last executing test programs: 20m11.583778136s ago: executing program 1 (id=293): mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x2000000000032, 0xffffffffffffffff, 0x0) r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x4, 0x4) 20m11.51824712s ago: executing program 1 (id=295): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x811}, 0x0) r0 = socket(0x1e, 0x1, 0x0) connect$tipc(r0, &(0x7f0000000000)=@name={0x1e, 0x2, 0x1, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r0, &(0x7f0000000340), 0x2000011a) write(r0, &(0x7f0000000180)="b4", 0x1) recvmmsg$unix(r0, &(0x7f0000000c80)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000033240)=""/4096, 0x1000}], 0x1}}], 0x1, 0x121, 0x0) 20m11.219775062s ago: executing program 1 (id=297): r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0xf, {[@global=@item_012={0x0, 0x1, 0x5}, @local=@item_4={0x3, 0x2, 0x0, "45501821"}, @global=@item_012={0x1, 0x1, 0x9, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "84"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGREPORT(r1, 0x400c4807, &(0x7f0000000040)={0x3, 0x100, 0x7}) 20m10.637127392s ago: executing program 1 (id=304): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(0x0, r0) sendmsg$DEVLINK_CMD_TRAP_GROUP_SET(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000002640)={0x4c, r1, 0x1, 0x0, 0x0, {0x3d}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0xd}, {0x5, 0x83, 0x1}}]}, 0x4c}}, 0x20000810) 20m10.636128471s ago: executing program 1 (id=305): sendmsg$inet(0xffffffffffffffff, 0x0, 0x800) signalfd(0xffffffffffffffff, &(0x7f0000000000)={[0x8]}, 0x8) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r0 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r0, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r0, 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) timer_create(0x4, &(0x7f0000001900)={0x0, 0x2e, 0x4, @thr={0x0, &(0x7f0000001880)="bc5cb2cbfacf31a70433077803ed54fdafa50806c1e0431dcd3d02e15e871f97cbed2ff6b0bfdb3d0f678a311b654be8db2573d4"}}, &(0x7f0000001940)=0x0) timer_settime(r1, 0x0, &(0x7f0000001980)={{}, {0x77359400}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={0x0}}, 0x24000058) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_open_dev$vbi(&(0x7f0000000000), 0x2, 0x2) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000006}, 0x0, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r4, 0xffffffffffffffff, 0x0) 20m9.773923618s ago: executing program 1 (id=312): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0xc080) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[], 0x44}}, 0x0) close(0x3) 20m9.542200362s ago: executing program 32 (id=312): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0xc080) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000940)=ANY=[], 0x44}}, 0x0) close(0x3) 18m15.140380957s ago: executing program 2 (id=1720): syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x1b78, &(0x7f0000000040)={0x0, 0xccdb, 0xc000, 0x0, 0x20002fb}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x29, 0xfa00, {0x1, 0x0, 0x111, 0x9}}, 0x20) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000300)=0x8) fchmodat(0xffffffffffffff9c, 0x0, 0xfffffffb) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 18m15.031472422s ago: executing program 2 (id=1723): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000001500)={0x1, 0x0, 0x0, &(0x7f0000001600)=""/65, 0x0, 0xeeef0000}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000001a80)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x0, 0x0, 0x0, &(0x7f0000000400)=""/185, &(0x7f0000000140)=""/79, 0x9000}) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002205"], 0x0}, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f00000000c0)=0x1) ioctl$VHOST_VSOCK_SET_GUEST_CID(r0, 0x4008af60, &(0x7f0000000040)={@my=0x1}) r1 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r1, &(0x7f0000000200)={0x28, 0x0, 0x0, @my=0x1}, 0x10) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=""/57, 0x0, &(0x7f0000000500)=""/4092}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000240)=0x1) socket$netlink(0x10, 0x3, 0x2) 18m13.647911491s ago: executing program 2 (id=1763): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x30}, 0x1, 0x0, 0x0, 0x40010}, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000025c0), 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 18m13.431234942s ago: executing program 2 (id=1769): mkdir(&(0x7f0000001a80)='./file0\x00', 0x1cb) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0/../file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x0, &(0x7f00000000c0)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bpf(0x200000000000, &(0x7f0000000200)='.\x00', 0x0, 0x8b7840, 0x0) mount$bpf(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x84000, 0x0) mkdir(&(0x7f0000000140)='./file0/../file0\x00', 0x190) mount$bpf(0x200000000000, &(0x7f0000000000)='./file0\x00', 0x0, 0x989046, 0x0) mount$bpf(0x200000000000, &(0x7f0000000440)='./file0/../file0\x00', 0x0, 0x2042, 0x0) mount$bpf(0x0, &(0x7f00000001c0)='./file0/../file0\x00', 0x0, 0x200001, 0x0) 18m13.318491902s ago: executing program 2 (id=1772): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1000, 0x0) ioctl$BINDER_SET_MAX_THREADS(r0, 0x40046205, &(0x7f0000000100)=0x1) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000002c0)={0x4c, 0x0, &(0x7f0000000240)=[@reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}], 0x0, 0x0, 0x0}) 18m13.067316839s ago: executing program 2 (id=1778): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x3, 0x6369, 0x7, 0x0, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0xffffffff, 0x4, 0xc, 0x9, 0x2, 0x1}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x5, 0x7, 0x40, 0x1, 0x0, 0xa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="452eadc200"}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x3e}, 0x80, &(0x7f0000000080)}, 0x4) 18m12.936774883s ago: executing program 33 (id=1778): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000640)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x0, 0x3, 0x6369, 0x7, 0x0, 0x3}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0xffffffff, 0x4, 0xc, 0x9, 0x2, 0x1}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000440)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70b928, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xffff, 0xb}, {0x4, 0xb}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x5, 0x7, 0x40, 0x1, 0x0, 0xa}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="452eadc200"}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f00000000c0)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r6, 0x3e}, 0x80, &(0x7f0000000080)}, 0x4) 16m53.144977385s ago: executing program 6 (id=3233): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="020000000400000006000000450000000010"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB, @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000300000207b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={r1, 0x2000321, 0xe, 0x0, &(0x7f00000007c0)="63eced8e460100000001acf12a04", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) 16m52.954981766s ago: executing program 6 (id=3234): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="01002abd7000fedbdf255200000008000300", @ANYRES32=r2, @ANYBLOB="050088000600"], 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x24004054) 16m52.765362819s ago: executing program 6 (id=3240): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$igmp(0x2, 0x3, 0x2) r2 = dup(r1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = syz_io_uring_setup(0x5578, &(0x7f0000000180)={0x0, 0xfffffffd, 0x1000, 0x3, 0x800011a}, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0}}, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e24, 0xe9, @dev={0xfe, 0x80, '\x00', 0xa}, 0x5}, 0x1c) io_uring_register$IORING_REGISTER_FILES(r3, 0x2, &(0x7f0000000480), 0x0) io_uring_register$IORING_UNREGISTER_FILES(0xffffffffffffffff, 0x3, 0x0, 0x0) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8084}, 0x14044094) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, 0x0}], 0x1, 0x4b, 0x0, 0x0) syz_open_dev$usbfs(0x0, 0xffffbffffffffff7, 0x280e00) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_CAP_X2APIC_API(r2, 0x4068aea3, 0x0) 16m52.639019273s ago: executing program 6 (id=3242): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a3100000000090003007379"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) r1 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000500)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x4}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000851}, 0x24044010) r2 = socket$kcm(0xa, 0x3, 0x3a) r3 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000200), 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(r2, &(0x7f0000000080)={&(0x7f0000000000)=@l2tp6={0xa, 0x0, 0x0, @loopback={0xffffffffffff0000, 0xac14140c}}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000140)="8bcd", 0xffe3}], 0x1, 0x0, 0x0, 0x900}, 0x60) 16m52.483470261s ago: executing program 6 (id=3244): bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1e000000000000000400000007b1572900"], 0x50) 16m50.680405384s ago: executing program 6 (id=3258): close(0xffffffffffffffff) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(anubis))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x2, &(0x7f0000000080)=0x8, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x4, 0x6, &(0x7f0000000940)=ANY=[@ANYBLOB="b40800000000000073110e00000000008510000002000000b7000000000000009500c200000000009500001200000000830345f5b3f42590c416b7"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x5}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_raw(r2, &(0x7f00000001c0)={0x1d, r3}, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x404, 0x9}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x3, 0x4, 0x801, 0x1, r4, 0x15b4}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000000)={r5, &(0x7f00000000c0), 0x0}, 0x20) close(0x3) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x1}, 0x4004004) 16m50.447623724s ago: executing program 34 (id=3258): close(0xffffffffffffffff) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(anubis))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, 0x0, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r2, 0x65, 0x2, &(0x7f0000000080)=0x8, 0x4) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x4, 0x6, &(0x7f0000000940)=ANY=[@ANYBLOB="b40800000000000073110e00000000008510000002000000b7000000000000009500c200000000009500001200000000830345f5b3f42590c416b7"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback=0x5}, 0x94) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) bind$can_raw(r2, &(0x7f00000001c0)={0x1d, r3}, 0x10) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x404, 0x9}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x3, 0x4, 0x801, 0x1, r4, 0x15b4}, 0x50) bpf$BPF_MAP_LOOKUP_AND_DELETE_ELEM(0x15, &(0x7f0000000000)={r5, &(0x7f00000000c0), 0x0}, 0x20) close(0x3) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0, 0x1}, 0x4004004) 16m17.658579601s ago: executing program 7 (id=3571): syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_MGMT(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB='8\x00', @ANYRES16=r0, @ANYBLOB="01002abd7000fedbdf255200000008000300", @ANYRES32=r2, @ANYBLOB="0500880006000000060048"], 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x24004054) 16m17.59953452s ago: executing program 7 (id=3572): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000000080)="a2", 0x1}], 0x1}, 0x4006041) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0xf, 0x4, 0x4, 0x16, 0x0, 0xffffffffffffffff, 0xfffffffd}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="18020000801000000000000004000000850000002e00000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x80) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 16m16.738403698s ago: executing program 7 (id=3579): pipe2$9p(0x0, 0x80000) ioctl$int_out(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'wlan0\x00'}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x1, 0x4, 0x0, 0xfffffffffffffff8, 0x0, 0x6}, {0x0, 0x0, 0x400000003, 0xfffffffffffffffc}, 0xfffffffc, 0x0, 0x1, 0x0, 0x3}, {{@in6=@loopback, 0x4, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0xb7, 0x2, 0xfffffffe}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 16m15.163490748s ago: executing program 7 (id=3584): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$gtp(&(0x7f0000000000), r0) r2 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r2) getsockname$packet(r2, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newlink={0x38, 0x10, 0x437, 0x800000, 0x0, {0x0, 0x0, 0x0, r3, 0x504c3}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gtp={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GTP_FD0={0x8, 0x1, @udp6}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x2000c014}, 0x0) sendmsg$GTP_CMD_DELPDP(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="03002cbd70000e00000001000000", @ANYRES32=r3, @ANYBLOB="08000200000008"], 0x34}, 0x1, 0x0, 0x0, 0x44800}, 0x20000000) 16m14.996947736s ago: executing program 7 (id=3586): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x34, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_ETHERTYPE={0x6, 0x66, 0x8864}]]}, 0x34}}, 0x20004800) 16m13.763518239s ago: executing program 7 (id=3587): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) getpriority(0x1, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = openat$qrtrtun(0xffffff9c, &(0x7f0000000240), 0x801) mmap$qrtrtun(&(0x7f000085a000/0x4000)=nil, 0x4000, 0x1000000, 0x10, r2, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000300000008000000fd7f000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="801600000000d01a0000000700000000ca24000100"], 0x48) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000000c0)={'nat\x00', 0x2, [{}, {}]}, 0x44) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYRES16=r0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xf, &(0x7f00000003c0)=ANY=[@ANYRES16=r1], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x57b2, &(0x7f00000002c0)={0x0, 0x98d2, 0x800, 0x3, 0x321}, &(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000000)) unshare(0x6a040000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000021c0), 0x181000) close(r4) mmap(&(0x7f00005f7000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000080000000000000020"], 0x24, 0x0) ioctl$BLKRRPART(0xffffffffffffffff, 0x125f, 0x1f) 15m58.404125143s ago: executing program 35 (id=3587): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) getpriority(0x1, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mount(0x0, 0x0, 0x0, 0x44021, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r2 = openat$qrtrtun(0xffffff9c, &(0x7f0000000240), 0x801) mmap$qrtrtun(&(0x7f000085a000/0x4000)=nil, 0x4000, 0x1000000, 0x10, r2, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="010000000300000008000000fd7f000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="801600000000d01a0000000700000000ca24000100"], 0x48) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r3, 0x0, 0x41, &(0x7f00000000c0)={'nat\x00', 0x2, [{}, {}]}, 0x44) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=ANY=[@ANYRES8=r0, @ANYRESHEX, @ANYRES16=r0], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xf, &(0x7f00000003c0)=ANY=[@ANYRES16=r1], 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xc, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_io_uring_setup(0x57b2, &(0x7f00000002c0)={0x0, 0x98d2, 0x800, 0x3, 0x321}, &(0x7f0000000000), &(0x7f0000000080), &(0x7f0000000000)) unshare(0x6a040000) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000021c0), 0x181000) close(r4) mmap(&(0x7f00005f7000/0x1000)=nil, 0x1000, 0x0, 0x12, 0xffffffffffffffff, 0x0) setxattr$system_posix_acl(&(0x7f0000002a00)='.\x00', &(0x7f0000002a40)='system.posix_acl_default\x00', &(0x7f0000000180)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000080000000000000020"], 0x24, 0x0) ioctl$BLKRRPART(0xffffffffffffffff, 0x125f, 0x1f) 1m3.447317347s ago: executing program 4 (id=9259): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b05000009058d67c0002a000009050502000000000009058b6e", @ANYRESOCT], 0x0) syz_usb_ep_write(r0, 0x8d, 0x0, 0x0) getdents(0xffffffffffffffff, 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000840)={0xf, 0x20000800, 0x2000, 0x1, 0x3, 0x0, 0x0, 0x0, 0x1, 0x1}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='cpuacct.usage_sys\x00', 0x26e1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x10000000049}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$SEG6_CMD_SETHMAC(0xffffffffffffffff, 0x0, 0x4004810) r4 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1000000000021, &(0x7f0000000180), 0x4) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, 0x0, 0x10) r5 = socket$kcm(0x2d, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r5, 0x89e2, &(0x7f0000000340)={r5}) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB, @ANYRES16, @ANYRESHEX=r6, @ANYRESHEX=r6, @ANYRES8=r2, @ANYBLOB="98fb82f03485933e8a6ba8e72dcc4db8349d6bf21dcd137988615b24fe87d7d802d61b0ac47f868ad11a29cb9336287ac15baede0ceb6de2039ff986eb7087d315ffa241643339d5f43f1d", @ANYRES64=r1, @ANYRES8=r5], 0x50) socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) setsockopt$inet6_group_source_req(r6, 0x29, 0x2d, &(0x7f0000000680)={0x0, {{0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x3}}, {{0xa, 0x0, 0x6, @remote}}}, 0x108) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200000054000480500001800a0001006d6174636800000040000280080002400000000028000300ebae551382395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316330b00010068656c70657200000900010073797a30000000000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) 1m0.075727938s ago: executing program 4 (id=9274): ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000016c0)={0x4c, 0x0, &(0x7f0000000240)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x1, 0x4000, &(0x7f00000006c0)="02"}) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x1c, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6c}, 0x94) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) r2 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x17, 0x5, &(0x7f0000000500)=ANY=[@ANYRES32, @ANYRES16=r2, @ANYRES64, @ANYRESOCT, @ANYRESOCT=r1, @ANYRESDEC=r2, @ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, '\x00', 0x0, @fallback=0x37, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x401}, 0x94) r3 = syz_open_procfs(0x0, &(0x7f00000001c0)='net\x00') getdents(r3, &(0x7f0000001fc0)=""/184, 0xb8) close(r2) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x5, 0x5, &(0x7f00000005c0)=ANY=[], &(0x7f0000000000)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r5 = socket$kcm(0xa, 0x5, 0x0) setsockopt$sock_attach_bpf(r5, 0x29, 0x1b, &(0x7f00000001c0)=r4, 0xa1) socket$inet6_tcp(0xa, 0x1, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd63"], 0xcfa4) r6 = socket$inet6(0xa, 0x5, 0x0) getpgid(0xffffffffffffffff) setsockopt$inet_int(r6, 0x0, 0xf, &(0x7f0000000340)=0xfffffffffffffff9, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_REM(r6, 0x84, 0x65, &(0x7f0000000000)=[@in={0x2, 0x0, @loopback}], 0x10) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0x1, 0x0, &(0x7f00000003c0)='%', 0x0, 0xd01, 0x88be, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x1}, 0x50) r7 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) r8 = openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r8, &(0x7f0000000140)='cgroup.kill\x00', 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioctl$DRM_IOCTL_AUTH_MAGIC(0xffffffffffffffff, 0x40046411, &(0x7f0000000080)=0x2) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x80000000) r10 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x2, 0x0, 0x7fff0001}]}) readv(r9, &(0x7f00000004c0)=[{&(0x7f0000000040)=""/113, 0x71}], 0x1) close_range(r10, 0xffffffffffffffff, 0x0) 57.591965793s ago: executing program 4 (id=9280): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000001380)={&(0x7f0000001440)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0x4, [@datasec={0xffffffff, 0xd706ea5d817779d3, 0x0, 0xf, 0x3, [{0x0, 0x7e7}], 'Dy='}, @datasec={0x0, 0x0, 0x0, 0xf, 0x1, [], "84"}]}, {0x0, [0x30, 0x2e]}}, 0x0, 0x44, 0x0, 0x9}, 0x28) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@bridge_newneigh={0x28, 0x1c, 0x1, 0x70bd29, 0x25dfdbfa, {0x7, 0x0, 0x0, 0x0, 0x80, 0x0, 0xa}, [@NDA_PROBES={0x0, 0x4, 0xe}]}, 0x28}, 0x1, 0x0, 0x0, 0x8084}, 0x4040000) 57.517036732s ago: executing program 4 (id=9281): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x140) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0x6}, 0x48) mount_setattr(0xffffffffffffffff, 0x0, 0x8800, &(0x7f0000000080)={0x5}, 0x20) bpf$BPF_GET_MAP_INFO(0x4, &(0x7f0000000100)={r0, 0xfffffffffffffea3, &(0x7f0000000080)}, 0x10) r1 = io_uring_setup(0x115c, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(r1, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_FILES(r1, 0x1e, 0x0, 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) chroot(&(0x7f0000001140)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) pivot_root(&(0x7f0000000240)='./file0\x00', &(0x7f0000000100)='./file0/../file0\x00') 57.460051076s ago: executing program 4 (id=9282): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_X86_APIC_BUS_CYCLES_NS(r1, 0x4068aea3, &(0x7f0000000040)={0xc0}) 57.051905781s ago: executing program 4 (id=9284): socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.io_serviced\x00', 0x275a, 0x0) syz_open_dev$vbi(0x0, 0x1, 0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) eventfd(0x3) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="8f506370d700de40390d6ff5d31059"], 0x18) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}], 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/ip6_tables_targets\x00') r2 = socket$unix(0x1, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0xf2ff, r5, {0xffff, 0x5}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x8, 0x8, 0x4, 0xa, 0x3}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x56}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}}, 0x0) socket$kcm(0x11, 0x3, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) 56.594564447s ago: executing program 36 (id=9284): socket$nl_generic(0x10, 0x3, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000600)='blkio.bfq.io_serviced\x00', 0x275a, 0x0) syz_open_dev$vbi(0x0, 0x1, 0x2) syz_open_dev$tty1(0xc, 0x4, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) eventfd(0x3) ioctl$KVM_IOEVENTFD(0xffffffffffffffff, 0x4040ae79, 0x0) setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x29, 0x39, &(0x7f0000000400)=ANY=[@ANYBLOB="8f506370d700de40390d6ff5d31059"], 0x18) writev(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}], 0x1) syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='net/ip6_tables_targets\x00') r2 = socket$unix(0x1, 0x1, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xb}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000280)=@newtfilter={0x90, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0xf2ff, r5, {0xffff, 0x5}, {}, {0x7, 0x3}}, [@filter_kind_options=@f_matchall={{0xd}, {0x5c, 0x2, [@TCA_MATCHALL_ACT={0x58, 0x2, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x8, 0x8, 0x4, 0xa, 0x3}, 0x1}}, @TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x56}]}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x90}}, 0x0) socket$kcm(0x11, 0x3, 0x0) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000001000/0x1000)=nil) 14.362983767s ago: executing program 9 (id=9418): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) move_pages(r0, 0x0, &(0x7f00000004c0), 0x0, &(0x7f0000000240)=[0x0], 0x0) ptrace(0x10, r0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r1}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000200)={&(0x7f0000000180), &(0x7f0000000440)=""/179, &(0x7f0000000500), &(0x7f00000006c0), 0x3, r1}, 0x38) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0x3f}], 0x1, &(0x7f0000000380)=[@op={0x18}], 0x18}], 0x1, 0x40800) recvmsg$can_bcm(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f0000000100)=""/3, 0x3}, {&(0x7f0000000680)=""/112, 0xfffffef2}], 0x2}, 0x10150) 13.252277188s ago: executing program 9 (id=9423): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="d4000000240001032abd70000000000001"], 0xd4}}, 0x4080) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) shutdown(r3, 0x0) recvmsg$unix(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) syz_open_procfs$namespace(r4, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/18, @ANYRES32=r5, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB="4ce211ba00002901001fff50b1348dd5a4de9200000000", @ANYRES8=r0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00fbdd708fa855a1bc42b906c4dad20b2ad605a9393d62609338b53dd06094cf051af1db6e3cfc5e001d4d7f2be65b734469143660fc48e84fddbae8be69734d68df4eea143e5f0e4968dda23d42ea161c763e3a2d68378f0851148ba5f113a85de1cc4cc30bb381271e1c9e0c5d4c34b84d8e22cd4eec66322f9da4689f8008ad4337fe80b273d6332f885c4008aa6a", @ANYRES64=r0], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_ATTACH(0x1c, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="94196e166b00aec4295fe10658988c611dc5467045964c136a35e7b689b8e7612069b068ef7847c5a0bbf8000ad2ea61225f8461a48c4086", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000001c0)={0x2, 'veth0\x00', {0x929}, 0x1}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r6 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="2f825f669ccd"}) socket$nl_route(0x10, 