927] usb 5-1: USB disconnect, device number 11 [ 385.443665][T10026] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1105'. [ 385.574523][T10029] netlink: 'syz.1.1105': attribute type 10 has an invalid length. [ 385.597799][T10019] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.683637][T10029] team0: Port device wlan1 added [ 385.738818][T10019] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 385.789325][ T5921] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 386.892636][ T5921] usb 4-1: Using ep0 maxpacket: 32 [ 387.313175][ T5920] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 387.395488][ T5921] usb 4-1: config 0 has an invalid descriptor of length 51, skipping remainder of the config [ 387.478113][ T5921] usb 4-1: string descriptor 0 read error: -71 [ 387.485779][ T5921] usb 4-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 387.549281][ T5920] usb 5-1: device descriptor read/64, error -71 [ 387.636677][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 387.986995][ T5921] usb 4-1: config 0 descriptor?? [ 388.013558][ T5921] usb 4-1: can't set config #0, error -71 [ 388.032541][T10019] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 388.040694][ T5920] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 388.065702][ T5921] usb 4-1: USB disconnect, device number 12 [ 388.190923][ T5920] usb 5-1: device descriptor read/64, error -71 [ 388.320873][ T5920] usb usb5-port1: attempt power cycle [ 391.274208][T10054] overlayfs: missing 'lowerdir' [ 391.652635][T10058] FAULT_INJECTION: forcing a failure. [ 391.652635][T10058] name failslab, interval 1, probability 0, space 0, times 0 [ 391.665658][T10058] CPU: 0 UID: 0 PID: 10058 Comm: syz.4.1110 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 391.665684][T10058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 391.665696][T10058] Call Trace: [ 391.665705][T10058] [ 391.665714][T10058] dump_stack_lvl+0x189/0x250 [ 391.665742][T10058] ? __pfx____ratelimit+0x10/0x10 [ 391.665763][T10058] ? __pfx_dump_stack_lvl+0x10/0x10 [ 391.665785][T10058] ? __pfx__printk+0x10/0x10 [ 391.665818][T10058] ? __lock_acquire+0xab9/0xd20 [ 391.665843][T10058] should_fail_ex+0x414/0x560 [ 391.665870][T10058] should_failslab+0xa8/0x100 [ 391.665893][T10058] kmem_cache_alloc_noprof+0x73/0x3c0 [ 391.665913][T10058] ? dst_alloc+0x105/0x170 [ 391.665937][T10058] dst_alloc+0x105/0x170 [ 391.665962][T10058] ip_route_input_rcu+0x1ed5/0x2ff0 [ 391.665984][T10058] ? __pfx_bpf_send_signal_common+0x10/0x10 [ 391.666025][T10058] ? __pfx_ip_route_input_rcu+0x10/0x10 [ 391.666043][T10058] ? inet_ehashfn+0x8d/0x210 [ 391.666101][T10058] ? ip_route_input_noref+0x98/0x250 [ 391.666123][T10058] ip_route_input_noref+0x167/0x250 [ 391.666147][T10058] ? __pfx_ip_route_input_noref+0x10/0x10 [ 391.666174][T10058] ? tcp_v4_early_demux+0x4e1/0x9d0 [ 391.666200][T10058] ? tcp_v4_early_demux+0x5ec/0x9d0 [ 391.666235][T10058] ip_rcv_finish_core+0x5af/0x1c00 [ 391.666275][T10058] ip_rcv_finish+0x14c/0x2f0 [ 391.666305][T10058] NF_HOOK+0x30c/0x3a0 [ 391.666339][T10058] ? __pfx_ip_rcv_finish+0x10/0x10 [ 391.666363][T10058] ? NF_HOOK+0x9a/0x3a0 [ 391.666387][T10058] ? __pfx_NF_HOOK+0x10/0x10 [ 391.666409][T10058] ? ip_rcv_core+0x7f7/0xd00 [ 391.666437][T10058] ? __pfx_ip_rcv_finish+0x10/0x10 [ 391.666473][T10058] ? __pfx_ip_rcv+0x10/0x10 [ 391.666496][T10058] __netif_receive_skb+0x143/0x380 [ 391.666520][T10058] ? read_tsc+0x9/0x20 [ 391.666551][T10058] ? netif_receive_skb+0x115/0x790 [ 391.666572][T10058] netif_receive_skb+0x1cb/0x790 [ 391.666598][T10058] ? __pfx_netif_receive_skb+0x10/0x10 [ 391.666627][T10058] ? trace_irq_disable+0x37/0x110 [ 391.666651][T10058] ? tun_rx_batched+0x160/0x730 [ 391.666679][T10058] tun_rx_batched+0x1b9/0x730 [ 391.666703][T10058] ? __lock_acquire+0xab9/0xd20 [ 391.666726][T10058] ? __pfx_tun_rx_batched+0x10/0x10 [ 391.666754][T10058] ? tun_get_user+0x2549/0x3ce0 [ 391.666794][T10058] tun_get_user+0x298e/0x3ce0 [ 391.666821][T10058] ? tun_get_user+0x693/0x3ce0 [ 391.666844][T10058] ? tun_get_user+0x2549/0x3ce0 [ 391.666885][T10058] ? __pfx_tun_get_user+0x10/0x10 [ 391.666913][T10058] ? __pfx_bpf_trace_run4+0x10/0x10 [ 391.666936][T10058] ? kvm_sched_clock_read+0x11/0x20 [ 391.666954][T10058] ? preempt_schedule_irq+0xb5/0x150 [ 391.666973][T10058] ? sched_clock_cpu+0x74/0x430 [ 391.667001][T10058] ? ref_tracker_alloc+0x318/0x460 [ 391.667021][T10058] ? __lock_acquire+0xab9/0xd20 [ 391.667041][T10058] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 391.667068][T10058] ? tun_get+0x1c/0x2f0 [ 391.667099][T10058] ? tun_get+0x1c/0x2f0 [ 391.667121][T10058] ? tun_get+0x1c/0x2f0 [ 391.667151][T10058] tun_chr_write_iter+0x113/0x200 [ 391.667178][T10058] vfs_write+0x54b/0xa90 [ 391.667203][T10058] ? __pfx_tun_chr_write_iter+0x10/0x10 [ 391.667229][T10058] ? __pfx_vfs_write+0x10/0x10 [ 391.667259][T10058] ? __fget_files+0x2a/0x420 [ 391.667292][T10058] ksys_write+0x145/0x250 [ 391.667319][T10058] ? __pfx_ksys_write+0x10/0x10 [ 391.667337][T10058] ? rcu_is_watching+0x15/0xb0 [ 391.667359][T10058] ? trace_sys_enter+0x25/0x120 [ 391.667383][T10058] do_syscall_64+0xfa/0x3b0 [ 391.667407][T10058] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.667426][T10058] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 391.667444][T10058] ? clear_bhb_loop+0x60/0xb0 [ 391.667469][T10058] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 391.667487][T10058] RIP: 0033:0x7fd17258d69f [ 391.667506][T10058] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 391.667523][T10058] RSP: 002b:00007fd17332c000 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 391.667544][T10058] RAX: ffffffffffffffda RBX: 00007fd1727b6090 RCX: 00007fd17258d69f [ 391.667559][T10058] RDX: 000000000000004a RSI: 0000200000000080 RDI: 00000000000000c8 [ 391.667572][T10058] RBP: 00007fd17332c090 R08: 0000000000000000 R09: 0000000000000000 [ 391.667584][T10058] R10: 000000000000004a R11: 0000000000000293 R12: 0000000000000001 [ 391.667596][T10058] R13: 00007fd1727b6128 R14: 00007fd1727b6090 R15: 00007ffcb212b018 [ 391.667630][T10058] [ 392.147141][T10019] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 393.336254][T10019] netdevsim netdevsim0 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.457258][T10082] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1116'. [ 393.458521][T10019] netdevsim netdevsim0 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.497305][T10082] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 393.517598][T10082] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 393.581076][T10019] netdevsim netdevsim0 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.636811][T10019] netdevsim netdevsim0 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 393.659379][ T927] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 393.922010][ T927] usb 5-1: Using ep0 maxpacket: 16 [ 393.930431][ T927] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 393.948431][ T927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 394.543982][ T927] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 394.567681][ T927] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 395.351439][ T927] usb 5-1: Product: syz [ 395.439301][ T927] usb 5-1: Manufacturer: syz [ 395.444042][ T927] usb 5-1: SerialNumber: syz [ 395.451813][ T927] usb 5-1: config 0 descriptor?? [ 395.613712][ T927] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 395.623958][ T927] em28xx 5-1:0.0: Audio interface 0 found (Vendor Class) [ 395.663155][T10104] input: syz0 as /devices/virtual/input/input29 [ 395.771161][T10111] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1124'. [ 395.790554][T10111] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1124'. [ 395.991738][T10104] syz.0.1121: attempt to access beyond end of device [ 395.991738][T10104] nbd0: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 396.218353][T10120] overlayfs: missing 'lowerdir' [ 396.363805][T10120] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 396.386484][ T927] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 396.410019][ T927] em28xx 5-1:0.0: Config register raw data: 0xfffffffb [ 396.907874][T10136] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1129'. [ 398.071426][ T927] em28xx 5-1:0.0: Unknown AC97 audio processor detected! [ 398.148767][ T927] em28xx 5-1:0.0: couldn't setup AC97 register 2 [ 398.202681][ T927] em28xx 5-1:0.0: couldn't setup AC97 register 4 [ 398.246182][ T927] em28xx 5-1:0.0: couldn't setup AC97 register 6 [ 398.324638][ T927] em28xx 5-1:0.0: couldn't setup AC97 register 54 [ 398.377543][ T927] em28xx 5-1:0.0: couldn't setup AC97 register 56 [ 398.607318][ T927] usb 5-1: USB disconnect, device number 15 [ 400.422918][T10174] misc userio: Invalid payload size [ 400.433553][T10171] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1138'. [ 400.461263][ T5897] kernel write not supported for file /bluetooth/6lowpan_control (pid: 5897 comm: kworker/0:3) [ 400.551704][T10177] overlayfs: missing 'lowerdir' [ 401.389629][T10181] netlink: 1041 bytes leftover after parsing attributes in process `syz.0.1141'. [ 401.486740][ T30] audit: type=1326 audit(1755892039.549:829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10182 comm="syz.2.1143" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f44b018ebe9 code=0x0 [ 402.110606][T10187] netlink: 'syz.1.1144': attribute type 21 has an invalid length. [ 402.125817][T10200] bridge0: entered promiscuous mode [ 402.141473][T10187] netlink: 156 bytes leftover after parsing attributes in process `syz.1.1144'. [ 402.150721][T10187] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1144'. [ 402.311613][T10208] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 402.466055][ T5897] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 402.649466][ T10] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 402.725446][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 402.784845][ T5897] usb 3-1: config 8 has an invalid interface number: 39 but max is 0 [ 402.810457][ T5897] usb 3-1: config 8 has no interface number 0 [ 402.857932][ T5897] usb 3-1: config 8 interface 39 altsetting 1 has an endpoint descriptor with address 0xDF, changing to 0x8F [ 402.871367][ T10] usb 4-1: Using ep0 maxpacket: 16 [ 402.881988][ T5897] usb 3-1: config 8 interface 39 altsetting 1 endpoint 0x8F has invalid wMaxPacketSize 0 [ 402.893253][ T10] usb 4-1: config 0 has an invalid interface number: 8 but max is 0 [ 402.912275][ T5897] usb 3-1: config 8 interface 39 altsetting 1 bulk endpoint 0x8F has invalid maxpacket 0 [ 402.923268][ T10] usb 4-1: config 0 has no interface number 0 [ 402.941970][ T10] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 34, changing to 9 [ 402.988706][ T5897] usb 3-1: config 8 interface 39 has no altsetting 0 [ 403.036017][ T10] usb 4-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid maxpacket 41732, setting to 1024 [ 403.094359][ T5897] usb 3-1: New USB device found, idVendor=05ac, idProduct=c704, bcdDevice=62.77 [ 403.149794][ T5921] usb 1-1: new high-speed USB device number 23 using dummy_hcd [ 403.167117][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 403.192931][ T10] usb 4-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 403.253219][ T5897] usb 3-1: Product: syz [ 403.266963][ T10] usb 4-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 403.297166][ T5897] usb 3-1: Manufacturer: syz [ 403.331792][ T5897] usb 3-1: SerialNumber: syz [ 403.346880][ T10] usb 4-1: Product: syz [ 403.394322][ T10] usb 4-1: SerialNumber: syz [ 403.550768][ T5921] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 403.571264][ T10] usb 4-1: config 0 descriptor?? [ 403.674049][ T5921] usb 1-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 403.773189][ T5921] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 403.792205][ T10] cm109 4-1:0.8: invalid payload size 1024, expected 4 [ 404.024181][ T10] input: CM109 USB driver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.8/input/input30 [ 404.037246][ T5921] usb 1-1: config 0 descriptor?? [ 404.586277][ T5921] usbhid 1-1:0.0: can't add hid device: -71 [ 404.606617][ T5921] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 404.629638][ T5921] usb 1-1: USB disconnect, device number 23 [ 404.706647][T10222] team_slave_0: entered promiscuous mode [ 404.712670][T10222] team_slave_1: entered promiscuous mode [ 404.718918][T10222] macsec1: entered promiscuous mode [ 404.726476][T10222] team0: entered promiscuous mode [ 404.733408][T10222] mac80211_hwsim hwsim6 wlan1: entered promiscuous mode [ 405.119899][ T5897] ipheth 3-1:8.39: ipheth_enable_ncm: usb_control_msg: -110 [ 405.170408][T10222] macsec1: entered allmulticast mode [ 405.176346][T10222] team0: entered allmulticast mode [ 405.198823][T10222] team_slave_0: entered