last executing test programs: 1m51.866705083s ago: executing program 2 (id=783): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = semget$private(0x0, 0x6, 0x0) semop(r3, &(0x7f0000000000)=[{0x2, 0x0, 0x2000}, {0x3, 0x1, 0x1000}], 0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = syz_init_net_socket$x25(0x9, 0x5, 0x0) sendmmsg$inet(r5, &(0x7f0000005d00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)=ANY=[], 0x18}}], 0x1, 0x40008000) bind$inet(r4, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) fcntl$setstatus(r4, 0x4, 0x40800) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) getsockopt$sock_cred(0xffffffffffffffff, 0x1, 0x11, &(0x7f0000000440)={0x0, 0x0, 0x0}, &(0x7f0000000480)=0xc) setsockopt$sock_cred(r4, 0x1, 0x11, &(0x7f00000000c0)={r0, 0xee01, r6}, 0xc) setsockopt$SO_BINDTODEVICE(r4, 0x1, 0x19, &(0x7f0000000040)='sit0\x00', 0x10) setsockopt$IP_VS_SO_SET_FLUSH(0xffffffffffffffff, 0x0, 0x485, 0x0, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) write$P9_RUNLINKAT(r7, 0x0, 0x0) semtimedop(r3, &(0x7f0000000140)=[{}], 0x1, &(0x7f00000001c0)) ftruncate(r7, 0x2000009) sendfile(r4, r7, 0x0, 0x7ffff004) 1m49.937238318s ago: executing program 2 (id=787): bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = syz_open_dev$dmmidi(0x0, 0xca64, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) fcntl$notify(r1, 0x402, 0x9) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf01b}, {0x0}], 0x2) syz_io_uring_submit(0x0, 0x0, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) read$FUSE(r3, &(0x7f00000030c0)={0x2020}, 0x2020) write$UHID_INPUT(r5, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) write(r3, &(0x7f00000001c0)="f300533b6d1e0e495b21fa81aed055ad5056d0c5d0e173b92187aa4455cd3c0aec5d591a67cd93283a00e9d4f1c0a01021a3ce0c3067e07c9505e69e0284094da3f63cde93de29bb2d91a160411fe0129d3ef8a311b403a9e1b79c0a786707ae6b0981c83b6a56bb380e79489291eed29590d094ac82d2cec8633b", 0x7b) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f00000005c0)=""/210) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) lseek(0xffffffffffffffff, 0x4, 0x2) sendmsg$inet6(r0, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) socket$nl_route(0x10, 0x3, 0x0) 1m48.125097329s ago: executing program 2 (id=791): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x2f, 0xc, 0xed, 0x6be8, 0x48, @rand_addr=' \x01\x00', @private0, 0x7, 0x10, 0x8, 0x2}}) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x1138}}, 0xc000) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782", 0xc}], 0x1}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={&(0x7f0000000740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x7, [@enum={0x5}, @union={0x6, 0x0, 0x0, 0x5, 0x1, 0x1}, @restrict={0x10, 0x0, 0x0, 0xb, 0x5}]}, {0x0, [0x5f, 0x0, 0x2e, 0x2e, 0x5f]}}, &(0x7f0000000640)=""/160, 0x43, 0xa0, 0x1, 0xfffffff8}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='\x00\x00', @ANYBLOB="00022cbd7000fddbdf25080000000c"], 0x20}, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1m47.621491199s ago: executing program 2 (id=795): mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) mount$bind(&(0x7f0000000180)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) mount$fuseblk(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x24000, 0x0) mount$bind(&(0x7f00000003c0)='.\x00', &(0x7f0000000340)='./file0\x00', 0x0, 0x2a05004, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet6_int(r0, 0x29, 0x10, &(0x7f0000000000)=0x5, 0x4) r1 = socket(0x22, 0x6, 0x0) setsockopt$WPAN_SECURITY(r1, 0x0, 0x22, &(0x7f0000000040), 0x4) r2 = socket$kcm(0x2, 0x5, 0x84) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x61, 0x10, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, &(0x7f00000000c0)}, 0x94) sendmsg$inet(r2, &(0x7f00000029c0)={&(0x7f0000000100)={0x2, 0x0, @private=0xa010101}, 0x10, &(0x7f0000002780)=[{&(0x7f00000006c0)='{', 0x1}], 0x1}, 0x4000040) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x18, 0x3, &(0x7f0000000700)=ANY=[@ANYRES64=r3, @ANYBLOB="61d63f5f74f094efee9a918e4ccadfffb643d6b2c3f6a51301cc7459e32793c1c44c4f6728a5bfb214c9ff9a4813153f732f0e9ce5e94f270a5841bce3ce3c11861b979154e1fdfc96d1ae5ec058d20abad95ea79debf841ec09f38921038d2f3bc75331d9f4a5c1636089a9373394df5a33c2248f8ba91f9db8e19ffc5679f1843e9615640515323f7c718b4bb5d42beb23b4585f25d22f9276698dbc7458716e187c98791a9bcd910ae798d2d686e0f5124490fbb7253936054e80a561b414fd569c188bcb32bbdf6d902a714a893566ec331efa24e17b8154bdd5ef"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5a}, 0x94) r5 = socket$inet(0x2, 0x1, 0x0) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="140100002e00010000000000fbdbdd250401f2800c00160002ac0f0000000000140017"], 0x114}], 0x1, 0x0, 0x0, 0x41}, 0x4008080) bind$inet(r5, &(0x7f0000e15000)={0x2, 0x4e20, @multicast2}, 0x10) r7 = socket$inet(0x2, 0x1, 0x0) setsockopt$sock_int(r5, 0x1, 0x2, &(0x7f0000356ffc)=0xffffffffffffff40, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000380)=[{0x3, 0x0, 0xfc, 0x7ffff7ff}]}) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r8) ptrace$PTRACE_SECCOMP_GET_METADATA(0x420d, r8, 0x0, 0x0) setsockopt$sock_int(r7, 0x1, 0x2, &(0x7f0000000040)=0x7f, 0x4) bind$inet(r7, &(0x7f0000e15000)={0x2, 0x4e20, @empty=0xe0000002}, 