0x3, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, 0x0) unshare(0x6a040000) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x15, 0x3, 'lblcr\x00', 0x2e, 0x5, 0x72}, 0x2c) r7 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x44) 10.315257692s ago: executing program 9 (id=9427): getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000000)={0x0}, &(0x7f0000000080)=0xc) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f0000000300)=0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000440)=[@text64={0x40, &(0x7f0000000180)="66baa000ecc744240011000000c7442402b16e0000ff2c2443f466baf80cb8f2c96789ef66bafc0c66ed0f072e0f01c248b820450000000000000f23d00f21f835000000010f23f8c46289900cabb9f9080000b8c93c0000ba000000000f30c4816857a601000000", 0x68}], 0x1, 0x0, 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r2 = socket(0x11, 0x2, 0x0) setsockopt(r2, 0x107, 0x12, &(0x7f00000001c0)="6c51b5ab0f100887", 0x8) setsockopt$bt_rfcomm_RFCOMM_LM(r2, 0x12, 0x3, &(0x7f0000000100)=0x6, 0x4) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r3 = open(&(0x7f00000001c0)='./bus\x00', 0x4c27e, 0x0) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27fffff, 0x13, r3, 0x0) fallocate(r3, 0x0, 0x9e1f, 0x575) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000440)=""/173) r4 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r4, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) fchmod(r4, 0x50) 10.051403165s ago: executing program 0 (id=9428): mkdir(&(0x7f0000000040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) dup2(r0, r1) setsockopt$inet6_buf(r1, 0x29, 0x1c, 0x0, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000500)=@nat={'nat\x00', 0x1b, 0x5, 0x548, 0x240, 0x240, 0xffffffff, 0x240, 0x388, 0x478, 0x478, 0xffffffff, 0x478, 0x478, 0x5, &(0x7f0000000140), {[{{@uncond, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@srh={{0x30}, {0x33, 0x8, 0x2, 0x3, 0x8, 0x69, 0x21}}]}, @unspec=@DNAT1={0x48, 'DNAT\x00', 0x1, {0x1, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @ipv4=@private=0xa010102, @icmp_id=0x64, @gre_key=0x99}}}, {{@uncond, 0x0, 0xd8, 0x120, 0x0, {}, [@common=@ah={{0x30}, {[0x4d3, 0x4d3], 0x7, 0xa6, 0x2}}]}, @MASQUERADE={0x48, 'MASQUERADE\x00', 0x0, {0x24, @ipv6=@private0={0xfc, 0x0, '\x00', 0x1}, @ipv4=@multicast1, @gre_key=0x4, @gre_key=0xa}}}, {{@uncond, 0x0, 0x100, 0x148, 0x0, {}, [@common=@unspec=@cluster={{0x30}, {0x2, 0x38, 0x3, 0x1}}, @common=@ipv6header={{0x28}, {0xb, 0x8}}]}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0xc, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, @ipv4=@rand_addr=0x64010100, @port=0x4e23, @port=0x4e24}}}, {{@uncond, 0x0, 0xa8, 0xf0}, @REDIRECT={0x48, 'REDIRECT\x00', 0x0, {0x18, @ipv6=@private0, @ipv4=@multicast1, @port=0x4e24, @port=0x4e21}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x5a8) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) msgrcv(0xffffffffffffffff, 0x0, 0x0, 0x1, 0x1000) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, 0x0, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000000)={0x7, 0x5, 0x4, 0x20, 0x80, 0x6, 0xd, 0x7, 0x2, 0x31, 0xa2, 0xb, 0x81, 0x84}, 0xe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000000c0)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0xfff, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) listen(r7, 0x20) setsockopt$inet_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000000)='bic', 0x3) shutdown(r7, 0x0) openat$sequencer2(0xffffff9c, &(0x7f00000001c0), 0x0, 0x0) 9.910356411s ago: executing program 8 (id=9429): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2) r0 = syz_open_procfs(0x0, &(0x7f0000000180)='fdinfo\x00') getdents(r0, &(0x7f0000000000)=""/43, 0x2b) getdents64(r0, 0x0, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000140), 0x0, &(0x7f0000000200)=ANY=[@ANYRES32=r0, @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0xdfffffff, 0x5e490420, 0x2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x88}}, 0x50) syz_fuse_handle_req(r1, &(0x7f000000e3c0)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a50e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0x3731}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0xc5001, 0x104) write$cgroup_netprio_ifpriomap(r3, 0x0, 0xeffd) 9.810028693s ago: executing program 8 (id=9431): socket$kcm(0x29, 0x5, 0x0) r0 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r0, 0x84, 0xc, &(0x7f0000000040)=@assoc_value={0x0}, &(0x7f0000000000)=0x8) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'ecryptfs', 0x20, 'user:', '}@^/!-{', 0x20, 0x400}, 0x2f, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f0000000080)={r1, 0x3}, 0x8) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r5, 0x0, r3, 0x0, 0x10, 0x0) ioctl$sock_SIOCINQ(r2, 0x541b, &(0x7f0000000100)) write$cgroup_pressure(r3, &(0x7f00000000c0)={'some', 0x20, 0xf, 0x20, 0x8}, 0x2f) sendmmsg$unix(r6, &(0x7f0000004580)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0) writev(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000200)="39ee6b73f2789222aa144a60d9dcb0707dfdffffff2b892dd5f50dffc81e9433ab4ef6ba41a71c8cea2c85b18fd8e918856c72b365779562a6fcabae440287464a0053d3a449bf3cf563fa3e4a98390fac68b4a1ffaae79a9c514d54c929de4d9293b29c1e780851c0a07d699cfd2d08e078336a8b516ab54525a2fe4c3d04d4cb99d5a409bdf760abaa70c90e86b25d9d560dcc20bf21bab8754788ef9993019b855d5097fd20a111e5978296476b5c8f3012bcfe7e8f4d4b8b3e5384d845ac969ed8523d2deb17167cd71c262d2f39159a9dd7acdda61c480ff9927f00e08dd8d8f6a4a83c58a484d532f22924e366ab6365a61bb2758d4d1639a1cd9fc23f709b3434ffbe00a836ec1be9c55831d7d80b4018439c8d005754b30abe470a9434e797cab05d4c11bbcb12da83edffea08b0b0fb0020434647879b29f5170ed957932c0d09b2fb886dd4773796de009d77fbfc58708c0708edbb47c20a9dd40b9fa3a1dda049b0ecf18877934b8e22560ce781a160d01d", 0x177}], 0x1) 9.695722046s ago: executing program 5 (id=9432): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29", 0xce}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05", 0x43}, {&(0x7f00000000c0)}], 0x5}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459e33fe5", 0xef}], 0x1}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 9.675447276s ago: executing program 5 (id=9433): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xb, 0x80000) ioctl$EVIOCGREP(r0, 0x80084503, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) socket(0x28, 0x3, 0x8) socket(0x40000000015, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000180)=ANY=[], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x6, 0x8, 0x8003, 0x0, 0x6, 0x1, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x122, 0x0) shutdown(0xffffffffffffffff, 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1", 0x17, 0xfffffffffffffffe) r4 = add_key$user(0x0, &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)="58d052799202003bc161b11518b712c09c5ed6389e", 0x15, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r4, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x8000) socket(0x1a, 0x0, 0xfffffff8) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e23, 0x7, @empty, 0x80000000}}, 0x0, 0xea, 0x43c, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0x6}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r5, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) r6 = syz_open_dev$vim2m(&(0x7f0000000580), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000100)={0x410000, 0x2}) 9.595955201s ago: executing program 8 (id=9434): openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) r0 = socket$nl_sock_diag(0x10, 0x3, 0x4) write(r0, &(0x7f0000000580)="2500000014000707030e00001280690f0a0011000100f5fe0012ff000000078a8f50c5440039", 0x26) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44800}, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r4 = socket$inet6(0xa, 0x2, 0x0) clock_gettime(0x3, 0x0) recvmmsg(r4, &(0x7f0000000040), 0x400000000000284, 0x2, 0x0) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000000)=0x15) ioctl$TCSETS(r5, 0x40384708, &(0x7f0000000040)={0x8, 0x40000001, 0x2000004, 0x7, 0x1a, "3e180000650000000000000000cb00002000"}) 8.817943201s ago: executing program 9 (id=9435): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$kcm(0x11, 0x3, 0x0) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003180)=@newtfilter={0xea4, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r9, {0x5, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe70, 0x2, [@TCA_MATCHALL_ACT={0xe6c, 0x2, [@m_pedit={0xe68, 0x1, 0x0, 0x0, {{0xa}, {0xe3c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe38, 0x4, {{{0x800, 0x2, 0x20000000, 0x10000, 0x40}, 0x8, 0x5, [{0x4, 0x6, 0x30, 0x9, 0xc, 0x9}]}, [{0x7, 0x8, 0x2, 0x5, 0x2, 0x200}, {0xff, 0x7, 0x101, 0x8, 0x810, 0xffffffff}, {0x5, 0x8, 0xfff, 0x2, 0xffffffff, 0xb93}, {0x6, 0x4, 0x3, 0xfffffff3, 0x4, 0x6}, {0xd3d4, 0x2, 0x8, 0x6, 0x101, 0x10}, {0x9, 0x40, 0x6, 0x80000000, 0x6, 0x10001}, {0x4, 0x9, 0x100, 0xf9d8, 0x7, 0xfd4}, {0x5796, 0xffff, 0xd44b, 0x8, 0x1, 0x37a}, {0x6, 0x3, 0x1, 0x80000001, 0x3f, 0x10}, {0x4, 0x9e9c, 0x60, 0x7, 0x0, 0x1}, {0xffe00000, 0x1, 0x8000, 0x4, 0x3, 0x7}, {0x101, 0x9, 0x400, 0x3, 0x9, 0x3}, {0xce9, 0xfffffffb, 0x4, 0xae5e, 0x3ff, 0x2}, {0x3, 0x5, 0x6, 0x4, 0x197d, 0xfb56}, {0x2, 0xe42, 0xf3, 0x0, 0x6, 0x101}, {0x4, 0x5, 0x74d77b97, 0xfffffd8b, 0x0, 0x4}, {0x7fff, 0x5b, 0xb3a, 0x6, 0x2, 0xb5e}, {0x4c5be96a, 0x6, 0x2, 0x5, 0xd2a1, 0xbe47}, {0x6, 0x7, 0x9, 0x4, 0x3, 0x1}, {0x3, 0x8, 0x7, 0x4, 0x95, 0x3}, {0x6, 0x5, 0x2, 0x7fffffff, 0x8, 0xff}, {0x1, 0x71, 0x800000, 0xcf55, 0x3, 0x9}, {0x7933, 0x6e20, 0x6, 0x81, 0x2, 0x8}, {0xff, 0x8001, 0xff, 0x10001, 0x5, 0x5}, {0x6, 0x37, 0x0, 0x6, 0xed, 0x5}, {0xce, 0xae, 0x4, 0x2, 0x10000, 0x800}, {0x200, 0x5, 0x6, 0x5, 0x9, 0x9}, {0x8, 0xdd4, 0x8, 0x8, 0x5}, {0x3, 0x3, 0xa, 0x6, 0x9, 0x9}, {0x9, 0x4, 0x9d42, 0x4, 0x1, 0xfffffffb}, {0x8c, 0x6b8, 0x6, 0x2, 0x2, 0xfffffffe}, {0x3, 0x811, 0x9, 0x5, 0x4}, {0x3, 0x80000001, 0x400, 0x2, 0x0, 0x8001}, {0xfffffe01, 0x2, 0x8, 0x2, 0x8, 0x8}, {0x0, 0x22, 0x5, 0x3, 0x401, 0x5}, {0xa, 0x5, 0x101, 0x5, 0xfffffc01}, {0x4, 0x5, 0x0, 0x0, 0xdb, 0x3d04b554}, {0x5, 0x9, 0xfffffffa, 0x1, 0xfffffffc, 0x2}, {0x8, 0x7, 0x7, 0x99f, 0x9, 0x3}, {0x5, 0x252, 0x8000, 0xffff8001, 0xb, 0x900}, {0x4, 0x3, 0x3, 0x21, 0x7, 0x7}, {0xfffffffb, 0x28a1, 0x2, 0x7, 0x0, 0x4}, {0x0, 0x7fff, 0x2, 0xfffff399, 0x20000009, 0xe756}, {0xfff, 0xc, 0x4, 0x8, 0x2, 0xe}, {0x6, 0x4, 0x6, 0x1, 0x80, 0x980}, {0x23ae789, 0xc, 0x4, 0x7, 0x200, 0x4}, {0x5, 0xe, 0x2, 0x9, 0x0, 0xf3}, {0x0, 0x9, 0x2, 0x4, 0x3, 0x4}, {0x8, 0x4, 0x5, 0xfffffffd, 0x400, 0x7f}, {0x9, 0x80, 0x6e6b, 0x6, 0x203}, {0x371cf7fc, 0x7, 0x2, 0x1ff, 0xfffffffa, 0x6a97}, {0xd1, 0x6, 0x4, 0x7, 0x5a, 0x9}, {0x8, 0x7f, 0x7fffffff, 0x7f, 0x2, 0x8}, {0x7ff, 0x1, 0x3, 0x2, 0x9, 0x400}, {0x6, 0x1ff, 0x0, 0x9, 0x7, 0x4}, {0x4, 0x6, 0xfe, 0x100, 0xc6}, {0x3, 0xfffffffd, 0xd, 0x6, 0xfffffffe, 0x1000}, {0x7, 0x2, 0x1, 0xd, 0xfffffffe, 0x3}, {0xfffffff9, 0x80000001, 0xe, 0x2, 0x200, 0x7}, {0x3, 0x0, 0xa820, 0x787e, 0x200002, 0x2}, {0x8, 0x4, 0x5ae, 0x2, 0x8}, {0x5, 0x52, 0x8, 0x5, 0x10, 0x9}, {0x1, 0x7, 0x3, 0x280, 0x800, 0x6}, {0x10, 0x801, 0x0, 0x8, 0x3, 0xa}, {0xad, 0x8, 0x4, 0x5, 0x0, 0xfff}, {0x6, 0x6, 0x7fff, 0x0, 0xff, 0x7fffffff}, {0x8, 0x85e6, 0x3, 0x0, 0x5, 0xc}, {0x9, 0x78e3, 0x5, 0xbc27, 0x7, 0x9}, {0x6, 0x7, 0x2, 0xdb60, 0x3}, {0x80000001, 0x0, 0x3, 0x1, 0x81, 0xba}, {0x10001, 0xfff, 0x7, 0x0, 0x9, 0xc29}, {0x100, 0x2, 0x9, 0x7, 0x84e1, 0x3ff}, {0xa45b, 0x8, 0xe, 0x7, 0x9}, {0x7, 0x5, 0x1, 0x80, 0x6, 0xff}, {0xd5e, 0x5, 0x0, 0x100, 0x0, 0x10}, {0x200, 0x2, 0x8000, 0x0, 0x6b, 0x4}, {0x0, 0x0, 0x9, 0x8, 0x100, 0x1000}, {0x4, 0x3ff, 0x0, 0x10000, 0x7, 0x7}, {0x8001, 0x1, 0x1, 0x2001ff, 0x4, 0x1}, {0x4, 0xd38f, 0x6, 0x4, 0x170ddbc4, 0xe38}, {0x14a, 0x7, 0x0, 0x10001, 0x1, 0x2}, {0x9, 0x6, 0x1, 0x400, 0xffffffff, 0xfffffffc}, {0x7, 0x6, 0x3909, 0xffffffff, 0x1705, 0x7}, {0x3, 0x3b10fe2d, 0x4006, 0x5, 0x3, 0xffff7fff}, {0x9430, 0xb, 0x6, 0x2, 0x9, 0x5}, {0xa, 0xb1fb, 0x6, 0x6, 0xc5, 0x9}, {0x2a455dad, 0x5, 0x29, 0xfffffff9, 0x800, 0x7fff}, {0x3, 0x3, 0xee, 0x9, 0x6, 0x8}, {0x5ce, 0x3, 0x0, 0xb, 0x8, 0x99}, {0x2, 0x9, 0xf623, 0x7, 0xff, 0x8}, {0x101, 0x6, 0x80000000, 0x9, 0xfffff697, 0x8}, {0x9, 0x8, 0x7, 0x2, 0xa226, 0x9}, {0x8, 0x8, 0x3, 0xfffff246, 0xf, 0x2}, {0x3, 0xaf, 0x7ff, 0xe0, 0x0, 0x7cf}, {0x8, 0x7, 0x29af2cf0, 0x1, 0x7, 0x80000000}, {0x7fff, 0x9, 0x4b, 0xa4e}, {0xffffffff, 0x7, 0xa, 0x80000000, 0x0, 0x69}, {0x4, 0x9, 0x9, 0x4, 0x100, 0x5}, {0x6, 0x6, 0x2, 0x80000001, 0x6, 0x9}, {0x6, 0x401, 0x2, 0x2, 0x3, 0xb}, {0xd, 0x40, 0x3, 0xa, 0xffffffff, 0x1d1a}, {0xc0, 0x81, 0xb, 0x3, 0xea, 0x3}, {0xc, 0x2, 0x1, 0xa, 0x1, 0x2f4}, {0xf, 0x6, 0x80, 0x73e7, 0x1000, 0x4}, {0x6, 0x8000, 0x80000001, 0x8dcc, 0x4, 0x7ff}, {0x7, 0x12, 0x8, 0x8, 0x69, 0x9}, {0x7f, 0x7, 0x4, 0x0, 0x3, 0x2}, {0x6, 0x0, 0x7a, 0x5, 0x4, 0x1000}, {0xb06, 0x7, 0x7ff, 0x400009, 0x0, 0x7bffffff}, {0x4, 0x7b, 0x3, 0x4, 0x0, 0xa7}, {0x81, 0x56c3, 0x1, 0xdda, 0x6, 0xb27d}, {0x4, 0x3, 0x401, 0xad, 0xcf5, 0xf8c}, {0x8, 0x1, 0x3, 0x40, 0x1, 0x4907}, {0x6, 0x4, 0x38, 0x4, 0x5, 0x6}, {0x7, 0x2, 0xf, 0x64, 0x1, 0x7}, {0x1, 0x2, 0x4010, 0xffffffad, 0x0, 0x751e}, {0xfff0, 0x2, 0x4, 0x3, 0x3, 0x5}, {0x5, 0x7, 0x8, 0x1, 0x5, 0xfff}, {0x4fb, 0x0, 0x0, 0x7ff, 0x4, 0x5}, {0xf455, 0x3, 0x7fff, 0x59ed, 0xb4e9, 0xe4}, {0x7, 0x2, 0xe, 0x0, 0x3da78e9c, 0x8000}, {0x2, 0x0, 0x400, 0x765, 0x7f, 0x7}, {0x5, 0x7, 0x5, 0x8, 0x8, 0x7}, {0x10, 0x3, 0x9, 0x5, 0x8, 0x2}, {0x6a, 0x200, 0x81, 0xffffffff, 0x4, 0x200}, {0x3, 0x8007, 0x3, 0x4a, 0x6, 0x1}, {0x0, 0x2, 0x7, 0x616, 0x5, 0x4}, {0x6, 0xb25b, 0x3, 0x0, 0x6, 0xb}], [{0x4, 0x1}, {0x5}, {0x4}, {}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x5, 0x1}, {0x6}, {0x0, 0x1}, {0x2}, {0x4}, {0x5}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x1}, {0x2}, {0x4}, {0x1}, {0x0, 0x1}, {0x5}, {0x5, 0x1}, {0x5}, {0x2, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x4}, {0x3, 0x1}, {}, {0x4, 0x1}, {0x4}, {}, {0x5}, {0x5, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x5, 0x1}, {0x4, 0x1}, {}, {0x3, 0x1}, {0x1, 0x1}, {0x1}, {}, {0x5}, {}, {0xd}, {0x0, 0x338f50ad6d91f11}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x4}, {0x3}, {0x1, 0x1}, {0x4}, {0x5}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x0, 0x1}, {0x5}, {0x4}, {0x4, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x3}, {0x1, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x4}, {0x1}, {0x4}, {0x3}, {}, {0x5, 0x1}, {0x2, 0x1}, {}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x1}, {0x6, 0x1}, {0x5}, {0x3}, {0x1, 0x1}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x4, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x3}, {0x3}, {0x4}, {0x5, 0x1}, {0x3}, {0x0, 0x1}, {0x2, 0x1}, {0x3}, {0x5}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x3, 0x1}, {0x4}, {0x4}, {0x5}, {0x5, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x4}]}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xea4}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r6, &(0x7f00000000c0)={&(0x7f0000000500)=@xdp={0x2c, 0x0, r4, 0xc}, 0x80, &(0x7f00000006c0)=[{&(0x7f0000000180)="27030200590214000600002fb96dbcf706e10500000086ddffff1144ee163cd4b8bf", 0x22}, {&(0x7f0000000c00)="4307ed2e", 0x4}], 0x2}, 0x4) 8.601308975s ago: executing program 8 (id=9436): socket$key(0xf, 0x3, 0x2) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, 0x0, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) symlink(0x0, &(0x7f0000000100)='./file0\x00') chmod(&(0x7f0000000180)='./file0\x00', 0x23f) setuid(0xee01) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) quotactl$Q_SYNC(0xffffffff80000101, 0x0, 0x0, 0x0) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='.\x00', &(0x7f0000000100)='ufs\x00', 0x210818, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0xc0405627, &(0x7f0000000100)={0x0, 0x980900}) sendmsg$nl_xfrm(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=ANY=[@ANYBLOB="040100001a0007002abd700000000000640000000000e0000001000000000000020000000000ffff00004e220000000000000200"/64, @ANYRES32=0x0, @ANYRES32=0xee00, @ANYBLOB="ff010000000000000000000000000001000000002b000000fc0000000000000000000000000000005a0000000000000000b40000000000000200000000000000010000007ffffffe0000000000000000000006000000000000000000000000000000000000000000000000000000000000002000000000000700000000000000fdffffffffffffff0000040000000000e80a000000000000000000000a000200700000000000000014000e00fe80"], 0x104}}, 0x0) 8.389832554s ago: executing program 5 (id=9437): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a09040000000000000100420000200900010073797a30000000000900020073797a320000000038000000080a01020000000000000000020000060c00034000000000000000020900020073797a32000000000900010073797a30"], 0x8c}, 0x1, 0x0, 0x0, 0x4040}, 0x0) r1 = syz_io_uring_setup(0x7eba, &(0x7f0000003500)={0x0, 0xadc, 0x2000, 0x3, 0x1000}, &(0x7f0000003580), &(0x7f00000035c0), &(0x7f0000003600)) r2 = eventfd(0x0) io_uring_register$IORING_REGISTER_EVENTFD(r1, 0x4, &(0x7f0000000000)=r2, 0x1) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000400)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r4, 0x0, 0x0) recvmmsg(r5, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="5c0000000206030000000000008000000000000805000100070000000900020073797a30000000001400078008001240001500000500150000100000050005000000000005000400000000000d000300686173683a6d6163"], 0x5c}}, 0x0) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r1, 0x19, &(0x7f0000003640)={0x0, 0x7, 0xc723}, 0x0) 7.425459465s ago: executing program 8 (id=9440): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="d4000000240001032abd70000000000001"], 0xd4}}, 0x4080) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) shutdown(r3, 0x0) recvmsg$unix(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) syz_open_procfs$namespace(r4, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/19, @ANYRES32=r5, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB="4ce211ba00002901001fff50b1348dd5a4de9200000000", @ANYRES8=r0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00fbdd708fa855a1bc42b906c4dad20b2ad605a9393d62609338b53dd06094cf051af1db6e3cfc5e001d4d7f2be65b734469143660fc48e84fddbae8be69734d68df4eea143e5f0e4968dda23d42ea161c763e3a2d68378f0851148ba5f113a85de1cc4cc30bb381271e1c9e0c5d4c34b84d8e22cd4eec66322f9da4689f8008ad4337fe80b273d6332f885c4008aa6a", @ANYRES64=r0], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_ATTACH(0x1c, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="94196e166b00aec4295fe10658988c611dc5467045964c136a35e7b689b8e7612069b068ef7847c5a0bbf8000ad2ea61225f8461a48c4086", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000001c0)={0x2, 'veth0\x00', {0x929}, 0x1}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r6 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="2f825f669ccd"}) socket$nl_route(0x10, 0x3, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, 0x0) unshare(0x6a040000) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x15, 0x3, 'lblcr\x00', 0x2e, 0x5, 0x72}, 0x2c) r7 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x44) 6.67098933s ago: executing program 5 (id=9441): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000780)=ANY=[@ANYBLOB="d4000000240001032abd70000000000001"], 0xd4}}, 0x4080) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff}) shutdown(r3, 0x0) recvmsg$unix(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000780)=[@cred={{0x1c, 0x1, 0x2, {0x0}}}], 0x20}, 0x0) syz_open_procfs$namespace(r4, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="3c0000001000850600"/19, @ANYRES32=r5, @ANYBLOB="01030003000000001c0012000c000100626f6e64000000000c0002000800010005"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000007c0)=ANY=[@ANYBLOB="4ce211ba00002901001fff50b1348dd5a4de9200000000", @ANYRES8=r0, @ANYBLOB="0002010000000000240012800b00010065727370616e000014000280050016000000000008000700ac1414bb08000a00fbdd708fa855a1bc42b906c4dad20b2ad605a9393d62609338b53dd06094cf051af1db6e3cfc5e001d4d7f2be65b734469143660fc48e84fddbae8be69734d68df4eea143e5f0e4968dda23d42ea161c763e3a2d68378f0851148ba5f113a85de1cc4cc30bb381271e1c9e0c5d4c34b84d8e22cd4eec66322f9da4689f8008ad4337fe80b273d6332f885c4008aa6a", @ANYRES64=r0], 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x1) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_ATTACH(0x1c, &(0x7f0000000440)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB=',\x00\x00\x00\x00\x00\x00\x00', @ANYRES32, @ANYBLOB="94196e166b00aec4295fe10658988c611dc5467045964c136a35e7b689b8e7612069b068ef7847c5a0bbf8000ad2ea61225f8461a48c4086", @ANYRES32, @ANYBLOB, @ANYRES64=0x0], 0x20) ioctl$sock_SIOCGIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(0xffffffffffffffff, 0x8982, &(0x7f00000001c0)={0x2, 'veth0\x00', {0x929}, 0x1}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r6 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @random="2f825f669ccd"}) socket$nl_route(0x10, 0x3, 0x0) getsockname$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs, 0x0) unshare(0x6a040000) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000080)={0x84, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x15, 0x3, 'lblcr\x00', 0x2e, 0x5, 0x72}, 0x2c) r7 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r7, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x44) 5.887350633s ago: executing program 0 (id=9443): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29", 0xce}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05", 0x43}, {&(0x7f00000000c0)}], 0x5}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459e33fe5", 0xef}], 0x1}}], 0x2, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, 0x0) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4.688450891s ago: executing program 3 (id=9445): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d0", 0x95}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb519864", 0x67}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a", 0xab}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e", 0x33}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459e33fe5", 0xef}], 0x1, &(0x7f0000000cc0)=[@timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x48}}], 0x2, 0x20000044) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 4.611486584s ago: executing program 0 (id=9446): socket$inet_sctp(0x2, 0x5, 0x84) socket$netlink(0x10, 0x3, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x2, 0x400, 0x0, 0x37d}, &(0x7f00000001c0), &(0x7f0000000080), 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1, 0x0, 0x2}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000240)=@mmap={0x1, 0x2, 0x4, 0x100000, 0x9, {}, {0x0, 0x2, 0x4, 0xc0, 0x0, 0xf0, "18a6fc23"}, 0x1, 0x1, {}, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000180)=@mmap={0x1, 0x2, 0x4, 0x100, 0x81, {}, {0x4, 0x8, 0x8, 0x5, 0x29, 0x9, "0adb3fb8"}, 0x5}) io_uring_setup(0x30aa, &(0x7f0000000440)={0x0, 0x764, 0x80, 0x1, 0x14c}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) timerfd_create(0x9, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000240), 0x2, 0x40102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2f) getsockopt$bt_BT_SECURITY(0xffffffffffffffff, 0x112, 0x4, &(0x7f0000000140), 0x2) mount(&(0x7f00000000c0)=@nullb, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000000)='iso9660\x00', 0x208000, 0x0) 4.610420924s ago: executing program 9 (id=9447): mount(&(0x7f0000000140)=@nullb, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000040)='udf\x00', 0x208000, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f00000000c0)={0x1, 0xfc, 0x5, &(0x7f0000000100)={0x22, "f40900000000000000ba0300"}}) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00'}) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4c814) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000005580)=""/102392, 0x18ff8) r2 = gettid() r3 = syz_open_procfs(r2, &(0x7f00000000c0)='net/tcp\x00') read$FUSE(r3, &(0x7f0000004180)={0x2020}, 0x2020) bpf$MAP_CREATE(0x0, &(0x7f0000000140)=ANY=[@ANYRES16=r2], 0x50) 3.827687239s ago: executing program 3 (id=9448): socket$nl_route(0x10, 0x3, 0x0) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet(0x2, 0x1, 0x100) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) mprotect(&(0x7f000081d000/0x2000)=nil, 0x2000, 0x1000008) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCADDRT(r5, 0x890b, &(0x7f0000000840)={0x0, {0x2, 0x0, @empty}, {0x4, 0x0, @loopback}, {0x2, 0x4e23, @remote}, 0x184, 0x0, 0x0, 0xfdffffffffffffff, 0x0, &(0x7f0000000180)='lo\x00', 0x0, 0x80000000}) shutdown(r1, 0x1) r6 = socket$inet(0x2, 0x2, 0x1) sendmsg$inet(r6, &(0x7f0000000080)={&(0x7f0000000000)={0x2, 0x5000, @empty}, 0x10, &(0x7f00000000c0), 0x0, 0x0, 0x0, 0x60000000}, 0x4) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x61, &(0x7f0000001040)={'filter\x00', 0x4}, 0x68) r7 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000b40)='source', &(0x7f0000000040)='\x01\x01\x00\x11\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) ioctl$VT_RESIZEX(r0, 0x560a, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(0xffffffffffffffff, 0xd000943e, &(0x7f0000000040)={0x0, 