allmulticast mode [ 405.214025][T10222] team_slave_1: entered allmulticast mode [ 405.254301][T10222] mac80211_hwsim hwsim6 wlan1: entered allmulticast mode [ 405.257027][ T5920] usb 4-1: USB disconnect, device number 13 [ 405.261755][ C0] cm109 4-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 405.261928][ C0] cm109 4-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 405.314565][T10222] team0: Device macsec1 is already an upper device of the team interface [ 405.323518][ T5920] cm109 4-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 405.358293][T10229] xt_hashlimit: max too large, truncated to 1048576 [ 405.371702][T10229] xt_hashlimit: overflow, try lower: 0/0 [ 405.378558][T10222] team0: left allmulticast mode [ 405.391186][T10222] team_slave_0: left allmulticast mode [ 405.396701][T10222] team_slave_1: left allmulticast mode [ 405.413486][T10222] mac80211_hwsim hwsim6 wlan1: left allmulticast mode [ 405.421371][T10222] team0: left promiscuous mode [ 405.426902][T10222] mac80211_hwsim hwsim6 wlan1: left promiscuous mode [ 405.435989][T10222] team_slave_0: left promiscuous mode [ 405.441507][T10222] team_slave_1: left promiscuous mode [ 405.476777][ T5897] ipheth 3-1:8.39: Apple iPhone USB Ethernet device attached [ 405.568763][T10235] block nbd1: NBD_DISCONNECT [ 405.605836][T10235] netdevsim netdevsim1: Direct firmware load for ./file0 failed with error -2 [ 405.620251][T10235] netdevsim netdevsim1: Falling back to sysfs fallback for: ./file0 [ 405.699417][ T5920] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 405.839502][ T5920] usb 4-1: device descriptor read/64, error -71 [ 405.939413][ T5897] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 406.090092][ T5920] usb 4-1: new high-speed USB device number 15 using dummy_hcd [ 406.101457][ T5897] usb 5-1: config 0 has an invalid interface number: 229 but max is 0 [ 406.118543][ T5897] usb 5-1: config 0 has no interface number 0 [ 406.135765][ T5897] usb 5-1: New USB device found, idVendor=0dfc, idProduct=0001, bcdDevice= c.19 [ 406.149903][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 406.173223][ T5897] usb 5-1: config 0 descriptor?? [ 406.229423][ T5920] usb 4-1: device descriptor read/64, error -71 [ 406.347900][ T5920] usb usb4-port1: attempt power cycle [ 406.381696][ T5897] usb 5-1: USB disconnect, device number 16 [ 406.587297][ T5949] usb 3-1: USB disconnect, device number 15 [ 406.642545][T10252] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 406.655619][T10252] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 406.709444][ T5920] usb 4-1: new high-speed USB device number 16 using dummy_hcd [ 406.739999][ T5920] usb 4-1: device descriptor read/8, error -71 [ 406.790425][ T5949] ipheth 3-1:8.39: Apple iPhone USB Ethernet now disconnected [ 406.989654][ T5920] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 407.103709][ T5920] usb 4-1: device descriptor read/8, error -71 [ 407.282158][ T5920] usb usb4-port1: unable to enumerate USB device [ 407.867971][T10275] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1164'. [ 408.110544][T10285] overlayfs: missing 'lowerdir' [ 408.472070][T10296] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1171'. [ 408.708558][ T51] Bluetooth: hci4: command 0x041b tx timeout [ 408.807490][T10305] IPVS: set_ctl: invalid protocol: 135 172.20.20.170:20003 [ 408.823754][T10303] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 408.898459][T10306] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 409.028597][T10303] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 409.035067][T10306] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 409.331678][T10310] netlink: 'syz.1.1172': attribute type 10 has an invalid length. [ 409.339622][T10310] netlink: 40 bytes leftover after parsing attributes in process `syz.1.1172'. [ 409.350626][T10310] batman_adv: batadv0: Adding interface: virt_wifi0 [ 409.357249][T10310] batman_adv: batadv0: The MTU of interface virt_wifi0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 409.383173][T10310] batman_adv: batadv0: Interface activated: virt_wifi0 [ 410.193550][T10325] pimreg: entered allmulticast mode [ 410.291492][T10325] batadv1: entered promiscuous mode [ 410.374260][T10334] delete_channel: no stack [ 410.449657][ T5949] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 410.603617][T10339] overlayfs: missing 'lowerdir' [ 410.623546][ T5949] usb 4-1: Using ep0 maxpacket: 8 [ 410.667539][ T5949] usb 4-1: unable to get BOS descriptor or descriptor too short [ 410.700271][ T5949] usb 4-1: config 8 has an invalid interface number: 154 but max is 0 [ 410.729822][ T5949] usb 4-1: config 8 has no interface number 0 [ 410.743521][ T5949] usb 4-1: config 8 interface 154 has no altsetting 0 [ 410.772382][ T5949] usb 4-1: New USB device found, idVendor=055f, idProduct=a800, bcdDevice=4f.f6 [ 410.799496][ T5949] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.825440][ T5949] usb 4-1: Product: syz [ 410.835787][ T5949] usb 4-1: Manufacturer: syz [ 410.841122][ T5949] usb 4-1: SerialNumber: syz [ 411.110773][ T5920] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 411.538716][ T5949] mdc800 4-1:8.154: probe fails -> wrong Interface [ 411.559440][ T5897] usb 1-1: new high-speed USB device number 24 using dummy_hcd [ 411.570451][ T5949] usb 4-1: USB disconnect, device number 18 [ 411.599845][ T5920] usb 5-1: Using ep0 maxpacket: 32 [ 411.611762][ T5920] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 411.648720][ T5920] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 411.719347][ T5920] usb 5-1: New USB device found, idVendor=1e7d, idProduct=2d51, bcdDevice= 0.00 [ 411.738203][T10353] mac80211_hwsim hwsim8 wlan0: entered promiscuous mode [ 411.746506][ T5920] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 411.766967][T10353] macsec1: entered promiscuous mode [ 411.776574][ T5920] usb 5-1: config 0 descriptor?? [ 411.798947][T10353] macsec1: entered allmulticast mode [ 411.824019][T10353] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 412.818405][ T5920] koneplus 0003:1E7D:2D51.0004: item fetching failed at offset 1/5 [ 412.937445][ T5920] koneplus 0003:1E7D:2D51.0004: parse failed [ 413.141646][ T5920] koneplus 0003:1E7D:2D51.0004: probe with driver koneplus failed with error -22 [ 413.729468][ T5897] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 413.768656][T10390] overlayfs: missing 'lowerdir' [ 413.773816][T10389] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1197'. [ 413.879338][ T5897] usb 3-1: Using ep0 maxpacket: 32 [ 413.889397][T10393] overlayfs: missing 'lowerdir' [ 414.615959][ T5897] usb 3-1: config 0 has an invalid interface number: 66 but max is 0 [ 414.729719][ T5897] usb 3-1: config 0 has no interface number 0 [ 414.739703][ T5897] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 414.748920][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.756985][ T5897] usb 3-1: Product: syz [ 414.769274][ T5897] usb 3-1: Manufacturer: syz [ 414.788154][ T5897] usb 3-1: SerialNumber: syz [ 414.840254][ T5897] usb 3-1: config 0 descriptor?? [ 414.853856][ T5897] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 414.873415][ T5897] dvb-usb: bulk message failed: -22 (2/0) [ 414.887896][ T5897] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 414.905889][ T30] audit: type=1326 audit(1755892052.969:830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10398 comm="syz.3.1199" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f4ecf78ebe9 code=0x0 [ 414.929678][ T5897] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 414.952288][ T5897] usb 3-1: media controller created [ 414.995985][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 415.113566][ T5921] IPVS: starting estimator thread 0... [ 415.126331][T10378] dvb-usb: bulk message failed: -22 (5/0) [ 415.210931][ T5897] cxusb: set interface failed [ 415.229658][T10401] IPVS: using max 32 ests per chain, 76800 per kthread [ 415.241455][ T5897] dvb-usb: bulk message failed: -22 (1/0) [ 415.334103][ T5920] usb 5-1: USB disconnect, device number 17 [ 415.465736][T10409] random: crng reseeded on system resumption [ 415.628134][T10415] netlink: 132 bytes leftover after parsing attributes in process `syz.3.1200'. [ 416.245470][T10413] 9pnet_fd: Insufficient options for proto=fd [ 416.311047][T10419] overlayfs: missing 'lowerdir' [ 416.326636][ T5897] DVB: Unable to find symbol lgdt330x_attach() [ 416.337955][ T5897] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 417.779710][ T5897] rc_core: IR keymap rc-dvico-portable not found [ 417.791625][ T5897] Registered IR keymap rc-empty [ 417.997256][ T5897] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 418.310373][ T5897] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input31 [ 418.329818][ T5897] dvb-usb: schedule remote query interval to 100 msecs. [ 418.349015][ T5897] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 418.389089][ T5897] usb 3-1: USB disconnect, device number 16 [ 418.646252][ T5897] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 419.173248][T10443] netlink: 'syz.1.1209': attribute type 1 has an invalid length. [ 420.099544][T10448] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 420.280047][T10455] overlayfs: missing 'lowerdir' [ 422.779418][ T5897] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 422.852677][T10514] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 422.903320][T10514] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 422.979574][ T5897] usb 4-1: Using ep0 maxpacket: 32 [ 423.008421][ T5897] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 423.061931][ T5897] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 423.138596][ T5897] usb 4-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 423.164707][T10520] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1228'. [ 423.177361][ T5897] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.227352][ T5897] usb 4-1: config 0 descriptor?? [ 423.513741][T10522] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1229'. [ 423.598764][T10524] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1229'. [ 423.696815][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.768416][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.788681][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.798817][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.844317][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.870444][T10526] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 423.888722][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.896703][ T5921] usb 1-1: new full-speed USB device number 25 using dummy_hcd [ 423.910919][T10526] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 423.921929][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.928767][ T5897] savu 0003:1E7D:2D5A.0005: unknown main item tag 0x0 [ 423.975940][ T5897] savu 0003:1E7D:2D5A.0005: hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.3-1/input0 [ 424.015049][ T5897] usb 4-1: USB disconnect, device number 19 [ 424.039381][ T5921] usb 1-1: device descriptor read/64, error -71 [ 424.218278][T10532] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 424.249692][T10532] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 424.341381][ T5921] usb 1-1: new full-speed USB device number 26 using dummy_hcd [ 424.499350][ T5921] usb 1-1: device descriptor read/64, error -71 [ 425.405882][T10537] overlayfs: missing 'lowerdir' [ 425.439845][ T5921] usb usb1-port1: attempt power cycle [ 425.669455][ T5943] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 425.899633][ T5921] usb 1-1: new full-speed USB device number 27 using dummy_hcd [ 425.929446][ T5943] usb 5-1: Using ep0 maxpacket: 16 [ 425.976772][ T5921] usb 1-1: device descriptor read/8, error -71 [ 425.984626][ T5943] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 426.004153][ T5943] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 426.035713][ T5943] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 426.052355][ T5943] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 426.072500][ T5943] usb 5-1: Product: syz [ 426.087585][ T5943] usb 5-1: Manufacturer: syz [ 426.098609][ T5943] usb 5-1: SerialNumber: syz [ 426.229386][ T5921] usb 1-1: new full-speed USB device number 28 using dummy_hcd [ 426.273890][ T5921] usb 1-1: device descriptor read/8, error -71 [ 426.391551][ T5943] usb 5-1: 0:2 : does not exist [ 426.402946][ T5943] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 426.422481][ T5921] usb usb1-port1: unable to enumerate USB device [ 426.435095][ T5943] usb 5-1: USB disconnect, device number 18 [ 427.145258][T10559] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1237'. [ 427.950441][T10563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 