0x10) recvmsg$unix(r3, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x68}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) setsockopt$sock_attach_bpf(r2, 0x84, 0x7b, &(0x7f0000000000)=r9, 0x8) 1m44.142425906s ago: executing program 2 (id=802): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x3c}, 0x1, 0x0, 0x0, 0x4008840}, 0x10) 1m42.716196314s ago: executing program 2 (id=811): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x2f, 0xc, 0xed, 0x6be8, 0x48, @rand_addr=' \x01\x00', @private0, 0x7, 0x10, 0x8, 0x2}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782", 0xc}], 0x1}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={&(0x7f0000000740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x7, [@enum={0x5}, @union={0x6, 0x0, 0x0, 0x5, 0x1, 0x1}, @restrict={0x10, 0x0, 0x0, 0xb, 0x5}]}, {0x0, [0x5f, 0x0, 0x2e, 0x2e, 0x5f]}}, &(0x7f0000000640)=""/160, 0x43, 0xa0, 0x1, 0xfffffff8}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='\x00\x00', @ANYBLOB="00022cbd7000fddbdf25080000000c"], 0x20}, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1m41.981231928s ago: executing program 32 (id=811): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x20045808}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'ip6_vti0\x00', &(0x7f0000000140)={'syztnl0\x00', 0x0, 0x2f, 0xc, 0xed, 0x6be8, 0x48, @rand_addr=' \x01\x00', @private0, 0x7, 0x10, 0x8, 0x2}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000007c0)="d8000000180081064e81f782", 0xc}], 0x1}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={&(0x7f0000000740)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x24, 0x24, 0x7, [@enum={0x5}, @union={0x6, 0x0, 0x0, 0x5, 0x1, 0x1}, @restrict={0x10, 0x0, 0x0, 0xb, 0x5}]}, {0x0, [0x5f, 0x0, 0x2e, 0x2e, 0x5f]}}, &(0x7f0000000640)=""/160, 0x43, 0xa0, 0x1, 0xfffffff8}, 0x28) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmsg$IPVS_CMD_GET_DEST(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000540)=ANY=[@ANYBLOB='\x00\x00', @ANYBLOB="00022cbd7000fddbdf25080000000c"], 0x20}, 0x1, 0x0, 0x0, 0x10805}, 0x44049) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 1m28.773064496s ago: executing program 0 (id=850): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x24, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_DATA={0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x140480c7}, 0x4000050) 1m28.428903728s ago: executing program 0 (id=851): socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) bind$alg(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r0 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000000)=ANY=[@ANYBLOB="1b1b", @ANYRES16=r0]) sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, 0x0, 0x0) 1m26.432532948s ago: executing program 0 (id=855): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x20008000) 1m26.246324612s ago: executing program 0 (id=856): unshare(0x6a040000) mmap(&(0x7f0000001000/0xc00000)=nil, 0xc00000, 0x2000004, 0x3b071, 0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x0) r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x90400, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f0000000080)) 1m22.468283063s ago: executing program 0 (id=865): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = dup(r0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a000100000000000000000081000000000000000000000008000f0004"], 0x24}}, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}], 0x1c) sendmsg$inet6(r0, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0xa, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x48043) r3 = dup(r0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000240)={0x0, @in6={{0xa, 0x4e21, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0xf}}, 0x8, 0xe61b, 0x8, 0xe8, 0x8, 0x1, 0x7}, 0x9c) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) getsockopt$inet6_mptcp_buf(r1, 0x11c, 0x3, &(0x7f0000000100)=""/147, &(0x7f00000001c0)=0x93) r7 = syz_open_dev$video4linux(&(0x7f0000000540), 0xff, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r7, 0x4020565a, &(0x7f0000000040)={0x8000000, 0xb}) write$P9_RSETATTR(r6, &(0x7f0000000000)={0x7, 0x1b, 0x2}, 0xffffff9a) splice(r5, 0x0, r3, 0x0, 0x4, 0x2) setsockopt$inet_sctp6_SCTP_AUTOCLOSE(0xffffffffffffffff, 0x84, 0x4, &(0x7f0000000200)=0x8, 0x4) 1m21.401306034s ago: executing program 0 (id=872): socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x35a71, 0x51a23}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20050805}, 0x20044060) socket(0x10, 0x80002, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r3, &(0x7f0000002940), 0x40000000000017d, 0x811) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f0000000280)={'sit0\x00', 0x0, 0x80, 0x20, 0x1, 0x80000001, {{0x20, 0x4, 0x2, 0x34, 0x80, 0x68, 0x0, 0x64, 0x4, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp_prespec={0x44, 0x34, 0xd, 0x3, 0x6, [{@empty, 0x7fff}, {@local}, {@loopback, 0x56c8}, {@rand_addr=0x64010102, 0x7}, {@empty, 0x3}, {@rand_addr=0x64010100, 0x5}]}, @end, @lsrr={0x83, 0x1f, 0xfe, [@dev={0xac, 0x14, 0x14, 0x1f}, @loopback, @multicast1, @dev={0xac, 0x14, 0x14, 0x30}, @dev={0xac, 0x14, 0x14, 0x36}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @rr={0x7, 0x3, 0xc6}, @rr={0x7, 0x13, 0x37, [@dev={0xac, 0x14, 0x14, 0x40}, @broadcast, @empty, @dev={0xac, 0x14, 0x14, 