0x0, "d607f8f9951e76c13f64323723e7eecdf40c363423eb3d259266ec9c37865c6c1a4640ce1b22bb3327ef4f001d34c09f39c3539e4f8d3ee0878ae95bc7f52363c468b257ff3e24852548deb01efd54f11ed2c41d078b9cf1fc8f725616b694bb4a6e4606c3fb19d1d2bd3c8c4e97da2213f9d5c3b90400000000000000c279f03558083906666827d61dcc3a633b72fad6265a293e3877adc1660edbc9a0307a25720a170e7f5670e419dc44febf7ddc73fd4a5a0b6c28665f7f46c7084e17c809268103a2584ab40a68e528329dffafc3612e325c1eb4a3ab2e156a97444800", "0615e456c196e819a321fdb3690bfab19538829a732a01781564ef7738cb5b82a704b3952f81c68bb4ceeaad63206f88201638e87c4981cbf9332cbc9c4d69e392bd33237ece7ad91e44edac0da8dacad81adf2e08c21ad6b44ce1f90bd618c255ca40cdb411485fb48a51d329c816b3488c7d032ef69c502c6e1236bd381efd410165988847c1dcb98a18ca2b853910e52044fa3b3026cb88de269537c8f26ffc3b15cbf279832bfc90bd95939043182e88050dfd2a4784a5d1453610fb1f1c2bac36c3ecd3e6fb756ef8880debeef3636afd981d8af4ab119928448f90351aec113335eacf52a18c87738d9679d3acc032a16fbefc64776f363610a15b37bcd36e6a7cba931151b9c9ba5779d550e9ab21603a43a25f3b4895d8dc4f3ce0e7d5e964e888169ea79a0848e9338b3d34d62e963fbf98834f4455419907f0ffdb76373af77a34edee7789f56e7f01bdab9614a0d460f791a06e6cf5243bf2b3a1624a80ec7e1116f1c81f5ef4b895be74bf67eea9193428b58a8b62b7976d3d2e59796c46ec918c83cd49c3f43dbd2967586966c19ace7b0bef5f94eb333b362649f1bfa114f8b1f126e97ec672cff77e2130823fa7a1df6760c6a8917815e9f0a409ed32b133df7dc9afceffcd472b35145c83c9167764d25ce214133c6170adeb6653b30b226a3b6ff1363ac862a540c7fab584cd051ce7ee951e0f121d43cff75afbdec6bc6f6e8f7db58c8086751320d22ee8582e915cabc536e3767e9a9230c9ae8b92398f0ca2a7141ea4588af7afde10e5ec2a6fe85ba5712e126629d4e3998fc4721cb638f2ef8356049e3448466e2c400d5e8baf843fa399907cb526b791c5350ce29204cb6fe50b892a69ec6dbecc28f032a745738faa12c2a34222942fef0ec0511da5fe0b565ceac429da7cc25cfe0320b40a514723e2392a6a361032343edb79fd83cd0a354837153542fd61b3156b54c566036e493250c3a3214738e3cacc24a50d5dfd17d5008b4ca629c3062f3417cb69c48b8b888ae51256bb4e6c68e95a71a00383ad9df263f6a775ded64fef20ed5cb5f31c33cb86f839d00a12e40cd31219113619c4e0585454cb1776278bfd7f5c4275792afb790e83ff0fc6925355c7aee7a070477d9ec2292366e39b9dc66f7adcf449a1a718e5217183faf0f679efc5cef20bcdcf2d12ea0684084ec0d693256e280025b23b5a08b7b1ebe7d41fb045793f971d6ee066604818cb09d86c1eda99a44c35476a113fd5d1a7543f8f99424ebb78dd9e00d719502a6eafa743a061fa3fa55e4deaa0a011b6b9d633f10e0c9446b5a2e3f6d6014ab00695366c1a6bf0c32f703aebb7988c7d4d322681458e85626302c70f37628835e1fcfff1da3099c0b4af433eb9a51f9609f2c0c09a98b18880c846b34d6ac0210f073765666100976ee1d928893f983580ea47a012144633b98e02c3e81869534ab985eb3a73e0bac892dac949f85db949285a6a7a490b1075467226af23df82d8dd09b7282490fbb3ada9ed4cae8f761aefbe0701de6b132f12044c58ac1c2607c8f51361de5bed021dea13fd0a440263cf0b304522a324b581ab274e7bdae5994316657b5c0ab0220d9b08739729f7a35d436878c182aec4f08dd161c11ee5b7937fae7835e8bfe98a44c8d4bbb2e0eee0cb5d7c93517e96a9fc8132e60f3ef7c735bea1934b37df451f981c8d9210e61278c871e6dad6ceb89aa4d7245658a63e65cec7b81d307426a60a31cc917844a14e1d9ad83bef1c9f736d1836687c950d1275caece0d46ab9f3b0e95d9cf560eb8134e8346b35e0a6f60e6a87a14c4aeb3e0d06158390660a52a6e44b524c1e16de2bf99870f78fc81d267072bc63e97d3f26d23fd59799ff2c847d6a724cebc2377a582ba73d99a610a095c28d66c60910ac64b7d18847fa98fd8528b72e0a149b082c731575b2e2763e67c821ba29eecd8b8c87981c4fb1fbbaaa4e8aa077ec98de1362fc7af7a0ac5e3297fd0d924124b2e255b5cc4f6b0873f3d34418d5ae0d6f734628f38cb9b856b2db3fbb2fafb76983eabc51a348e55789e997fa25cbe6e5031bd2e33d4e2686f964a65d1abf7f96a20a8b270b1522ace4adf6fdade5cd3f101574960d13267e2382f70027ebe5ef7f9418e14e6a8a130d2aec2253c8fe21825e3295774db0c9b1340ea28a96589ba0d9f79aa61b92aea6f704ef7f716d849b8c77e6922e198a086d8133491d0bb85b925825a6d307d7cc8f09c655aa3edabf84c75560dfb279ee3e8b825323279edc58c3161e72cf9ae02ef80d500da922c0abeb8b164abd9c17ef7c02e89000d67b0c2ddd078cacbf37c4826be3845948d598980d63c1d7aade89d0637d80a4c102a35eb027a08ef90cc20d17fc514926914e68e5de54b861200ffa4ce1cbc16e4ecf342a1176cdb561f7dea38b3ae0fd81260f72d34e6f33d364cf313d3b3161410dcbf5f0f0579a1d235b49bb5d27f85825b94f1899e7846d0292ad912d934574f9d55d2152dbfb39d662e6e0f2496182d012af8b4bebbdfa1d68e3e988869fb5cd9612db97e6cc574444f4b5025ec9827bafc55341bf6ad3fd4fab2ee43f343cb9bcec0c38384b5699e5c6d5973ba591978275c51a40200d340b9ed3681f08c69f58320f538f9cd78a34eb6ed55710d2478ea4bd15813921817b42f88f1bb038033b519668f0a2e8693b9a19c7bcf96eec04bda625b31c32f4286be922ab2c87aa30310c8f46551450d5bc26b5fbfdedaae0f756384023bb9a28d3200cfeaedd63d6afe076513e8ad73d16607cd4ede16344e60d8707357e82b1089258c56d851a435e23ce0919825e04471dd61a44c43e87c2959d4e89311a30ee8be010094d0ef109bb210dda58b21b685b9e9c078c9ded6117d9a88dd7799291969851cd4c3f22b5f870a275a692188dafcf6e89ba87b0eb61011de031fda25fb3349901d40da2bbdb76eda417c9fafd90fb23504ab150ca0033ea1d00000000000086ba3aaa79d0df4f2e4e4afa565e66d28aa167f835d080bf1d41d0e52dbf81c671f8eacae234bf4fc328302671fab46613b73daf2ace80aff2f80f6a9d84b82480178cc612aa90adfc80ab3bba7d1527fc6ab04f009011bf093494a0d329df4e53d855b1c0ff6a25d22052b3a778e1ca2fbe59c9eeedf99e13682d06da269560524ffa0f404b73b946edf900ee958ceba09a051e27a620fb78e7a352c182c8c2981ce822eeaf6323965b4b3f322d40d406a158b6f3cf5d74822de952fefc341d0dead6c1c8fed8e48e0a85b51c1dcc7796d3f45bb1f50467a475da76c356c9e031b096867da1dbb89c3a038d475dbcdb2df1278d5dba55c2fb5ba6a9778c2a244198491f0f711cdb2ef0332f347afffb1b098b4c59041ccb0c286bb2dd40e7ec713f6ffe0b1067678c748615dae3c1e090f3739a9035767fb9972580d19fdef49a5071f99c3706b8fa4991f430721cf3ca11af0e3bd7c4d0cd0ab5b7d98ee66730c20a098110e4a15ce0bfc88c41fe375f261fe3557e14eb5ff4a2cdf6a008fd7b6702951b8456e940fbd269a0f3ed515ac03cfecce67027d579e1226bd7b7381827453550343566508d38790ee838c3bf85c6c91a45e7a44752f57313533a3e82e4042e65d346afb20c0527575f79080aef4e1aa8d5868d190c8d37bdae7592e41bed37b9d4c30d8126d3debde02dff25f5ef1e48133e2a41cd55347bd23dcce57a00189619db629c530dc112d22ac72bce353681264b5175be40b3ba84408d0f56762cc720e96c128447be7128748e185be2640115556bac64d060207e629b0144e501c1c49c6abd15c7982b01e22da2ad04bb28df1a27f31e18040c16406071d798bb40d901d001e22cc5ed870d08702f49f0021814cdd814901a13c7ab061bb4b8172c639b3449e24f656fee58186e69e6874ea95d946da781b49ca080ffb4a3c87746c661f43e9be52d0ba2ee368b9c143687c8846abac599069decf41e69fddcadf31c5f715917df12df4eedbfcc5805fe8e661b8fcd7b130d7bcc4a9a152de93a15dddacf3cf52479956185a3c5000d18ddce0236d5858c0d8761bca7446e3d30f3e8f48d5e8f86a60cbe46f038b1028ffd35590bdacfeebb86e28d42a923bdc3f9a307b919341a2a7dda096d41070db245c2c424aedd4a4bb9863169454d09f25fd0aa2da7bfc97ad7aca886dd998e041133e07899ad48f7cda600de48ac3951152dfbe6331b8acae24cfd2dd2b14696c75040685c756942a0d049ee9863a2e480388f93876f3910ecb3a59fa16c25b2b3636a542f92744495e10a4ce37f19f5c2256e2d61775d388e2a86b52f76add2f956aa02501f5badb94da12595b2bbf88b05dc70caae6766fd3df4f299d0ff71c8787249b255ea49b3d33b3f1a8c9403cb75d64264465c3578538382b23d721f8a49134020ca2d9e887d9949624ac6d63322b6507e277a0020db9bfa2928736b96c72fa3406a95adfe6b374ffa27001d37d3bbe725e75c257834572026c511f57dce67153a4008f9e75e07ed9237f600005800ee667c137fc78bc4fd4ebf4d228979ab0ccafbcd8b8daad76fb2abcfc585377ea6e19f170db898b950a7b0f4e75466a2ba26e7d60e0a6f5c54a3fe78677f3362c5b01ae791b62ee8a5d0fd65b739ece4f3b758d05a8e4e4ea7e4866ee67750ce2769f72a9f45780eadfae73b42d4dd4c614c797c694ece8af88cc732edabfa26ace57de54835c7551154dfa3be11a0d3b5845ac97b2da84410a652e72cd563acbb2b02bb59370cebaaa80014e3ad280944eae6fbf8d5f85237257bb5b8e5ec3e52dc06f8394176b325a577804e9eb78d7015172d17ed15f905f705d56687f53988bb207c74fbeb2b03a700258e835362886239f4d8f1c2cf6d4d10ff26d2579ea40a5fb99e5b6d01cdeda050d3faa78ed674f2899be08332086c8bf0410a7d06099c50a2d949d49a0f21b43bcdfbdf435875cf5a9def46db63746574ee8a5b1fbcef411154e914dd9e5bb1b1bd2944581083fb66a017e7972df3daefc487e4198cb281d3a80637d52b41738b7f1a57c867d5b2ee5d72465657593339506fd0c3807cd6445eb54cfb5ca9d35ef93eec6383224ebf85197eb6ed75f6c324f6a0345a25be6bb52ed347e57ccb059b903fb7db4e9f46513a4158ce29c1f5d6081b556bbc471e89225cad81aed34dae0f90ee8e7237b3b286e29b49d7a1700c537b28571f7d7e2a55e10792d6f7779ddefa3febdea5693048372a45903c04f1035a96c6cfbe6f6c2b754581aac02f8a70e698be6e37fd411cf4b76317b47683f6b0f80dfdeef3a9767c7e5c30dff786093a21477431fea0458023953700"}) ioctl$DRM_IOCTL_INFO_BUFS(0xffffffffffffffff, 0xc0106418, &(0x7f0000001100)={0x84, 0x4, 0xcd, 0xd694, 0x12, 0xff}) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r8, 0x84, 0x10, &(0x7f0000002a40)=@sack_info={0x0, 0xd1f, 0x8}, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, 0x0, 0x0) 3.591191548s ago: executing program 0 (id=9449): r0 = syz_open_dev$evdev(&(0x7f00000000c0), 0xb, 0x80000) ioctl$EVIOCGREP(r0, 0x80084503, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) socket(0x28, 0x3, 0x8) socket(0x40000000015, 0x5, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000180)=ANY=[], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x6, 0x8, 0x8003, 0x0, 0x6, 0x1, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x122, 0x0) shutdown(0xffffffffffffffff, 0x2) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r3 = add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1", 0x17, 0xfffffffffffffffe) r4 = add_key$user(0x0, &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000001c0)="58d052799202003bc161b11518b712c09c5ed6389e", 0x15, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000140)={r3, r4, r3}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x8000) socket(0x1a, 0x0, 0xfffffff8) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e23, 0x7, @empty, 0x80000000}}, 0x0, 0xea, 0x43c, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0x6}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) sendto$inet6(r5, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r5, 0x2) r6 = syz_open_dev$vim2m(&(0x7f0000000580), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f0000000100)={0x410000, 0x2}) 3.120524432s ago: executing program 9 (id=9450): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ERR(r0, 0x4008af22, &(0x7f00000002c0)={0x1}) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, 0x0) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$RTC_UIE_ON(r2, 0x7003) ioctl$RTC_AIE_ON(r2, 0x7001) ioctl$RTC_ALM_SET(r2, 0x40247007, &(0x7f0000000b40)={0x0, 0x28, 0x16, 0x1c, 0x9, 0x3, 0x1, 0xe6, 0xffffffffffffffff}) r3 = open(0x0, 0x1, 0x104) syz_usb_connect$hid(0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x7, 0xf32}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x3, &(0x7f0000000200)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000047c0)=[{{&(0x7f0000000240)=@pptp={0x18, 0x2, {0x0, @local}}, 0x80, &(0x7f0000004140)=[{&(0x7f0000001c00)=""/4096, 0x1000}, {&(0x7f0000002c00)=""/4096, 0x1000}, {&(0x7f0000003c00)=""/196, 0xc4}, {&(0x7f0000003d00)=""/183, 0xb7}, {&(0x7f0000003dc0)=""/87, 0x57}, {&(0x7f0000003e40)=""/244, 0xf4}, {&(0x7f0000003f40)=""/188, 0xbc}, {&(0x7f0000004000)=""/182, 0xb6}, {&(0x7f00000040c0)=""/45, 0x2d}, {&(0x7f0000004100)=""/53, 0x35}], 0xa, &(0x7f0000004200)=""/252, 0xfc}, 0x70}, {{&(0x7f0000004300)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x80, &(0x7f0000004740)=[{&(0x7f0000004380)=""/122, 0x7a}, {&(0x7f0000004400)=""/90, 0x5a}, {&(0x7f0000004480)=""/32, 0x20}, {&(0x7f00000044c0)=""/179, 0xb3}, {&(0x7f0000004580)=""/171, 0xab}, {&(0x7f0000004640)=""/45, 0x2d}, {&(0x7f0000004680)=""/138, 0x8a}], 0x7}, 0x4}], 0x2, 0x2, 0x0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42032, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000, 0x0, &(0x7f00008b5000/0x1000)=nil) socket$inet_mptcp(0x2, 0x1, 0x106) syz_open_dev$mouse(&(0x7f0000000040), 0x8, 0x323b02) bpf$LINK_GET_NEXT_ID(0x1f, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000b80)=ANY=[@ANYRES8=r6, @ANYRESHEX=r3, @ANYBLOB="125e630ae40b0ecbfedc38ff7e4dc8f88733ae300a835ef380237ec2af9b1bbc0ef4dcf272a6383005d46660c3b7f6a9a1d83a49debe55e825fa52db6516ec01a78cb23a934c8ec629a3feec1265c3ddd9c7d3abffa4ff3aa663e028405a8ed359ff8cf5d9d4ac30b6d1faa3b816ba665c08802a80013fd725fca61dd2da8aab9786e9c18c698675c5b5075020c2e29286a073178d895b98c0d7f17b191a8eff6ce54ba45306d140ade9d2d2db67e73567cf3c38d6d8bd9e9568ccddd25c3f921c3fe21d14bf8e806d69fb9093fcfbb5191c373d737931fe1fa0d3b2f67abc333939006cbf26595b5c295471f1f6d955e47d7d5c5835d56dc72b7efac1c041332bb08af6a675c599c48f2a0c3100794d7e8400337c2fcfeed4a779e97978040b55c50cd3241060f1555def394e62ebab90169d3102d40fd0af08b26ddfb282db19021dbbeef27626bfec48462307b0bc25e7b3483d17bb1a7891aedaf25361ca83f9eaa9bff860869324a4d93cb9df08f9de58ffeb35c6dfc8cdb4ca5d8d2dfce0c653fb250eb087778374b1fd168040fbf929da32ce03b428bfc3c8b22459a927ea40624fba62b52c0f511b2ad053ecb2c8f4c55c56249ca54f36e4b8a3bc695dcf682ae537525dffe9a5d5d68aba8185adabdeac8ea8efe2fdc89b5ef608dc44ff51c0db83a3d4d8964fb120c7dbb77a82ade2de1a7621ce79e6377b69b90b331efbf9d261e83669b572a39c4d33ef98365627e73cca763fb141ef528fd61080ef730d4bc154c86333ce0c240e7a6b47e69d4a9701d237eaa5733ba1bbd7247bf22ff16c22a5e58da0ed5dc60eb4f9721bb4aaba6a142be1e66d5b5f38b1c31a88f298544ce3b9f7b1912c27ba4ce9fd322af42d1dece0aa12e754755776edfdd5d0caa52465ccb32e2d78815336ced51a0f31b97bf6d581c95fd9c7e91828ccad34bd26c0942d5726abd62d76023271fb9640074ef509190d379276b8a3acec3ebdce9a0986db6d9ff3effb720a1872def9e92c250e7859a50778af613551086e6e374832036da5e94de95d40898f7cb816df49371c63abca1269cbafc6479cc52600e9b05a240aa04bc29e639e20db6f57d2d18fff7e9f36934400dcdf4f2f7b546ae775bc38e03a41d5ec4d45ef2cb72ce6867cbf746936e5c587e042b3a547525c70f15c2e613e1665317a10bca1f84e8826418f6d100b9baf1e0742dfa9fd115b208004d8bb0bf39e5bd8862f481bbc6ec7243ab760709a0ba52cc6a1ae09054e058d0f423e994b35b6600307049a07d39fb5f515d4659b0d2a042f50d1f3d6fd2330a1b6c2c91083e178a63e0f7ff671d5e1db0cbf06019e298e40862c5ba4553867d5882ebee7744c55c19d8a443da90361e84fa9216a507c286feadec5d91ff7dcac86fccd57048f30a1304b3149a1054be72b2c69b2000eb7eab17abc1b6599aced4873fde53c3a1f9b780f918b83570d4c0074418504655bcdfcef439a3d0923ecfe68450b6acebb5d64fcdb5900f88f659f36a8d5a0ccf4298aee7e77086a2a50970ab9e7058c6297bd36522a3177e7132ba8487692ceea8643db9df120e90f78f82382af38fd51f7da160025f997eaf74389fcfb452e32e9061fbb28072f1bed9eeb2f7dbf1a20970e884b549d50d8c5f9e7b1d4ecf18e857ef9348c73f5449a82b6c2c3611cdefda16b859d9068385b829c2f246fbb933cc0c701184bbeb99bd2be5133285975773db85650d1732547809a15125ccbc243be735b0fe3cd682d9b7dd699eba4b3f64405eef6939aeeb22d505ca71feea7586dde7fef706299793f52d83fdf7611e95bac10fc22b48eb60656aa8f5cf5decb88b6cd5f268cdde8b9a06731817670733fdbe92cc662189c45a470bdbbcc030c65d36b13a132fcfd0a89849232e15684a643055dc140878efc621d22b3b453aa34835c5313e1d20c1dccf40a15f66d0a61b33370c3afe88e182eb6c6af14dca027556a6b0c6f5322d77dcbd2e792732216be4ba1af84ee8f56d5d0f5049f5dd43c55dba8c58fad062638fe160667014b267648bcb3b585b2ab8d5172e1695ebea79e7de0bd116c10168e8fce804841c284db836fdf6ff971fc43585cd95520172647bea5565e83678519e64bc9bdcfca48597a2eae98c27e010119e4c4f0d303c838dbec1ac33ca474f760df899894e568edd5f1c5513da638455377696db79716b7516635898a17e4c43d1edbb2b67b56cdf4776287742d91db0ab8ada9e55a5204b40924a30f9e9812fb744deb6e3458971c0d18ed1a272a743b84a0eacb07fe635e6bf76d2dd001f9485a5cd250cbbac60edfaa202dd2805f52f87070c36afaa44d7079e69ce7f65d3a21956a71419d02af6b649cd4f35880526b9edcbcfd119435540cd9d5869a0fbdd68167371a0a8f800c1fada2d8af6fae91e5f0ed4526c46869a5c22e7ed52d3d896f326138d5a7c47777a808af9a138ad5fdb33148e240048b9ffa5c975c2cc11777f9ec2e9f719c5cf52e237c4e37eed33c57424dc37ce5ed24f3334534c4c47b00a2ed756f4dd66c54521fbf41a41cd09b1cd454ac690521af7eed106589787cd1dfe4f5506d0722da5ad10ab2f9d799ea9ef575efb1dcd745cbb510aa6874f65c61a02a6041fb48a413553ceef4ba1b63f444dc13d8868c6fb267597a03b31afbb1d427b40f5f801f86233326ab89a44f3a9ed9828725356c8809e772e890d46ee1e40345e4d114d39282e18b661bf5ed9877d6150815519e6099df7cdd12854cf560634116f1f6949367d1e8b731708ad5116c9d66e293eef1b9c0a5a379c48753fb4ff959342b198e5146ac8cf4ed9e4bd2888e3f12d0e6cbcbe02d65e5716870d547062de2b3108e8ab36c2c21c6b7d4cd29847a1a61eba2354ab54c4ef53b3ea369c40c3898a3a9a5ded38536a5e45e619514ed2e937ec063364ed1739d19dddf593030d9e591a9f0e954bde651d1f1f60b3c0f125e815dc257249945a056b9683dce69e08a6f0749b711c44d38e62f6469623c2d150be1b8ca344fd343b3f7daaccae9c94bdead599f9ecd7b1d88b248eade05769509a99d07f863ca655606b6f5a676fe88bde0b59bc27da03e7d543b3608faedf6b7e2301bf486db68e15ccdcf6e32152e3fb888c453b761b26f18fc5fc69f82e964c16368cb31118e43dba0cb32ac468cb41cc43a1ff89bea344bbef6f346caae12b57548a4e6ad89580f8d6f8a3eab776cbbbe24607fd1844e246ee6dc3c81ee8ce51424c22902a32defeed7b804873a0f8d7be4b964dd33e62883c92d2c75de5bd1277a0c100fa5d74597363dd865a63c8770fd49d9a670504b25c19935bc78e0ee404c1515d55d4bbe20967cd96b088ca5da108e136d81f898062cbab457047da34d7d7bd53f4edbd4a4d4b638a881682ba1fa6f511f6e60874c8716cf0a79caccbebe29174a4cfc6da89957e62850f0dab45001cffcb4044c7ba5a6834e435372f15f033673fc9f1e7e9c780342920a0c1f1f0fafa13e5d2538e1a8f4bf85e1a61102c707d25d64443fb06f261fa26f87f5891455d561c9e2b4235357e1b214be033723b0cc0acb184f04dac55a9e40959700aebfdc9b22cfe6a278a08f49d7069b3b0173051e79af87affdce331582f4b7fddcf49a8d783f5b8c3e9b98752cc94d218733286587e1777c2362588f6dad18d40600fdaef1aace267650a84b7207679d622f4b0ee125922cef7be8cc076aa1ad7937dc8d3118e8a411973b56abc1f08f5ddc08a8bf9b01cb38f34dfaae23812003b17b24ad3c69b9c2e5cc2642cb61f0cbe2ee394b3fe07db8efb59b22bbb5127c0f691c3ef378e5a86a44a9aeb231d8e9466f526d6d8a4a0f870dbe4b9d290224516f592c0487e0d8a5194e74c2d7546ee3f2553537d202ca72409e323a46afd042255a10ac2e1eb6e5bb284b0c8fedecdebb2c6780d75b9a52df9e93c959c6b4c3ef4a5e074f57fec8bc128071b08c878a28bdf7f09f54d58ececf015fcaeef263257536760e4e4e7fb797d7e55c832eed83de69190a8d3884274d91f0036d19231d5db045d86bc3ee106b44e2f5bcbbb48a56bd7f1a586421c71506312bc81d34b399334f0c6f69706a75b21b8f63d77cda097c20f0a0a999d14ae427a5a9f43b10eed143652ef8aed1a9ccd69e8d311357536a4473a691278c08aeb2c8aac972523e8471007ab2746895896307cb28526db4da5f8af5be1373d04f88c3c0eb56c868eb749944fe668c8b61991ba5d8639f4b2dd1d93e198127817915bc46a58e5252dc82bfe8d2d5eb0b6af1f96fc71b8f21c7b8458604de35ac03005d91bde992bf78e3267ddee895331184295dfd27bf8e69dca3c75b415bc61e9f91c03b29c885e230d147499413af75126292f6c5c089b976277d746d21261fcc6f71d8044e4cc01e3c5de51a363c0c9527261ee52de975ff49b3311e8c5100dce2a47c9750ad26a42292f8f46a9e1ca16c2c3b23522d48bbff093d9c86ec696a196b58710a5248d7ac2e3c420efd1332482ddd1ca097d049bf8991503d3e56e4aba48e2fc148fe386be9f63a73fe0f15502bda14803364169eeff59a416fff2b10810304df9fccc2049b8cf96a1e923f18209df3ff8703ec40d2374c613aaee3b91f5654874c88978a9b24e6a8694dda05882893c79e92bdff77d787700ec62004767f3037ce153f9deef14988e35f35d846d72d3c002c022d3505eca6e1d13a874dae6c81ec93f1bd7c6d7490cf89f5f300a42e7efebdb5329bb98a3246eabbc232d51b1fd136e894dd6230966d32aeba5c4f9330b6cd9779d6b0c5b9c905655bdcea0d308bf0c557487bee300dc3b1686a2ea454479dc5f9f721c7c36bfee7905f8f619888a357094e89f4345ed2c6ed4858db50746b5365e5b36390a0ee179f6251fa7951dda8b58377a1bb82214ba0665918857fc81891cf0abd4f7a2f3bde6d5f8dadb483708607605f10f48b8e8ee8fedd0e5cc0bd63ad345e434f4537e80c5baee2d0ca681b388109f52d114c70ea33aea7f191fb3e1bc3b0ee561c1585cefa7bd24b109338b1ec3f1cfa72ceec2dc8ece4122d9f355c02641ad76c22f5c49d9f952775c6472c9b9177077aecdf60b04db7afbd6c2fd7fd94f609e4463b998ef6815b807d9d0570a5969c38e32b894d643de7897c6f99bc98dc996d903f7846e153a999f31558be45f8ca4e2fc35804aa9c9968948db28ad7b44fac5472a493f72937786e0d438b3576397e6079872450eb52ffcad47dbcaa1a542a4137c64da7281092a8b14affe99f9c36163ebd477ee4ef51275be6a104f3bc5f04ef1dfea9c6ab24eaab8ac4755c6c1b9c671990b1bbf56f827ac3a3e74c795ea5fae75a093057346deb9ff0435c57818d65c629fc45b2198af1ac89bf484b11bcf1ff19f5f7a529fce4345536affe6c6c415fe27bae3662ae822d4b2eaf1c258350ef32a78cb1d4313bc1556c82ac17844393b79c279913b5997f79fccc26ea340c36b4389a4047470854bda5fe43e4eace642c569513197ff5748ce1b45dbc3c59abb985335227276b60e2447c3ccf46d717a582e280acc7281a446527ca05d57c71c586962f8a2511fa271aa63e44a05516d212f5e7ecaa0ac7cebe7c61f540934ea34421213b94a837ad52184d03e59e875a7e5ef5a70c7e6110b8b3a50191f228cb780ad4b5a86fd7d5d211b76dc86e1ec153f163701ee1cc5187e15b53acfbf77a293a5e4d78d103b8d8451e404cee53c2aa7d9baa99529e0380e44a6e21f0b6c0a34d235ace0d694e", @ANYRESDEC=r0, @ANYRESOCT=r0, @ANYRES16=r4, @ANYRES64=r1], 0x48) r7 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$USBDEVFS_SUBMITURB(r8, 0x8038550a, &(0x7f00000000c0)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x80, 0x13, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) 2.823852459s ago: executing program 3 (id=9451): r0 = socket(0x1, 0x2, 0x0) bind$unix(r0, 0x0, 0x0) sendmmsg$unix(r0, &(0x7f0000001680)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0}}], 0x1, 0x0) recvmmsg(r0, &(0x7f0000000d40)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0, 0x0) r1 = socket(0x1, 0x803, 0x0) close(0x3) sendto$unix(r1, 0x0, 0x0, 0x800, &(0x7f0000000700)=@file={0x1, './file0\x00'}, 0x6e) 2.806269586s ago: executing program 8 (id=9452): socket(0x11, 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) (async) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f0000000140)=[0x0], 0x0, 0xfffffffffffffffd, 0x0, 0x0, 0xa}) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r1, 0x4038ae7a, &(0x7f00000000c0)={0x2, 0x240, 0x0, 0x0}) r2 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) (async) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x5, 0x8, 0x8005, 0x0, 0x9, 0x1000000000, 0x7, 0x3, 0x6}, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') (async) syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7ffc0000}]}) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) statx(0xffffffffffffffff, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x7100, 0x7ff, 0x0) (async) statx(0xffffffffffffffff, &(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x7100, 0x7ff, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) fanotify_init(0x200, 0x0) (async) fanotify_init(0x200, 0x0) memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) (async) memfd_create(&(0x7f0000000500)='-B\xd5NI\xc5j\x9appp\xf0\b\x84\xa2m\x00\v\x1c\x004\xa6Ey\xdb\xd1\xa7\xb1S\xf1:)\x00\xca\x83\x11\v}k+\xeb\xc3\xc0O\xae\xd2\xd7Uw\x00\xbc\xfa2\xb3\xbb\x8d\xac\xac\xbe\xe1}knh#\xcf)\x0f\xc8\xc0\"\x9cc\x10d\xee\xa9\x8b\x06\x97k\xde\xc5\xe96\xddU)\xc98M\xcd\xfb\xcc\x82n=\x7f=\xcdJx\xaa\xcf~\xb901nEy\x82\x83\x80\xd3O\x00|hP\x00\x00\x00\x00\x00\x00\x00\x05\x86\xfe\xd9\xa5\xc6\nSy\xa3N\xba-]\'q\xc6\xfb\x02\x9a\xa9Z\xa8\x80Bx\xbd74\xcf\"\xa5\xea$\x95\xfd\x06T\xef\x89\xe4j\x06\xdc\x15\xe7\xc3\xb5H\xf7\xdc\xee\x182\xab\xe2?\"\xbewm\x9d\xd8x\xd92\xeeS/\xd2\xcd[\x9dcO1\xcb\x12lZ$\xa7\x9d\xf8b\xf6}\xc5``\xfe0\x8a\'v-\x99`?\x97\x8c\xdd\xd6\xfa\xa2\x06>\xf3\xe2uI\xe65C\xdb\x84\xe6eU\xe8RK\xd6=s\xcd\x9d\x1f#3\xc5\x16\xd0\xbbD\xc5\xde\xc8/\v\xa5W\xbep\x87\x15\x10\xcdm\xa7\x93\x01\x1c,9V8\xdc\xfd\xb7\xc0\xfc\x04\x00p\xad\x12\xb2\xbf\xfbFZ\x1a\f\x99\x05\xe4\x1eP\xed\x87\x89\xbeo\xfbv\xb6\x8a\xee\xf6Oc8\xaf\x11[\xc3\x98w-\xf0\xb2z\xc7\xaf;\x92\xad4\x1b\x92L\x97<\xbdh\x80\xf2\xc0\xd0n)K\xf2#Ncp\xe4\xb4\xfb\x94\x18\xc2-TWA\x13\xfe\xea\xad\v\xc4\xa5\x02\xf9\xed]\xf4\\\x01\xab\xdc\xb6\xcdP\x93\xf2\xc3\x96\xf2\xc0\xd6-x\xd5\xd6\xc7\x9d\xa5\x1f\xd2t\xd7\x8f}b\x9749\xd4a7\x18\xe0\x91KV7[\xb8\x8dL\xc8\xc8\x8f>sbE\xf5\xa7\xdb|\xb0m\x16c\x84\r\"\xf2\x92s\xeb\xaf\x1c\x00\xf4\x8dL\xa5\x10\x89FB\xfb8\xf9\x9d\xcbm\x1c\x91\xe9fd$5\xdc\xad\xec\xef\x90\xd9\xefX\xd2m\x9e\xec\x94w\xb3\xf9\xd9\x0eu-z\x81\xbb\xa6\xc0\x00\xa1\xd9\xcbI\xda\xa3\b\x9e@\xb8\xc8k\xdeQ/\xb8X\x9c\xff4Np~\xc4\xc1_\x1c#zX\a\xd41\x1c\x7fH\x91\xd9k\x05\x1f\n\b\b\x88\xd6\xcf4i\xa0B\xe7\x9c\x9c\xe6\xcax\xca\xa1E#6\xe9\xf31W\xd0\x1bY3/\x00I#\xfa\xb0\f\xd5!\x9fR[\x0e\xdb`\xdb\x82M\'k\x16(\xfa\xc2\xec\x96e\\Q\xe9\x19\xe1u\x86\xcb\xc3\xb0\xb8\x19\xb9l\x1fk!R\xb1P\x8b\xda\xffE\x89\x97\n\x17m\xd10\x1a\xe7Qz\xd8\bi\x8dRw+\xa1^N\xaf\x1b\x1dg\x8f$\xbe\x93\x8d\x8b\xfd\r\xee<\x84\x95\x82)TH\xcac9\x98\x13WW@;\xb4\xd5\x0f\xa1\xb3xX(\x80\xe8\x89\xed e.