427.981053][T10563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 428.040654][T10563] netlink: 68 bytes leftover after parsing attributes in process `syz.1.1240'. [ 428.080472][T10563] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1240'. [ 428.164870][T10563] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1240'. [ 428.221507][T10577] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1243'. [ 428.337461][T10580] overlayfs: missing 'workdir' [ 428.462982][T10585] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(8) [ 428.469557][T10585] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 428.544459][T10590] vhci_hcd vhci_hcd.0: pdev(4) rhport(1) sockfd(11) [ 428.551127][T10590] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 428.561422][T10585] vhci_hcd vhci_hcd.0: Device attached [ 428.599604][T10585] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 428.635460][T10585] vhci_hcd vhci_hcd.0: pdev(4) rhport(3) sockfd(15) [ 428.642133][T10585] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 428.649910][T10590] vhci_hcd vhci_hcd.0: Device attached [ 428.698533][T10590] vhci_hcd vhci_hcd.0: pdev(4) rhport(4) sockfd(13) [ 428.705189][T10590] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 428.713100][T10585] vhci_hcd vhci_hcd.0: Device attached [ 428.739501][ T5921] vhci_hcd: vhci_device speed not set [ 428.827742][ T5921] usb 41-1: new full-speed USB device number 6 using vhci_hcd [ 429.693865][T10590] vhci_hcd vhci_hcd.0: Device attached [ 429.825485][T10610] Can't find ip_set type hash [ 430.113933][T10585] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 430.139334][T10604] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(17) [ 430.145993][T10604] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 430.165765][T10604] vhci_hcd vhci_hcd.0: Device attached [ 430.185167][T10615] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 430.211382][T10615] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 430.238808][T10614] vhci_hcd: connection closed [ 430.239071][ T3452] vhci_hcd: stop threads [ 430.239156][T10601] vhci_hcd: connection closed [ 430.248762][T10591] vhci_hcd: connection closed [ 430.249046][T10595] vhci_hcd: connection closed [ 430.265530][T10586] vhci_hcd: connection reset by peer [ 430.283169][ T3452] vhci_hcd: release socket [ 430.298460][ T3452] vhci_hcd: disconnect device [ 430.320436][ T3452] vhci_hcd: stop threads [ 430.324737][ T3452] vhci_hcd: release socket [ 430.334592][T10603] syz.0.1246 (10603) used obsolete PPPIOCDETACH ioctl [ 430.365995][ T3452] vhci_hcd: disconnect device [ 430.402516][ T3452] vhci_hcd: stop threads [ 430.406826][ T3452] vhci_hcd: release socket [ 430.451438][ T3452] vhci_hcd: disconnect device [ 430.479573][ T3452] vhci_hcd: stop threads [ 430.490206][ T3452] vhci_hcd: release socket [ 430.562263][T10632] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1252'. [ 430.599252][ T3452] vhci_hcd: disconnect device [ 430.660954][ T5943] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 430.899586][ T3452] vhci_hcd: stop threads [ 430.904685][ T3452] vhci_hcd: release socket [ 430.922188][ T3452] vhci_hcd: disconnect device [ 431.092198][ T5943] usb 4-1: Using ep0 maxpacket: 16 [ 431.122955][ T5943] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 431.148329][T10641] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1257'. [ 431.154010][ T5943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 431.178624][T10645] futex_wake_op: syz.1.1256 tries to shift op by -1; fix this program [ 432.002986][ T5943] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 432.013707][ T5943] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 432.026810][ T5943] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 432.041749][ T5943] usb 4-1: New USB device found, idVendor=204e, idProduct=b138, bcdDevice= 1.42 [ 432.050958][ T5943] usb 4-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 432.058972][ T5943] usb 4-1: Manufacturer: syz [ 432.093880][T10648] overlayfs: missing 'lowerdir' [ 432.179375][ T5897] usb 5-1: new full-speed USB device number 19 using dummy_hcd [ 432.245906][ T5943] usb 4-1: config 0 descriptor?? [ 432.394566][ T5897] usb 5-1: config 0 has an invalid interface number: 176 but max is 2 [ 432.413809][ T5897] usb 5-1: config 0 has an invalid interface number: 3 but max is 2 [ 432.437229][ T5897] usb 5-1: config 0 has no interface number 0 [ 432.456130][ T5897] usb 5-1: config 0 has no interface number 1 [ 432.537249][T10657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.549268][ T5897] usb 5-1: too many endpoints for config 0 interface 3 altsetting 255: 255, using maximum allowed: 30 [ 432.550752][T10657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 432.568535][T10629] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 432.706526][T10629] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 433.239297][ T5897] usb 5-1: config 0 interface 3 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 433.269266][ T5897] usb 5-1: config 0 interface 3 has no altsetting 0 [ 433.276032][ T5897] usb 5-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 433.414668][ T5897] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 433.430930][ T5897] usb 5-1: config 0 descriptor?? [ 433.453872][T10657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 434.408540][T10666] (unnamed net_device) (uninitialized): peer notification delay (9) is not a multiple of miimon (5), value rounded to 5 ms [ 434.430427][T10657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 434.678166][ T5897] usb 5-1: Could not set interface, error -71 [ 434.763356][ T5897] usb 5-1: selecting invalid altsetting 0 [ 434.773779][ T5897] usb 5-1: Could not set interface, error -22 [ 434.787648][ T5897] usb 5-1: USB disconnect, device number 19 [ 434.819670][ T5921] vhci_hcd: vhci_device speed not set [ 434.837630][T10666] 8021q: adding VLAN 0 to HW filter on device bond2 [ 434.846923][T10670] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1263'. [ 435.977369][T10683] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1267'. [ 436.188941][T10692] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1269'. [ 436.210369][ T5897] usb 4-1: USB disconnect, device number 20 [ 436.479064][T10697] hub 8-0:1.0: USB hub found [ 436.487220][T10697] hub 8-0:1.0: 1 port detected [ 436.540144][T10692] overlayfs: missing 'lowerdir' [ 437.324792][T10691] delete_channel: no stack [ 438.570573][ T5897] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 438.809369][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 439.393230][ T5943] usb 1-1: new high-speed USB device number 29 using dummy_hcd [ 439.427849][ T5897] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 439.458795][ T5897] usb 3-1: config 0 has no interface number 0 [ 439.538373][ T5897] usb 3-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 439.563177][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.573310][ T5897] usb 3-1: Product: syz [ 439.578565][ T5897] usb 3-1: Manufacturer: syz [ 439.611474][ T5943] usb 1-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 439.702364][ T5897] usb 3-1: SerialNumber: syz [ 439.710359][ T5897] usb 3-1: config 0 descriptor?? [ 440.200407][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.207057][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.524525][ T5943] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.610515][ T5943] usb 1-1: config 0 descriptor?? [ 440.648836][T10717] netlink: 19 bytes leftover after parsing attributes in process `syz.2.1275'. [ 440.678865][ T5943] cp210x 1-1:0.0: cp210x converter detected [ 440.745335][ T5897] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 440.766839][ T30] audit: type=1326 audit(1755892078.829:831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10736 comm="syz.1.1281" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f443e78ebe9 code=0x0 [ 440.796896][ T5897] gspca_spca1528: reg_w err -71 [ 440.819543][ T5897] spca1528 3-1:0.1: probe with driver spca1528 failed with error -71 [ 440.835073][ T5897] usb 3-1: USB disconnect, device number 17 [ 440.881154][T10743] overlayfs: failed to resolve './file0': -2 [ 441.352116][T10747] Lens B: ================= START STATUS ================= [ 441.359825][T10747] Lens B: Focus, Absolute: 0 [ 441.364976][T10747] Lens B: ================== END STATUS ================== [ 441.392805][ T5943] cp210x 1-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 441.782879][ T5943] usb 1-1: cp210x converter now attached to ttyUSB0 [ 441.960504][T10753] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1283'. [ 442.088166][ T5897] usb 1-1: USB disconnect, device number 29 [ 442.108277][ T5897] cp210x ttyUSB0: cp210x converter now disconnected from ttyUSB0 [ 442.363259][ T5897] cp210x 1-1:0.0: device disconnected [ 442.379388][ T5920] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 442.490788][T10759] Smack: duplicate mount options [ 442.699964][ T5920] usb 4-1: Using ep0 maxpacket: 32 [ 442.898263][T10755] overlayfs: missing 'lowerdir' [ 443.152478][ T5920] usb 4-1: config 0 has an invalid interface number: 66 but max is 0 [ 443.223828][ T5920] usb 4-1: config 0 has no interface number 0 [ 443.362849][ T5920] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 443.595904][ T5920] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 443.658230][ T5920] usb 4-1: Product: syz [ 443.690142][ T5920] usb 4-1: Manufacturer: syz [ 443.695482][ T5920] usb 4-1: SerialNumber: syz [ 443.740864][ T5920] usb 4-1: config 0 descriptor?? [ 443.922816][T10770] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 443.933081][ T5897] kernel write not supported for file task/832/attr/keycreate (pid: 5897 comm: kworker/0:3) [ 443.937999][ T5920] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 444.039587][ T5920] dvb-usb: bulk message failed: -22 (2/0) [ 444.072495][ T5920] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 444.102770][ T5920] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 444.118749][ T5920] usb 4-1: media controller created [ 444.161937][T10776] overlayfs: missing 'lowerdir' [ 444.215661][T10749] dvb-usb: bulk message failed: -22 (5/0) [ 444.234065][ T5920] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 444.263238][ T5897] usb 1-1: new high-speed USB device number 30 using dummy_hcd [ 444.315128][ T5920] cxusb: set interface failed [ 444.339606][ T5920] dvb-usb: bulk message failed: -22 (1/0) [ 444.525669][ T5897] usb 1-1: New USB device found, idVendor=0582, idProduct=008d, bcdDevice=7a.ac [ 444.738450][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 444.824935][ T5897] usb 1-1: Product: syz [ 444.868895][ T5897] usb 1-1: Manufacturer: syz [ 444.971331][ T5897] usb 1-1: SerialNumber: syz [ 445.197572][ T5897] usb 1-1: config 0 descriptor?? [ 445.268456][ T5897] usb 1-1: interface 1 not found [ 445.293652][ T5920] DVB: Unable to find symbol lgdt330x_attach() [ 445.322832][ T5920] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 445.440019][T10791] ALSA: mixer_oss: invalid OSS volume '' [ 445.459509][ T5920] rc_core: IR keymap rc-dvico-portable not found [ 445.465902][ T5920] Registered IR keymap rc-empty [ 445.474173][T10791] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 445.489743][ T5921] usb 1-1: USB disconnect, device number 30 [ 445.491844][T10791] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 445.512173][T10791] iommufd_mock iommufd_mock2: Adding to iommu group 2 [ 445.519866][ T5920] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 445.549445][ T5920] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input32 [ 445.582024][ T5920] dvb-usb: schedule remote query interval to 100 msecs. [ 445.589036][ T5920] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 445.619682][ T5920] usb 4-1: USB disconnect, device number 21 [ 445.668486][ T5920] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 445.814613][ T5897] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 445.880053][T10797] netlink: 72 bytes leftover after parsing attributes in process `syz.4.1297'. [ 445.964819][T10798] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 445.973850][ T5920] usb 4-1: new full-speed USB device number 22 using dummy_hcd [ 445.982268][T10798] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 446.003704][ T5897] usb 3-1: Using ep0 maxpacket: 16 [ 446.235399][ T5920] usb 4-1: New USB device found, idVendor=2304, idProduct=020f, bcdDevice=3b.de [ 446.308732][ T5920] usb 4-1: New USB device strings: Mfr=1, Product=12, SerialNumber=3 [ 446.372199][ T5920] usb 4-1: Product: syz [ 446.415269][ T5920] usb 4-1: Manufacturer: syz [ 446.451614][ T5920] usb 4-1: SerialNumber: syz [ 446.605977][ T5920] usb 4-1: config 0 descriptor?? [ 446.748418][ T5897] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 446.758564][ T5897] usb 3-1: config 0 interface 0 altsetting 1 endpoint 0x89 has invalid wMaxPacketSize 0 [ 446.760168][ T5920] dvb-usb: found a 'Pinnacle 400e DVB-S USB2.0' in warm state. [ 446.768525][ T5897] usb 3-1: config 0 interface 0 has no altsetting 0 [ 446.785611][ T5897] usb 3-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 446.794798][ T5897] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 446.806471][ T5897] usb 3-1: Product: syz [ 446.810765][ T5897] usb 3-1: Manufacturer: syz [ 446.815380][ T5897] usb 3-1: SerialNumber: syz [ 446.828356][ T5897] usb 3-1: config 0 descriptor?? [ 446.873087][ T5920] dvb-usb: bulk message failed: -22 (4/0) [ 446.897420][ T5920] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 446.952223][ T5920] dvb-usb: bulk message failed: -22 (5/0) [ 446.968651][ T5920] ttusb2: there might have been an error during control message transfer. (rlen = 0, was 0) [ 447.055118][ T5920] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 447.323250][ T5920] dvb-usb: Pinnacle 400e DVB-S USB2.0 error while loading driver (-19) [ 447.569453][ T5920] usb 4-1: USB disconnect, device number 22 [ 448.098877][T10825] overlayfs: missing 'lowerdir' [ 448.429443][ T5897] usb 1-1: new high-speed USB device number 31 using dummy_hcd [ 448.601328][ T5897] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 448.619370][ T5897] usb 1-1: New USB device found, idVendor=056a, idProduct=00c6, bcdDevice= 0.00 [ 448.640613][ T5897] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 448.670952][ T5897] usb 1-1: config 0 descriptor?? [ 449.717129][ T5920] usb 3-1: USB disconnect, device number 18 [ 450.356811][ T5897] wacom 0003:056A:00C6.0006: hidraw0: USB HID v0.00 Device [HID 056a:00c6] on usb-dummy_hcd.0-1/input0 [ 450.509744][T10845] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1310'. [ 450.778032][T10847] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 450.788234][T10847] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 451.850960][T10848] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1309'. [ 452.424633][ T5897] usb 1-1: USB disconnect, device number 31 [ 452.843289][T10871] ptrace attach of "./syz-executor exec"[5837] was attempted by "./syz-executor exec"[10871] [ 454.210950][T10896] FAULT_INJECTION: forcing a failure. [ 454.210950][T10896] name failslab, interval 1, probability 0, space 0, times 0 [ 454.223754][T10896] CPU: 1 UID: 0 PID: 10896 Comm: syz.4.1321 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 454.223779][T10896] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 454.223794][T10896] Call Trace: [ 454.223804][T10896] [ 454.223812][T10896] dump_stack_lvl+0x189/0x250 [ 454.223838][T10896] ? __pfx____ratelimit+0x10/0x10 [ 454.223859][T10896] ? __pfx_dump_stack_lvl+0x10/0x10 [ 454.223879][T10896] ? __pfx__printk+0x10/0x10 [ 454.223906][T10896] ? __pfx___might_resched+0x10/0x10 [ 454.223928][T10896] ? fs_reclaim_acquire+0x7d/0x100 [ 454.223955][T10896] should_fail_ex+0x414/0x560 [ 454.223980][T10896] should_failslab+0xa8/0x100 [ 454.224002][T10896] __kmalloc_noprof+0xcb/0x4f0 [ 454.224020][T10896] ? tomoyo_encode+0x28b/0x550 [ 454.224052][T10896] tomoyo_encode+0x28b/0x550 [ 454.224079][T10896] tomoyo_realpath_from_path+0x58d/0x5d0 [ 454.224114][T10896] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 454.224133][T10896] tomoyo_path_number_perm+0x1e8/0x5a0 [ 454.224154][T10896] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 454.224178][T10896] ? __lock_acquire+0xab9/0xd20 [ 454.224208][T10896] ? __lock_acquire+0xab9/0xd20 [ 454.224248][T10896] ? __fget_files+0x2a/0x420 [ 454.224273][T10896] ? __fget_files+0x2a/0x420 [ 454.224292][T10896] ? __fget_files+0x3a0/0x420 [ 454.224311][T10896] ? __fget_files+0x2a/0x420 [ 454.224337][T10896] security_file_ioctl+0xcb/0x2d0 [ 454.224361][T10896] __se_sys_ioctl+0x47/0x170 [ 454.224391][T10896] do_syscall_64+0xfa/0x3b0 [ 454.224423][T10896] ? lockdep_hardirqs_on+0x9c/0x150 [ 454.224443][T10896] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.224461][T10896] ? clear_bhb_loop+0x60/0xb0 [ 454.224485][T10896] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 454.224503][T10896] RIP: 0033:0x7fd17258ebe9 [ 454.224521][T10896] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 454.224539][T10896] RSP: 002b:00007fd17332c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 454.224559][T10896] RAX: ffffffffffffffda RBX: 00007fd1727b6090 RCX: 00007fd17258ebe9 [ 454.224572][T10896] RDX: 00002000000000c0 RSI: 0000000000000720 RDI: 000000000000000a [ 454.224585][T10896] RBP: 00007fd17332c090 R08: 0000000000000000 R09: 0000000000000000 [ 454.224597][T10896] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 454.224607][T10896] R13: 00007fd1727b6128 R14: 00007fd1727b6090 R15: 00007ffcb212b018 [ 454.224639][T10896] [ 454.224778][T10896] ERROR: Out of memory at tomoyo_realpath_from_path. [ 454.396895][T10905] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1324'. [ 454.504564][T10906] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1325'. [ 454.648169][T10912] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 454.657672][T10912] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 454.669343][ T927] usb 1-1: new high-speed USB device number 32 using dummy_hcd [ 455.413214][ T927] usb 1-1: Using ep0 maxpacket: 8 [ 456.295147][ T5943] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 456.580377][ T927] usb 1-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 456.646615][ T927] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 456.729381][ T927] usb 1-1: Product: syz [ 456.749262][ T927] usb 1-1: Manufacturer: syz [ 456.759618][ T5943] usb 3-1: Using ep0 maxpacket: 8 [ 456.889012][ T927] usb 1-1: SerialNumber: syz [ 456.911769][ T5943] usb 3-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 1024, setting to 64 [ 456.923642][ T927] usb 1-1: config 0 descriptor?? [ 456.937417][ T5943] usb 3-1: config 0 interface 0 has no altsetting 0 [ 456.962035][ T927] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 457.015745][T10934] netlink: 'syz.1.1331': attribute type 3 has an invalid length. [ 457.023743][T10934] netlink: 199836 bytes leftover after parsing attributes in process `syz.1.1331'. [ 457.045638][T10934] bridge0: port 2(bridge_slave_1) entered disabled state [ 457.053362][T10934] bridge0: port 1(bridge_slave_0) entered disabled state [ 457.064780][T10934] bridge0: entered allmulticast mode [ 457.342041][ T5943] usb 3-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 457.417918][ T5943] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 457.469121][ T5943] usb 3-1: Product: syz [ 457.482334][ T5943] usb 3-1: Manufacturer: syz [ 457.494019][ T5943] usb 3-1: SerialNumber: syz [ 457.515403][ T927] gspca_sonixj: reg_r err -71 [ 457.537270][ T927] sonixj 1-1:0.0: probe with driver sonixj failed with error -71 [ 457.555100][ T5943] usb 3-1: config 0 descriptor?? [ 457.587056][ T927] usb 1-1: USB disconnect, device number 32 [ 457.597555][ T5943] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 found [ 457.765183][T10947] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1336'. [ 457.774388][ T5949] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 457.783728][T10947] netlink: 24 bytes leftover after parsing attributes in process `syz.3.1336'. [ 457.813653][ T5943] snd_usb_toneport 3-1:0.0: Line 6 TonePort UX2 now disconnected [ 457.842238][ T5943] snd_usb_toneport 3-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 457.939695][ T5949] usb 5-1: Using ep0 maxpacket: 8 [ 457.946628][ T5949] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 457.973856][ T5949] usb 5-1: config 0 has no interface number 0 [ 457.980274][ T5949] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 457.991879][ T5949] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 458.001654][ T5949] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 458.021715][ T5949] usb 5-1: config 0 descriptor?? [ 458.029371][ T5897] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 458.066177][ T5949] iowarrior 5-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 458.143621][T10950] No such timeout policy "syz0" [ 458.214275][ T5897] usb 4-1: Using ep0 maxpacket: 32 [ 458.236012][ T5897] usb 4-1: New USB device found, idVendor=04e2, idProduct=1424, bcdDevice=8a.0a [ 458.254232][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.276057][ T5897] usb 4-1: Product: syz [ 458.288085][ T5943] usb 5-1: USB disconnect, device number 20 [ 458.308867][ T5897] usb 4-1: Manufacturer: syz [ 458.319665][ T5897] usb 4-1: SerialNumber: syz [ 458.333714][ T5897] usb 4-1: config 0 descriptor?? [ 458.346734][ T5897] xr_serial 4-1:0.0: skipping garbage [ 458.363166][ T927] usb 3-1: USB disconnect, device number 19 [ 459.066386][T10962] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1339'. [ 459.138022][T10963] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 459.151156][T10963] autofs: Bad value for 'fd' [ 461.722408][T10983] overlayfs: missing 'lowerdir' [ 461.876052][ T5943] usb 4-1: USB disconnect, device number 23 [ 461.876253][ T5949] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 462.439303][ T5949] usb 3-1: Using ep0 maxpacket: 32 [ 462.461836][ T5949] usb 3-1: config 0 has an invalid interface number: 66 but max is 0 [ 462.493739][ T5949] usb 3-1: config 0 has no interface number 0 [ 462.527143][T11005] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1351'. [ 462.538527][ T5949] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 462.564918][ T5949] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.746972][ T5836] Bluetooth: hci4: command 0x041b tx timeout [ 463.137316][ T5949] usb 3-1: Product: syz [ 463.141645][ T5949] usb 3-1: Manufacturer: syz [ 463.153394][ T5949] usb 3-1: SerialNumber: syz [ 463.181457][ T5949] usb 3-1: config 0 descriptor?? [ 463.260724][T11015] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 463.270637][T11015] autofs: Bad value for 'fd' [ 463.637951][ T5949] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 463.681651][ T5949] dvb-usb: bulk message failed: -22 (2/0) [ 463.758221][ T5949] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 463.816090][ T5949] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 463.878004][T10979] dvb-usb: bulk message failed: -22 (5/0) [ 463.889007][ T5949] usb 3-1: media controller created [ 464.253918][ T5949] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 464.533891][ T5949] cxusb: set interface failed [ 464.548006][ T5949] dvb-usb: bulk message failed: -22 (1/0) [ 464.812069][ T5949] DVB: Unable to find symbol lgdt330x_attach() [ 464.843823][ T5949] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 464.962897][T11055] netlink: 72 bytes leftover after parsing attributes in process `syz.3.1364'. [ 464.989332][ T5897] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 465.069528][ T5949] rc_core: IR keymap rc-dvico-portable not found [ 465.076008][ T5949] Registered IR keymap rc-empty [ 465.188392][T11058] fuse: Bad value for 'fd' [ 465.701556][ T5897] usb 5-1: device descriptor read/64, error -71 [ 465.821303][ T5949] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 465.833195][ T5949] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input36 [ 465.884571][ T5949] dvb-usb: schedule remote query interval to 100 msecs. [ 465.894424][ T5949] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 465.907117][ T5949] usb 3-1: USB disconnect, device number 20 [ 466.000432][T11062] netlink: 41 bytes leftover after parsing attributes in process `syz.0.1365'. [ 466.059721][ T5897] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 466.208126][ T5949] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 466.248078][T11070] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1367'. [ 466.269623][ T5897] usb 5-1: device descriptor read/64, error -71 [ 466.410890][ T5897] usb usb5-port1: attempt power cycle [ 467.009517][ T5897] usb 5-1: new high-speed USB device number 23 using dummy_hcd [ 467.041556][ T5897] usb 5-1: device descriptor read/8, error -71 [ 467.289363][ T5897] usb 5-1: new high-speed USB device number 24 using dummy_hcd [ 467.373380][ T5897] usb 5-1: device descriptor read/8, error -71 [ 467.537175][ T5897] usb usb5-port1: unable to enumerate USB device [ 467.770728][ T5907] usb 1-1: new high-speed USB device number 33 using dummy_hcd [ 467.816914][T11127] netlink: 96 bytes leftover after parsing attributes in process `syz.4.1372'. [ 467.936353][T11130] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1373'. [ 467.950615][ T5907] usb 1-1: Using ep0 maxpacket: 32 [ 467.964347][ T5907] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 467.975971][ T5907] usb 1-1: config 0 has no interface number 0 [ 467.997170][ T5907] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 468.030561][ T5907] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.040083][ T5907] usb 1-1: Product: syz [ 468.048692][ T5907] usb 1-1: Manufacturer: syz [ 468.054485][ T5907] usb 1-1: SerialNumber: syz [ 468.062317][ T5907] usb 1-1: config 0 descriptor?? [ 468.068977][T11130] netlink: 'syz.4.1373': attribute type 10 has an invalid length. [ 468.071093][ T5907] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 468.084681][ T5921] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 468.097218][ T5907] dvb-usb: bulk message failed: -22 (2/0) [ 468.107424][ T5907] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 468.121571][ T5907] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 468.142779][ T5907] usb 1-1: media controller created [ 468.184825][ T5907] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 468.209253][ T5907] cxusb: set interface failed [ 468.215006][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 468.271490][ T5921] usb 3-1: Using ep0 maxpacket: 16 [ 468.288133][ T5907] DVB: Unable to find symbol lgdt330x_attach() [ 468.297026][ T5921] usb 3-1: too many configurations: 29, using maximum allowed: 8 [ 468.317257][ T5907] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 468.337815][T11123] dvb-usb: bulk message failed: -22 (5/0) [ 468.355008][ T5921] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 468.383705][ T5921] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 468.412402][ T5921] usb 3-1: Product: syz [ 468.423449][ T5921] usb 3-1: Manufacturer: syz [ 468.438623][ T5921] usb 3-1: SerialNumber: syz [ 468.456877][ T5921] r8152-cfgselector 3-1: Unknown version 0x0000 [ 468.476785][ T5921] r8152-cfgselector 3-1: config 0 descriptor?? [ 468.483096][ T5907] rc_core: IR keymap rc-dvico-portable not found [ 468.499713][ T5907] Registered IR keymap rc-empty [ 468.515430][ T5907] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 468.546369][ T5907] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input37 [ 468.560931][ T5907] dvb-usb: schedule remote query interval to 100 msecs. [ 468.568046][ T5907] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 468.679417][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 468.717427][T11125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.728854][T11125] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.742185][ T5921] r8152-cfgselector 3-1: USB disconnect, device number 21 [ 468.789414][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 468.903730][ T5943] usb 1-1: USB disconnect, device number 33 [ 468.922510][ T5907] dvb-usb: bulk message failed: -22 (1/0) [ 469.017172][T11142] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1376'. [ 469.874736][ T5943] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 469.988476][T11149] netlink: 96 bytes leftover after parsing attributes in process `syz.1.1383'. [ 470.271121][T11157] FAULT_INJECTION: forcing a failure. [ 470.271121][T11157] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 470.284659][T11157] CPU: 0 UID: 0 PID: 11157 Comm: syz.2.1382 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 470.284684][T11157] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 470.284696][T11157] Call Trace: [ 470.284704][T11157] [ 470.284713][T11157] dump_stack_lvl+0x189/0x250 [ 470.284739][T11157] ? __pfx____ratelimit+0x10/0x10 [ 470.284761][T11157] ? __pfx_dump_stack_lvl+0x10/0x10 [ 470.284782][T11157] ? __pfx__printk+0x10/0x10 [ 470.284820][T11157] should_fail_ex+0x414/0x560 [ 470.284847][T11157] _copy_to_user+0x31/0xb0 [ 470.284877][T11157] simple_read_from_buffer+0xe1/0x170 [ 470.284903][T11157] proc_fail_nth_read+0x1df/0x250 [ 470.284930][T11157] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 470.284957][T11157] ? rw_verify_area+0x258/0x650 [ 470.284985][T11157] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 470.285010][T11157] vfs_read+0x200/0x980 [ 470.285045][T11157] ? __pfx___mutex_lock+0x10/0x10 [ 470.285067][T11157] ? __pfx_vfs_read+0x10/0x10 [ 470.285098][T11157] ? __fget_files+0x2a/0x420 [ 470.285124][T11157] ? __fget_files+0x3a0/0x420 [ 470.285145][T11157] ? __fget_files+0x2a/0x420 [ 470.285176][T11157] ksys_read+0x145/0x250 [ 470.285196][T11157] ? __pfx_ksys_read+0x10/0x10 [ 470.285214][T11157] ? rcu_is_watching+0x15/0xb0 [ 470.285243][T11157] ? trace_sys_enter+0x25/0x120 [ 470.285267][T11157] do_syscall_64+0xfa/0x3b0 [ 470.285287][T11157] ? lockdep_hardirqs_on+0x9c/0x150 [ 470.285307][T11157] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.285326][T11157] ? clear_bhb_loop+0x60/0xb0 [ 470.285350][T11157] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 470.285369][T11157] RIP: 0033:0x7f44b018d5fc [ 470.285386][T11157] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 470.285404][T11157] RSP: 002b:00007f44b0fef030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 470.285425][T11157] RAX: ffffffffffffffda RBX: 00007f44b03b6090 RCX: 00007f44b018d5fc [ 470.285439][T11157] RDX: 000000000000000f RSI: 00007f44b0fef0a0 RDI: 000000000000000b [ 470.285451][T11157] RBP: 00007f44b0fef090 R08: 0000000000000000 R09: 0000000000000000 [ 470.285463][T11157] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 470.285475][T11157] R13: 00007f44b03b6128 R14: 00007f44b03b6090 R15: 00007ffe53cebce8 [ 470.285508][T11157] [ 471.003467][T11167] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 471.021886][T11167] autofs: Bad value for 'fd' [ 471.668342][T11183] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1389'. [ 471.699428][ T5943] usb 1-1: new high-speed USB device number 34 using dummy_hcd [ 471.721621][T11183] overlayfs: failed to clone upperpath [ 471.885034][ T5943] usb 1-1: Using ep0 maxpacket: 32 [ 471.965008][ T5943] usb 1-1: config 0 has an invalid interface number: 66 but max is 0 [ 472.012938][ T5943] usb 1-1: config 0 has no interface number 0 [ 472.073970][ T5943] usb 1-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 472.152691][ T5943] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.371561][T11185] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 472.892417][ T5943] usb 1-1: Product: syz [ 472.896645][ T5943] usb 1-1: Manufacturer: syz [ 472.901599][ T5943] usb 1-1: SerialNumber: syz [ 472.911643][ T5943] usb 1-1: config 0 descriptor?? [ 472.922084][ T5943] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 472.930298][ T5943] dvb-usb: bulk message failed: -22 (2/0) [ 472.943245][ T5943] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 472.959925][ T5943] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 472.968255][ T5943] usb 1-1: media controller created [ 473.013665][ T5943] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 473.020532][T11199] netlink: 96 bytes leftover after parsing attributes in process `syz.2.1394'. [ 473.056535][ T5943] cxusb: set interface failed [ 473.070701][ T5943] dvb-usb: bulk message failed: -22 (1/0) [ 473.379578][T11171] dvb-usb: bulk message failed: -22 (5/0) [ 473.999507][ T5943] DVB: Unable to find symbol lgdt330x_attach() [ 474.056220][ T5943] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 474.184859][T11226] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1402'. [ 474.259283][ T5943] rc_core: IR keymap rc-dvico-portable not found [ 474.276272][ T5943] Registered IR keymap rc-empty [ 474.364086][ T5943] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 474.496443][ T5943] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input38 [ 474.699424][ T5943] dvb-usb: schedule remote query interval to 100 msecs. [ 474.774825][ T5943] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 474.879362][ T43] dvb-usb: bulk message failed: -22 (1/0) [ 474.968381][ T5943] usb 1-1: USB disconnect, device number 34 [ 476.294624][ T5943] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 476.535888][T11249] netlink: 'syz.2.1408': attribute type 2 has an invalid length. [ 477.551828][ T5943] usb 1-1: new high-speed USB device number 35 using dummy_hcd [ 477.739317][ T5943] usb 1-1: device descriptor read/64, error -71 [ 477.989615][ T5943] usb 1-1: new high-speed USB device number 36 using dummy_hcd [ 478.139481][ T5943] usb 1-1: device descriptor read/64, error -71 [ 478.149411][ T43] usb 5-1: new high-speed USB device number 25 using dummy_hcd [ 478.263498][ T5943] usb usb1-port1: attempt power cycle [ 478.309770][ T43] usb 5-1: Using ep0 maxpacket: 32 [ 478.350155][ T43] usb 5-1: config 0 has an invalid interface number: 66 but max is 0 [ 478.378444][ T43] usb 5-1: config 0 has no interface number 0 [ 478.413816][ T43] usb 5-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 478.455998][ T43] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.495463][ T43] usb 5-1: Product: syz [ 478.522876][ T43] usb 5-1: Manufacturer: syz [ 478.545970][ T43] usb 5-1: SerialNumber: syz [ 478.575414][ T43] usb 5-1: config 0 descriptor?? [ 478.602186][ T43] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 478.637266][ T43] dvb-usb: bulk message failed: -22 (2/0) [ 478.639354][T11276] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1416'. [ 478.663364][ T43] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 478.732979][T11276] overlayfs: failed to clone upperpath [ 478.739472][ T43] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 478.780737][ T43] usb 5-1: media controller created [ 478.816430][ T43] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 479.039982][T11265] dvb-usb: bulk message failed: -22 (5/0) [ 479.047553][ T43] cxusb: set interface failed [ 479.060625][ T43] dvb-usb: bulk message failed: -22 (1/0) [ 479.480453][T11289] autofs: Bad value for 'fd' [ 482.433570][ T43] DVB: Unable to find symbol lgdt330x_attach() [ 482.439891][ T43] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 482.724586][ T43] rc_core: IR keymap rc-dvico-portable not found [ 482.731612][ T43] Registered IR keymap rc-empty [ 482.737897][ T43] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 482.756726][ T43] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input40 [ 483.372337][ T43] dvb-usb: schedule remote query interval to 100 msecs. [ 483.379785][ T43] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 483.396789][ T43] usb 5-1: USB disconnect, device number 25 [ 483.611806][ T43] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 483.697272][T11325] netlink: 76 bytes leftover after parsing attributes in process `syz.2.1428'. [ 483.859356][ T927] usb 1-1: new high-speed USB device number 38 using dummy_hcd [ 483.985433][T11331] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1430'. [ 483.999293][ T927] usb 1-1: device descriptor read/64, error -71 [ 484.017609][T11331] overlayfs: failed to clone upperpath [ 484.308967][T11344] autofs: Bad value for 'fd' [ 484.466540][ T927] usb 1-1: new high-speed USB device number 39 using dummy_hcd [ 485.219736][ T927] usb 1-1: device descriptor read/64, error -71 [ 485.499499][ T927] usb usb1-port1: attempt power cycle [ 487.032337][ T927] usb 1-1: new high-speed USB device number 40 using dummy_hcd [ 488.018457][ T927] usb 1-1: device not accepting address 40, error -71 [ 490.001083][T11381] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1442'. [ 491.010794][T11389] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 491.020264][T11389] autofs: Bad value for 'fd' [ 491.468154][T11402] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1448'. [ 491.979333][ T5907] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 492.766337][ T5907] usb 4-1: Using ep0 maxpacket: 16 [ 492.925481][ T5907] usb 4-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=f4.9b [ 493.153459][ T5907] usb 4-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 493.177040][ T5907] usb 4-1: Product: syz [ 493.183805][ T5907] usb 4-1: SerialNumber: syz [ 493.197166][ T5907] usb 4-1: config 0 descriptor?? [ 493.209006][T11420] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 493.261868][ T5907] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 493.322013][ T5907] dvb_usb_af9015 4-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 493.359820][ T5907] usb 4-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 493.373839][ T5907] dvb_usb_af9035 4-1:0.0: probe with driver dvb_usb_af9035 failed with error -22 [ 493.503992][T11434] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1459'. [ 493.954319][ T5907] usb 4-1: USB disconnect, device number 24 [ 494.729351][ T927] usb 5-1: new high-speed USB device number 26 using dummy_hcd [ 494.881333][T11449] snd_dummy snd_dummy.0: control 3:4:-2:syz0:2147483647 is already present [ 494.891014][T11449] autofs: Bad value for 'fd' [ 494.919819][ T927] usb 5-1: Using ep0 maxpacket: 32 [ 494.931967][ T927] usb 5-1: config 0 interface 0 altsetting 15 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 