0x2e}]}]}}}}}) sendto$inet6(r4, &(0x7f00000001c0)="16", 0x1, 0x44010, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x2}, @TCA_CAKE_FWMARK={0x8}]}}]}, 0x44}}, 0x0) 1m5.601209173s ago: executing program 33 (id=872): socket$packet(0x11, 0x2, 0x300) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setaffinity(0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x35a71, 0x51a23}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bond={{0x9}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x6}, @IFLA_BOND_ARP_VALIDATE={0x8, 0x9, 0x1}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20050805}, 0x20044060) socket(0x10, 0x80002, 0x0) r3 = socket$inet6(0xa, 0x802, 0x0) setsockopt$inet6_buf(r3, 0x29, 0x39, &(0x7f0000000040)="ff02040000ffffffffffffffff1f2be82db1af0000000000", 0x18) connect$inet6(r3, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback, 0x3}, 0x31) sendmmsg$inet6(r3, &(0x7f0000002940), 0x40000000000017d, 0x811) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) socket$xdp(0x2c, 0x3, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'gretap0\x00', &(0x7f0000000280)={'sit0\x00', 0x0, 0x80, 0x20, 0x1, 0x80000001, {{0x20, 0x4, 0x2, 0x34, 0x80, 0x68, 0x0, 0x64, 0x4, 0x0, @private=0xa010100, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp_prespec={0x44, 0x34, 0xd, 0x3, 0x6, [{@empty, 0x7fff}, {@local}, {@loopback, 0x56c8}, {@rand_addr=0x64010102, 0x7}, {@empty, 0x3}, {@rand_addr=0x64010100, 0x5}]}, @end, @lsrr={0x83, 0x1f, 0xfe, [@dev={0xac, 0x14, 0x14, 0x1f}, @loopback, @multicast1, @dev={0xac, 0x14, 0x14, 0x30}, @dev={0xac, 0x14, 0x14, 0x36}, @multicast2, @initdev={0xac, 0x1e, 0x0, 0x0}]}, @rr={0x7, 0x3, 0xc6}, @rr={0x7, 0x13, 0x37, [@dev={0xac, 0x14, 0x14, 0x40}, @broadcast, @empty, @dev={0xac, 0x14, 0x14, 0x2e}]}]}}}}}) sendto$inet6(r4, &(0x7f00000001c0)="16", 0x1, 0x44010, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x1c) r5 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000240)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000000c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x0, 0xfff2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x14, 0x2, [@TCA_CAKE_SPLIT_GSO={0x8, 0x11, 0x2}, @TCA_CAKE_FWMARK={0x8}]}}]}, 0x44}}, 0x0) 32.234374272s ago: executing program 3 (id=979): sendmsg$ETHTOOL_MSG_LINKMODES_GET(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20040005}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0500000000000000000021"], 0x20}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x58, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x33, 0x0, 0x0, 0x0}, 0x94) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r5, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000080)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002bbd7000fbfddf254c0000000e00a90066697273746e616d650000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x10) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) capget(&(0x7f0000000640)={0x19980330}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000200)={0x0, 0x1, 0xf000, 0x2000, &(0x7f0000f9a000/0x2000)=nil}) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002500)=ANY=[@ANYBLOB="b702000007000000bfa30000000000000703000000feffff7a0af0ff0100000079a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000000000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d839240d29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e60c08dc8b8dbf11e6e94d75938321a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2209c67deca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080851dcac3c12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18cac1bd4f4390af9a9ceafd0002cab154ad029a1090000002780870014f51c3c975d5aec84222fd3a0ec4be3e563112b0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a6a71bc85018e5ff2c91018afc9ffc2cc788bee1b47683db01ac69398685211dfbbae3e2ed0a50e7313bff5d4c391ddece00fc786b409ac930c90ff90f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d85893f229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2a2d0e0000000000000578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9d24d37cef099ece729aa218f9f44a3210223fdae7ed04935c3c90d3add8eebc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ef6a8c88e18c2977aab37d9ac4cfc1c7b400000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f7ca1664fe2f3ced846891180604b6dd2499d16d7d9158ffffffff00000000ef069dc42749a89f854797f29d0000002d8c38a967c1bbe09315c29877a308bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a90800c66ee2b1ad76dff9f9000071414c99d4894ee7f8249dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8412392191fa83ee830548f11e1036a8debd64cbe359454a3f2239cfe35f81b7a490f167e6d5c1109000000000000000042b8ff8c21ad702ccacad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd1f285f653b6214912a517810200e2ff08644fb94c06006eff1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09e3187a10d905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e578af7dc7d5e87d44ff828de453f34c2b18660b080efc707e676e1fb4d5825c0ca177a4c7fbb4eda0545c00f576b2b5cc7f819abd0f885cc4806f40300966fcf1e54f5a2d38708294cd6f496e5de0900000000000000cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d367638cda690d192a070886df42b27098773b45198b4a34ac977ebd4450e1217c1342703f5bf030e935878a6d169c80aa4252d4ea6b8f6216ff202b5b5a182cb5e838b307632d03a7ca6f6d0339