\xe04\xba\x9c=\xc6\x04\f\xbf\x06\xce5\xf99GD8@\xd2\r\xd0\xdf@\xe3\xbe\"qq#]\x86W\tA\xa7\x91\x85\xae\x9c\x8dO\xa6\xa3\xf9i\x83\xc5\xa8C\x164\xef\xa4\\\a\xaa%\x94!3k]\xd5\xbe\'U\xf17', 0x1) 2.670849142s ago: executing program 5 (id=9453): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x5, @loopback}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x10, 0x3, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1d, 0x3, &(0x7f00000006c0)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000004c0)={r4, 0x0, 0x25, 0x14, @void}, 0xfffffffffffffdf8) r5 = socket(0x10, 0x803, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(camellia)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000ac0)=[{&(0x7f0000000b40)="ea618d08c356a10eff0fff4b5377dedc86d8f12ac17013b3d3ef2e911ad87534fd78f3c3f173353771b870dfcca8815eb5e69e25a8952127115a7eab0c341c93ea4b8a05c9ad1d9626e6d9ce5843ba645ee108fdfd94f40bf8b2baa8277350fa8c13720b9bd03fba43c5caa0fcb711a8b772f0df44cc29b755df3e3b68c5eb23935db8faf878022f411e3766310f13019642d5b00d5dac5c60290a7d964bcb955fb5c82a1bc2c9d36e613fc345f878cc045d07efb82e1eba082acd84c6e09cfb990570c0c1d7bdebc9262110f9544267e3baf5776e97b04a74f1da712cb6eac68c4163da39780fdef86c143e2922b8d1a38ef5a196ca99adc915a9378ec7ea0aa14d48c17a7d70675d1bc0170b8df56ba505893bae15ffa819e9a121fa7ff5efea7cf85c9767d135379ee69f0aa40a2afcb3bf5a70cb45b6ece6ba06c569b27226cc490fa5dd0cf2eb10589ed273230720ab334ad5f143a262f26b75b1065d8932779ee419c46731a3dd6e8cec3862dfe0fe584673366cd92e4a64522351389607a37a78ff0f27bf14637896dd5c09b7dfa0e08a60273de6399ad7539706db44dec8bf9eae803bb121983f605800e90d253fca1cf3823923fc9835882be4020f09c61ee7bf5aba4af2aed439b45c4493db3eb52717260660e8e1d7a85f07773b252abcde77ff7c655767aa74b5f4602f5588e31bcf57f37dafe88c6762104c8fa41cbe4c08b35e0c1607b6c18996c929dd3619eafadeee4beec5613dee5c3a30d439294d4e77af899ea85ebaa3914d346993aa131fe0370adaca5a1dd2158fe70eb014b9ee14d38331eccef5471e4eee7e732d0b2ee7452e26d137ea9810af0e68adb4f6a1770042b1623ebfec90e3e46223a260552d773b21d16e8965616d6057d3c149b9a96ddd919f2a31faa4afed7da5c8230d2037381a930f85cbfaeff30269a5a9377dbd64cd12683096526b3926e7c6bc33a38c3364dc4167d3a9fb7520974b65ed323d7ce9c63932403c8db982f9a562b4e911102a30ea3dff9f80d8f09439ae9f1a55477e1f4708b773090d7efadac93c235cdc8e62e440c0818abfe41eb3fedd992b61dfeeabd25fdbdd50ecac0c777b276d6637e38b7da12691622f4ef6dbc1b7cab77110d55b9130c41deac9b198e4ffc2237a79198b718e58d976cd6ee38c2fbe3077ee0884408be633750452aa8388c29c99db235cbc3129f03bc634a7899f4fa24ae6e943778e7b5413f2e9620ca01f192c5283383ee280cd605b7f3ac72662afda0771782e6f8b6914172e3214fe605ac44ba5ef9bad17d6bac7b56e011a1222497232e1f8ef01109f36b47b9b7b20205639871a37f4dc9db1c4cbe0819bd52f10d2692da03688db7478ddbe9b590b6bc74e195d8378d2955cfd72a572dba82574a2c7c79908565f78d11e99d5dd008fe15672de0f93b8e7d63e99894a77d57e74cdc23d41aa8eb0ffae3aa68017bd27fa1477d6b661ebe6", 0x420}, {&(0x7f0000000600)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219dd45e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e60ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4c}, {&(0x7f00000002c0)="0a973cc2c1e0cfa18c2b38a6a96c309664f6e0a5b0b656652fa3fc17b0864f0d23f9bd4601e9ff91e4b40cf2b89a44c8a9448ffca1b7f41d7b6ed0ef1f5324e629d6d3783057661d9473683da0175208023fd394cca1396471da8767467dd650ad3a689424c312c99989f68e74198297ce3f79a92e1bc348d038a493bc36320aebdce4b460f994a3083e7affe73a4059e4", 0x91}, {&(0x7f00000003c0)}, {0x0}, {&(0x7f0000000a40)="1eda2010ff72e66563819c9faf11f73e51c48032155af5439c9588161e6eb657043dc3c9efae8be93168a96372abfb13c7976052ebb2cdaa2e1dca2a20490a3f532fbaa720836b0dd94b2257e08be7db18e00b0c07acc590e3ade70bc98b3c4fb813ac7d81", 0x65}], 0x6}], 0x1, 0x40800) recvmsg(r7, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x8946, &(0x7f00000002c0)={'veth0_to_team\x00', &(0x7f0000000000)=@ethtool_channels={0x3d, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2}}) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r3, 0xf507, 0x0) fanotify_init(0x8, 0x0) ioctl$RTC_IRQP_READ(0xffffffffffffffff, 0x40187013, &(0x7f0000000680)) pipe2$9p(0x0, 0x84880) 1.854579582s ago: executing program 3 (id=9454): syz_emit_ethernet(0xd5, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaabbbbbbbbbbbb884700001edb73a5080570f08ad9eb76fb72c7f955192b2221ef819ceedd8e35f7c7a7ce9bb2f6f078facb1f4a6dc92a3982d38c922e452a5931add3e4b5d61e7ed16e3f"], 0x0) r0 = openat$nci(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, 0x0, 0x0) r4 = socket(0x2b, 0x1, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1c8) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x24040084) r5 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000b80)=@raw={'raw\x00', 0x3c1, 0x3, 0x388, 0x0, 0x4c, 0x1a, 0x0, 0x73, 0x2b8, 0x258, 0x258, 0x2b8, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @local, [], [], 'wg2\x00', 'macvlan1\x00', {}, {}, 0x29, 0x0, 0x0, 0x40}, 0x0, 0x168, 0x188, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x0, 0x1, 0xc}}, @common=@srh1={{0x90}, {0x0, 0x0, 0x0, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @rand_addr=' \x01\x00', @dev={0xfe, 0x80, '\x00', 0x1f}, [], [0x0, 0x0, 0xffffff00]}}]}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0xf8, 0x130, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@icmp6={{0x28}, {0x0, "e1f6"}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3e8) socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f0000000080)=0x5, 0x4) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r6, 0x84, 0x81, &(0x7f0000000280)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r6, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @loopback}], 0x1c) sendto$inet6(r6, &(0x7f0000000100)="b8", 0xffe0, 0x2000c851, &(0x7f0000000140)={0xa, 0x4e23, 0x0, @loopback, 0xffffffff}, 0x1c) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r6, 0x84, 0x18, &(0x7f0000000240)={0x0, 0x1}, &(0x7f0000000380)=0x8) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, &(0x7f0000000280)={0x48, 0x1, 0x0, 0x0, 0x100000001, 0xfffffffffffffff8}) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r1) ioctl$IOCTL_GET_NCIDEV_IDX(r0, 0x0, &(0x7f00000000c0)) 1.737559551s ago: executing program 5 (id=9455): ioctl$XFS_IOC_FD_TO_HANDLE(0xffffffffffffffff, 0xc038586a, &(0x7f00000005c0)={0xffffffffffffffff, &(0x7f00000002c0)=']*@\x00', 0x8040, &(0x7f0000000300)={@_ha_fsid={[0x0, 0x58]}, {0xca89, 0x9, 0x7, 0xfffffffffffffffb}}, 0x80000000, &(0x7f0000000400)={@_ha_fsid}, &(0x7f0000000580)=0x4}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, &(0x7f0000000600)=ANY=[], 0x0, 0x4, 0x0, 0x0, 0x0, 0xc}, 0x94) r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0xc70, 0xf003, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x3, "", [{{0x9, 0x4, 0x0, 0x0, 0xa, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0xa, 0x3, 0x1, {0x22, 0x29}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0x0, 0x3, 0x4}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x9c, 0x0, 0x7fff7ffc}]}) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x0) rename(&(0x7f0000000180)='./file0\x00', &(0x7f0000000440)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x2, 0xc, 0x1400}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000980)={r1}, 0x4) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000280)={r1, 0x68, &(0x7f0000000200)}, 0x10) syz_usb_connect(0x0, 0x48, &(0x7f0000000000)=ANY=[@ANYRES8=r1], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.317403291s ago: executing program 3 (id=9456): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x2, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getuid() r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0x5) setreuid(r5, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) setresuid(r3, r5, r6) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r7, 0x89a2, &(0x7f0000000000)='bridge0\x00') 1.274876303s ago: executing program 0 (id=9457): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) clock_gettime(0x2, &(0x7f0000000040)) socket$inet_tcp(0x2, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = getuid() r4 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f0000000000)={0x0, 0x0}, &(0x7f0000000040)=0x5) setreuid(r5, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f00000000c0)=0x0) setresuid(r3, r5, r6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="1800000000194c0000001f00000000000000e600000000000000000000000000e590524539f7aa4777966b712e7a64b5ea57cdaa18130af2bbcb3676f0a937199490e5ec5e8ea9e04cbe11aeded8b20827030d67bf18e11ad7f24d99cf1e67177b741d38c637f0468cc3b364bfe5060c6588a9bc95609f0482afe50d79aca43036cadfe42dd59a"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0xfffffffffffffd1a, 0x0, 0x0, 0xbf9d8a7589883a08}, 0x94) r7 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r7, 0x89a2, &(0x7f0000000000)='bridge0\x00') 23.32116ms ago: executing program 3 (id=9458): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x13, 0x4, 0x0, &(0x7f00000000c0)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x6a, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x130}, 0x94) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{0x0, 0x0, &(0x7f00000009c0)=[{&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d0", 0x95}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb519864", 0x67}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a", 0xab}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e", 0x33}, {&(0x7f00000000c0)}], 0x6}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459e33fe5", 0xef}], 0x1, &(0x7f0000000cc0)=[@timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}, @txtime={{0x18, 0x1, 0x3d, 0x9d}}], 0x48}}], 0x2, 0x20000044) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000100)=0xfffffffe, 0x4) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 0s ago: executing program 0 (id=9459): socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) writev(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0xa, 0x8b}, 0x0) bind$l2tp6(r0, &(0x7f0000000180)={0xa, 0x0, 0xfff, @local, 0xffffffff, 0x1}, 0x20) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000500), 0xfffffffffffffffd) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x1000000000000002) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_open_procfs(0x0, 0x0) r3 = socket$kcm(0x10, 0x2, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(0xffffffffffffffff, 0xc08c5335, &(0x7f0000000040)={0xfffffffb, 0x80, 0x1, 'queue1\x00', 0x85}) sendmsg$kcm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000002c80)}, {&(0x7f00000004c0)="f80ec2e2badd", 0x6}], 0x2, 0x0, 0x0, 0x2663}, 0x0) request_key(&(0x7f0000000340)='user\x00', &(0x7f0000000380)={'syz', 0x3}, &(0x7f00000003c0)='q\xa9', 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x2000002, &(0x7f0000000780)=ANY=[@ANYBLOB='idi', @ANYRESHEX=r0, @ANYRES8=r2, @ANYBLOB="ba66e47f892991c4eb5291204b3dd7c8f37b6e9600284725d766cc31dde6f8a692a52ffc28cf572c1dd6f0be35d8dc545f4902089ff2d38783ed3d2f383b4066e643f348332f3d0c8c9dac8234bd4dd84eff44a4acd8b27ae785472761ea844a5eb888c45e9a1e571442959e362f148a6da6", @ANYBLOB="2c67726f75705f4fed359c225a63b4881a68798d0f6cf769643d", @ANYRESOCT=r2]) mknodat$loop(0xffffffffffffff9c, &(0x7f00000002c0)='./file0\x00', 0x800, 0x1) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000040), 0x52026, &(0x7f0000000200)=ANY=[]) statx(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x3000, 0x2dd8806920477201, &(0x7f00000003c0)) syz_fuse_handle_req(r4, 0x0, 0x0, &(0x7f0000007a80)={&(0x7f0000006400)={0x50, 0x0, 0x1ff, {0x7, 0x29, 0x1, 0x24ff871999b0dbe7, 0xdcf, 0x4005, 0x9, 0x800, 0x0, 0x0, 0x2, 0x3}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x2e}, 0x94) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi0\x00', 0x0, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, &(0x7f0000000580)={'pcl812\x00', [0x8001, 0x3, 0x4, 0x4, 0xedc5, 0xfffffffc, 0x2, 0x7, 0x1, 0x6, 0x200060, 0x1, 0x8, 0x2, 0x6, 0x8, 0x1, 0x5, 0x43, 0x547, 0x89, 0x10c, 0xfa7, 0x4, 0xd, 0x8, 0x5, 0x6, 0x8, 0xbf, 0xffffffb4]}) ioctl$COMEDI_INSN(r5, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92ff, 0xfffffffffffffffe, 0x0, 0x9}) kernel console output (not intermixed with test programs): r this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1167.491864][ T1634] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1167.521173][ T1703] 9p: Bad value for 'rfdno' [ 1167.691992][T24045] dummy0: left promiscuous mode [ 1167.751243][T24045] team0: left promiscuous mode [ 1167.795371][T24045] team_slave_0: left promiscuous mode [ 1167.806095][T24045] team_slave_1: left promiscuous mode [ 1167.900443][T24045] hsr_slave_0: left promiscuous mode [ 1167.966013][ T29] audit: type=1400 audit(1775987289.014:648): avc: denied { getopt } for pid=1728 comm="syz.5.8943" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1167.983058][ T800] Bluetooth: hci4: command tx timeout [ 1168.015029][T24045] hsr_slave_1: left promiscuous mode [ 1168.033665][T24045] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1168.048830][T24045] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1168.210385][ T1747] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=20409 sclass=netlink_route_socket pid=1747 comm=syz.5.8948 [ 1168.334036][ T1751] netlink: 'syz.5.8948': attribute type 13 has an invalid length. [ 1168.353733][ T1751] netlink: 'syz.5.8948': attribute type 17 has an invalid length. [ 1168.374130][T24045] team0 (unregistering): Port device team_slave_1 removed [ 1168.390735][T24045] team0 (unregistering): Port device team_slave_0 removed [ 1168.598842][ T1634] hsr_slave_0: entered promiscuous mode [ 1168.610108][ T1634] hsr_slave_1: entered promiscuous mode [ 1168.631308][ T1634] debugfs: 'hsr0' already exists in 'hsr' [ 1168.644861][ T1634] Cannot create hsr debugfs directory [ 1168.834441][ T1751] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1168.852634][ T1751] 8021q: adding VLAN 0 to HW filter on device team0 [ 1169.320371][ T1751] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1169.380269][ T1752] syzkaller0: entered promiscuous mode [ 1169.385909][ T1752] syzkaller0: entered allmulticast mode [ 1170.066470][ T800] Bluetooth: hci4: command tx timeout [ 1171.668161][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1171.684112][ T1295] lec:lec_start_xmit: lec0:No lecd attached [ 1171.810784][ T1803] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2 sclass=netlink_route_socket pid=1803 comm=syz.8.8957 [ 1172.143012][ T800] Bluetooth: hci4: command tx timeout [ 1172.922751][ T1818] faux_driver vgem: [drm] Unknown color mode 13; guessing buffer size. [ 1172.983793][ T29] audit: type=1400 audit(1775987294.044:649): avc: denied { map } for pid=1817 comm="syz.5.8962" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1173.009845][ T1637] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 1173.035265][ T29] audit: type=1400 audit(1775987294.044:650): avc: denied { execute } for pid=1817 comm="syz.5.8962" path="/dev/dri/card0" dev="devtmpfs" ino=627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1173.217091][ T1637] usb 1-1: Using ep0 maxpacket: 8 [ 1173.242005][ T1637] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1173.272783][ T1637] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1173.298591][ T1637] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1173.333476][ T1637] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1173.437531][ T1637] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1173.453031][ T1637] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1173.462261][ T1637] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1173.711299][ T1832] netlink: 'syz.5.8963': attribute type 72 has an invalid length. [ 1173.719228][ T1832] netlink: 'syz.5.8963': attribute type 1 has an invalid length. [ 1173.727046][ T1832] netlink: 44 bytes leftover after parsing attributes in process `syz.5.8963'. [ 1174.121418][ T1634] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 1174.210822][ T1634] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 1174.246951][ T1634] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 1174.284082][ T1634] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 1174.572904][ T1852] syzkaller0: entered promiscuous mode [ 1174.580152][ T1852] syzkaller0: entered allmulticast mode [ 1174.659356][ T1634] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1174.731821][ T1634] 8021q: adding VLAN 0 to HW filter on device team0 [ 1174.781568][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 1174.788680][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1174.838121][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 1174.845350][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1175.110214][ T1637] usb 1-1: usb_control_msg returned -71 [ 1175.174432][ T1637] usbtmc 1-1:16.0: can't read capabilities [ 1175.210942][ T1637] usb 1-1: USB disconnect, device number 80 [ 1175.247854][ T1878] netlink: 240 bytes leftover after parsing attributes in process `syz.0.8972'. [ 1175.809586][ T1885] netlink: 'syz.8.8973': attribute type 72 has an invalid length. [ 1175.817546][ T1885] netlink: 'syz.8.8973': attribute type 1 has an invalid length. [ 1175.825753][ T1885] netlink: 44 bytes leftover after parsing attributes in process `syz.8.8973'. [ 1176.403440][ T29] audit: type=1400 audit(1775987297.474:651): avc: denied { ioctl } for pid=1890 comm="syz.8.8975" path="pid:[4026534167]" dev="nsfs" ino=4026534167 ioctlcmd=0xb702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1176.404981][ T1634] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1176.579012][ T1893] syzkaller0: entered promiscuous mode [ 1176.603720][ T1893] syzkaller0: entered allmulticast mode [ 1176.674954][ T1900] syzkaller0: entered promiscuous mode [ 1176.680453][ T1900] syzkaller0: entered allmulticast mode [ 1176.750962][ T29] audit: type=1326 audit(1775987297.814:652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=1911 comm="syz.0.8978" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f997ad9c819 code=0x0 [ 1177.343058][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5660 ms [ 1177.351163][ C0] lec:lec_tx_timeout: lec0 [ 1180.166539][ T1954] netlink: 76 bytes leftover after parsing attributes in process `syz.5.8981'. [ 1180.202790][ T1951] syzkaller0: entered promiscuous mode [ 1180.224530][ T1951] syzkaller0: entered allmulticast mode [ 1180.851320][ T1971] netlink: 'syz.8.8984': attribute type 72 has an invalid length. [ 1180.859268][ T1971] netlink: 'syz.8.8984': attribute type 1 has an invalid length. [ 1180.867037][ T1971] netlink: 44 bytes leftover after parsing attributes in process `syz.8.8984'. [ 1182.404139][ T1634] veth0_vlan: entered promiscuous mode [ 1182.428808][ T1634] veth1_vlan: entered promiscuous mode [ 1182.504983][ T1634] veth0_macvtap: entered promiscuous mode [ 1182.520121][ T1634] veth1_macvtap: entered promiscuous mode [ 1182.584124][ T1634] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1182.616745][ T1634] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1182.668792][T24045] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.696060][T24045] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.715088][T24045] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.739787][T24045] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1182.893543][ T1314] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1182.925347][ T1314] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1183.048218][ T1314] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1183.075461][ T1314] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1183.238876][ T2002] netlink: 28 bytes leftover after parsing attributes in process `syz.3.8923'. [ 1183.443030][ T1637] usb 6-1: new full-speed USB device number 44 using dummy_hcd [ 1183.606443][ T1637] usb 6-1: config 0 has an invalid interface number: 133 but max is 0 [ 1183.624358][ T1637] usb 6-1: config 0 has no interface number 0 [ 1183.634777][ T1637] usb 6-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1183.647035][ T1637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1183.655547][ T1637] usb 6-1: Product: syz [ 1183.659923][ T1637] usb 6-1: Manufacturer: syz [ 1183.667783][ T1637] usb 6-1: SerialNumber: syz [ 1183.676692][ T1637] usb 6-1: config 0 descriptor?? [ 1183.949559][ T1637] keyspan 6-1:0.133: Keyspan 1 port adapter converter detected [ 1184.052095][ T1637] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 81 [ 1184.060109][ T1637] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 1 [ 1184.068934][ T1637] keyspan 6-1:0.133: found no endpoint descriptor for endpoint 2 [ 1184.106421][ T1637] usb 6-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1184.226744][ T2020] netlink: 76 bytes leftover after parsing attributes in process `syz.0.8994'. [ 1184.258078][ T2020] syzkaller0: entered promiscuous mode [ 1184.267222][ T2020] syzkaller0: entered allmulticast mode [ 1184.301650][ T2022] netlink: 76 bytes leftover after parsing attributes in process `syz.4.8996'. [ 1184.313727][ T2024] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1184.334085][ T2022] syzkaller0: entered promiscuous mode [ 1184.340263][ T2022] syzkaller0: entered allmulticast mode [ 1184.360332][ T2024] syzkaller0: entered promiscuous mode [ 1184.370712][ T1637] usb 6-1: USB disconnect, device number 44 [ 1184.391054][ T2024] syzkaller0: entered allmulticast mode [ 1184.406221][ T1637] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1184.426579][ T1637] keyspan 6-1:0.133: device disconnected [ 1185.261716][ T2047] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9002'. [ 1185.428055][ T29] audit: type=1400 audit(1775987306.494:653): avc: denied { read append } for pid=2048 comm="syz.8.9004" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1185.479610][ T29] audit: type=1400 audit(1775987306.514:654): avc: denied { open } for pid=2048 comm="syz.8.9004" path="/dev/autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 1185.723925][ T5914] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 1185.887350][ T5914] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1185.940585][ T5914] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1186.010232][ T5914] usb 9-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1186.366793][ T5914] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1186.406001][ T5914] usb 9-1: SerialNumber: syz [ 1186.504999][ T2061] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9008'. [ 1186.536161][ T2061] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9008'. [ 1186.678398][ T2063] netlink: 76 bytes leftover after parsing attributes in process `syz.3.9009'. [ 1186.699663][ T5914] usb 9-1: 0:2 : does not exist [ 1186.737040][ T5914] usb 9-1: unit 253 not found! [ 1186.892167][ T5914] usb 9-1: USB disconnect, device number 56 [ 1186.999225][ T1996] udevd[1996]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1187.366743][ T29] audit: type=1400 audit(1775987308.434:655): avc: denied { map } for pid=2079 comm="syz.0.9011" path="cgroup:[4026532827]" dev="nsfs" ino=4026532827 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1187.390765][ T29] audit: type=1400 audit(1775987308.434:656): avc: denied { write execute } for pid=2079 comm="syz.0.9011" path="cgroup:[4026532827]" dev="nsfs" ino=4026532827 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1187.547007][ T2090] syzkaller0: entered promiscuous mode [ 1187.552531][ T2090] syzkaller0: entered allmulticast mode [ 1187.560979][ T2090] 0: reclassify loop, rule prio 0, protocol 800 [ 1187.733366][ T2096] netlink: 28 bytes leftover after parsing attributes in process `syz.3.9017'. [ 1188.882535][ T2117] netlink: 76 bytes leftover after parsing attributes in process `syz.5.9022'. [ 1188.953975][ T2117] syzkaller0: entered promiscuous mode [ 1188.959594][ T2117] syzkaller0: entered allmulticast mode [ 1189.113484][ T5848] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1189.357002][ T5848] usb 5-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1189.373046][ T5848] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1189.410743][ T5848] usb 5-1: config 0 descriptor?? [ 1189.459563][ T5848] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1190.010513][ T5848] cpia1 5-1:0.0: unexpected state after lo power cmd: 00 [ 1190.446072][ T5848] gspca_cpia1: usb_control_msg 02, error -71 [ 1190.525553][ T2144] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9029'. [ 1190.590244][ T5848] gspca_cpia1: usb_control_msg 05, error -71 [ 1190.676169][ T5848] cpia1 5-1:0.0: unexpected systemstate: 00 [ 1190.687996][ T5848] usb 5-1: USB disconnect, device number 75 [ 1191.555043][ T5914] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 1191.675456][ T2154] syzkaller0: entered promiscuous mode [ 1191.683123][ T2154] syzkaller0: entered allmulticast mode [ 1191.723044][ T5914] usb 6-1: Using ep0 maxpacket: 32 [ 1191.736654][ T5914] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 1191.759222][ T5914] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1191.790210][ T5914] usb 6-1: config 0 descriptor?? [ 1192.081363][ T5914] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 1192.103536][ T5914] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1192.127720][ T5914] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 1192.149049][ T5914] usb 6-1: media controller created [ 1192.182130][ T5914] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1192.217460][ T2163] batadv_slave_0: entered promiscuous mode [ 1192.353364][ T30] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1192.364117][ T5914] az6027: usb out operation failed. (-71) [ 1192.370212][ T5914] az6027: usb out operation failed. (-71) [ 1192.378275][ T5914] stb0899_attach: Driver disabled by Kconfig [ 1192.390513][ T5914] az6027: no front-end attached [ 1192.390513][ T5914] [ 1192.405321][ T5914] az6027: usb out operation failed. (-71) [ 1192.417303][ T5914] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 1192.435291][ T5914] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input43 [ 1192.463380][ T5914] dvb-usb: schedule remote query interval to 400 msecs. [ 1192.479771][ T5914] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 1192.504137][ T5914] usb 6-1: USB disconnect, device number 45 [ 1192.524311][ T30] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1192.551065][ T30] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1192.568523][ T30] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1192.584028][ T5914] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 1192.599242][ T30] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1192.608868][ T2168] netlink: 28 bytes leftover after parsing attributes in process `syz.8.9038'. [ 1192.618088][ T30] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1192.626336][ T30] usb 5-1: Product: syz [ 1192.630684][ T30] usb 5-1: Manufacturer: syz [ 1192.658606][ T30] cdc_wdm 5-1:1.0: skipping garbage [ 1192.666027][ T30] cdc_wdm 5-1:1.0: probe with driver cdc_wdm failed with error -22 [ 1192.739130][ T2155] batadv_slave_0: left promiscuous mode [ 1192.933419][ T5914] usb 5-1: USB disconnect, device number 76 [ 1193.103156][ T2179] syzkaller0: entered promiscuous mode [ 1193.129686][ T2179] syzkaller0: entered allmulticast mode [ 1193.204755][ T2180] syzkaller0: entered promiscuous mode [ 1193.257646][ T2180] syzkaller0: entered allmulticast mode [ 1194.793936][ T2202] netlink: 4 bytes leftover after parsing attributes in process `syz.3.9045'. [ 1195.137233][ T1990] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 1195.296436][ T1990] usb 4-1: device descriptor read/64, error -71 [ 1195.553025][ T1990] usb 4-1: new high-speed USB device number 62 using dummy_hcd [ 1195.577040][ T2190] netlink: 76 bytes leftover after parsing attributes in process `syz.8.9043'. [ 1195.586626][ T2196] sch_tbf: burst 4398 is lower than device lo mtu (65550) ! [ 1195.693087][ T1990] usb 4-1: device descriptor read/64, error -71 [ 1195.876245][ T1990] usb usb4-port1: attempt power cycle [ 1195.963939][ T2218] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9050'. [ 1196.179600][ T2222] IPVS: fo: FWM 3 0x00000003 - no destination available [ 1196.233287][ T1990] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 1196.373983][ T1990] usb 4-1: device descriptor read/8, error -71 [ 1196.526508][ T29] audit: type=1400 audit(1775987317.594:657): avc: denied { connect } for pid=2226 comm="syz.0.9051" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 1196.693151][ T1990] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 