494.961886][ T927] usb 5-1: config 0 interface 0 has no altsetting 0 [ 494.989361][ T927] usb 5-1: New USB device found, idVendor=046d, idProduct=c626, bcdDevice= 0.00 [ 495.004747][ T927] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 495.017701][ T927] usb 5-1: config 0 descriptor?? [ 495.558585][ T927] logitech 0003:046D:C626.0007: item fetching failed at offset 5/7 [ 495.604684][ T927] logitech 0003:046D:C626.0007: parse failed [ 495.620696][ T927] logitech 0003:046D:C626.0007: probe with driver logitech failed with error -22 [ 495.776577][T11443] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.839794][T11443] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.859893][T11444] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1461'. [ 495.869273][T11443] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1461'. [ 496.579962][ T5920] usb 5-1: USB disconnect, device number 26 [ 497.894347][ T30] audit: type=1326 audit(1755892135.949:832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=11470 comm="syz.2.1469" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f44b018ebe9 code=0x0 [ 497.982600][T11484] binder: Bad value for 'max' [ 498.121893][ T927] usb 5-1: new high-speed USB device number 27 using dummy_hcd [ 498.302939][ T927] usb 5-1: Using ep0 maxpacket: 16 [ 498.315792][ T927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 498.340777][T11495] netlink: 72 bytes leftover after parsing attributes in process `syz.2.1476'. [ 498.347468][ T927] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 498.378575][T11495] overlayfs: failed to clone upperpath [ 498.405120][ T927] usb 5-1: New USB device found, idVendor=6161, idProduct=4d15, bcdDevice= 0.00 [ 498.473236][ T927] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 498.518896][ T927] usb 5-1: config 0 descriptor?? [ 498.543643][T11498] can: request_module (can-proto-4) failed. [ 498.749464][ T5949] usb 1-1: new high-speed USB device number 42 using dummy_hcd [ 498.899576][ T5949] usb 1-1: device descriptor read/64, error -71 [ 499.159692][ T5949] usb 1-1: new high-speed USB device number 43 using dummy_hcd [ 499.247967][ T927] usbhid 5-1:0.0: can't add hid device: -32 [ 499.257232][T11522] tipc: Can't bind to reserved service type 1 [ 499.267416][ T927] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 499.311579][ T927] usb 5-1: USB disconnect, device number 27 [ 499.325255][ T5949] usb 1-1: device descriptor read/64, error -71 [ 499.387985][T11530] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1488'. [ 499.449712][ T5949] usb usb1-port1: attempt power cycle [ 500.387393][ T5949] usb 1-1: new high-speed USB device number 44 using dummy_hcd [ 500.435109][ T5949] usb 1-1: device descriptor read/8, error -71 [ 500.749875][ T5949] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 500.793098][ T5949] usb 1-1: device descriptor read/8, error -71 [ 500.809054][T11552] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1812281087 (231971979136 ns) > initial count (128 ns). Using initial count to start timer. [ 500.939797][ T5949] usb usb1-port1: unable to enumerate USB device [ 501.179325][ T927] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 501.700089][ T1302] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.706607][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.891734][ T927] usb 4-1: Using ep0 maxpacket: 32 [ 501.898998][ T927] usb 4-1: config 0 has an invalid interface number: 66 but max is 0 [ 501.938027][ T927] usb 4-1: config 0 has no interface number 0 [ 501.969381][ T927] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 502.056485][ T927] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 502.080392][ T927] usb 4-1: Product: syz [ 502.094454][ T927] usb 4-1: Manufacturer: syz [ 502.099121][ T927] usb 4-1: SerialNumber: syz [ 502.153390][ T927] usb 4-1: config 0 descriptor?? [ 502.173945][ T927] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 502.219528][ T927] dvb-usb: bulk message failed: -22 (2/0) [ 502.227982][T11577] xt_CT: No such helper "netbios-ns" [ 502.290159][ T927] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 502.599424][ T5920] usb 1-1: new full-speed USB device number 46 using dummy_hcd [ 503.161464][ T927] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 503.221713][ T5920] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 503.234699][T11558] dvb-usb: bulk message failed: -22 (5/0) [ 503.252097][ T927] usb 4-1: media controller created [ 503.269258][ T5920] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 4 [ 503.302505][ T5920] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 503.318715][ T927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 503.429947][ T5920] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.296888][ T5920] usb 1-1: Product: syz [ 504.310878][ T5920] usb 1-1: Manufacturer: syz [ 504.315690][ T5920] usb 1-1: SerialNumber: syz [ 504.332442][ T5920] usb 1-1: config 0 descriptor?? [ 504.340957][ T927] cxusb: set interface failed [ 504.345754][ T927] dvb-usb: bulk message failed: -22 (1/0) [ 504.363895][ T5920] em28xx 1-1:0.0: New device syz syz @ 12 Mbps (2040:0264, interface 0, class 0) [ 504.389399][ T5920] em28xx 1-1:0.0: Device initialization failed. [ 504.395713][ T5920] em28xx 1-1:0.0: Device must be connected to a high-speed USB 2.0 port. [ 504.420225][T11596] veth0_to_team: entered promiscuous mode [ 504.426008][T11596] veth0_to_team: entered allmulticast mode [ 505.270574][ T43] usb 1-1: USB disconnect, device number 46 [ 505.320436][ T927] DVB: Unable to find symbol lgdt330x_attach() [ 505.327073][ T927] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 505.573541][T11604] netlink: 72 bytes leftover after parsing attributes in process `syz.1.1509'. [ 505.642334][T11604] overlayfs: failed to clone upperpath [ 505.998406][ T927] rc_core: IR keymap rc-dvico-portable not found [ 506.035597][ T927] Registered IR keymap rc-empty [ 506.052418][ T927] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 506.094809][ T927] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input41 [ 506.144225][T11616] overlayfs: failed to clone upperpath [ 506.164993][ T927] dvb-usb: schedule remote query interval to 100 msecs. [ 506.205409][ T927] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 506.285575][ T927] usb 4-1: USB disconnect, device number 25 [ 506.933444][ T927] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 507.422909][T11634] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1517'. [ 507.509908][T11640] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1519'. [ 510.112964][T11653] netlink: 14 bytes leftover after parsing attributes in process `syz.0.1513'. [ 510.538378][T11653] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 510.554740][T11653] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 510.600025][T11653] bond0 (unregistering): (slave team0): Releasing backup interface [ 510.622133][T11653] bond0 (unregistering): (slave syz_tun): Releasing backup interface [ 510.650322][T11653] bond0 (unregistering): Released all slaves [ 510.681043][T11657] veth1_macvtap: left promiscuous mode [ 510.699883][T11657] macsec0: entered promiscuous mode [ 512.169592][ T5921] usb 4-1: new full-speed USB device number 26 using dummy_hcd [ 512.329532][ T5921] usb 4-1: device descriptor read/64, error -71 [ 512.599433][ T5921] usb 4-1: new full-speed USB device number 27 using dummy_hcd [ 512.629458][ T5949] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 512.779492][ T5921] usb 4-1: device descriptor read/64, error -71 [ 512.900117][ T5921] usb usb4-port1: attempt power cycle [ 513.911340][ T5949] usb 1-1: Using ep0 maxpacket: 8 [ 513.960586][ T5949] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 513.999642][ T5949] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 514.007885][ T5949] usb 1-1: Product: syz [ 514.021273][ T5949] usb 1-1: Manufacturer: syz [ 514.026299][ T5949] usb 1-1: SerialNumber: syz [ 514.040802][ T5949] usb 1-1: config 0 descriptor?? [ 514.060565][ T5949] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 514.068965][ T5949] usb 1-1: setting power ON [ 514.077574][ T5949] dvb-usb: bulk message failed: -22 (2/0) [ 514.086849][ T5949] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 514.251914][ T5949] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 514.270128][ T5949] usb 1-1: media controller created [ 514.275616][T11698] dvb-usb: bulk message failed: -22 (3/0) [ 514.302414][ T5949] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 514.311371][ T5921] usb 4-1: new full-speed USB device number 28 using dummy_hcd [ 514.335462][ T5949] usb 1-1: selecting invalid altsetting 6 [ 514.343058][ T5949] usb 1-1: digital interface selection failed (-22) [ 514.350250][ T5949] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 514.358983][ T5921] usb 4-1: device descriptor read/8, error -71 [ 514.367011][ T5949] usb 1-1: setting power OFF [ 514.373501][ T5949] dvb-usb: bulk message failed: -22 (2/0) [ 514.380856][ T5949] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 514.390359][ T5949] (NULL device *): no alternate interface [ 514.424850][ T5949] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 514.448937][ T5949] usb 1-1: USB disconnect, device number 47 [ 514.609833][ T5921] usb 4-1: new full-speed USB device number 29 using dummy_hcd [ 514.630346][ T5921] usb 4-1: device descriptor read/8, error -71 [ 514.740403][ T5921] usb usb4-port1: unable to enumerate USB device [ 514.806102][T11711] IPv6: Can't replace route, no match found [ 514.975575][T11715] trusted_key: syz.0.1541 sent an empty control message without MSG_MORE. [ 515.202078][ T5921] usb 4-1: new low-speed USB device number 30 using dummy_hcd [ 515.442162][ T5921] usb 4-1: config 9 has an invalid interface number: 1 but max is 0 [ 515.509728][ T5921] usb 4-1: config 9 has no interface number 0 [ 515.607331][ T5921] usb 4-1: config 9 interface 1 has no altsetting 0 [ 515.738316][ T5921] usb 4-1: string descriptor 0 read error: -22 [ 515.817230][ T5921] usb 4-1: New USB device found, idVendor=2040, idProduct=b140, bcdDevice=75.36 [ 515.949669][ T5921] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.059008][ T5921] cx231xx 4-1:9.1: New device @ 1.5 Mbps (2040:b140) with 1 interfaces [ 516.088689][ T5921] cx231xx 4-1:9.1: Not found matching IAD interface [ 516.195889][T11741] netlink: 153 bytes leftover after parsing attributes in process `syz.1.1545'. [ 517.318509][ T5897] usb 4-1: USB disconnect, device number 30 [ 518.412785][T11750] ip6erspan0: entered allmulticast mode [ 521.016248][T11761] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 521.030111][T11770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1555'. [ 521.036426][T11761] infiniband : RDMA CMA: cma_listen_on_dev, error -98 [ 522.004474][T11770] netlink: 'syz.0.1555': attribute type 5 has an invalid length. [ 522.012744][T11770] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1555'. [ 522.036295][T11770] netdevsim netdevsim0 eth0: set [1, 1] type 2 family 0 port 256 - 0 [ 522.044751][T11770] netdevsim netdevsim0 eth1: set [1, 1] type 2 family 0 port 256 - 0 [ 522.096018][T11770] netdevsim netdevsim0 eth2: set [1, 1] type 2 family 0 port 256 - 0 [ 522.107700][T11770] netdevsim netdevsim0 eth3: set [1, 1] type 2 family 0 port 256 - 0 [ 522.116612][T11770] geneve2: entered promiscuous mode [ 522.123148][T11770] geneve2: entered allmulticast mode [ 523.469341][ T5897] usb 1-1: new low-speed USB device number 48 using dummy_hcd [ 523.734602][ T5897] usb 1-1: Invalid ep0 maxpacket: 64 [ 524.056586][ T5897] usb 1-1: new low-speed USB device number 49 using dummy_hcd [ 524.077436][T11806] overlayfs: failed to clone upperpath [ 524.209495][ T927] usb 4-1: new high-speed USB device number 31 using dummy_hcd [ 524.215549][T11809] kernel read not supported for file / lhOb~h3JyxvL=QRnFGrqςû~QV7"qHd0%NnyD (pid: 11809 comm: syz.1.1569) [ 524.240162][ T5897] usb 1-1: Invalid ep0 maxpacket: 64 [ 524.259463][ T5897] usb usb1-port1: attempt power cycle [ 524.338668][ T30] audit: type=1800 audit(1755892162.389:833): pid=11809 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed comm="syz.1.1569" name=BD16206C684F62EDF17EE501D168FEB51D9093339E8F064AC7C879FB78D0EEC3FC76F74CAA3D51E452FA6EC1B746477282A5F28F71F0CF82C3BB7E517F567F37B6B7227148E11197C964309DFA86F888B989FD254E6E79B503831CDD4402 dev="mqueue" ino=33300 res=0 errno=0 [ 524.379450][ T927] usb 4-1: Using ep0 maxpacket: 32 [ 524.389170][ T927] usb 4-1: config 0 has an invalid interface number: 66 but max is 0 [ 524.409010][ T927] usb 4-1: config 0 has no interface number 0 [ 524.439039][ T927] usb 4-1: New USB device found, idVendor=0fe9, idProduct=d501, bcdDevice=23.50 [ 524.463457][ T927] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 