f9953c3093c3690d10ecb65dc5b47481edbf1f000000000000004d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026ded4dd6fe1518cc7802043ecfe69f743f1213bf8179ecd9e5a225d67521dc728eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c67df4c6505c78ad67548f4b192be1827fcd95cf107753cb0a6a979d3db0c407081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f32468f65bd06b4082d43e121861b5cc03f1a1561f0589e0d12969bc982ff5d8e9b986c0c6c747d9a1cc500bb892c3a16ff10feea20bdac0000000000000000ca06f256c8028e0f9b65f037b21f3289f86a6826c69fa35ba5cbc3f2db1516ffc5c6e3fa618b24a6ce16d6c7010bb37b61fa0a2d8974e69115d33394e86e4b838297ba20f96936b7e4746e92dea6c5d1d33d84d96b50fb000000ae07c65b71088dd7d5d1e1bab9000000000000000000000000b5ace293bec833c13e3229432ad71d646218b5229dd88137fc7c59aa242af3bb4efb82055a3b61227ad40f52c9f2500579aca11033ec14bb9cc16bd83a00840e31d828ec78e116ae46c4897e2795b6ff92e9a1e24b0b855c02f2b7add58ffb25f339297729a7a51810134d3dfbf71f6516737be55c06d9cdcfb1e2bb10b50000eb4acff90756dba1ecf9f58afd3c19b5c4558ba9af6b7333c894a1fb29ade9ad75c9c022e8d03fe28bc358684492aa771dbfe80745fe89ad349ffaad76ff9dd643796caffdf67af5dd476c37e7e9a84e2e5da2696e285a59b53f2fb0e16d8262c080c159ce40c14089c82759106f422582b42e3e8484ea5a6ad9aa52106eafe0e0caea1ad4cb23f3c2b8a0f455ba69ea284c268d54b43158a8b1d128d02af263b3dc1cab794c9ac57a2a7332f4d8764c302ccd5aac114482b619fc575aa0dd2777e881e29a854380e2f1e49db5a1517ec40bb3fa44f9959bad67ccaba76408da35c9f1534c8bd48bbd61627a2e0a74b5e6aefb7eee403502734837ff47257f164391c673b6079e65d7295eed164ca63e4ea26dce0fb3ce0f6591d80dfb8f386bb74b5589829b6b0679b5d65a6d072034cecc457776c5fa1f33b0203c07052c6bc314b0ac5c63bc2083c9cda0b7480e0b17854ffcc76176ce266bc698f7921b8afe798a7a5ed33ab0374455ee368fda99a0e681bf9426831b193395cb01a7332a50aac841cb7d48a1768a7640a9820631ba775a2d4f12e8e717eaaa2a6d14fee0c15f36c203dbc7c06128bec84231d43e152ef19ce027436fb4ebb9fce431b913f4817597a6f53d1626f9d1cb7b36fb18ac19547a9b20ede70c81a75686cea85dcd34408128da7cab045541bc6b9a0a79f63f2e7646356e04b977c9f47467537015240b974184be9c54b7c628ae4d97ebdb06070344468994afbaac71e5ffac2c61d9af66f9de2760a38e968a781528531c1c936a02065be48f1eee77be878873206d65bd0b1241fab9139abd7f40febe81fed3684e6b59273da01f1743c6a5df300ec59c65e8174fc2d95a62ca7b937289ad14107333007eab833a5849eb19f18ae41743dfb949377e"], &(0x7f0000000340)='syzkaller\x00'}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r8, 0x18000000000002a0, 0xfe, 0x60000000, &(0x7f0000000100)="b9ff03076844268cb89e14f008004be0ffff00124000632f77fbacf01416ac141416440c05114d2f87e5940c05ab861813f2325f1a39010702038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014caf28c0adc043084617d7ecf41e9d134589d46e5dfc4ca5780d38cae870b9a1df48b238190da450296b0ac01496ace23eefc9d4246dd14afbf79a2283a0bb7e1d235f3df126c3acc240d75a058f6efa6d1f5f7ff4000000000000000000", 0x0, 0xfe, 0x60000000}, 0x2c) r9 = dup(r7) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000002200)={0x0, 0x0, &(0x7f00000021c0)={&(0x7f0000002140)=ANY=[@ANYBLOB="1c000000010401040000e26624ea00000a0000040500010001"], 0x1c}, 0x1, 0x0, 0x0, 0x4000001}, 0x20000004) sendmsg$NFULNL_MSG_CONFIG(r10, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x1c, 0x1, 0x4, 0x5, 0x0, 0x0, {0x7, 0x0, 0x4}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048010}, 0x4000) ioctl$KVM_SET_VCPU_EVENTS(r7, 0x4400ae8f, &(0x7f0000000040)=@arm64={0x6, 0x4, 0x9, '\x00', 0x1}) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r11, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB="6c00000004000180181000000000018008000100e0000001080002000a0101013c0002802c00018014000300ff020000000000000008006927dff2b16d0f7000ff0100000000000000000000000000010c0102800500010086000000"], 0x6c}, 0x1, 0x0, 0x0, 0x20008004}, 0x48010) ioctl$KVM_SET_VAPIC_ADDR(r9, 0x4008ae93, &(0x7f00000000c0)=0xffff) ioctl$KVM_RUN(r9, 0xae80, 0x0) 27.990572281s ago: executing program 3 (id=995): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xecf86c37d53049cc) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000120000000800080000000100080009"], 0x4c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x48, 0x2, 0x6, 0x301, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x48}}, 0x8000) sendmsg$IPSET_CMD_PROTOCOL(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000040}, 0x4000050) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYBLOB="08b0010006820000400012800b0001006272696467650000300002800c002200000000040000000005002400010000000600080088a8"], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 27.713791687s ago: executing program 3 (id=997): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x5, &(0x7f0000000040)=@framed={{0x65, 0xa, 0x0, 0x0, 0x0, 0x61, 0x11, 0x44}, [@initr0]}, &(0x7f0000000000)='GPL\x00'}, 0x80) fsopen(&(0x7f0000000040)='hpfs\x00', 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) dup(r0) socket$nl_netfilter(0x10, 0x3, 0xc) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0x1ff, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xf, 0x80000009}, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000540)=ANY=[@ANYBLOB="03000000000000002000128008000100677265001400028008000600a714142e08000700e0"], 0x48}, 0x1, 0x0, 0x0, 0x24040000}, 0x2000800) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0xe, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000800000000000000080000006b118e000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) sendmmsg(r1, &(0x7f0000000000), 