1196.790311][ T1990] usb 4-1: device descriptor read/8, error -71 [ 1197.277913][ T1990] usb usb4-port1: unable to enumerate USB device [ 1197.296067][ T2231] netlink: 68 bytes leftover after parsing attributes in process `syz.5.9052'. [ 1197.934497][ T2247] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9057'. [ 1198.243053][ T5914] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 1198.383764][ T5914] usb 4-1: device descriptor read/64, error -71 [ 1198.642432][ T2255] syzkaller0: entered promiscuous mode [ 1198.649037][ T2255] syzkaller0: entered allmulticast mode [ 1198.673024][ T5914] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 1198.804008][ T5914] usb 4-1: device descriptor read/64, error -71 [ 1198.923366][ T5914] usb usb4-port1: attempt power cycle [ 1199.303406][ T5914] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 1199.432227][ T2263] syzkaller0: entered promiscuous mode [ 1199.448769][ T2263] syzkaller0: entered allmulticast mode [ 1199.471121][ T2263] 0: reclassify loop, rule prio 0, protocol 800 [ 1199.664193][ T5815] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1199.683331][ T5815] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1199.692037][ T5815] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1199.707067][ T5815] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1199.715005][ T5815] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1199.970357][T23870] syz_tun (unregistering): left allmulticast mode [ 1200.316370][ T29] audit: type=1400 audit(1775987321.384:658): avc: denied { write } for pid=2278 comm="syz.0.9066" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1 [ 1200.470738][ T2264] chnl_net:caif_netlink_parms(): no params data found [ 1200.923450][ T2264] bridge0: port 1(bridge_slave_0) entered blocking state [ 1200.956381][ T2264] bridge0: port 1(bridge_slave_0) entered disabled state [ 1201.823151][ T800] Bluetooth: hci1: command tx timeout [ 1201.945340][ T2264] bridge_slave_0: entered allmulticast mode [ 1202.008951][ T2264] bridge_slave_0: entered promiscuous mode [ 1202.045426][ T2264] bridge0: port 2(bridge_slave_1) entered blocking state [ 1202.060450][ T2264] bridge0: port 2(bridge_slave_1) entered disabled state [ 1202.077990][ T2264] bridge_slave_1: entered allmulticast mode [ 1202.095803][ T5914] usb 4-1: device descriptor read/8, error -71 [ 1202.102697][ T2264] bridge_slave_1: entered promiscuous mode [ 1202.302037][ T2304] syzkaller1: entered promiscuous mode [ 1202.364109][ T2304] syzkaller1: entered allmulticast mode [ 1202.557173][ T2264] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1202.634927][ T2264] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1202.736684][ T2314] binder: 2310:2314 ioctl 4018620d 0 returned -22 [ 1202.945057][ T13] bond0 (unregistering): left promiscuous mode [ 1202.963624][ T13] bond_slave_0: left promiscuous mode [ 1202.987819][ T13] bond_slave_1: left promiscuous mode [ 1203.016200][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1203.147138][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1203.263713][ T13] bond0 (unregistering): Released all slaves [ 1203.303927][ T13] bond1 (unregistering): Released all slaves [ 1203.360347][ T13] bond2 (unregistering): Released all slaves [ 1203.426879][ T13] bond3 (unregistering): Released all slaves [ 1203.644743][ T2321] syzkaller0: entered promiscuous mode [ 1203.650248][ T2321] syzkaller0: entered allmulticast mode [ 1203.683488][ T2264] team0: Port device team_slave_0 added [ 1203.721116][ T13] tipc: Left network mode [ 1203.726651][ T2264] team0: Port device team_slave_1 added [ 1203.824604][ T2353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9079'. [ 1203.833903][ T2353] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9079'. [ 1203.903063][ T800] Bluetooth: hci1: command tx timeout [ 1203.993270][ T5848] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 1205.130753][ T5848] usb 1-1: Using ep0 maxpacket: 16 [ 1205.138328][ T5848] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1205.152322][ T5848] usb 1-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice=27.0a [ 1205.161759][ T5848] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1205.169987][ T5848] usb 1-1: Product: syz [ 1205.178276][ T5848] usb 1-1: Manufacturer: syz [ 1205.182892][ T5848] usb 1-1: SerialNumber: syz [ 1205.199721][ T2362] FAULT_INJECTION: forcing a failure. [ 1205.199721][ T2362] name failslab, interval 1, probability 0, space 0, times 1 [ 1205.214171][ T2362] CPU: 0 UID: 0 PID: 2362 Comm: syz.3.9082 Tainted: G L syzkaller #0 PREEMPT(full) [ 1205.214199][ T2362] Tainted: [L]=SOFTLOCKUP [ 1205.214204][ T2362] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1205.214213][ T2362] Call Trace: [ 1205.214219][ T2362] [ 1205.214225][ T2362] dump_stack_lvl+0x100/0x190 [ 1205.214256][ T2362] should_fail_ex.cold+0x5/0xa [ 1205.214278][ T2362] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1205.214305][ T2362] should_failslab+0xc2/0x120 [ 1205.214324][ T2362] __kmalloc_noprof+0xe0/0x850 [ 1205.214355][ T2362] tomoyo_realpath_from_path+0xb6/0x690 [ 1205.214386][ T2362] tomoyo_path_number_perm+0x23c/0x580 [ 1205.214408][ T2362] ? tomoyo_path_number_perm+0x22e/0x580 [ 1205.214431][ T2362] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1205.214485][ T2362] ? find_held_lock+0x2b/0x80 [ 1205.214508][ T2362] ? __fget_files+0x215/0x3d0 [ 1205.214525][ T2362] ? hook_file_ioctl_common+0x146/0x410 [ 1205.214548][ T2362] ? __fget_files+0x21f/0x3d0 [ 1205.214572][ T2362] security_file_ioctl+0xd3/0x230 [ 1205.214599][ T2362] __x64_sys_ioctl+0xb7/0x210 [ 1205.214627][ T2362] do_syscall_64+0x106/0xf80 [ 1205.214644][ T2362] ? clear_bhb_loop+0x40/0x90 [ 1205.214666][ T2362] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1205.214685][ T2362] RIP: 0033:0x7f7eb6f9c819 [ 1205.214701][ T2362] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1205.214718][ T2362] RSP: 002b:00007f7eb7ea2028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1205.214735][ T2362] RAX: ffffffffffffffda RBX: 00007f7eb7215fa0 RCX: 00007f7eb6f9c819 [ 1205.214746][ T2362] RDX: 0000000000001063 RSI: 0000000000000703 RDI: 0000000000000003 [ 1205.214757][ T2362] RBP: 00007f7eb7ea2090 R08: 0000000000000000 R09: 0000000000000000 [ 1205.214767][ T2362] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1205.214776][ T2362] R13: 00007f7eb7216038 R14: 00007f7eb7215fa0 R15: 00007fffb86d4908 [ 1205.214801][ T2362] [ 1205.215076][ T2362] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1205.421437][ T5848] usb 1-1: config 0 descriptor?? [ 1205.458334][ T5914] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 1205.524232][ T2364] netlink: 240 bytes leftover after parsing attributes in process `syz.3.9083'. [ 1205.633093][ T5914] usb 6-1: Using ep0 maxpacket: 8 [ 1205.682784][ T5914] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1205.808501][ T5848] usb 1-1: USB disconnect, device number 81 [ 1205.863410][ T5914] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1205.897438][ T5914] usb 6-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 1205.906658][ T5914] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1205.914987][ T5914] usb 6-1: Product: syz [ 1205.919270][ T5914] usb 6-1: Manufacturer: syz [ 1205.926258][ T5914] usb 6-1: SerialNumber: syz [ 1205.944178][ T5914] usb 6-1: config 0 descriptor?? [ 1205.971615][ T5914] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 found [ 1205.984320][ T800] Bluetooth: hci1: command tx timeout [ 1206.242378][ T5914] snd_usb_toneport 6-1:0.0: cannot get proper max packet size [ 1206.303361][ T5914] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 now disconnected [ 1206.312187][ T5914] snd_usb_toneport 6-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1207.191627][ T5848] usb 6-1: USB disconnect, device number 46 [ 1208.003353][ T5914] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1208.066209][ T800] Bluetooth: hci1: command tx timeout [ 1208.170523][ T5914] usb 1-1: Using ep0 maxpacket: 8 [ 1208.195161][ T5914] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 1208.203732][ T5914] usb 1-1: config 179 has no interface number 0 [ 1208.210581][ T5914] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1208.221926][ T5914] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1208.233351][ T5914] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1208.244790][ T5914] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1208.256326][ T5914] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1208.273216][ T5914] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1208.282339][ T5914] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1208.301668][ T2395] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1208.454287][ T2411] netlink: 16 bytes leftover after parsing attributes in process `syz.5.9089'. [ 1208.553892][ T5914] input: Generic X-Box pad as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:179.65/input/input44 [ 1208.793466][ T29] audit: type=1400 audit(1775987329.864:659): avc: denied { read } for pid=2396 comm="syz.5.9089" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 1209.222072][ T2264] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1209.229149][ T2264] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1209.255179][ T2264] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1209.369857][ T2403] syzkaller0: entered promiscuous mode [ 1209.388563][ T2403] syzkaller0: entered allmulticast mode [ 1209.447043][ T2264] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1209.460203][ T2264] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1209.513220][ T30] usb 1-1: USB disconnect, device number 82 [ 1209.519169][ C1] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1209.519198][ C1] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1209.553050][ T2264] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1210.193099][ T30] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1210.373348][ T30] usb 1-1: Using ep0 maxpacket: 32 [ 1210.380349][ T30] usb 1-1: config 0 has an invalid interface number: 196 but max is 0 [ 1210.423557][ T30] usb 1-1: config 0 has no interface number 0 [ 1210.429813][ T30] usb 1-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 1210.443392][ T30] usb 1-1: config 0 interface 196 has no altsetting 0 [ 1210.453194][ T30] usb 1-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 1210.462406][ T30] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1210.481551][ T30] usb 1-1: Product: syz [ 1210.491866][ T30] usb 1-1: Manufacturer: syz [ 1210.497071][ T30] usb 1-1: SerialNumber: syz [ 1210.514277][ T30] usb 1-1: config 0 descriptor?? [ 1210.520274][ T2429] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1210.531975][ T2433] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9094'. [ 1210.541851][ T2433] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9094'. [ 1210.608841][ T2435] fuse: Bad value for 'fd' [ 1212.629344][ T30] ipheth 1-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 1212.638247][ T30] ipheth 1-1:0.196: probe with driver ipheth failed with error -71 [ 1212.655652][ T30] usb 1-1: USB disconnect, device number 83 [ 1213.182212][ T2445] syzkaller0: entered promiscuous mode [ 1213.188061][ T2445] syzkaller0: entered allmulticast mode [ 1215.965819][ T2500] netlink: 76 bytes leftover after parsing attributes in process `syz.0.9103'. [ 1216.012114][ T2264] hsr_slave_0: entered promiscuous mode [ 1216.019013][ T2264] hsr_slave_1: entered promiscuous mode [ 1216.082093][ T2264] debugfs: 'hsr0' already exists in 'hsr' [ 1216.088198][ T800] Bluetooth: hci2: unexpected event for opcode 0x042c [ 1216.097812][ T2264] Cannot create hsr debugfs directory [ 1216.143967][ T13] team0: left promiscuous mode [ 1216.178627][ T13] team_slave_0: left promiscuous mode [ 1216.188738][ T13] team_slave_1: left promiscuous mode [ 1216.223205][ T13] hsr_slave_0: left promiscuous mode [ 1216.248136][ T13] hsr_slave_1: left promiscuous mode [ 1216.269209][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1216.282901][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1216.291150][ T13] batman_adv: batadv0: Removing interface: dummy0 [ 1216.306545][ T30] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 1216.463069][ T5914] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 1216.481296][ T30] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16 [ 1216.936034][ T30] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 255 [ 1216.951682][ T30] usb 9-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1216.960842][ T30] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1216.975154][ T30] usb 9-1: Product: syz [ 1216.979349][ T30] usb 9-1: Manufacturer: syz [ 1216.984037][ T30] usb 9-1: SerialNumber: syz [ 1216.994926][ T30] usb 9-1: config 0 descriptor?? [ 1217.001314][ T2509] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1217.020433][ T2509] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1217.087113][ T5914] usb 6-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice= 0.7f [ 1217.098921][ T5914] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1217.100027][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1217.110207][ T5914] usb 6-1: config 0 descriptor?? [ 1217.141367][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1217.247661][ T2509] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1217.256267][ T2509] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1217.335375][ T5914] usb 6-1: string descriptor 0 read error: -71 [ 1217.354014][ T5914] ldusb 6-1:0.0: Interrupt in endpoint not found [ 1217.356487][ T5848] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 1217.402872][ T5914] usb 6-1: USB disconnect, device number 47 [ 1217.525236][ T5848] usb 4-1: too many configurations: 91, using maximum allowed: 8 [ 1217.539147][ T5848] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1217.547263][ T5848] usb 4-1: can't read configurations, error -61 [ 1217.612128][ T2547] bond5: entered promiscuous mode [ 1217.617718][ T2547] bond5: entered allmulticast mode [ 1217.623544][ T2547] 8021q: adding VLAN 0 to HW filter on device bond5 [ 1217.669455][ T30] dm9601: No valid MAC address in EEPROM, using 00:00:00:00:00:00 [ 1217.677164][ T13] IPVS: stop unused estimator thread 0... [ 1217.694693][ T5848] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 1217.703523][ T2556] IPVS: fo: FWM 3 0x00000003 - no destination available [ 1217.875124][ T5848] usb 4-1: too many configurations: 91, using maximum allowed: 8 [ 1217.892333][ T5848] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1217.902636][ T5848] usb 4-1: can't read configurations, error -61 [ 1217.910117][ T5848] usb usb4-port1: attempt power cycle [ 1218.090631][ T30] dm9601 9-1:0.0 (unnamed net_device) (uninitialized): Error reading chip ID [ 1218.151044][ T30] usb 9-1: USB disconnect, device number 57 [ 1218.244549][ T2574] syzkaller0: entered promiscuous mode [ 1218.250465][ T2574] syzkaller0: entered allmulticast mode [ 1218.259820][ T2264] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1218.266850][ T5848] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 1218.278535][ T2574] 0: reclassify loop, rule prio 0, protocol 800 [ 1218.288785][ T2264] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1218.300034][ T2264] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1218.314228][ T5848] usb 4-1: too many configurations: 91, using maximum allowed: 8 [ 1218.334908][ T5848] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1218.345364][ T2264] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1218.352879][ T5848] usb 4-1: can't read configurations, error -61 [ 1218.603068][ T5848] usb 4-1: new high-speed USB device number 72 using dummy_hcd [ 1218.624717][ T5848] usb 4-1: too many configurations: 91, using maximum allowed: 8 [ 1218.635496][ T5848] usb 4-1: unable to read config index 0 descriptor/start: -61 [ 1218.644245][ T5848] usb 4-1: can't read configurations, error -61 [ 1218.652297][ T5848] usb usb4-port1: unable to enumerate USB device [ 1218.685922][ T2591] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1218.711493][ T2591] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1218.902696][ T2597] syzkaller0: entered promiscuous mode [ 1218.916039][ T2597] syzkaller0: entered allmulticast mode [ 1218.933030][ T30] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 1218.963628][ T2603] 0: reclassify loop, rule prio 0, protocol 800 [ 1218.975751][ T2264] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1219.028929][ T2264] 8021q: adding VLAN 0 to HW filter on device team0 [ 1219.073007][ T30] usb 6-1: device descriptor read/64, error -71 [ 1219.112399][ T1314] bridge0: port 1(bridge_slave_0) entered blocking state [ 1219.119566][ T1314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1219.152726][ T1314] bridge0: port 2(bridge_slave_1) entered blocking state [ 1219.159896][ T1314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1219.189772][ T2611] fuse: Bad value for 'rootmode' [ 1219.201277][ T2605] netlink: 76 bytes leftover after parsing attributes in process `syz.0.9116'. [ 1220.096019][ T2653] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9121'. [ 1220.100004][ T2264] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1220.223455][ T2653] netlink: 8 bytes leftover after parsing attributes in process `syz.0.9121'. [ 1220.275518][ T2663] syzkaller0: entered promiscuous mode [ 1220.291734][ T2663] syzkaller0: entered allmulticast mode [ 1220.379415][ T2663] 0: reclassify loop, rule prio 0, protocol 800 [ 1220.662726][ T2669] netlink: 76 bytes leftover after parsing attributes in process `syz.8.9124'. [ 1221.767275][ T2686] syzkaller0: entered promiscuous mode [ 1221.772781][ T2686] syzkaller0: entered allmulticast mode [ 1221.781800][ T2686] 0: reclassify loop, rule prio 0, protocol 800 [ 1221.971720][ T2264] veth0_vlan: entered promiscuous mode [ 1222.003580][ T2701] netlink: 76 bytes leftover after parsing attributes in process `syz.8.9129'. [ 1222.044610][ T2264] veth1_vlan: entered promiscuous mode [ 1222.144434][ T2264] veth0_macvtap: entered promiscuous mode [ 1222.165349][ T2264] veth1_macvtap: entered promiscuous mode [ 1222.182192][ T2264] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1222.193720][ T2264] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1222.248371][ T30] usb 4-1: new full-speed USB device number 73 using dummy_hcd [ 1222.311502][T24045] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.324186][T24045] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.509603][ T30] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1222.576884][ T30] usb 4-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 1222.576938][ T30] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1222.576984][ T30] usb 4-1: Product: syz [ 1222.577026][ T30] usb 4-1: Manufacturer: syz [ 1222.577066][ T30] usb 4-1: SerialNumber: syz [ 1222.659733][ T30] usb 4-1: config 0 descriptor?? [ 1222.726093][T24045] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.730222][T24045] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1222.730272][T24045] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1222.730286][T24045] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1222.749767][T24045] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1222.749788][T24045] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1222.774835][ T5848] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1222.856773][ T2720] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9132'. [ 1222.873564][T26095] usb 4-1: USB disconnect, device number 73 [ 1222.988941][ T5848] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1222.988965][ T5848] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1222.991421][ T5848] usb 1-1: config 0 descriptor?? [ 1223.410811][ T29] audit: type=1400 audit(1775987344.474:660): avc: denied { getopt } for pid=2703 comm="syz.0.9130" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1224.147821][ T5848] usb 1-1: Cannot set autoneg [ 1224.152690][ T5848] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -61 [ 1224.241942][ T2743] FAULT_INJECTION: forcing a failure. [ 1224.241942][ T2743] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 1224.259626][ T2741] syzkaller0: entered promiscuous mode [ 1224.265420][ T2741] syzkaller0: entered allmulticast mode [ 1224.271809][ T2743] CPU: 0 UID: 0 PID: 2743 Comm: syz.3.9135 Tainted: G L syzkaller #0 PREEMPT(full) [ 1224.271837][ T2743] Tainted: [L]=SOFTLOCKUP [ 1224.271843][ T2743] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1224.271854][ T2743] Call Trace: [ 1224.271860][ T2743] [ 1224.271866][ T2743] dump_stack_lvl+0x100/0x190 [ 1224.271899][ T2743] should_fail_ex.cold+0x5/0xa [ 1224.271922][ T2743] _copy_from_iter+0x1f4/0x1690 [ 1224.271945][ T2743] ? __asan_memset+0x23/0x50 [ 1224.271971][ T2743] ? __pfx__copy_from_iter+0x10/0x10 [ 1224.271990][ T2743] ? __pfx___alloc_skb+0x10/0x10 [ 1224.272021][ T2743] netlink_sendmsg+0x808/0xda0 [ 1224.272041][ T2743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1224.272056][ T2743] ? __might_fault+0x30/0x140 [ 1224.272088][ T2743] ____sys_sendmsg+0x9e1/0xb70 [ 1224.272107][ T2743] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1224.272126][ T2743] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1224.272155][ T2743] ___sys_sendmsg+0x190/0x1e0 [ 1224.272177][ T2743] ? __pfx____sys_sendmsg+0x10/0x10 [ 1224.272226][ T2743] __sys_sendmsg+0x170/0x220 [ 1224.272250][ T2743] ? __pfx___sys_sendmsg+0x10/0x10 [ 1224.272288][ T2743] do_syscall_64+0x106/0xf80 [ 1224.272305][ T2743] ? clear_bhb_loop+0x40/0x90 [ 1224.272324][ T2743] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1224.272340][ T2743] RIP: 0033:0x7f7eb6f9c819 [ 1224.272362][ T2743] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1224.272380][ T2743] RSP: 002b:00007f7eb7ea2028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1224.272396][ T2743] RAX: ffffffffffffffda RBX: 00007f7eb7215fa0 RCX: 00007f7eb6f9c819 [ 1224.272406][ T2743] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1224.272415][ T2743] RBP: 00007f7eb7ea2090 R08: 0000000000000000 R09: 0000000000000000 [ 1224.272433][ T2743] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1224.272442][ T2743] R13: 00007f7eb7216038 R14: 00007f7eb7215fa0 R15: 00007fffb86d4908 [ 1224.272465][ T2743] [ 1225.589233][T13499] usb 1-1: USB disconnect, device number 84 [ 1225.622501][T18373] lec:lec_start_xmit: lec0:No lecd attached [ 1226.874661][ T2797] netlink: 76 bytes leftover after parsing attributes in process `syz.5.9141'. [ 1227.049534][ T2802] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1227.623102][ T1637] usb 6-1: new full-speed USB device number 50 using dummy_hcd [ 1227.784391][ T1637] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1227.797090][ T1637] usb 6-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 1227.806197][ T1637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1227.814220][ T1637] usb 6-1: Product: syz [ 1227.819052][ T1637] usb 6-1: Manufacturer: syz [ 1227.823698][ T1637] usb 6-1: SerialNumber: syz [ 1227.829680][ T1637] usb 6-1: config 0 descriptor?? [ 1227.979783][ T2819] sch_tbf: peakrate 9 is lower than or equals to rate 8022975959529529383 ! [ 1228.020829][ T2821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9148'. [ 1228.031003][ T2821] netlink: 8 bytes leftover after parsing attributes in process `syz.3.9148'. [ 1228.046283][T26095] usb 6-1: USB disconnect, device number 50 [ 1228.584158][ T2780] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1228.759611][ T2831] netlink: 260 bytes leftover after parsing attributes in process `syz.8.9152'. [ 1229.032827][ T29] audit: type=1400 audit(1775987350.094:661): avc: denied { mounton } for pid=2837 comm="syz.4.9154" path=2F322FE91F7189591E9233614B dev="tmpfs" ino=28 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 1229.099676][ T5815] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1229.114274][ T5815] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1229.124085][ T5815] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1229.132331][ T5815] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1229.140144][ T5815] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1230.167133][T23660] syz_tun (unregistering): left allmulticast mode [ 1230.257552][ T2842] chnl_net:caif_netlink_parms(): no params data found [ 1230.433445][ T2879] netlink: 76 bytes leftover after parsing attributes in process `syz.8.9161'. [ 1231.193805][ T800] Bluetooth: hci3: command tx timeout [ 1231.352986][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5730 ms [ 1231.360978][ C0] lec:lec_tx_timeout: lec0 [ 1231.772792][ T2842] bridge0: port 1(bridge_slave_0) entered blocking state [ 1231.784015][ T2842] bridge0: port 1(bridge_slave_0) entered disabled state [ 1231.800867][ T2842] bridge_slave_0: entered allmulticast mode [ 1231.819349][ T2842] bridge_slave_0: entered promiscuous mode [ 1232.104414][ T2842] bridge0: port 2(bridge_slave_1) entered blocking state [ 1232.115602][ T2842] bridge0: port 2(bridge_slave_1) entered disabled state [ 1232.125441][ T2842] bridge_slave_1: entered allmulticast mode [ 1232.132866][ T2842] bridge_slave_1: entered promiscuous mode [ 1232.191812][ T2842] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1232.217084][ T2899] netlink: 40 bytes leftover after parsing attributes in process `syz.3.9167'. [ 1232.262261][ T2842] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1232.311742][ T2903] netlink: 'syz.5.9168': attribute