524.476257][ T927] usb 4-1: Product: syz [ 524.480748][ T927] usb 4-1: Manufacturer: syz [ 524.485805][ T927] usb 4-1: SerialNumber: syz [ 524.507435][ T927] usb 4-1: config 0 descriptor?? [ 524.538788][ T927] dvb-usb: found a 'DViCO FusionHDTV5 USB Gold' in warm state. [ 524.555831][ T927] dvb-usb: bulk message failed: -22 (2/0) [ 524.576148][ T927] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 524.591430][ T927] dvbdev: DVB: registering new adapter (DViCO FusionHDTV5 USB Gold) [ 524.600779][ T927] usb 4-1: media controller created [ 524.624907][T11818] overlayfs: failed to clone upperpath [ 524.709290][ T5897] usb 1-1: new low-speed USB device number 50 using dummy_hcd [ 524.725824][ T927] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 524.740253][ T5897] usb 1-1: Invalid ep0 maxpacket: 64 [ 524.791010][T11802] dvb-usb: bulk message failed: -22 (5/0) [ 524.834464][ T927] cxusb: set interface failed [ 524.842081][ T927] dvb-usb: bulk message failed: -22 (1/0) [ 524.923457][ T927] DVB: Unable to find symbol lgdt330x_attach() [ 524.934204][ T927] dvb-usb: no frontend was attached by 'DViCO FusionHDTV5 USB Gold' [ 524.960790][ T5897] usb 1-1: new low-speed USB device number 51 using dummy_hcd [ 525.026392][ T5897] usb 1-1: Invalid ep0 maxpacket: 64 [ 525.068260][ T5897] usb usb1-port1: unable to enumerate USB device [ 525.103402][ T927] rc_core: IR keymap rc-dvico-portable not found [ 525.118390][ T927] Registered IR keymap rc-empty [ 525.128384][ T927] rc rc0: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 525.153199][ T927] input: DViCO FusionHDTV5 USB Gold as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input42 [ 525.178026][ T927] dvb-usb: schedule remote query interval to 100 msecs. [ 525.188411][ T927] dvb-usb: DViCO FusionHDTV5 USB Gold successfully initialized and connected. [ 525.203397][ T927] usb 4-1: USB disconnect, device number 31 [ 527.218261][ T927] dvb-usb: DViCO FusionHDTV5 USB Gold successfully deinitialized and disconnected. [ 527.371140][T11837] netlink: 136 bytes leftover after parsing attributes in process `syz.0.1576'. [ 527.386154][T11837] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 527.426070][T11837] netlink: 72 bytes leftover after parsing attributes in process `syz.0.1576'. [ 528.476797][T11854] tipc: Enabling of bearer rejected, failed to enable media [ 530.029423][ T5897] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 531.179481][ T5897] usb 1-1: Using ep0 maxpacket: 8 [ 531.280306][T11872] ubi31: attaching mtd0 [ 531.288391][T11872] ubi31: scanning is finished [ 531.293220][T11872] ubi31: empty MTD device detected [ 532.173657][T11872] ubi31: attached mtd0 (name "mtdram test device", size 0 MiB) [ 532.181685][T11872] ubi31: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 532.189099][T11872] ubi31: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 532.196226][T11872] ubi31: VID header offset: 64 (aligned 64), data offset: 128 [ 532.203859][T11872] ubi31: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 532.210815][T11872] ubi31: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 532.218928][T11872] ubi31: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 3640161427 [ 532.229382][T11872] ubi31: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 532.275593][T11876] ubi31: background thread "ubi_bgt31d" started, PID 11876 [ 534.099601][ T5897] usb 1-1: device descriptor read/all, error -71 [ 534.329610][ T927] usb 4-1: new high-speed USB device number 32 using dummy_hcd [ 534.539638][ T927] usb 4-1: Using ep0 maxpacket: 8 [ 534.563347][ T927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 534.605719][ T927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 534.646428][ T927] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 534.683212][ T927] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12336, setting to 1024 [ 534.728420][ T927] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 534.768878][ T927] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 534.806429][ T927] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.858108][ T927] usb 4-1: config 0 descriptor?? [ 534.887495][T11878] raw-gadget.2 gadget.3: fail, usb_ep_enable returned -22 [ 535.614485][T11895] batman_adv: batadv0: Interface deactivated: virt_wifi0 [ 535.644792][ T927] usb 4-1: USB disconnect, device number 32 [ 535.653178][ T51] Bluetooth: hci5: Opcode 0x0c03 failed: -19 [ 535.710784][T11904] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1594'. [ 535.780948][T11904] netlink: 'syz.1.1594': attribute type 10 has an invalid length. [ 535.839920][T11910] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1595'. [ 535.859492][T11910] openvswitch: netlink: EtherType 0 is less than min 600 [ 536.273200][T11895] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 536.299036][T11895] Bluetooth: hci0: Error when powering off device on rfkill (-4) [ 536.335484][T11895] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 536.364269][T11895] Bluetooth: hci1: Error when powering off device on rfkill (-4) [ 536.391286][T11895] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 536.408442][T11895] Bluetooth: hci2: Error when powering off device on rfkill (-4) [ 536.432436][T11895] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 536.448698][T11895] Bluetooth: hci3: Error when powering off device on rfkill (-4) [ 536.647839][T11895] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 536.667818][T11895] Bluetooth: hci4: Error when powering off device on rfkill (-4) [ 537.002498][T11941] xt_connbytes: Forcing CT accounting to be enabled [ 537.018473][T11941] set match dimension is over the limit! [ 537.051833][T11941] netlink: 4 bytes leftover after parsing attributes in process `syz.4.1600'. [ 537.973555][T11949] netlink: 20 bytes leftover after parsing attributes in process `syz.0.1603'. [ 543.044281][T11999] overlayfs: missing 'lowerdir' [ 543.130230][T11996] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1616'. [ 544.275875][ T5836] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 544.289734][ T5836] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 544.299654][ T5836] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 544.310385][ T5836] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 544.322340][ T5836] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 544.338748][ T51] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 544.346187][ T51] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 544.353492][ T51] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 544.365940][ T51] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 544.373954][ T51] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 544.648557][T12028] netlink: 20 bytes leftover after parsing attributes in process `syz.4.1623'. [ 544.768821][ T8458] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.005139][ T8458] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.119858][T12043] No source specified [ 546.205983][ T8458] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.338671][ T8458] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 546.442382][T12053] netlink: 'syz.4.1627': attribute type 16 has an invalid length. [ 546.452611][T12053] netlink: 'syz.4.1627': attribute type 17 has an invalid length. [ 546.499654][ T5836] Bluetooth: hci5: command tx timeout [ 546.537876][T12053] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 546.672104][T12055] overlayfs: upper fs does not support file handles, falling back to index=off. [ 547.461331][T12011] chnl_net:caif_netlink_parms(): no params data found [ 548.253089][T12093] overlayfs: missing 'lowerdir' [ 548.599301][ T5836] Bluetooth: hci5: command 0x041b tx timeout [ 549.210814][ T8458] bond0 (unregistering): (slave veth1): Releasing active interface [ 549.222136][ T8458] bond0 (unregistering): (slave veth0_to_bond): Releasing active interface [ 549.241633][ T8458] bond0 (unregistering): Released all slaves [ 550.429101][ T8458] tipc: Left network mode [ 550.589455][T12115] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1636'. [ 550.659297][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 550.994989][ T8458] [ 550.997378][ T8458] ====================================================== [ 551.004404][ T8458] WARNING: possible circular locking dependency detected [ 551.011420][ T8458] 6.16.0-syzkaller #0 Not tainted [ 551.016422][ T8458] ------------------------------------------------------ [ 551.023419][ T8458] kworker/u8:11/8458 is trying to acquire lock: [ 551.029636][ T8458] ffff8880321b8e00 (team->team_lock_key#4){+.+.}-{4:4}, at: team_del_slave+0x32/0x1c0 [ 551.039215][ T8458] [ 551.039215][ T8458] but task is already holding lock: [ 551.046571][ T8458] ffff88802f688768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 551.056930][ T8458] [ 551.056930][ T8458] which lock already depends on the new lock. [ 551.056930][ T8458] [ 551.067329][ T8458] [ 551.067329][ T8458] the existing dependency chain (in reverse order) is: [ 551.076340][ T8458] [ 551.076340][ T8458] -> #1 (&rdev->wiphy.mtx){+.+.}-{4:4}: [ 551.084080][ T8458] lock_acquire+0x120/0x360 [ 551.089107][ T8458] __mutex_lock+0x182/0xe80 [ 551.094161][ T8458] ieee80211_open+0xed/0x1f0 [ 551.099272][ T8458] __dev_open+0x470/0x880 [ 551.104147][ T8458] netif_open+0xaa/0x170 [ 551.108912][ T8458] dev_open+0x125/0x260 [ 551.113594][ T8458] team_add_slave+0xb36/0x2840 [ 551.118881][ T8458] do_set_master+0x530/0x6d0 [ 551.123993][ T8458] do_setlink+0xcf0/0x41c0 [ 551.128934][ T8458] rtnl_newlink+0x160b/0x1c70 [ 551.134134][ T8458] rtnetlink_rcv_msg+0x7cc/0xb70 [ 551.139591][ T8458] netlink_rcv_skb+0x205/0x470 [ 551.144877][ T8458] netlink_unicast+0x75c/0x8e0 [ 551.150163][ T8458] netlink_sendmsg+0x805/0xb30 [ 551.155467][ T8458] __sock_sendmsg+0x21c/0x270 [ 551.160661][ T8458] ____sys_sendmsg+0x505/0x830 [ 551.165952][ T8458] ___sys_sendmsg+0x21f/0x2a0 [ 551.171155][ T8458] __x64_sys_sendmsg+0x19b/0x260 [ 551.176618][ T8458] do_syscall_64+0xfa/0x3b0 [ 551.181640][ T8458] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 551.188052][ T8458] [ 551.188052][ T8458] -> #0 (team->team_lock_key#4){+.+.}-{4:4}: [ 551.196230][ T8458] validate_chain+0xb9b/0x2140 [ 551.201515][ T8458] __lock_acquire+0xab9/0xd20 [ 551.206708][ T8458] lock_acquire+0x120/0x360 [ 551.211731][ T8458] __mutex_lock+0x182/0xe80 [ 551.216764][ T8458] team_del_slave+0x32/0x1c0 [ 551.221873][ T8458] team_device_event+0x285/0xa20 [ 551.227329][ T8458] notifier_call_chain+0x1b3/0x3e0 [ 551.232959][ T8458] unregister_netdevice_many_notify+0x15d8/0x2320 [ 551.239893][ T8458] unregister_netdevice_queue+0x33c/0x380 [ 551.246133][ T8458] _cfg80211_unregister_wdev+0x165/0x590 [ 551.252288][ T8458] ieee80211_remove_interfaces+0x49a/0x6d0 [ 551.258613][ T8458] ieee80211_unregister_hw+0x5d/0x2c0 [ 551.264510][ T8458] mac80211_hwsim_del_radio+0x275/0x460 [ 551.270582][ T8458] hwsim_exit_net+0x584/0x640 [ 551.275780][ T8458] ops_undo_list+0x497/0x990 [ 551.280890][ T8458] cleanup_net+0x4c5/0x800 [ 551.285829][ T8458] process_scheduled_works+0xade/0x17b0 [ 551.291936][ T8458] worker_thread+0x8a0/0xda0 [ 551.297044][ T8458] kthread+0x70e/0x8a0 [ 551.301636][ T8458] ret_from_fork+0x3fc/0x770 [ 551.306748][ T8458] ret_from_fork_asm+0x1a/0x30 [ 551.312034][ T8458] [ 551.312034][ T8458] other info that might help us debug this: [ 551.312034][ T8458] [ 551.322254][ T8458] Possible unsafe locking scenario: [ 551.322254][ T8458] [ 551.329694][ T8458] CPU0 CPU1 [ 551.335052][ T8458] ---- ---- [ 551.340406][ T8458] lock(&rdev->wiphy.mtx); [ 551.344910][ T8458] lock(team->team_lock_key#4); [ 551.352370][ T8458] lock(&rdev->wiphy.mtx); [ 551.359389][ T8458] lock(team->team_lock_key#4); [ 551.364335][ T8458] [ 551.364335][ T8458] *** DEADLOCK *** [ 551.364335][ T8458] [ 551.372474][ T8458] 5 locks held by kworker/u8:11/8458: [ 551.377851][ T8458] #0: ffff88801b2fb948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 551.388743][ T8458] #1: ffffc9001d327bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 551.399278][ T8458] #2: ffffffff8f4fd310 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 551.408606][ T8458] #3: ffffffff8f509f08 (rtnl_mutex){+.+.}-{4:4}, at: ieee80211_unregister_hw+0x55/0x2c0 [ 551.418458][ T8458] #4: ffff88802f688768 (&rdev->wiphy.mtx){+.+.