0x4000000000001f2, 0x0) 26.688894821s ago: executing program 3 (id=1004): add_key$user(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, &(0x7f0000000100)="5b1faec333b1bee91574963f28d8f7946a1a4145828fcdf08ee5f32ac4f674d09ddcce04499d938b36a98ee66f086cfe77a329c34083aad1bc9ecb69374fdaa4df48ce00ed142bfd3227cc5246cb494d71e560aa7cc26d91d1d335bef7a4e21455d789af41e3ea4f43c49a76c6c8e7f7b4629d12ed19340329c3e7c17ae829d8711262c4933d2eb5a8bd42945fd0fe1a1f7f46a5c95b237545244368f849f2b7ce1907c07bb31276a2b5655c135f7b732fb572f9b9e01c77322370f45d888744e5a9ffc423fd05702e81c369cdbc56154564bec25dbd35f0bab962183ccdd41cb89e86687add670223504297ea2f781622824ad3a9048fbe834fef9d8cbbdf80e83b26883e10ff8bd22b2e13c0a55b48a82fa0f0df078139540ad546f0762c11f438a1c95f2d4b1db086d4813ac986c85e7a1aee3268a0aab46537c36b954ce5af462d5c7fdf266c6d1635928137e05cae05c1131a0a7d2733d8232d4f9c9b7ad2268d66ba64f9220f13ec9cc3889fa63f1d2ae306c26896ea28687d02048138558ce6851479f57d53304aecd1637bea36f7d0e8b916d6f8f6ab39e7bba5b15c88d1e75e7b496403b2fce9659d1e6840284eab0a57a0c09b587c7e7e4decaad74baad5c84d61605d5be39fa66e0ac9fe77075a78fff28d06ed487055b50bd64ecc82c220ba513157be27b6f947ecebb8a6cf273de806018e0885fe4574e01a48d3e6a983741caf5eb17fc4a36b62ee17a0354e7ad663de57476f93c67cbaf896ac6b26a35498be25591f02d8e7e3ab8eea986b1e1495749e75838b03a8f12cbe14afe83004b3481288006992a809324da440c29ca737ada24e8afa0b7b995e3c7c5dc8f5c5d9f4939cca184c0547300695146b0ff687548808033db09338583d820d2173819a4e9e40780fd7856f02f9db7f4f2708bf4ab21c1f9a813cac085b3204f8bdfde4130820c3fd7fb205f32341e87c6320e9db36d6e7bae0098033be18b1fdecee41f0045ff2f3444734e35e39e9bcc2e282658a2142a5198f97e23b11daccedb52da735c42fddd026b426f6ce12288b7bdec6767b0290ae433aa3b9d1ad90a3f1fa7ca4436de212a5ef5449fd46df62649193e2812173222cf2a6d4c19ffa7277dbd30dd80ad86083d3d03efb6b2e83618a8978debb383fa6bc00642d7001e6fc7b9897eeb81b753221074f415f8291359471cb62789ef54e878a1a88cac800ada6c280ce7d9ebab0d6e1076b1c4ea7fc4612489e721008c33258243e37ddcb3d41a5050fdc84787a1a00b6b89dfc54dc21440204783b7b6dd154b13f08dbce062f2cb8c851b11bb91c08b660f41712c77a0c47e144f04d1b4d7fc649ce4f36c71a0cea49c2847d69a92773db429504af56d7da2dc76ff548c86c39ea206ed13bd800b9bb6b2e777d0a811832e1c385038b269ee0fd179875d810aec8b571a3d5e0e1797265682dcdab7bcb077db8e843b295d520c2ec2ffe4fc79ff3d30f2dc4c4eeeec621c8e22cf5f11edc1b17f96405e2c15549608e6c59229cc1bd8be9d592e148a095b5802b9175a63454ade9ecfe0aa01cedfd8f564d6adb35ebe2f7aee4f2234b271b09583d9f2a50d6449e648bfe09ef61441b74a96d8e7291c0a23fbb6b6b68a14bf8ec6ec042bdaa55f260b1df1a899bdf2d69a6d91566a1ce00072434cd036d0ae4849f1ff8f101a58306b4d27b42c35c2cb41758851428e9dcebbb0da812fa90f6944c5315dab5de45be1ca314ed877318b5c2e6a981fcb6169ffef518533c9ff5654bc148b83a477790868a1cd855ed6b238565b41c2b9fc06a17944661de7dc99d69fb52974419928db016b7612c4672ae0069937d056aa62a34b6f5c713063463e2ae0088b095f1af2a4f0f316c3b577a0f3103f9a809cc270b3aa7f1321986439350f0aee94807c79c095d4a3044f8bacf4b4754c4f79ee368a24d0efe00a37faa976721154d468841c77445bf4947fcff1161ca4a48bc7a3898d614c8c2c7ef44e868f9a115212cc9334a27a1e0f1b5ecd2edb3be90526df848ced3a410124f71f51a75e832039579f09645a163586c0fbaa8c3ba02532ac934a0f9e17d0d03961ec3a162cfe623fe04ac1b22035328ec71924cb8811b876322b3f071ffed33b6799f477d519338e400f9908eb70cc7b9fd015093084da7bd3e536d8a70a6882c3cc5a8343d663b765f768b512b98171d2f4520e77be1ac999a5f7ae6aaaf1bd57344d612091afd020fe3bc37094ffcd01b9820f781d1caafe30a7b60e4b861fc2764e4bc2e0d584daa1ba409cb8f5f544218a61f8d1de7a8157bc2b35e11a3359b52c40cad3b50793ec210fa2dfef346498a3b3042120b76308e950da1763dee1dee7ce244adc25dfaee1f75572f2111e1a925858aeab40e11d3dfdc210c822b92064260a77c50779864bcd134675fb94c2b0557dfe0e8879d3cbe61abbb950c3a0b7e085966de28d324013dfcf1b67024915561050fa18e6a6c4d661befc1e92f2e3da2aae2cc677eab4ed09e69940cccdf40157d59b76db104679a733cace6b2ef02f6160f0179388116cab625bee0b150ee92112922491f71701b47bfe46b320afbff2d3afe50ae88e7edfe6072027ff4418c29a918f21a62205b2d6e9abe18d4d2676f125755ccbc5f69cb083ec7b0448f837d9925ed940bf921d368f85aa6da5dbfb11acefd6077a708250c120dc918582fb2d76f076e06d6162e91e1a147d23bd022f13d5a8661fad1651b856ef1179786af6cb9fc04eb2039fc9ac271028f926e8c5186bd6c5c0423d4dcdbcd72e6cb39ff8be5f3c5a763bc74b411f6216e40539d6822affce2fb07a9a8baa76d0555c7c5d49f77fee7edc305eb369ed91e326b8331d9d5d9910d2d58d0db94d6e2edcef418da153652505fe2eedb8a2741c7731812d2a803f7a5cbf2df4c678e76a9044940d83619316293d7babcdda453b3bd78342827f53b94746f70ac56fd7ec27c1ab59e20049ffae7db3116eba1c671931f628d19ecaaf1d768f42897bf6868dbb516cf95a83946d00f53347b8d5879cdeab81084631f5d25baea8627a0c7c1d8a15eb4695dda5d52b840e285519f2a6249b0d97eeb2b3edf652b61fd3967c9bca2eda1206402c2de89c718add2d6d3c59407ba6318a9f4ecc85bef048aa8af208c74fa9c392e0f62357712762037f37975500524b6d5a190bb68fa5b815c9f8366a8de533e92f09c7ee696d895eae79a74873199651e5d44f227fd1747fea3bc553840eba9b86e2f3adafc6e9b1942944a45907379f22385c641a728b52c99a753009a6fe4c158518688ec86720d7e026b2869ab5a1a6f5f858d2ae06efab5b8cd1ac3929342a1b0643159db843b206d5ee71c1dcc526f9851703ee3cae2dbefecd7cf3f1d5344641315dbdb86c25f7eeab78f0817bf04fdf6ce34e6cb7bea8af70d012ff6d43ba5e59f55b8329bc6ef129faf63f144c85bb22a43617a932c540b62a2f4e10b876b4e00ea79d10ccf38cef9426ddcc46b8de7c88ec8f26259515fb9f54e6e12cac755c0b