type 1 has an invalid length. [ 1232.331446][ T2842] team0: Port device team_slave_0 added [ 1232.355586][ T2903] bond2: entered promiscuous mode [ 1232.361254][ T2903] bond2: entered allmulticast mode [ 1232.368048][ T2903] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1232.391189][ T2842] team0: Port device team_slave_1 added [ 1232.576966][T24045] bond0 (unregistering): left promiscuous mode [ 1232.583369][T24045] bond_slave_0: left promiscuous mode [ 1232.588834][T24045] bond_slave_1: left promiscuous mode [ 1232.595481][T24045] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1232.605076][T24045] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1232.614874][T24045] bond0 (unregistering): Released all slaves [ 1232.625629][T24045] bond1 (unregistering): Released all slaves [ 1232.638449][T24045] bond2 (unregistering): Released all slaves [ 1232.649624][T24045] bond3 (unregistering): Released all slaves [ 1232.660429][T24045] bond4 (unregistering): Released all slaves [ 1232.672183][T24045] bond5 (unregistering): Released all slaves [ 1232.699486][ T2842] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1232.706755][ T2842] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1232.734498][ T2842] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1232.752209][ T2842] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1232.765479][ T2842] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1232.801350][ T2842] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1232.857023][T24045] tipc: Left network mode [ 1232.867522][ T2842] hsr_slave_0: entered promiscuous mode [ 1232.874653][ T2842] hsr_slave_1: entered promiscuous mode [ 1232.881121][ T2842] debugfs: 'hsr0' already exists in 'hsr' [ 1232.887588][ T2842] Cannot create hsr debugfs directory [ 1233.061919][T24045] team0: left promiscuous mode [ 1233.070996][T24045] team_slave_0: left promiscuous mode [ 1233.079309][T24045] team_slave_1: left promiscuous mode [ 1233.093860][T24045] hsr_slave_0: left promiscuous mode [ 1233.101646][T24045] hsr_slave_1: left promiscuous mode [ 1233.108793][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1233.110473][T24045] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1233.118562][ T1295] lec:lec_start_xmit: lec0:No lecd attached [ 1233.145573][T24045] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1233.263013][ T800] Bluetooth: hci3: command tx timeout [ 1233.366138][T24045] team0 (unregistering): Port device team_slave_1 removed [ 1233.581595][ T2922] netlink: 76 bytes leftover after parsing attributes in process `syz.3.9173'. [ 1233.652495][T24045] team0 (unregistering): Port device team_slave_0 removed [ 1234.586965][ T2886] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1235.164172][ T2943] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9180'. [ 1235.267444][ T2956] netlink: 84 bytes leftover after parsing attributes in process `syz.5.9181'. [ 1235.303150][ T2956] nbd: must specify at least one socket [ 1235.319270][T24045] IPVS: stop unused estimator thread 0... [ 1235.354621][ T800] Bluetooth: hci3: command tx timeout [ 1235.415237][ T1990] usb 4-1: new high-speed USB device number 74 using dummy_hcd [ 1235.458773][ T29] audit: type=1400 audit(1775987356.524:662): avc: denied { lock } for pid=2960 comm="syz.5.9184" path="socket:[126021]" dev="sockfs" ino=126021 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 1235.465310][ T2842] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1235.546153][ T5914] IPVS: starting estimator thread 0... [ 1235.552225][ T2842] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1235.605015][ T2842] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1235.609301][ T1990] usb 4-1: config index 0 descriptor too short (expected 65004, got 45) [ 1235.641669][ T1990] usb 4-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 1235.654219][ T2967] IPVS: using max 41 ests per chain, 98400 per kthread [ 1235.673579][ T1990] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1235.689779][ T2842] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1235.698628][ T1990] usb 4-1: Product: syz [ 1235.723006][ T1990] usb 4-1: Manufacturer: syz [ 1235.736494][ T1990] usb 4-1: SerialNumber: syz [ 1235.818886][ T2976] random: crng reseeded on system resumption [ 1236.032671][ T29] audit: type=1400 audit(1775987356.884:663): avc: denied { write } for pid=2936 comm="syz.4.9178" name="snapshot" dev="devtmpfs" ino=92 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:acpi_bios_t tclass=chr_file permissive=1 [ 1237.019828][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 1237.035360][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 1237.466507][ T2992] netlink: 'syz.4.9186': attribute type 21 has an invalid length. [ 1237.474397][ T2992] IPv6: NLM_F_CREATE should be specified when creating new route [ 1237.482196][ T2992] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1237.489433][ T2992] IPv6: NLM_F_CREATE should be set when creating new route [ 1237.496671][ T2992] IPv6: NLM_F_CREATE should be set when creating new route [ 1237.503888][ T2992] IPv6: NLM_F_CREATE should be set when creating new route [ 1237.516092][ T2992] netlink: 'syz.4.9186': attribute type 21 has an invalid length. [ 1237.524057][ T2992] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1237.563025][ T800] Bluetooth: hci3: command tx timeout [ 1237.693430][ T800] Bluetooth: hci1: unknown advertising packet type: 0x75 [ 1237.693566][ T800] Bluetooth: hci1: Dropping invalid advertising data [ 1237.709003][ T800] Bluetooth: hci1: Malformed LE Event: 0x02 [ 1238.382972][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5260 ms [ 1238.383000][ C0] lec:lec_tx_timeout: lec0 [ 1238.686820][ T2842] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1238.728327][ T2842] 8021q: adding VLAN 0 to HW filter on device team0 [ 1238.782387][ T1314] bridge0: port 1(bridge_slave_0) entered blocking state [ 1238.789605][ T1314] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1238.982012][ T1314] bridge0: port 2(bridge_slave_1) entered blocking state [ 1238.989371][ T1314] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1239.123017][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000010. ret = -EPIPE [ 1239.153538][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPIPE [ 1239.194862][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 1239.207590][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 1239.221542][ T1990] lan78xx 4-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 1239.242438][ T1990] lan78xx 4-1:1.0: probe with driver lan78xx failed with error -71 [ 1239.267517][ T3018] netlink: 260 bytes leftover after parsing attributes in process `syz.5.9191'. [ 1239.299042][ T1990] usb 4-1: USB disconnect, device number 74 [ 1239.390125][ T2842] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1239.508603][ T3030] netlink: 16 bytes leftover after parsing attributes in process `syz.4.9194'. [ 1239.533601][ T3005] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 1239.659056][ T2842] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1239.703809][ T3039] syzkaller0: entered promiscuous mode [ 1239.713487][ T3005] usb 9-1: Using ep0 maxpacket: 8 [ 1239.719502][ T3039] syzkaller0: entered allmulticast mode [ 1239.724885][ T3005] usb 9-1: config 162 has an invalid interface number: 84 but max is 2 [ 1239.744204][ T3005] usb 9-1: config 162 has an invalid interface number: 3 but max is 2 [ 1239.752452][ T3005] usb 9-1: config 162 has no interface number 0 [ 1239.755910][ T3039] 0: reclassify loop, rule prio 0, protocol 800 [ 1239.774057][ T3005] usb 9-1: config 162 has no interface number 1 [ 1239.780384][ T3005] usb 9-1: config 162 interface 84 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1239.806342][ T3005] usb 9-1: config 162 interface 2 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 1239.818216][ T3005] usb 9-1: config 162 interface 2 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1239.863040][ T3005] usb 9-1: config 162 interface 2 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 1239.888895][ T2842] veth0_vlan: entered promiscuous mode [ 1239.898775][ T3005] usb 9-1: config 162 interface 2 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 1239.934137][ T2842] veth1_vlan: entered promiscuous mode [ 1239.941280][ T3005] usb 9-1: config 162 interface 2 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 1239.974111][ T3005] usb 9-1: config 162 interface 84 has no altsetting 0 [ 1239.981006][ T3005] usb 9-1: config 162 interface 2 has no altsetting 0 [ 1240.009372][ T2842] veth0_macvtap: entered promiscuous mode [ 1240.019264][ T3005] usb 9-1: New USB device found, idVendor=0e8d, idProduct=763f, bcdDevice=9b.23 [ 1240.045354][ T2842] veth1_macvtap: entered promiscuous mode [ 1240.053485][ T3005] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1240.074244][ T3053] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9199'. [ 1240.095576][ T3005] usb 9-1: Product: syz [ 1240.099817][ T3005] usb 9-1: Manufacturer: syz [ 1240.104682][ T3005] usb 9-1: SerialNumber: syz [ 1240.113131][ T3053] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9199'. [ 1240.135844][ T3053] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9199'. [ 1240.168460][ T2842] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1240.200474][ T2842] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1240.232069][ T192] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1240.276545][ T192] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1240.285534][ T192] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1240.294540][ T192] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1240.359764][ T29] audit: type=1400 audit(1775987361.404:664): avc: denied { listen } for pid=3019 comm="syz.8.9192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1240.410921][ T800] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 1240.424628][ T3005] usb 9-1: USB disconnect, device number 58 [ 1240.438214][ T29] audit: type=1400 audit(1775987361.404:665): avc: denied { accept } for pid=3019 comm="syz.8.9192" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1240.484941][ T3063] fuse: Unknown parameter 'gïoup_md' [ 1240.531877][ T3063] dlm: no locking on control device [ 1240.557802][ T29] audit: type=1400 audit(1775987361.524:666): avc: denied { write } for pid=3056 comm="syz.5.9200" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 1240.598458][ T192] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1240.616759][ T192] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1240.671512][ T192] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1240.685712][ T192] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1241.183554][ T3084] syzkaller0: entered promiscuous mode [ 1241.189108][ T3084] syzkaller0: entered allmulticast mode [ 1241.431768][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.438119][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.445728][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.453485][ T3090] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 1241.465032][ T3090] infiniband óyz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1241.484946][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.491980][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.498907][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.505701][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.512394][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.519087][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.525832][ T3090] wlan1 speed is unknown, defaulting to 1000 [ 1241.631759][ T3097] netlink: 8 bytes leftover after parsing attributes in process `syz.8.9205'. [ 1241.872125][ T3103] netlink: 212408 bytes leftover after parsing attributes in process `syz.8.9207'. [ 1241.945441][ T3105] syzkaller0: entered promiscuous mode [ 1241.951629][ T3105] syzkaller0: entered allmulticast mode [ 1241.959408][T13499] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 1241.970458][ T3105] 0: reclassify loop, rule prio 0, protocol 800 [ 1242.133142][T13499] usb 6-1: Using ep0 maxpacket: 32 [ 1242.141059][T13499] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 1242.156323][T13499] usb 6-1: config 0 has no interface number 0 [ 1242.192829][T13499] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 1242.314327][T13499] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1242.325895][T13499] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1242.334902][ T29] audit: type=1400 audit(1775987363.394:667): avc: denied { wake_alarm } for pid=3115 comm="syz.4.9210" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1242.373617][T13499] usb 6-1: Product: syz [ 1242.377869][T13499] usb 6-1: Manufacturer: syz [ 1242.382658][T13499] usb 6-1: SerialNumber: syz [ 1242.399874][T13499] usb 6-1: config 0 descriptor?? [ 1242.771509][ T3100] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1243.134065][ T3100] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1243.206234][ T3131] vivid-007: disconnect [ 1243.344276][ C0] bridge0: received packet on bridge_slave_0 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0) [ 1244.060544][ T3153] syzkaller0: entered promiscuous mode [ 1244.066610][ T3153] syzkaller0: entered allmulticast mode [ 1244.095838][ T3129] vivid-007: reconnect [ 1244.559184][ T3164] netlink: 156 bytes leftover after parsing attributes in process `syz.4.9217'. [ 1245.038017][ T3176] netlink: 156 bytes leftover after parsing attributes in process `syz.0.9218'. [ 1245.456589][ T3184] syzkaller0: entered promiscuous mode [ 1245.462389][ T3184] syzkaller0: entered allmulticast mode [ 1245.478203][ T3184] 0: reclassify loop, rule prio 0, protocol 800 [ 1245.731124][ T3177] vimc link validate: Scaler:src:640x480 (0x33424752, 8, 0, 0, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1245.985044][T13499] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1246.014194][T13499] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to write RX_CTL mode to 0x0088: ffffffb9 [ 1246.049126][T13499] asix 6-1:0.188: probe with driver asix failed with error -71 [ 1246.110151][T13499] usb 6-1: USB disconnect, device number 51 [ 1246.197179][ T3192] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1246.795799][ T3200] program syz.0.9222 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1247.452302][ T3225] tmpfs: Unknown parameter 'mpo' [ 1247.504575][ T29] audit: type=1400 audit(1775987368.514:668): avc: denied { mounton } for pid=3217 comm="syz.4.9227" path="/syzcgroup/unified/syz4" dev="cgroup2" ino=158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=dir permissive=1 [ 1247.601082][T13499] hid-generic 0000:0000:0000.0009: unknown main item tag 0x0 [ 1247.611822][T13499] hid-generic 0000:0000:0000.0009: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1247.758072][ T3234] openvswitch: netlink: IP tunnel dst address not specified [ 1248.265928][T26095] usb 4-1: new high-speed USB device number 75 using dummy_hcd [ 1248.370194][ T29] audit: type=1400 audit(1775987369.434:669): avc: denied { mounton } for pid=3206 comm="syz.5.9225" path="mnt:[4026533201]" dev="nsfs" ino=4026533201 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1248.393839][ T5914] usb 9-1: new high-speed USB device number 59 using dummy_hcd [ 1248.424769][T26095] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1248.436565][T26095] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1248.472248][T26095] usb 4-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1248.483093][T13499] usb 1-1: new full-speed USB device number 85 using dummy_hcd [ 1248.500472][T26095] usb 4-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 1248.532015][T26095] usb 4-1: Manufacturer: syz [ 1248.560072][T26095] usb 4-1: config 0 descriptor?? [ 1248.576587][ T5914] usb 9-1: Using ep0 maxpacket: 8 [ 1248.591077][ T5914] usb 9-1: New USB device found, idVendor=13d8, idProduct=0001, bcdDevice=30.62 [ 1248.623662][ T5914] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1248.652197][ T5914] usb 9-1: Product: syz [ 1248.657478][ T5914] usb 9-1: Manufacturer: syz [ 1248.666328][T13499] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1248.672424][ T5914] usb 9-1: SerialNumber: syz [ 1248.703033][T13499] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x3 has invalid wMaxPacketSize 0 [ 1248.724682][T13499] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a5, bcdDevice= 0.40 [ 1248.743025][T13499] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1248.761237][T13499] usb 1-1: SerialNumber: syz [ 1248.780187][T13499] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 1248.795846][ T3239] syzkaller1: entered promiscuous mode [ 1248.808823][T13499] usb-storage 1-1:1.0: USB Mass Storage device detected [ 1248.818043][ T3239] syzkaller1: entered allmulticast mode [ 1248.837040][ T5914] usb 9-1: config 0 descriptor?? [ 1248.842819][ T3239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1248.863786][T13499] usb-storage 1-1:1.0: Quirks match for vid 0525 pid a4a5: 10000 [ 1248.873360][T13499] scsi host1: usb-storage 1-1:1.0 [ 1248.873682][ T3239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1248.946175][ T5914] usb 9-1: selecting invalid altsetting 3 [ 1248.971265][ T5914] comedi comedi5: could not set alternate setting 3 in high speed [ 1248.972066][ T3239] netlink: 'syz.3.9232': attribute type 2 has an invalid length. [ 1249.006340][ T3239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1249.016513][ T3239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1249.048947][ T29] audit: type=1400 audit(1775987370.114:670): avc: denied { write } for pid=3241 comm="syz.0.9231" name="renderD128" dev="devtmpfs" ino=626 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1249.073851][ T5914] usbdux 9-1:0.0: driver 'usbdux' failed to auto-configure device. [ 1249.139448][ T5914] usbdux 9-1:0.0: probe with driver usbdux failed with error -22 [ 1249.167491][ T30] usb 1-1: USB disconnect, device number 85 [ 1249.173719][T26095] usbhid 4-1:0.0: can't add hid device: -71 [ 1249.179687][T26095] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 1249.202191][ T5914] usb 9-1: USB disconnect, device number 59 [ 1249.212636][T26095] usb 4-1: USB disconnect, device number 75 [ 1249.546296][ T3270] netlink: 156 bytes leftover after parsing attributes in process `syz.4.9234'. [ 1250.133704][ T1637] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 1250.193032][ T30] usb 4-1: new high-speed USB device number 76 using dummy_hcd [ 1250.364691][ T1637] usb 9-1: config 1 interface 0 has no altsetting 0 [ 1250.374581][ T1637] usb 9-1: string descriptor 0 read error: -22 [ 1250.380859][ T1637] usb 9-1: New USB device found, idVendor=258a, idProduct=0033, bcdDevice= 0.40 [ 1250.391149][ T1637] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1250.632750][ T30] usb 4-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1250.641535][ T30] usb 4-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1250.651818][ T30] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1250.661241][ T30] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1250.672375][ T30] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1250.692146][ T3278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1250.710165][ T3278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1250.889307][ T30] usb 4-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1250.898871][ T30] usb 4-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1250.907420][ T30] usb 4-1: Product: syz [ 1250.911594][ T30] usb 4-1: Manufacturer: syz [ 1250.927061][ T3278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1250.992019][ T30] cdc_wdm 4-1:1.0: skipping garbage [ 1251.018741][ T3296] netlink: 260 bytes leftover after parsing attributes in process `syz.4.9245'. [ 1251.028749][ T3296] netlink: 64 bytes leftover after parsing attributes in process `syz.4.9245'. [ 1251.443865][ T3278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1251.446202][ T30] cdc_wdm 4-1:1.0: skipping garbage [ 1251.457766][ T3278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1251.468817][ T3278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1251.479118][ T3278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1251.489982][ T30] cdc_wdm 4-1:1.0: cdc-wdm0: USB WDM device [ 1251.496815][ T30] cdc_wdm 4-1:1.0: Unknown control protocol [ 1251.660379][ T3298] xt_addrtype: input interface limitation not valid in POSTROUTING and OUTPUT [ 1251.796382][ T3278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1251.825692][ T3278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1251.834899][ T3278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1252.124419][ C1] cdc_wdm 4-1:1.0: Unexpected error -71 [ 1252.130064][ C1] wdm_int_callback: 3426 callbacks suppressed [ 1252.130083][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1252.142695][ C1] wdm_int_callback: 3426 callbacks suppressed [ 1252.142709][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1252.155888][ C1] cdc_wdm 4-1:1.0: nonzero urb status received: -71 [ 1252.161736][ T5848] usb 4-1: USB disconnect, device number 76 [ 1252.162495][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - 0 bytes [ 1252.162517][ C1] cdc_wdm 4-1:1.0: wdm_int_callback - usb_submit_urb failed with result -19 [ 1252.373722][ T3308] netlink: 8 bytes leftover after parsing attributes in process `syz.4.9248'. [ 1252.473123][ T1637] usbhid 9-1:1.0: can't add hid device: -71 [ 1252.481268][ T1637] usbhid 9-1:1.0: probe with driver usbhid failed with error -71 [ 1252.525003][ T1637] usb 9-1: USB disconnect, device number 60 [ 1252.564032][ T3315] netlink: 76 bytes leftover after parsing attributes in process `syz.8.9250'. [ 1252.578725][ T3315] syzkaller0: entered promiscuous mode [ 1252.663919][ T3315] syzkaller0: entered allmulticast mode [ 1253.132979][ T1637] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 1253.284367][ T29] audit: type=1400 audit(1775987374.334:671): avc: denied { name_bind } for pid=3328 comm="syz.5.9255" src=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:reserved_port_t tclass=tcp_socket permissive=1 [ 1253.613041][ T1637] usb 9-1: Using ep0 maxpacket: 8 [ 1253.632656][ T1637] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1253.643841][ T1637] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1253.688617][ T1637] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1253.779669][ T1637] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1253.800327][ T1637] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1253.815876][ T1637] usb 9-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1253.899003][ T1637] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1254.014524][ T1637] usb 9-1: config 0 descriptor?? [ 1254.020398][ T3324] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1254.652323][ T29] audit: type=1400 audit(1775987375.714:672): avc: denied { unmount } for pid=24673 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:configfs_t tclass=filesystem permissive=1 [ 1254.773106][ T3264] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1254.933381][ T3264] usb 5-1: Using ep0 maxpacket: 8 [ 1254.934858][ T3351] netlink: 8 bytes leftover after parsing attributes in process `syz.5.9260'. [ 1254.939935][ T3264] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1255.172014][ T3264] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1255.241668][ T3264] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1255.279722][ T3264] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1255.333031][ T3264] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1255.363029][ T3264] usb 5-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1255.389947][ T3264] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1255.404147][ T30] usb 9-1: USB disconnect, device number 61 [ 1255.413760][ T800] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 1255.474679][ T3264] usb 5-1: config 0 descriptor?? [ 1255.485453][ T3346] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 1255.555732][ T3354] overlayfs: failed to resolve './cgroup': -2 [ 1255.570884][ T3360] netlink: 76 bytes leftover after parsing attributes in process `syz.5.9263'. [ 1255.615180][ T3360] syzkaller0: entered promiscuous mode [ 1255.621342][ T3360] syzkaller0: entered allmulticast mode [ 1256.873902][ T5848] usb 5-1: USB disconnect, device number 77 [ 1256.880524][ T800] Bluetooth: hci5: Opcode 0x0c03 failed: -71 [ 1256.991976][ T3372] syzkaller0: entered promiscuous mode [ 1257.010965][ T3372] syzkaller0: entered allmulticast mode [ 1257.052470][ T3372] 0: reclassify loop, rule prio 0, protocol 800 [ 1257.126426][ T3380] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1257.141432][ T3380] syzkaller0: entered promiscuous mode [ 1257.155747][ T3380] syzkaller0: entered allmulticast mode [ 1257.487619][ T5815] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1257.511869][ T5815] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1257.529920][ T5815] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1257.542284][ T5815] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1257.549973][ T5815] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1257.636755][ T3388] wlan1 speed is unknown, defaulting to 1000 [ 1257.803247][ T1637] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1257.870836][ T29] audit: type=1400 audit(1775987377.909:673): avc: denied { accept } for pid=3401 comm="syz.0.9275" path="socket:[128356]" dev="sockfs" ino=128356 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1258.022983][ T1637] usb 5-1: Using ep0 maxpacket: 32 [ 1258.030517][ T1637] usb 5-1: config index 0 descriptor too short (expected 29220, got 36) [ 1258.063048][ T1637] usb 5-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 1258.082580][ T1637] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 1258.094718][T24673] syz_tun (unregistering): left allmulticast mode [ 1258.352306][ T1637] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1258.370898][ T1637] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1258.382995][ T3264] usb 4-1: new full-speed USB device number 77 using dummy_hcd [ 1258.398062][ T1637] usb 5-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 1258.677363][ T1637] usb 5-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 1258.706101][ T3264] usb 4-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1258.726063][ T1637] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1258.726981][ T3264] usb 4-1: New USB device found, idVendor=3823, idProduct=0001, bcdDevice= 3.eb [ 1258.757666][ T3264] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1258.776896][ T1637] usb 5-1: config 0 descriptor?? [ 1258.799983][ T3264] usb 4-1: Product: syz [ 1258.811432][ T3264] usb 4-1: Manufacturer: syz [ 1258.844081][ T3264] usb 4-1: SerialNumber: syz [ 1258.870446][ T3264] usb 4-1: config 0 descriptor?? [ 1258.934282][ T3388] chnl_net:caif_netlink_parms(): no params data found [ 1259.002866][ T1637] usblp 5-1:0.0: usblp0: USB Bidirectional printer dev 78 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 1259.066927][ T3388] bridge0: port 1(bridge_slave_0) entered blocking state [ 1259.077295][ T3388] bridge0: port 1(bridge_slave_0) entered disabled state [ 1259.085082][ T3388] bridge_slave_0: entered allmulticast mode [ 1259.096136][ T3264] usb 4-1: USB disconnect, device number 77 [ 1259.122871][ T3388] bridge_slave_0: entered promiscuous mode [ 1259.130710][ T3388] bridge0: port 2(bridge_slave_1) entered blocking state [ 1259.138382][ T3388] bridge0: port 2(bridge_slave_1) entered disabled state [ 1259.151869][ T3388] bridge_slave_1: entered allmulticast mode [ 1259.162850][ T3388] bridge_slave_1: entered promiscuous mode [ 1259.220048][ T29] audit: type=1400 audit(1775987379.279:674): avc: denied { read write } for pid=3390 comm="syz.4.9274" name="lp0" dev="devtmpfs" ino=3908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 1259.248112][ T29] audit: type=1400 audit(1775987379.279:675): avc: denied { open } for pid=3390 comm="syz.4.9274" path="/dev/usb/lp0" dev="devtmpfs" ino=3908 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 1259.253920][ T3388] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1259.282029][ C0] usblp0: nonzero read bulk status received: -71 [ 1259.282367][ T30] usb 5-1: USB disconnect, device number 78 [ 1259.290403][ T3397] usblp0: error -71 reading from printer [ 1259.305868][ T3388] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1259.306935][ T30] usblp0: removed [ 1259.341781][ T3388] team0: Port device team_slave_0 added [ 1259.349133][ T3388] team0: Port device team_slave_1 added [ 1259.367918][ T3388] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1259.373013][ T5914] usb 1-1: new high-speed USB device number 86 using dummy_hcd [ 1259.382516][ T3388] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1259.408576][ T3388] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1259.420562][ T3388] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1259.427880][ T3388] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1259.453884][ T3388] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1259.484786][ T3388] hsr_slave_0: entered promiscuous mode [ 1259.490910][ T3388] hsr_slave_1: entered promiscuous mode [ 1259.533010][ T5914] usb 1-1: Using ep0 maxpacket: 8 [ 1259.541258][ T5914] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1259.552314][ T5914] usb 1-1: config 0 has no interfaces? [ 1259.560537][ T5914] usb 1-1: New USB device found, idVendor=12d1, idProduct=fae2, bcdDevice=70.8b [ 1259.570855][ T5914] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1259.579190][ T5914] usb 1-1: Product: syz [ 1259.586345][ T5815] Bluetooth: hci5: command tx timeout [ 1259.593613][ T5914] usb 1-1: Manufacturer: syz [ 1259.598245][ T5914] usb 1-1: SerialNumber: syz [ 1259.611666][ T5914] usb 1-1: config 0 descriptor?? [ 1259.938883][ T3426] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9280'. [ 1260.014871][ T3388] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1260.030197][ T3388] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1260.049149][ T3388] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1260.060597][ T3388] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1260.142520][ T3388] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1260.161072][ T3388] 8021q: adding VLAN 0 to HW filter on device team0 [ 1260.179424][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1260.186561][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1260.252583][ T192] bridge0: port 2(bridge_slave_1) entered blocking state [ 1260.259695][ T192] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1260.274706][ T3438] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1260.288912][ T3438] syzkaller0: entered promiscuous mode [ 1260.294984][ T3438] syzkaller0: entered allmulticast mode [ 1260.457091][ T30] usb 1-1: USB disconnect, device number 86 [ 1260.526467][ T192] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1260.627345][ T3448] FAULT_INJECTION: forcing a failure. [ 1260.627345][ T3448] name failslab, interval 1, probability 0, space 0, times 0 [ 1260.640487][ T3448] CPU: 0 UID: 0 PID: 3448 Comm: syz.0.9285 Tainted: G L syzkaller #0 PREEMPT(full) [ 1260.640517][ T3448] Tainted: [L]=SOFTLOCKUP [ 1260.640523][ T3448] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1260.640535][ T3448] Call Trace: [ 1260.640541][ T3448] [ 1260.640549][ T3448] dump_stack_lvl+0x100/0x190 [ 1260.640585][ T3448] should_fail_ex.cold+0x5/0xa [ 1260.640611][ T3448] should_failslab+0xc2/0x120 [ 1260.640631][ T3448] __kmalloc_cache_noprof+0x7a/0x6f0 [ 1260.640656][ T3448] ? snd_info_text_entry_write+0x3d3/0x510 [ 1260.640684][ T3448] snd_info_text_entry_write+0x3d3/0x510 [ 1260.640711][ T3448] ? __pfx_snd_info_text_entry_write+0x10/0x10 [ 1260.640734][ T3448] proc_reg_write+0x240/0x330 [ 1260.640759][ T3448] vfs_write+0x2aa/0x1070 [ 1260.640778][ T3448] ? __pfx_proc_reg_write+0x10/0x10 [ 1260.640801][ T3448] ? __pfx_vfs_write+0x10/0x10 [ 1260.640818][ T3448] ? __fget_files+0x215/0x3d0 [ 1260.640844][ T3448] ? __fget_files+0x21f/0x3d0 [ 1260.640872][ T3448] ksys_write+0x12a/0x250 [ 1260.640890][ T3448] ? __pfx_ksys_write+0x10/0x10 [ 1260.640916][ T3448] do_syscall_64+0x106/0xf80 [ 1260.640934][ T3448] ? clear_bhb_loop+0x40/0x90 [ 1260.640957][ T3448] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1260.640976][ T3448] RIP: 0033:0x7fed6e79c819 [ 1260.640993][ T3448] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1260.641010][ T3448] RSP: 002b:00007fed6c9b4028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1260.641028][ T3448] RAX: ffffffffffffffda RBX: 00007fed6ea16180 RCX: 00007fed6e79c819 [ 1260.641041][ T3448] RDX: 0000000000000033 RSI: 0000200000000380 RDI: 0000000000000009 [ 1260.641052][ T3448] RBP: 00007fed6c9b4090 R08: 0000000000000000 R09: 0000000000000000 [ 1260.641063][ T3448] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1260.641073][ T3448] R13: 00007fed6ea16218 R14: 00007fed6ea16180 R15: 00007fff16d53c88 [ 1260.641099][ T3448] [ 1260.861032][ T3388] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1260.982969][ T5848] usb 4-1: new high-speed USB device number 78 using dummy_hcd [ 1261.168524][ T5848] usb 4-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1261.177884][ T5848] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1261.189091][ T5848] usb 4-1: config 0 descriptor?? [ 1261.205469][ T800] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1261.216728][ T800] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1261.245710][ T800] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1261.253785][ T800] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1261.261404][ T800] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1261.326504][ T3454] wlan1 speed is unknown, defaulting to 1000 [ 1261.384425][ T3388] veth0_vlan: entered promiscuous mode [ 1261.404522][ T3388] veth1_vlan: entered promiscuous mode [ 1261.578080][ T192] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1261.608708][ T3388] veth0_macvtap: entered promiscuous mode [ 1261.624120][ T3454] chnl_net:caif_netlink_parms(): no params data found [ 1261.639077][ T3388] veth1_macvtap: entered promiscuous mode [ 1261.683363][ T5815] Bluetooth: hci5: command tx timeout [ 1261.717496][ T192] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1261.728021][ T5848] usb 4-1: Cannot set MAC address [ 1261.737393][ T5848] MOSCHIP usb-ethernet driver 4-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 1261.766001][ T5848] usb 4-1: USB disconnect, device number 78 [ 1261.773830][ T3388] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1261.951572][ T3388] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1261.974612][ T192] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1262.015639][ T12] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1262.069133][ T12] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1262.084946][ T3454] bridge0: port 1(bridge_slave_0) entered blocking state [ 1262.097088][ T3454] bridge0: port 1(bridge_slave_0) entered disabled state [ 1262.104774][ T3454] bridge_slave_0: entered allmulticast mode [ 1262.112351][ T3454] bridge_slave_0: entered promiscuous mode [ 1262.130391][ T12] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1262.152027][ T3454] bridge0: port 2(bridge_slave_1) entered blocking state [ 1262.159533][ T3454] bridge0: port 2(bridge_slave_1) entered disabled state [ 1262.167104][ T3454] bridge_slave_1: entered allmulticast mode [ 1262.174394][ T3454] bridge_slave_1: entered promiscuous mode [ 1262.191359][ T12] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1262.267090][ T3454] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1262.303536][T24045] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1262.314375][ T3454] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1262.331229][T24045] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1262.382269][ T3454] team0: Port device team_slave_0 added [ 1262.389211][ T3473] netlink: 24 bytes leftover after parsing attributes in process `syz.3.9291'. [ 1262.398704][ T192] bridge_slave_1: left allmulticast mode [ 1262.404449][ T192] bridge_slave_1: left promiscuous mode [ 1262.412081][ T192] bridge0: port 2(bridge_slave_1) entered disabled state [ 1262.421175][ T192] bridge_slave_0: left allmulticast mode [ 1262.427171][ T192] bridge_slave_0: left promiscuous mode [ 1262.433417][ T192] bridge0: port 1(bridge_slave_0) entered disabled state [ 1262.568832][ T192] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1262.579870][ T192] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1262.590879][ T192] bond0 (unregistering): Released all slaves [ 1262.604147][ T1314] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1262.612987][ T1314] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1262.617976][ T3454] team0: Port device team_slave_1 added [ 1262.693378][ T3454] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1262.700533][ T3454] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1262.758214][ T3454] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1262.847981][ T3454] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1262.873047][ T3454] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1262.930797][ T3454] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1263.249853][ T3454] hsr_slave_0: entered promiscuous mode [ 1263.256576][ T3454] hsr_slave_1: entered promiscuous mode [ 1263.273452][ T3454] debugfs: 'hsr0' already exists in 'hsr' [ 1263.284911][ T3454] Cannot create hsr debugfs directory [ 1263.332570][ T192] hsr_slave_0: left promiscuous mode [ 1263.343485][ T5815] Bluetooth: hci0: command tx timeout [ 1263.356902][ T192] hsr_slave_1: left promiscuous mode [ 1263.363793][ T192] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1263.371249][ T192] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1263.624136][ T29] audit: type=1400 audit(1775987383.449:676): avc: denied { connect } for pid=3503 comm="syz.8.9296" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 1263.647220][ T192] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1263.659109][ T3504] netlink: 228 bytes leftover after parsing attributes in process `syz.8.9296'. [ 1263.668278][ T3504] netlink: 72 bytes leftover after parsing attributes in process `syz.8.9296'. [ 1263.677350][ T3504] netlink: 24 bytes leftover after parsing attributes in process `syz.8.9296'. [ 1263.688041][ T192] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1263.736126][ T192] veth1_macvtap: left promiscuous mode [ 1263.763294][ T5815] Bluetooth: hci5: command tx timeout [ 1263.768886][ T192] veth0_macvtap: left promiscuous mode [ 1263.805915][ T192] veth1_vlan: left promiscuous mode [ 1263.822874][ T192] veth0_vlan: left promiscuous mode [ 1264.614514][ T29] audit: type=1400 audit(1775987384.559:677): avc: denied { write } for pid=3532 comm="syz.3.9302" name="file0" dev="tmpfs" ino=384 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1264.830678][ T29] audit: type=1400 audit(1775987384.559:678): avc: denied { open } for pid=3532 comm="syz.3.9302" path="/71/file0" dev="tmpfs" ino=384 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1264.939575][ T29] audit: type=1400 audit(1775987384.569:679): avc: denied { ioctl } for pid=3532 comm="syz.3.9302" path="/71/file0" dev="tmpfs" ino=384 ioctlcmd=0x1273 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1264.971804][ T29] audit: type=1400 audit(1775987384.639:680): avc: denied { ioctl } for pid=3532 comm="syz.3.9302" path="socket:[129315]" dev="sockfs" ino=129315 ioctlcmd=0x89e0 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 1265.005232][ T192] team0 (unregistering): Port device team_slave_1 removed [ 1265.027315][ T192] team0 (unregistering): Port device team_slave_0 removed [ 1265.143024][ T1637] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 1265.218127][ T3524] syzkaller0: entered promiscuous mode [ 1265.224523][ T3524] syzkaller0: entered allmulticast mode [ 1265.306337][ T1637] usb 1-1: Using ep0 maxpacket: 16 [ 1265.332258][ T1637] usb 1-1: config index 0 descriptor too short (expected 16456, got 72) [ 1265.341030][ T1637] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 1265.355107][ T1637] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 1265.364034][ T1637] usb 1-1: config 0 has an invalid interface number: 125 but max is 1 [ 1265.372849][ T1637] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1265.382078][ T1637] usb 1-1: config 0 has no interface number 0 [ 1265.388288][ T1637] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 1265.399769][ T1637] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 1265.409676][ T1637] usb 1-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1265.420304][ T1637] usb 1-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1265.432974][ T5815] Bluetooth: hci0: command tx timeout [ 1265.434383][ T1637] usb 1-1: config 0 interface 125 has no altsetting 0 [ 1265.445655][ T1637] usb 1-1: config 0 interface 125 has no altsetting 2 [ 1265.454897][ T1637] usb 1-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 1265.468209][ T1637] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1265.489570][ T1637] usb 1-1: Product: syz [ 1265.494121][T26090] usb 4-1: new high-speed USB device number 79 using dummy_hcd [ 1265.501976][ T1637] usb 1-1: Manufacturer: syz [ 1265.506790][ T1637] usb 1-1: SerialNumber: syz [ 1265.519170][ T1637] usb 1-1: config 0 descriptor?? [ 1265.527436][ T1637] usb 1-1: selecting invalid altsetting 2 [ 1265.683519][T26090] usb 4-1: Using ep0 maxpacket: 16 [ 1265.700031][T26090] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 250, changing to 7 [ 1265.714356][T26090] usb 4-1: New USB device found, idVendor=0e41, idProduct=4244, bcdDevice= 0.40 [ 1265.724716][T26090] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1265.732796][T26090] usb 4-1: Product: syz [ 1265.739179][T26090] usb 4-1: Manufacturer: syz [ 1265.744061][ C0] usb 1-1: async_complete: urb error -71 [ 1265.744169][ C0] usb 1-1: async_complete: urb error -71 [ 1265.744289][ C0] usb 1-1: async_complete: urb error -71 [ 1265.744360][ C0] usb 1-1: async_complete: urb error -71 [ 1265.768835][ T1637] get_1284_register: usb error -71 [ 1265.778914][ T1637] usb 1-1: USB disconnect, device number 87 [ 1265.788445][T26090] usb 4-1: SerialNumber: syz [ 1265.836821][ T5815] Bluetooth: hci5: command tx timeout [ 1267.503023][ T5815] Bluetooth: hci0: command tx timeout [ 1267.626327][T26090] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 1267.634641][T26090] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 1267.661735][T26090] usb 4-1: USB disconnect, device number 79 [ 1267.686147][ T3066] udevd[3066]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1267.773071][ T30] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 1267.923125][ T30] usb 9-1: Using ep0 maxpacket: 8 [ 1267.929623][ T30] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1267.940713][ T30] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1267.950511][ T30] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1267.960670][ T30] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1267.972549][ T30] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1267.982651][ T30] usb 9-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1267.991802][ T30] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1268.001300][ T30] usb 9-1: config 0 descriptor?? [ 1268.007152][ T3562] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1268.012641][ T3548] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1268.040871][ T3454] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1268.052692][ T3454] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1268.071073][ T3454] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1268.096826][ T3454] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1268.268751][ T3581] FAULT_INJECTION: forcing a failure. [ 1268.268751][ T3581] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1268.323204][ T3581] CPU: 0 UID: 0 PID: 3581 Comm: syz.5.9310 Tainted: G L syzkaller #0 PREEMPT(full) [ 1268.323233][ T3581] Tainted: [L]=SOFTLOCKUP [ 1268.323240][ T3581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1268.323250][ T3581] Call Trace: [ 1268.323256][ T3581] [ 1268.323263][ T3581] dump_stack_lvl+0x100/0x190 [ 1268.323300][ T3581] should_fail_ex.cold+0x5/0xa [ 1268.323324][ T3581] _copy_from_user+0x2e/0xd0 [ 1268.323346][ T3581] move_addr_to_kernel+0x65/0x170 [ 1268.323368][ T3581] __sys_connect+0xb5/0x170 [ 1268.323391][ T3581] ? __pfx___sys_connect+0x10/0x10 [ 1268.323413][ T3581] ? __fget_files+0x21f/0x3d0 [ 1268.323440][ T3581] ? __pfx_ksys_write+0x10/0x10 [ 1268.323462][ T3581] __x64_sys_connect+0x72/0xb0 [ 1268.323482][ T3581] ? lockdep_hardirqs_on+0x78/0x100 [ 1268.323504][ T3581] do_syscall_64+0x106/0xf80 [ 1268.323519][ T3581] ? clear_bhb_loop+0x40/0x90 [ 1268.323541][ T3581] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.323558][ T3581] RIP: 0033:0x7fdcbeb9c819 [ 1268.323573][ T3581] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1268.323587][ T3581] RSP: 002b:00007fdcbfa5b028 EFLAGS: 00000246 ORIG_RAX: 000000000000002a [ 1268.323603][ T3581] RAX: ffffffffffffffda RBX: 00007fdcbee15fa0 RCX: 00007fdcbeb9c819 [ 1268.323614][ T3581] RDX: 0000000000000010 RSI: 0000200000000100 RDI: 0000000000000004 [ 1268.323624][ T3581] RBP: 00007fdcbfa5b090 R08: 0000000000000000 R09: 0000000000000000 [ 1268.323633][ T3581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1268.323642][ T3581] R13: 00007fdcbee16038 R14: 00007fdcbee15fa0 R15: 00007ffe806345b8 [ 1268.323665][ T3581] [ 1269.584060][ T800] Bluetooth: hci0: command tx timeout [ 1270.063767][ T5815] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 1270.126354][ T1637] usb 9-1: USB disconnect, device number 62 [ 1270.218907][ T3454] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1270.284645][ T3454] 8021q: adding VLAN 0 to HW filter on device team0 [ 1270.330314][ T1324] bridge0: port 1(bridge_slave_0) entered blocking state [ 1270.337463][ T1324] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1270.391906][ T1324] bridge0: port 2(bridge_slave_1) entered blocking state [ 1270.399036][ T1324] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1270.439435][ T29] audit: type=1400 audit(1775987390.499:681): avc: denied { remount } for pid=3608 comm="syz.0.9317" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=filesystem permissive=1 [ 1271.079862][ T3454] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1271.707016][ T3454] veth0_vlan: entered promiscuous mode [ 1271.734649][ T3454] veth1_vlan: entered promiscuous mode [ 1271.814501][ T3454] veth0_macvtap: entered promiscuous mode [ 1271.833649][ T3454] veth1_macvtap: entered promiscuous mode [ 1271.882217][ T3454] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1271.897238][ T3454] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1271.911685][ T192] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1271.929671][ T192] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1272.170440][ T192] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1272.318031][ T192] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1273.363246][ T3670] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1273.372622][ T3670] syzkaller0: entered promiscuous mode [ 1273.379564][ T3670] syzkaller0: entered allmulticast mode [ 1273.632589][ T3618] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1273.802106][ T1324] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1273.844285][ T1324] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1273.935025][ T3685] SELinux: policydb version 673370981 does not match my version range 15-35 [ 1273.968520][ T1324] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1273.985176][ T1324] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1274.015419][ T5914] usb 4-1: new high-speed USB device number 80 using dummy_hcd [ 1274.035330][ T3685] SELinux: failed to load policy [ 1274.166151][ T3693] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1274.194306][ T3693] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1274.325025][ T5914] usb 4-1: Using ep0 maxpacket: 8 [ 1274.370946][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1274.435037][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1274.481943][ T5914] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1274.531658][ T5914] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1274.598069][ T5914] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1274.640540][ T5914] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1274.690709][ T5914] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1274.747230][ T5914] usb 4-1: config 0 descriptor?? [ 1274.787775][ T3680] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 1275.623287][ T5815] Bluetooth: hci1: Opcode 0x0c03 failed: -71 [ 1275.633458][ T1637] usb 4-1: USB disconnect, device number 80 [ 1276.074567][ T3714] bridge2: entered promiscuous mode [ 1276.079876][ T3714] bridge2: entered allmulticast mode [ 1276.553010][ T1637] usb 9-1: new high-speed USB device number 63 using dummy_hcd [ 1276.866123][ T1637] usb 9-1: config 1 has an invalid interface number: 142 but max is 0 [ 1276.973921][ T1637] usb 9-1: config 1 has no interface number 0 [ 1277.952986][ T1637] usb 9-1: config 1 interface 142 has no altsetting 0 [ 1278.135418][ T1637] usb 9-1: New USB device found, idVendor=04cb, idProduct=013d, bcdDevice=dc.cc [ 1278.144741][ T1637] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1278.152821][ T1637] usb 9-1: Product: syz [ 1278.160402][ T1637] usb 9-1: Manufacturer: syz [ 1278.189903][ T1637] usb 9-1: SerialNumber: syz [ 1278.296324][ T3742] sch_tbf: burst 555 is lower than device syzkaller0 mtu (1514) ! [ 1278.331705][ T3742] syzkaller0: entered promiscuous mode [ 1278.358372][ T3742] syzkaller0: entered allmulticast mode [ 1278.658071][ T3750] wlan1 speed is unknown, defaulting to 1000 [ 1278.813395][ T3735] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1278.982965][ T3735] usb 10-1: Using ep0 maxpacket: 32 [ 1279.000977][ T3735] usb 10-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 1279.073251][T26090] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 1279.312053][ T3735] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1279.354854][ T3735] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 1279.452949][T26090] usb 6-1: Using ep0 maxpacket: 8 [ 1279.569589][ T1637] gspca_main: finepix-2.14.0 probing 04cb:013d [ 1279.582492][T26090] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1279.621429][T26090] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1279.632316][ T1637] usb 9-1: USB disconnect, device number 63 [ 1279.659216][T26090] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1279.680325][T26090] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1279.693231][T26090] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1279.706064][T26090] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1279.751132][T26090] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1279.788078][T26090] usb 