}-{4:4}, at: ieee80211_remove_interfaces+0x133/0x6d0 [ 551.429255][ T8458] [ 551.429255][ T8458] stack backtrace: [ 551.435141][ T8458] CPU: 1 UID: 0 PID: 8458 Comm: kworker/u8:11 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 551.435162][ T8458] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 551.435173][ T8458] Workqueue: netns cleanup_net [ 551.435199][ T8458] Call Trace: [ 551.435208][ T8458] [ 551.435216][ T8458] dump_stack_lvl+0x189/0x250 [ 551.435236][ T8458] ? __pfx_dump_stack_lvl+0x10/0x10 [ 551.435253][ T8458] ? __pfx__printk+0x10/0x10 [ 551.435274][ T8458] ? print_lock_name+0xde/0x100 [ 551.435294][ T8458] print_circular_bug+0x2ee/0x310 [ 551.435315][ T8458] check_noncircular+0x134/0x160 [ 551.435336][ T8458] validate_chain+0xb9b/0x2140 [ 551.435357][ T8458] ? lockdep_hardirqs_on+0x9c/0x150 [ 551.435378][ T8458] __lock_acquire+0xab9/0xd20 [ 551.435395][ T8458] ? team_del_slave+0x32/0x1c0 [ 551.435415][ T8458] lock_acquire+0x120/0x360 [ 551.435428][ T8458] ? team_del_slave+0x32/0x1c0 [ 551.435450][ T8458] ? __mutex_trylock_common+0x153/0x260 [ 551.435471][ T8458] __mutex_lock+0x182/0xe80 [ 551.435488][ T8458] ? team_del_slave+0x32/0x1c0 [ 551.435508][ T8458] ? rcu_is_watching+0x15/0xb0 [ 551.435528][ T8458] ? team_del_slave+0x32/0x1c0 [ 551.435549][ T8458] ? __pfx___mutex_lock+0x10/0x10 [ 551.435566][ T8458] ? bond_netdev_event+0xd9/0xe80 [ 551.435591][ T8458] ? __pfx___mutex_lock+0x10/0x10 [ 551.435608][ T8458] ? __pfx_bond_netdev_event+0x10/0x10 [ 551.435634][ T8458] team_del_slave+0x32/0x1c0 [ 551.435656][ T8458] team_device_event+0x285/0xa20 [ 551.435673][ T8458] notifier_call_chain+0x1b3/0x3e0 [ 551.435694][ T8458] unregister_netdevice_many_notify+0x15d8/0x2320 [ 551.435725][ T8458] ? __pfx_unregister_netdevice_many_notify+0x10/0x10 [ 551.435744][ T8458] ? __lock_acquire+0xab9/0xd20 [ 551.435768][ T8458] unregister_netdevice_queue+0x33c/0x380 [ 551.435786][ T8458] ? __pfx_unregister_netdevice_queue+0x10/0x10 [ 551.435806][ T8458] _cfg80211_unregister_wdev+0x165/0x590 [ 551.435830][ T8458] ieee80211_remove_interfaces+0x49a/0x6d0 [ 551.435850][ T8458] ? __pfx_synchronize_rcu+0x10/0x10 [ 551.435869][ T8458] ? __pfx_ieee80211_remove_interfaces+0x10/0x10 [ 551.435887][ T8458] ? rcu_is_watching+0x15/0xb0 [ 551.435906][ T8458] ieee80211_unregister_hw+0x5d/0x2c0 [ 551.435932][ T8458] mac80211_hwsim_del_radio+0x275/0x460 [ 551.435958][ T8458] ? __pfx_mac80211_hwsim_del_radio+0x10/0x10 [ 551.435985][ T8458] hwsim_exit_net+0x584/0x640 [ 551.436006][ T8458] ? __pfx_hwsim_exit_net+0x10/0x10 [ 551.436027][ T8458] ? __ip_vs_dev_cleanup_batch+0x238/0x260 [ 551.436052][ T8458] ops_undo_list+0x497/0x990 [ 551.436076][ T8458] ? __pfx_ops_undo_list+0x10/0x10 [ 551.436100][ T8458] cleanup_net+0x4c5/0x800 [ 551.436123][ T8458] ? __pfx_cleanup_net+0x10/0x10 [ 551.436144][ T8458] ? _raw_spin_unlock_irq+0x23/0x50 [ 551.436158][ T8458] ? process_scheduled_works+0x9ef/0x17b0 [ 551.436175][ T8458] ? process_scheduled_works+0x9ef/0x17b0 [ 551.436192][ T8458] process_scheduled_works+0xade/0x17b0 [ 551.436219][ T8458] ? __pfx_process_scheduled_works+0x10/0x10 [ 551.436242][ T8458] worker_thread+0x8a0/0xda0 [ 551.436260][ T8458] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 551.436288][ T8458] ? __kthread_parkme+0x7b/0x200 [ 551.436310][ T8458] kthread+0x70e/0x8a0 [ 551.436330][ T8458] ? __pfx_worker_thread+0x10/0x10 [ 551.436347][ T8458] ? __pfx_kthread+0x10/0x10 [ 551.436367][ T8458] ? _raw_spin_unlock_irq+0x23/0x50 [ 551.436382][ T8458] ? lockdep_hardirqs_on+0x9c/0x150 [ 551.436396][ T8458] ? __pfx_kthread+0x10/0x10 [ 551.436416][ T8458] ret_from_fork+0x3fc/0x770 [ 551.436433][ T8458] ? __pfx_ret_from_fork+0x10/0x10 [ 551.436450][ T8458] ? __switch_to_asm+0x39/0x70 [ 551.436469][ T8458] ? __switch_to_asm+0x33/0x70 [ 551.436487][ T8458] ? __pfx_kthread+0x10/0x10 [ 551.436507][ T8458] ret_from_fork_asm+0x1a/0x30 [ 551.436532][ T8458] [ 551.897485][ T8458] team0: Port device wlan1 removed [ 551.916123][T12011] bridge0: port 1(bridge_slave_0) entered blocking state [ 551.923601][T12011] bridge0: port 1(bridge_slave_0) entered disabled state [ 551.930916][T12011] bridge_slave_0: entered allmulticast mode [ 551.937739][T12011] bridge_slave_0: entered promiscuous mode [ 551.989441][T12011] bridge0: port 2(bridge_slave_1) entered blocking state [ 551.997391][T12011] bridge0: port 2(bridge_slave_1) entered disabled state [ 552.275609][T12011] bridge_slave_1: entered allmulticast mode [ 552.290338][T12011] bridge_slave_1: entered promiscuous mode [ 552.749819][ T51] Bluetooth: hci5: command 0x041b tx timeout [ 552.799359][ T8458] hsr_slave_0: left promiscuous mode [ 552.822503][ T8458] hsr_slave_1: left promiscuous mode [ 552.855711][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 552.891480][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 552.916959][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 552.936721][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 552.971782][ T8458] veth1_macvtap: left promiscuous mode [ 552.977371][ T8458] veth0_macvtap: left promiscuous mode [ 552.986603][ T8458] veth1_vlan: left promiscuous mode [ 552.992052][ T8458] veth0_vlan: left promiscuous mode [ 553.243041][ T8458] team0 (unregistering): Port device team_slave_1 removed [ 553.279080][ T8458] team0 (unregistering): Port device team_slave_0 removed [ 553.769697][ T5949] usb 2-1: USB disconnect, device number 13 [ 553.885186][ T8458] IPVS: stop unused estimator thread 0... [ 553.972281][ T8458] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.046119][ T8458] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.095176][ T8458] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.142693][ T8458] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.227025][ T8458] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.264927][ T8458] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.312904][ T8458] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.363055][ T8458] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.446757][ T8458] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.482703][ T8458] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.553154][ T8458] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.595030][ T8458] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.656404][ T8458] netdevsim netdevsim0 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.666338][ T8458] netdevsim netdevsim0 eth3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 554.711832][ T8458] netdevsim netdevsim0 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.721675][ T8458] netdevsim netdevsim0 eth2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 554.781311][ T8458] netdevsim netdevsim0 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.791432][ T8458] netdevsim netdevsim0 eth1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 554.822108][ T8458] netdevsim netdevsim0 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 554.831904][ T8458] netdevsim netdevsim0 eth0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 554.894919][ T8458] bridge_slave_1: left allmulticast mode [ 554.901036][ T8458] bridge_slave_1: left promiscuous mode [ 554.906713][ T8458] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.914742][ T8458] bridge_slave_0: left allmulticast mode [ 554.920574][ T8458] bridge_slave_0: left promiscuous mode [ 554.926238][ T8458] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.934640][ T8458] bridge_slave_1: left allmulticast mode [ 554.940413][ T8458] bridge_slave_1: left promiscuous mode [ 554.946057][ T8458] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.954372][ T8458] bridge_slave_0: left allmulticast mode [ 554.960254][ T8458] bridge_slave_0: left promiscuous mode [ 554.965894][ T8458] bridge0: port 1(bridge_slave_0) entered disabled state [ 554.974302][ T8458] bridge_slave_1: left allmulticast mode [ 554.980369][ T8458] bridge_slave_1: left promiscuous mode [ 554.986136][ T8458] bridge0: port 2(bridge_slave_1) entered disabled state [ 554.994446][ T8458] bridge_slave_0: left allmulticast mode [ 555.000270][ T8458] bridge_slave_0: left promiscuous mode [ 555.005921][ T8458] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.014507][ T8458] bridge_slave_1: left allmulticast mode [ 555.020481][ T8458] bridge_slave_1: left promiscuous mode [ 555.026149][ T8458] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.034113][ T8458] bridge_slave_0: left promiscuous mode [ 555.040059][ T8458] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.048705][ T8458] bridge_slave_1: left allmulticast mode [ 555.054516][ T8458] bridge_slave_1: left promiscuous mode [ 555.060212][ T8458] bridge0: port 2(bridge_slave_1) entered disabled state [ 555.068131][ T8458] bridge_slave_0: left allmulticast mode [ 555.074103][ T8458] bridge_slave_0: left promiscuous mode [ 555.079830][ T8458] bridge0: port 1(bridge_slave_0) entered disabled state [ 555.188904][ T8458] bond0 (unregistering): Released all slaves [ 555.263536][ T8458] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 555.274293][ T8458] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 555.286168][ T8458] bond0 (unregistering): Released all slaves [ 555.388108][ T8458] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 555.398711][ T8458] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 555.408922][ T8458] bond0 (unregistering): Released all slaves [ 555.433250][ T8458] bond1 (unregistering): (slave gretap1): Releasing active interface [ 555.494134][ T8458] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 555.504304][ T8458] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 555.513695][ T8458] bond0 (unregistering): Released all slaves [ 555.523126][ T8458] bond1 (unregistering): Released all slaves [ 555.748062][ T8458] bond1 (unregistering): Released all slaves [ 555.878487][ T8458] bond2 (unregistering): Released all slaves [ 555.888285][ T927] : Port: 1 Link DOWN [ 556.091609][ T8458] team0: Port device wlan1 removed [ 556.328221][ T8458] team0: Port device wlan1 removed [ 556.458244][ T8458] team0: Port device wlan1 removed [ 556.526937][ T8458] mac80211_hwsim hwsim8 wlan0 (unregistering): left allmulticast mode [ 556.593478][ T8458] hsr_slave_0: left promiscuous mode [ 556.599227][ T8458] hsr_slave_1: left promiscuous mode [ 556.604885][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 556.612335][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 556.620853][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 556.628250][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 556.635800][ T8458] batman_adv: batadv0: Removing interface: virt_wifi0 [ 556.645384][ T8458] hsr_slave_0: left promiscuous mode [ 556.651087][ T8458] hsr_slave_1: left promiscuous mode [ 556.656698][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 556.664282][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 556.671893][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 556.679844][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 556.689373][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 556.696794][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 556.704909][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 556.712360][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 556.722987][ T8458] hsr_slave_0: left promiscuous mode [ 556.728677][ T8458] hsr_slave_1: left promiscuous mode [ 556.734504][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 556.742473][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 556.750460][ T8458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 556.757855][ T8458] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 556.772360][ T8458] veth1_macvtap: left promiscuous mode [ 556.777876][ T8458] veth0_macvtap: left promiscuous mode [ 556.783495][ T8458] veth1_vlan: left promiscuous mode [ 556.788731][ T8458] veth0_vlan: left promiscuous mode [ 556.794747][ T8458] veth1_macvtap: left promiscuous mode [ 556.800305][ T8458] veth0_macvtap: left promiscuous mode [ 556.805843][ T8458] veth1_vlan: left promiscuous mode [ 556.811455][ T8458] veth0_vlan: left promiscuous mode [ 556.817278][ T8458] veth1_macvtap: left promiscuous mode [ 556.822859][ T8458] veth0_macvtap: left promiscuous mode [ 556.828386][ T8458] veth1_vlan: left promiscuous mode [ 556.833721][ T8458] veth0_vlan: left promiscuous mode [ 556.840760][ T8458] veth0_macvtap: left promiscuous mode [ 556.846290][ T8458] veth1_vlan: left allmulticast mode [ 556.851620][ T8458] veth1_vlan: left promiscuous mode [ 556.856850][ T8458] veth0_vlan: left promiscuous mode [ 557.142387][ T8458] team0 (unregistering): Port device team_slave_1 removed [ 557.168906][ T8458] team0 (unregistering): Port device team_slave_0 removed [ 557.585477][ T8458] team0 (unregistering): Port device team_slave_1 removed [ 557.614808][ T8458] team0 (unregistering): Port device team_slave_0 removed [ 557.726356][ T8458] pimreg (unregistering): left allmulticast mode [ 557.845493][ T8458] team0 (unregistering): Port device team_slave_1 removed [ 557.874173][ T8458] team0 (unregistering): Port device team_slave_0 removed [ 559.204297][ T8458] IPVS: stop unused estimator thread 0... [ 559.210717][ T8458] IPVS: stop unused estimator thread 0...