696dee768613b5a715b13e037356f4784dc8f7966a650e458742a8cecd0229c09422dbc2cc275a30365b5386356b8035588ef2c7096062d843585865859dfb499ffa7da6d300edcf6ac47addc420c16a86e55665342203038561addae9839d738c896f680370f76b09652dfc901f94130598bc8d443d60ba0689347dd744abc2c04fea16539eaa6ef9c24a170f98140c530bd7109158539fc526f1db251872cfa65259255f302bf80d336c31e37445f7c695130c6a9bfc2eda8397953dbb7b2abd8397f3963be1f34f66b8b49aa1591f55337f418e1a4b0c0b302eb2ca48dc915e527ec264cb6997c8e9ed2e2f0607798a9e239e7844f9e8feaa723957be01b431c216b2f44096f3e586ecc3785b2dbe8565da0c009bff0c4ce357033ef7551cdd67cbadbb0562a63439f686c52fc839a43a9f778cfaf16c467687717ed1dd0b0285ec3f2049dc0909cdf7a7220b4ceb923a856faf9a409782fdb571011ba1e8dc9a548dfc8932554ee2cbc6e69013433b9243679e6dfeecaee29437c47e8901ac543736249cb08a40686f08cd09c48d37302a2", 0xb60, 0xfffffffffffffffc) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) r3 = openat$rfkill(0xffffffffffffff9c, 0x0, 0x4600, 0x0) ioctl$BTRFS_IOC_GET_DEV_STATS(r3, 0xc4089434, &(0x7f0000000880)={0x0, 0x2, 0x1, [0x1, 0xeb5b, 0x6, 0x3, 0x100000000], [0x1, 0x3, 0x4, 0x2ca, 0x4, 0x200, 0x5, 0x5631, 0x7, 0x5, 0xfffffffffffffff7, 0xaf, 0x100000001, 0x7, 0x6e0, 0x86e, 0x2, 0x4, 0x1, 0x2, 0xfffffffffffffff7, 0x7c, 0x8, 0x4, 0x8000, 0x157b84ad, 0x0, 0xa, 0x80000001, 0x9, 0x3, 0xfffffffffffffff9, 0x5, 0x3, 0x1, 0x1, 0x1001, 0x1, 0x4, 0x3, 0x8, 0x7, 0xb, 0x3, 0x0, 0x9, 0x10000, 0x1000, 0x2, 0x8, 0x64, 0x280000000000, 0x1, 0x4, 0x7, 0xa, 0x3, 0x8, 0x2, 0x0, 0xa0000000000, 0xfffffffffffffff5, 0x7, 0x3, 0x176, 0x15f, 0x0, 0x5, 0x5, 0xfc72, 0x9, 0x7, 0x7, 0x2, 0x6, 0x81, 0x2, 0x4, 0x10000000100, 0x0, 0x9, 0x2ce1, 0x7f, 0x8, 0xeab5, 0xffffffffffffffff, 0xeffffffffffffffe, 0x6, 0x10001, 0x2b6, 0x1, 0x2e06ffea, 0x10001, 0xf2d5, 0xffffffffffffffff, 0x2b6b, 0x1, 0x4, 0x5ac, 0x7f95, 0x20000d13, 0x2c, 0x1ff, 0x1000, 0xd05, 0x1, 0x9e, 0x8000000000000000, 0x3, 0x0, 0x3, 0x5, 0xc, 0x6, 0x6281, 0x10, 0x7f, 0x7, 0x3, 0x3, 0x7]}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r4 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20008000) sendmsg$nl_netfilter(0xffffffffffffffff, &(0x7f0000001440)={&(0x7f00000011c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8001}, 0x40) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = syz_open_dev$loop(&(0x7f0000000240), 0x6, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_freeze_timeout', 0x82802, 0xf) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000000280)={r7, 0x0, {0x0, 0x0, 0x0, 0x32, 0x4000000000001001, 0x0, 0x0, 0x1c, 0xc, "faf98317e5a1149989fc8dbe53ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a8a0f3500000000000000000e00", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "675237601a8ca5b07dcc141802c4dae4162e43ac61b7ad3300", [0x3, 0x6]}}) ioctl$SNDCTL_DSP_GETODELAY(r7, 0x80045017, 0x0) pipe2$9p(0x0, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_TSC(0x43, 0x0) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000000080)={0x1, 0xc4}) ioctl$TCSETAW(0xffffffffffffffff, 0x5407, &(0x7f0000000040)={0x6, 0x7, 0x9, 0x3, 0xfe, "6c00d6f200"}) ioctl$TIOCMSET(0xffffffffffffffff, 0x5418, &(0x7f0000000000)=0x8001) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r9, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000010c0)=[0x7, 0x8001], &(0x7f0000000500)=[0x2], 0x0, 0x2}}, 0x40) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x54, '\x00', 0x0, @fallback=0x30, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r10, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000240)=[0x8], 0x0, 0x0, 0x1}}, 0x40) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000001080)=[{{&(0x7f0000000cc0)=@abs={0x1, 0x0, 0x4e20}, 0x6e, &(0x7f0000000f80)=[{&(0x7f0000000d40)="42d3b2cedf50335bbbfd98b50d5d7480caf3cc493098a66c6532ffe044e02f73346f8037a2209ed2068eabf0ca690cbb74f9ac2acadd692e431feb2b817665af48a7c957f839faf1c26f479d", 0x4c}, {&(0x7f0000001480)="51fed4a5442e722236456544f0bfe18f762ae9e7a54787de7d9c8913460d3f732ac2a57a92b82017e98aa4fc22acdd600832cb54ccae93514587e5bbed057a015a816a8ce8353e60c74bc45d4532e73c0b51bf5980f88342e0267d9569b42a769150e9e1c51843688e0f46c33d11938d9ba0d103d8a61415adbc6d9bc0d60c4c3999b6b40712b4eba566f409ad2357cca2a1022f66a62ee9ac7db8f7e32b3c545030686063faabc4605264cd2fc50a0d5b211ab313b21d789da090b3b53ce41ac6f47df41e13a315c168741ed1d01e9f245bfab59f95cc934616ff7186251c9063f883fc184489803deb62072016f4c37079c35fa74ce437327b04529bc4fadf79df321c7a7d6be71adcbfd696e76adafad418a0892defc38f223e3f9e30006f9682c4ba5333e9d5ce1fb84dc7daa3a1e17cc590330bc53b8fcea33f0e607779822b2a750e5d4c735473b1d58e560aa35265d584447e57541492dae74fe916a2f4a6149a932cdb924e4a6805e963366a0e71e39fc20134f8572fbaa6f4dc82f0f6d67c1a6266a4639ee9b941da34bee717e45680b4e8ef7440368e1c8076682b01496ce9b29af70874215e241be6b72964588ef1abed52de703a3992bd950358d5a3386c4b7c5d46c9d18f66c9c28086fde2dfb82569e148f7caec36c593107724fa2339e4417c54d1d1741050536245e2341fa295a0fc1887b21f487d0e9eabcf553e17ef571425fc1b11a8c9689846224d9101fccab1c7a3177575e4f35ceaa4eea162d021d45c29c1211f837e6073a30603fb5c74d2bcdb5dcba91730e75e16db28ef5a1075f37fafbacfc185c627c22af4816e48573d36c3ba4f29c4e15ba1270a1ab2b6a08d997ad6cba631788dccde8ebae21a0a582ed75eaf1229d7612cb4eb7558e2181e83fc2bdc52d23d8b22c12a48c8f6b7eaea84a4a7465435196982713eb5f249b7c00494d44e67b2737dc1a3ede236dcd72ff2b6c7d9465c497a4d39530