6-1: config 0 descriptor?? [ 1279.812729][ T3759] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1280.073865][ T29] audit: type=1400 audit(1775987400.129:682): avc: denied { map_create } for pid=3784 comm="syz.8.9351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1280.621063][ T29] audit: type=1400 audit(1775987400.129:683): avc: denied { map_read map_write } for pid=3784 comm="syz.8.9351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1280.644110][ T29] audit: type=1400 audit(1775987400.159:684): avc: denied { prog_load } for pid=3784 comm="syz.8.9351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1281.230121][ T3795] netlink: 12 bytes leftover after parsing attributes in process `syz.0.9352'. [ 1281.562133][ T1990] usb 6-1: USB disconnect, device number 52 [ 1281.575013][ T800] Bluetooth: hci1: Opcode 0x0c03 failed: -71 [ 1281.789903][ T3799] netlink: 12 bytes leftover after parsing attributes in process `syz.8.9353'. [ 1282.117186][ T3802] sch_tbf: burst 2 is lower than device veth0_to_hsr mtu (1514) ! [ 1282.136585][T26090] usb 9-1: new high-speed USB device number 64 using dummy_hcd [ 1282.459600][T26090] usb 9-1: Using ep0 maxpacket: 32 [ 1282.467992][T26090] usb 9-1: config 238 has an invalid interface number: 1 but max is 0 [ 1282.478265][T26090] usb 9-1: config 238 has an invalid descriptor of length 0, skipping remainder of the config [ 1282.489839][T26090] usb 9-1: config 238 has no interface number 0 [ 1282.505100][T26090] usb 9-1: too many endpoints for config 238 interface 1 altsetting 10: 86, using maximum allowed: 30 [ 1282.517400][T26090] usb 9-1: config 238 interface 1 altsetting 10 has 0 endpoint descriptors, different from the interface descriptor's value: 86 [ 1282.591982][T26090] usb 9-1: config 238 interface 1 has no altsetting 0 [ 1282.736350][ T3808] netlink: 156 bytes leftover after parsing attributes in process `syz.3.9355'. [ 1283.044618][T26090] usb 9-1: New USB device found, idVendor=0572, idProduct=58a5, bcdDevice=27.0a [ 1283.053740][T26090] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1283.062592][T26090] usb 9-1: Product: syz [ 1283.071676][T26090] usb 9-1: Manufacturer: syz [ 1283.076460][T26090] usb 9-1: SerialNumber: syz [ 1283.104515][T13494] usb 10-1: USB disconnect, device number 2 [ 1283.492216][ T29] audit: type=1326 audit(1775987403.409:685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.544657][ T29] audit: type=1326 audit(1775987403.409:686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.568707][ T29] audit: type=1326 audit(1775987403.409:687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=426 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.682027][ T29] audit: type=1326 audit(1775987403.439:688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.727261][ T29] audit: type=1326 audit(1775987403.439:689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.794304][ T29] audit: type=1326 audit(1775987403.449:690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.857076][ T29] audit: type=1326 audit(1775987403.549:691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=3817 comm="syz.9.9359" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f036459c819 code=0x7ffc0000 [ 1283.948751][ T3799] netlink: 256 bytes leftover after parsing attributes in process `syz.8.9353'. [ 1285.469815][T26090] cx231xx 9-1:238.1: New device syz syz @ 480 Mbps (0572:58a5) with 1 interfaces [ 1285.505211][T26090] cx231xx 9-1:238.1: Not found matching IAD interface [ 1285.532153][T26090] usb 9-1: USB disconnect, device number 64 [ 1286.440700][ T1990] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1286.440999][ T5815] Bluetooth: hci4: command 0x0406 tx timeout [ 1286.614693][ T1990] usb 10-1: config index 0 descriptor too short (expected 23569, got 27) [ 1286.624007][ T1990] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1286.635856][ T1990] usb 10-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1286.645413][ T1990] usb 10-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1286.653887][ T1990] usb 10-1: Manufacturer: syz [ 1286.660792][ T1990] usb 10-1: config 0 descriptor?? [ 1286.668046][ T1990] igorplugusb 10-1:0.0: incorrect number of endpoints [ 1286.713004][ T1637] usb 1-1: new low-speed USB device number 88 using dummy_hcd [ 1286.752987][T26090] usb 9-1: new high-speed USB device number 65 using dummy_hcd [ 1286.863252][ T1637] usb 1-1: device descriptor read/64, error -71 [ 1286.893353][ T3735] usb 10-1: USB disconnect, device number 3 [ 1286.923223][T26090] usb 9-1: Using ep0 maxpacket: 8 [ 1286.931949][T26090] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1286.954389][T26090] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1286.973408][T26090] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1286.992685][T26090] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1287.003987][T26090] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1287.014082][T26090] usb 9-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1287.023278][T26090] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1287.033854][T26090] usb 9-1: config 0 descriptor?? [ 1287.046572][ T3850] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1287.113073][ T1637] usb 1-1: new low-speed USB device number 89 using dummy_hcd [ 1287.253649][ T1637] usb 1-1: device descriptor read/64, error -71 [ 1287.451878][ T1637] usb usb1-port1: attempt power cycle [ 1287.635347][ T3862] syz.5.9368 uses old SIOCAX25GETINFO [ 1287.739984][ T3863] netlink: 'syz.5.9368': attribute type 10 has an invalid length. [ 1288.181194][T13494] usb 9-1: USB disconnect, device number 65 [ 1288.188859][ T800] Bluetooth: hci1: Opcode 0x0c03 failed: -71 [ 1288.203072][ T1637] usb 1-1: new low-speed USB device number 90 using dummy_hcd [ 1288.233489][ T1637] usb 1-1: device descriptor read/8, error -71 [ 1288.332099][ T3868] syzkaller0: entered promiscuous mode [ 1288.338265][ T3868] syzkaller0: entered allmulticast mode [ 1288.487563][ T1637] usb 1-1: new low-speed USB device number 91 using dummy_hcd [ 1288.523458][ T1637] usb 1-1: device descriptor read/8, error -71 [ 1288.693585][ T1637] usb usb1-port1: unable to enumerate USB device [ 1288.752992][T26090] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 1288.987321][T26090] usb 6-1: config 0 has no interfaces? [ 1288.992824][T26090] usb 6-1: New USB device found, idVendor=06cd, idProduct=010f, bcdDevice=d5.1b [ 1289.022453][T26090] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1289.073965][T26090] usb 6-1: config 0 descriptor?? [ 1289.250842][ T29] kauditd_printk_skb: 1 callbacks suppressed [ 1289.250875][ T29] audit: type=1400 audit(1775987409.309:693): avc: denied { prog_run } for pid=3892 comm="syz.8.9376" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 1289.461029][ T3903] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1289.470733][ T3903] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1289.724162][T13494] usb 4-1: new high-speed USB device number 81 using dummy_hcd [ 1292.952466][ T3934] syzkaller0: entered promiscuous mode [ 1292.966067][ T3934] syzkaller0: entered allmulticast mode [ 1292.977816][ T5914] usb 6-1: USB disconnect, device number 53 [ 1293.322178][ T29] audit: type=1400 audit(1775987413.379:694): avc: denied { append } for pid=3951 comm="syz.8.9388" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1293.358043][ T3735] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1293.432360][ T3952] netlink: 'syz.8.9388': attribute type 10 has an invalid length. [ 1293.787819][T26090] usb 9-1: new high-speed USB device number 66 using dummy_hcd [ 1293.983962][T26090] usb 9-1: device descriptor read/64, error -71 [ 1294.255741][T26090] usb 9-1: new high-speed USB device number 67 using dummy_hcd [ 1294.403007][ T3735] usb 10-1: Using ep0 maxpacket: 8 [ 1294.414528][ T3735] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1294.450086][ T3735] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1294.475091][T26090] usb 9-1: device descriptor read/64, error -71 [ 1294.475091][ T3735] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1294.475119][ T3735] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1294.513584][ T3735] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1294.583269][T26090] usb usb9-port1: attempt power cycle [ 1294.613728][ T3735] usb 10-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1294.624417][ T3735] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1294.627970][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1294.634720][ T3735] usb 10-1: config 0 descriptor?? [ 1294.644767][ T3942] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1294.646502][ T1295] lec:lec_start_xmit: lec0:No lecd attached [ 1295.467211][T26090] usb 9-1: new high-speed USB device number 68 using dummy_hcd [ 1295.736969][T26090] usb 9-1: device descriptor read/8, error -71 [ 1295.757196][ T1637] usb 10-1: USB disconnect, device number 4 [ 1295.763327][ T800] Bluetooth: hci1: Opcode 0x0c03 failed: -71 [ 1295.909798][ T3994] syzkaller0: entered promiscuous mode [ 1295.947945][ T3994] syzkaller0: entered allmulticast mode [ 1296.368032][T26090] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 1296.478905][T26090] usb 9-1: device descriptor read/8, error -71 [ 1296.596762][T26090] usb usb9-port1: unable to enumerate USB device [ 1297.234283][T26090] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1297.396518][T26090] usb 10-1: Using ep0 maxpacket: 32 [ 1297.410579][T26090] usb 10-1: config index 0 descriptor too short (expected 35577, got 27) [ 1297.430261][T26090] usb 10-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1297.446407][T26090] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1297.456257][T26090] usb 10-1: config 1 has no interface number 0 [ 1297.462549][T26090] usb 10-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1297.473645][T26090] usb 10-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1297.487133][T26090] usb 10-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1297.498873][T26090] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1297.517695][T26090] snd_usb_pod 10-1:1.1: Line 6 Pocket POD found [ 1297.673029][ T3005] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 1297.726687][T26090] snd_usb_pod 10-1:1.1: Line 6 Pocket POD now attached [ 1297.825809][ T3005] usb 6-1: Using ep0 maxpacket: 8 [ 1297.834931][ T3005] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1297.845638][ T3005] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1297.857421][ T3005] usb 6-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 1297.866927][ T3005] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1297.875275][ T3005] usb 6-1: Product: syz [ 1297.879486][ T3005] usb 6-1: Manufacturer: syz [ 1297.884241][ T3005] usb 6-1: SerialNumber: syz [ 1297.899634][ T3005] usb 6-1: config 0 descriptor?? [ 1297.908967][ T3005] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 found [ 1298.110826][ T3005] snd_usb_toneport 6-1:0.0: cannot get proper max packet size [ 1298.118776][ T3005] snd_usb_toneport 6-1:0.0: Line 6 TonePort UX2 now disconnected [ 1298.128717][ T3005] snd_usb_toneport 6-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1298.281067][ T3005] usb 10-1: USB disconnect, device number 5 [ 1298.288408][ T3005] snd_usb_pod 10-1:1.1: Line 6 Pocket POD now disconnected [ 1298.322498][T26095] usb 6-1: USB disconnect, device number 54 [ 1298.757643][ T29] audit: type=1400 audit(1775987418.819:695): avc: denied { watch_mount } for pid=4029 comm="syz.3.9402" path="/90" dev="tmpfs" ino=479 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1299.892979][ T3005] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1300.047997][ T4075] syzkaller0: entered promiscuous mode [ 1300.054529][ T4075] syzkaller0: entered allmulticast mode [ 1300.112999][ T3005] usb 10-1: Using ep0 maxpacket: 8 [ 1300.128126][ T3005] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 1300.150150][ T3005] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1300.167141][ T3005] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1300.183220][ T3005] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 1300.203205][ T3005] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 1300.225590][ T3005] usb 10-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1300.243577][ T3005] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1300.279602][ T3005] usb 10-1: config 0 descriptor?? [ 1300.297566][ T4063] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1300.382945][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5730 ms [ 1300.391004][ C0] lec:lec_tx_timeout: lec0 [ 1300.395702][ C0] lec:lec_start_xmit: lec0:No lecd attached [ 1300.765006][ T4079] netlink: 'syz.8.9413': attribute type 9 has an invalid length. [ 1300.772831][ T4079] netlink: 'syz.8.9413': attribute type 11 has an invalid length. [ 1300.780745][ T4079] netlink: 'syz.8.9413': attribute type 12 has an invalid length. [ 1300.788754][ T4079] netlink: 210020 bytes leftover after parsing attributes in process `syz.8.9413'. [ 1300.798582][ T4079] netlink: 4 bytes leftover after parsing attributes in process `syz.8.9413'. [ 1301.570057][ T29] audit: type=1400 audit(1775987421.629:696): avc: denied { read } for pid=4084 comm="syz.3.9415" lport=37580 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1301.641378][T26095] usb 10-1: USB disconnect, device number 6 [ 1301.668704][ T800] Bluetooth: hci1: Opcode 0x0c03 failed: -71 [ 1304.220758][ T4104] syzkaller0: entered promiscuous mode [ 1304.288870][ T4104] syzkaller0: entered allmulticast mode [ 1304.314507][ T4113] netlink: 8 bytes leftover after parsing attributes in process `syz.9.9423'. [ 1304.813023][T26090] usb 1-1: new high-speed USB device number 92 using dummy_hcd [ 1304.992643][T26090] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1305.014843][T26090] usb 1-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 18 [ 1305.050964][T26090] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1305.074200][T26090] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1305.093008][T26090] usb 1-1: SerialNumber: syz [ 1305.117826][T26090] usb 1-1: bad CDC descriptors [ 1305.403946][ C0] lec0: NETDEV WATCHDOG: CPU: 0: transmit queue 0 timed out 5010 ms [ 1305.411985][ C0] lec:lec_tx_timeout: lec0 [ 1306.488385][ T4116] team0: entered allmulticast mode [ 1306.493576][ T4116] team_slave_0: entered allmulticast mode [ 1306.499284][ T4116] team_slave_1: entered allmulticast mode [ 1306.505589][ T4116] netlink: 32 bytes leftover after parsing attributes in process `syz.5.9421'. [ 1306.514608][ T4116] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1306.549100][ T4115] wlan1 speed is unknown, defaulting to 1000 [ 1306.734341][ T4131] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1306.861720][ T3735] usb 4-1: new high-speed USB device number 82 using dummy_hcd [ 1307.397250][ T1990] usb 1-1: USB disconnect, device number 92 [ 1307.433035][ T3735] usb 4-1: Using ep0 maxpacket: 8 [ 1307.444344][ T3735] usb 4-1: config 127 has an invalid interface number: 171 but max is 1 [ 1307.465151][ T3735] usb 4-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 1307.485757][ T3735] usb 4-1: config 127 has 1 interface, different from the descriptor's value: 2 [ 1307.495194][ T3735] usb 4-1: config 127 has no interface number 0 [ 1307.507248][ T3735] usb 4-1: config 127 interface 171 has no altsetting 0 [ 1307.525624][ T29] audit: type=1800 audit(1775987427.589:697): pid=4139 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.9.9427" name="bus" dev="tmpfs" ino=140 res=0 errno=0 [ 1307.548910][ T3735] usb 4-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 1307.571123][ T3735] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1307.582924][ T3735] usb 4-1: Product: syz [ 1307.587156][ T3735] usb 4-1: Manufacturer: syz [ 1307.621649][ T4141] fuse: Unknown parameter '' [ 1307.691601][ T3735] usb 4-1: SerialNumber: syz [ 1307.721827][ T4143] trusted_key: encrypted_key: keylen for the ecryptfs format must be equal to 64 bytes [ 1308.121666][ T3735] usb 4-1: USB disconnect, device number 82 [ 1309.018035][ T4166] syzkaller0: entered promiscuous mode [ 1309.023773][ T4166] syzkaller0: entered allmulticast mode [ 1309.260103][ T4171] ufs: You didn't specify the type of your ufs filesystem [ 1309.260103][ T4171] [ 1309.260103][ T4171] mount -t ufs -o ufstype=sun|sunx86|44bsd|ufs2|5xbsd|old|hp|nextstep|nextstep-cd|openstep ... [ 1309.260103][ T4171] [ 1309.260103][ T4171] >>>WARNING<<< Wrong ufstype may corrupt your filesystem, default is ufstype=old [ 1309.292614][ T4171] ufs: ufstype=old is supported read-only [ 1309.302512][ T4171] ufs: ufs_fill_super(): bad magic number [ 1310.857515][ T29] audit: type=1400 audit(1775987430.919:698): avc: denied { mount } for pid=4176 comm="syz.3.9439" name="/" dev="rpc_pipefs" ino=131617 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 1310.923195][ T4184] netlink: 28 bytes leftover after parsing attributes in process `syz.5.9441'. [ 1310.957420][ T4186] netlink: 28 bytes leftover after parsing attributes in process `syz.8.9440'. [ 1312.087770][ T4199] Bluetooth: MGMT ver 1.23 [ 1312.842316][ T4188] wlan1 speed is unknown, defaulting to 1000 [ 1312.874390][ T4187] wlan1 speed is unknown, defaulting to 1000 [ 1314.385256][ T29] audit: type=1400 audit(1775987434.129:699): avc: denied { setopt } for pid=4213 comm="syz.3.9448" lport=49308 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1314.803060][ T29] audit: type=1326 audit(1775987434.859:700): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f147019c819 code=0x7ffc0000 [ 1314.856649][ T29] audit: type=1326 audit(1775987434.859:701): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f147019c819 code=0x7ffc0000 [ 1314.987826][ T29] audit: type=1326 audit(1775987434.859:702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f147019c819 code=0x7ffc0000 [ 1315.023994][ T29] audit: type=1326 audit(1775987434.859:703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f147019c819 code=0x7ffc0000 [ 1315.529878][ T29] audit: type=1326 audit(1775987434.859:704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f147019c819 code=0x7ffc0000 [ 1315.564878][ T29] audit: type=1326 audit(1775987434.859:705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f147015d04e code=0x7ffc0000 [ 1315.589150][ T29] audit: type=1326 audit(1775987434.859:706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f147019db17 code=0x7ffc0000 [ 1315.612973][ T29] audit: type=1326 audit(1775987434.859:707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f147019c819 code=0x7ffc0000 [ 1315.661183][ T29] audit: type=1326 audit(1775987435.049:708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=4232 comm="syz.8.9452" exe="/root/syz-executor" sig=0 arch=c000003e syscall=308 compat=0 ip=0x7f147019db17 code=0x7ffc0000 [ 1315.836633][ T4246] xt_l2tp: invalid flags combination: c [ 1317.087975][T26095] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 1317.483014][T26095] usb 6-1: Using ep0 maxpacket: 16 [ 1317.489526][T26095] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1317.501220][T26095] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 10 [ 1317.529702][T26095] usb 6-1: New USB device found, idVendor=0c70, idProduct=f003, bcdDevice= 0.00 [ 1317.540275][T26095] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1317.550956][T26095] usb 6-1: config 0 descriptor?? [ 1317.654277][ T4263] fuse: Unknown parameter 'idi0x0000000000000005ÿºfä‰)‘ÄëR‘ K' [ 1317.754273][ T4263] [ 1317.756646][ T4263] ============================================ [ 1317.762798][ T4263] WARNING: possible recursive locking detected [ 1317.768955][ T4263] syzkaller #0 Tainted: G L [ 1317.774928][ T4263] -------------------------------------------- [ 1317.781163][ T4263] syz.0.9459/4263 is trying to acquire lock: [ 1317.787137][ T4263] ffff888032ce18f8 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_do_insn+0x2e/0x360 [ 1317.796019][ T4263] [ 1317.796019][ T4263] but task is already holding lock: [ 1317.803365][ T4263] ffff8880326b70f8 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x180/0x3310 [ 1317.813032][ T4263] [ 1317.813032][ T4263] other info that might help us debug this: [ 1317.821077][ T4263] Possible unsafe locking scenario: [ 1317.821077][ T4263] [ 1317.828522][ T4263] CPU0 [ 1317.831805][ T4263] ---- [ 1317.835062][ T4263] lock(&dev->mutex#4); [ 1317.839296][ T4263] lock(&dev->mutex#4); [ 1317.843536][ T4263] [ 1317.843536][ T4263] *** DEADLOCK *** [ 1317.843536][ T4263] [ 1317.851665][ T4263] May be due to missing lock nesting notation [ 1317.851665][ T4263] [ 1317.859961][ T4263] 1 lock held by syz.0.9459/4263: [ 1317.864964][ T4263] #0: ffff8880326b70f8 (&dev->mutex#4){+.+.}-{4:4}, at: comedi_unlocked_ioctl+0x180/0x3310 [ 1317.875156][ T4263] [ 1317.875156][ T4263] stack backtrace: [ 1317.881042][ T4263] CPU: 0 UID: 0 PID: 4263 Comm: syz.0.9459 Tainted: G L syzkaller #0 PREEMPT(full) [ 1317.881063][ T4263] Tainted: [L]=SOFTLOCKUP [ 1317.881068][ T4263] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 1317.881077][ T4263] Call Trace: [ 1317.881084][ T4263] [ 1317.881091][ T4263] dump_stack_lvl+0x100/0x190 [ 1317.881118][ T4263] print_deadlock_bug.cold+0xbd/0xca [ 1317.881148][ T4263] __lock_acquire+0x12bb/0x2630 [ 1317.881167][ T4263] lock_acquire+0x1cf/0x380 [ 1317.881181][ T4263] ? comedi_do_insn+0x2e/0x360 [ 1317.881195][ T4263] ? __pfx___might_resched+0x10/0x10 [ 1317.881212][ T4263] ? irqentry_exit+0x180/0x670 [ 1317.881228][ T4263] __mutex_lock+0x1a2/0x1b90 [ 1317.881244][ T4263] ? comedi_do_insn+0x2e/0x360 [ 1317.881258][ T4263] ? comedi_do_insn+0x2e/0x360 [ 1317.881276][ T4263] ? __pfx___mutex_lock+0x10/0x10 [ 1317.881290][ T4263] ? lock_acquire+0x5e/0x380 [ 1317.881303][ T4263] ? __pfx___might_resched+0x10/0x10 [ 1317.881320][ T4263] ? __up_read+0x2c5/0x700 [ 1317.881337][ T4263] ? comedi_do_insn+0x2e/0x360 [ 1317.881349][ T4263] comedi_do_insn+0x2e/0x360 [ 1317.881362][ T4263] comedi_dio_bitfield2+0x3c0/0x420 [ 1317.881376][ T4263] ? __pfx_comedi_dio_bitfield2+0x10/0x10 [ 1317.881389][ T4263] ? lockdep_hardirqs_on+0x78/0x100 [ 1317.881403][ T4263] ? kvm_sched_clock_read+0x11/0x20 [ 1317.881426][ T4263] ? sched_clock+0x38/0x60 [ 1317.881448][ T4263] ? __pfx_sched_clock_cpu+0x10/0x10 [ 1317.881461][ T4263] ? update_se+0x94/0x760 [ 1317.881474][ T4263] bonding_dio_insn_bits+0x2b9/0x570 [ 1317.881492][ T4263] ? __pfx_bonding_dio_insn_bits+0x10/0x10 [ 1317.881508][ T4263] ? __schedule+0x1000/0x6120 [ 1317.881530][ T4263] insn_rw_emulate_bits+0x2a2/0x5e0 [ 1317.881552][ T4263] ? __pfx_insn_rw_emulate_bits+0x10/0x10 [ 1317.881572][ T4263] ? __pfx___schedule+0x10/0x10 [ 1317.881594][ T4263] ? comedi_check_chanlist+0x27e/0x300 [ 1317.881613][ T4263] parse_insn+0x83f/0x19f0 [ 1317.881629][ T4263] ? __pfx_parse_insn+0x10/0x10 [ 1317.881646][ T4263] do_insn_ioctl+0x152/0x4e0 [ 1317.881663][ T4263] comedi_unlocked_ioctl+0xf68/0x3310 [ 1317.881683][ T4263] ? tomoyo_path_number_perm+0x188/0x580 [ 1317.881704][ T4263] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1317.881724][ T4263] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1317.881745][ T4263] ? do_vfs_ioctl+0x226/0x13e0 [ 1317.881767][ T4263] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1317.881787][ T4263] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1317.881814][ T4263] ? __fget_files+0x215/0x3d0 [ 1317.881829][ T4263] ? hook_file_ioctl_common+0x146/0x410 [ 1317.881847][ T4263] ? selinux_file_ioctl+0x139/0x290 [ 1317.881868][ T4263] ? selinux_file_ioctl+0xb4/0x290 [ 1317.881888][ T4263] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1317.881906][ T4263] __x64_sys_ioctl+0x18e/0x210 [ 1317.881928][ T4263] do_syscall_64+0x106/0xf80 [ 1317.881942][ T4263] ? clear_bhb_loop+0x40/0x90 [ 1317.881960][ T4263] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1317.881974][ T4263] RIP: 0033:0x7fed6e79c819 [ 1317.881988][ T4263] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1317.882004][ T4263] RSP: 002b:00007fed6c9d5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1317.882018][ T4263] RAX: ffffffffffffffda RBX: 00007fed6ea16090 RCX: 00007fed6e79c819 [ 1317.882028][ T4263] RDX: 0000200000000000 RSI: 000000008028640c RDI: 000000000000000a [ 1317.882039][ T4263] RBP: 00007fed6e832c91 R08: 0000000000000000 R09: 0000000000000000 [ 1317.882050][ T4263] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1317.882061][ T4263] R13: 00007fed6ea16128 R14: 00007fed6ea16090 R15: 00007fff16d53c88 [ 1317.882077][ T4263] [ 1318.447334][ T4266] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1318.473357][ T4266] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1318.493439][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.509304][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.528068][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.540610][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.558690][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.571716][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.580080][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.588387][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.648081][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.663242][T26095] aquacomputer_d5next 0003:0C70:F003.000A: unknown main item tag 0x0 [ 1318.676980][T26095] aquacomputer_d5next 0003:0C70:F003.000A: hidraw0: USB HID v0.0a Device [HID 0c70:f003] on usb-dummy_hcd.5-1/input0 [ 1318.761420][T26095] usb 6-1: USB disconnect, device number 55