aee55e1edb6fe77a451229ef9a6a711135f920b03376c4f3cd60eba20b497e6cad95486afecd3995a1d60b219262a89df122b29d28ac8573c8da7b2754b94839d41655d6aeb804e0e871bf9cdea0851c90dd0b2c68dcec6e4ad825e3b9f42b0149fdf722f17364645039380469ea440f79cb41a722833a744a00fc36c27021b40e6f40fa73d64ecbf0cf458d8d93ad03c3f47a76e83015594bc654006f5466fffda307119f59a5137949edc30bac79448a27a30afd8ba74fba7a00f0f9098e1edccf0d978e725258ab6cbb8ddf1441e801d1ea8ec273b3a3dca4bc0b64d3739a515690c5d9c5933fd51f7877e3f06b5bd0d465e499aece4bd6409a71a915c3619bdc82a2297f7a02b0fb16bba5dedfc543fe6ad10a85df2542641197575c10977b8c230f4bd794784fabd269e76344bcfba4d94bc3e08530fc24861fc8510dc23d71b9f4a30aee43df3b70c0b033d3f70ef1fd597a47d3de411e0f09c065753ce27539a8355f39888653480401a576719f6e7d73d1b4efbda567ab87b69d8888274f186ebe73984faa7e5f1f78cca98bc3dfe7bc2c686e2fa5db8c4ad16f02928516444c2802bcabe2c03878d98f6423ab1a1d3898e6a7f45937f42cad11c98b51cfea3f2d0f83df35c1b4415128cf456c088cb3644903c567115e19306e19f2ff5119d57a6f6fdbf04f20deaaacea582fd529fd017ec82f7dead99ae8959b96c5e9ae0d92066931536f1d685a84b3e512316f70281470ac90270de1fa6d345df6d5d6aa93c85afc592b164dba0bd8aff2fa2adb49864c09bb91327a80fb5ea3d19710d99511356bac236c5239f73f21300af4a9101f8872b9a3c31594557472dc6d10d8c961c228e07b0d99744176bb3603256d1f0a52f6f971f5434d80122406e7c97c410b4a8183a0993dfa5f3b89bad9dc310b33f7511a2595b3d8c0f67da229a69674315946a155785afb668ba36f9032bd291461078408a3e26d0490be11a23d0ebbfd5b082d814c5e16e1213346a3671cc25783cde0220876b182eccda4ad02f099b304f494bc9edbbcdd61ede769d7f2158fc8ab92544f802311ace80b26e6c956a69231695badd53761da15ce68f4ab99395623ab54601671d8a390b41fd8fde27a7d1c095ba4dd063c55462fd154a91e476c27a105267b212da639f693bff4a0dcb611193419266afc573f78477baa88635d0bbc46950577fd68cb0dc2ad1e289a22397dc06f68f4641ac861473e2b5e9897048d021264e584d8e23769027134b37292a2cbebecb6823d1dc8e0339d6cc63c36b619c0519ef82178fb74de8f4bf987d68c8ae655e7acb8057faf8320de580f9a64a06f38c060936e28a938780c62acf75acc0cb597e376201c9f260eb39bbaf06fd918f2ebaf7948726f0225905aa72e3c4f4181435b1ea0ad9c693f5907d2bad020f7704acf7fe6f43bb60ff4c23bab7bcacd291f873547f2186f7fb00eaaeb795d885af6f0ed3be5a8a811bb1d188be55fa5b14f312e0f9930d33d36e64fd42d6764d54b103f44a739a6df188e236c66c1e3d1280b85c60f1090b163690c340be2cf01cbf6831d2926551da0f194b07ad9beff9a2be27b0c7d32c5329936c2607ba259d638b2019e37f1c1e3a994e03f935fcc60ce24dbec52345c0770bd3e33d5367cd815360ea4e9b9c8ae9231e85a127bfa58ce296173f01dfe9ec46c318a5fa07aab5c1f946280784c829070f0156249d37a371bd9614e0657726f599679401f5a35ba178d07d60b671a0e2d3e90f9070352272924225ea01d6987bbb143d1f31a4239d8b0ca4422dd60a25e8400488be2d6c662ef8736f8ef2465d9bfb42fbd2a2da03556ea3f171b6d0b06d87cc5bbaf3c183433ef5cc56a793eeb08bdfdd657442c0ed2bcac216ce03beae480cc3311b2ad0e16be7f3bbc6ee139b5c0a65216e2c4f380fcf5e9e76805aa758fb9b80663961c51861dc1ee56f7153014daf020d83dcc969ad56b254fafb5401e0558a8962b7ee1d2f2d110195fd145f5560e70ea17081b6f9c46e538bd91c6624d0ba1693f44ae562084422c0badfe3eff27e3e7b1993724110e4688b10dea01e9b8a4eeb61470eb90bbd6e519a4fe0227d72f585329533273cf4b0af4f20c62652cd5ec72c7d06d3b63783d5644d358515a960b83902498f0ddec06e16e484c3a27eab6fa3f48504d650135704cb3247f814c537a248b88bfaef541c16d248bc0d5451d93d051e6004ddab717fb76a185c8a74eb560b692e17255c5106d27480f7f19b262ccac7f25db8a74c2e6cb05884c8dd13293f252748f308eaa8ca5708ddf619e281ce5996c7599e602e113d31804bf0750d2020a2e2f8d0b6f82fa9fba9c3f61f64d65c76e02920b8f73d2a772ea93c8c560162b89c1e99e3ccc3807d937368c7fdd173bf05dba4e34f19da9314ec7a7fc5c6dd4ab4e3533b0bc18d7fdeec21fca3c95a466e640efbf736e65b4338edda0c7b2a8dd62af808a09d49151e437ed8d2f05a566cfc6cbb82325d1a8d204eb12717cba2704020a7f3eaef5c45ba36434e51414b6ef6cb07322e897fca4d336d69ea1d8d899f791a66052256e430b737f4395d99f172164ab67e674ab1b1aff2520e827f17757e8d4569c7fa8991ace77d98305430edbed70d1b1093b19b1538b1396e091f34c3cc346f713816b134444121b394b53a3a6585a40c52da7fd11d37ef714b087e294fceb6de98ec740d73b84b15ecf88a8cbe66840f86601e05b60d8fa01f8daf2ddf66404aeea84ad40c6ec2e95574630cad7e28cee69e029fb7ff0da0d15e7b5bfe8ba71576137a26dc44dd27ba699953c48f0c0f3c81eb70fdc60c76b0f8c25e094ff8173be6cd9ba5c82aaa589ed7c0f51cfff3a9fd2de5ef5989ea1fc4bf8845d8e9572ed4a3b342fc0d79d4e69301da86d7d9e2da83354fd6c0935230d681dbe5d24c2509193895b477a3284af8f1146a4627a0c9dab5e9cc27609a8da121656a7da4ba170f78dc7058e238b69a4ae2db7befdca4e949e6e9c7283d32f05cd4bb92deb2115d0bb92d373e4559338bc79867b6694cdbe8d68dfaadad840a575138ce611aa72c590e2356507529b3efa80738ce3a22605f637f227a2d1254dc9291da040678fc443280d481fed834fc5b4b1698ceb6865efe4c94e931497c4db577d631acddb8e4208659a4672afddc8a10c8d995c203ef33fc647f0ab2394f4cf43808b9ff780bd4d3238257d9197b55477a7045e5225af2a62ae2477738bb8cb99d7d871c65f4e3c0cd48effa69a3d75fb37c6b1a4f227809d9572db83acf0d9c1456b8cefc80d818300601b63ed27911cb2d905df6f34511df047953420091b2b35c45e348b288da267ecd96f95da498c89731da66c1a0f33bfa5279d7413ecccbd73496da2c97372a129734fdf78e034411a90045cb74a34ac4c8e4d34ef1ccbbbe9b9a0412dc0fea939e1f9a550ecf9f1912cc571eab1ca5d667eba7413512ce3357cbcf48dcfcaf76aa1ad12ce9ada16eb6a28d35f66cefdea1329b0130cbbd4fae80eacaa01fff299f6b84e2d35a84290b2baed61c10f8a5ace5544caa40ee61c509cf77a87f115078953ff8b6d003bf68d7052e19647342100707f8e19692681890ba2fc9b48f8056aa84e539b588831c89bc1df3f0609ea66b56682f7f742a90e6402b66563194c0c60cff5e1aab51d8a33ff946e58fe1fec4144822722807135ef99bbb6fbb37a35113371c91a55d5972c9370c11c446428c1f3f358deff66cd58ea8bdad6d10e1e67bb1c815a5adb2b8cc2a0358ca7c426eb6d9dd604f691ac239db7fec46730fc0d6e8b838f45b877650eedf037085213f4100bf8b7459312244338e03fede8d02358a1cb001abd74115b531a424eda99b76a6e77b8c548014ad46622daa3538d5bd639a9882269b8a68c1579acdadada9c3d51aa2bb9fd03884bcf973616ece5fd5fc53e20f2884266933f6caf93f63cd71d18990d50a37651b37afeee5721b45036344f82e601f9feeb87c5d9dc0cad3f73a5d10e63461d56edda34d94c8c8a347e078f7590aec93d67427cad63b46fa1658f49722655050af13cc6968e7bb173f6a8f9de26eed36b8eb42e65203afdb0ca0f1b90e2c7abf67acf7d95ab440ac30f69fe8095b11bbf707b297059bc81cb5884ddd6c5e7cae38a542345ecc3381402feaa98ee0c711b57eec5ff1c0c652c0679a6c94393fd029d8c806813d1b1b9de5998823a63497e3e526cafe515764447356e8883541b26eaded5bb6bc21a79205a92c8d3554c5df22e9adf2721a0c23ae3056571ec09f9d45d1422e6bcd48fed1a5b9bbce6b275630d99f49c95976a10b0f221666f4536e462fa641a45934f95b7f2aff8bacc49a12a39fcc87a4b747342e0147dde10a698ed87c863c2c4eb5ca94e239f25f0fab8bed9bf240ae1cf0f22167591e14bb0b7ef3391b4fd185f2cc29f8568a3c567fc87740ac78eec21021002205fbfea766819fd267a9ad33c14656793d2bb637dc5b9c5877011f96145f761413994151e75d5ee32bc661d51c14a2f92e4401bba77f8ad2155d9147ca63a112b0a23ec1ad71eea8969412da8addf83fc9eeac080735ea8d4cc4ca3a5ad272897e907bc33fa19294dae037d3160d89fc953bed0edc7105b8d8f92ad7807066f996a7f78da15e0f30200233f0f4dce724b2de94108e7c4941c74fab0e49be5c1913ecf1b05be434d77dd7cb8f00bebc10cdeda80a099fea5494eb3fd0dae1d70b7e7f9f5a0bfc3f4ed4055c611ae1cdb128e26849cb", 0x1000}, {&(0x7f0000000dc0)="2934e6ef24d06d50810a2ae4cca5fe4e0ac0a0841944d53090dd457dee0249ec787e1c42577b5dfe028df0588e2fb65db2c8bdf22555192f83259aed5fe2df3d92317ca56d1e563cad9f00241480a8312040a567778d57cf1eff2d18c50e28341e72c0782d10abc45e7f95b0cf74e9f3b9d074d1b2590083819dd9f7acef5840ab46701e7a7b96076c44ad13b4fe0f45418c71fa31f9bb7ce48f4b72cbf238982fa3fdec5b", 0xa5}, {&(0x7f0000000e80)="5a12e926b41fa564850c7b6b076b19f5d95eb8ad0c8dbd00f1e754f3578f487b5ef1afbde95682ca7ee36a48f3e2467fc04883d49582ae3228d53c100257a644450fa016b7f7fba110b592d2d6840d6440d2457e7cf4a932c1ee1280104a3824cfe982058e9c045711f67de5c0c98a281eec318114a64448176337428f2866eb978531b3c31ea98b90d2b3169dd7a65c8aaf528a6a32ce83e5577f05275457610c642f047c385f667abf8032700200902f0daeacaf011c9a72cf5d955998f5b0ed32bb3997b8484384f0f8b3445708014f9bd5147947b5966ba89285f2b27c067e7f453f794cc1bfe959793164d0f5d432227b896e", 0xf5}], 0x4, &(0x7f0000000fc0)=[@rights={{0x30, 0x1, 0x1, [r6, r0, r0, 0xffffffffffffffff, r9, r2, r0, r2]}}, @rights={{0x1c, 0x1, 0x1, [r10, r3, r4]}}, @rights={{0x14, 0x1, 0x1, [r6]}}, @rights={{0x2c, 0x1, 0x1, [r4, r3, r4, r1, r7, r3, r3]}}], 0x98, 0x4}}], 0x1, 0x800) sendmsg$NFT_MSG_GETRULE(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x14}}, 0x0) 22.030482061s ago: executing program 3 (id=1009): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000", @ANYRES32=r3, @ANYBLOB="1f003300d0"], 0x3c}, 0x1, 0x0, 0x0, 0x4008840}, 0x10) 16.559055094s ago: executing program 6 (id=1024): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x48c}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wlan1\x00'}) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_OPTIONS(r3, 0x11, 0x1, 0x0, &(0x7f0000000180)) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/consoles\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x0) 14.985046546s ago: executing program 6 (id=1026): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', 0x0, &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0xfffffff6}]}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000001f40)=@usbdevfs_disconnect={0x8}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x8890}, 0x24008084) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000080bfa300000000000007030000fffeffff7a0af0fff8ffff1971a4f0ff00000000b7050000080000001e2400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x20000000000000bc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa}, 0x54) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000400)={0x0, @loopback, @empty}, &(0x7f0000000440)=0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x7, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xd, 0x1}, {0xc, 0x1}, {0xc, 0x4}, {0xd, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x9, 0x1}, {0x9, 0x5}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x5, 0x6}, @enum64={0xf, 0x4, 0x0, 0x13, 0x0, 0x0, [{0x3, 0x2, 0xa707}, {0x6, 0x63da, 0xecb}, {0x5, 0xd4c}, {0xb, 0x848, 0x6}]}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{}, {0xd, 0x1}, {0x8, 0x10000}, {0xc, 0x800}, {0xb, 0x5c}]}, @datasec={0xe, 0x4, 0x0, 0xf, 0x2, [{0x3, 0x6, 0x7}, {0x2, 0x9, 0xf3d}, {0x3, 0x8, 0x3}, {0x2, 0x40, 0x1}], "927b"}]}, {0x0, [0x5f, 0x5f, 0x61, 0x10, 0x5f]}}, &(0x7f0000000600)=""/203, 0x147, 0xcb, 0x1, 0x9, 0x10000, @value=r3}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x6, 0x7, 0x3, 0xb840, 0x1, 0x368d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000600)="8716799b2e810800b500148b1368c211d7000023268056ac8d5db0f12c23d285b18d91425a93c62676934bf2ab864fe7a500c0306b57165bc9943747acb8c56323151336b7986047bece6c74225c3dff9de2016180f21212d1e35f1a408380dfe85913bdf60eaf3c717aea06560b136351034b4a030240299b84bf3797295c635141cc473cf9efaa71a634d075c7c916a3800bfbdbfbfad341fecc89908b5918691e7b916cbb8ca23171eabb622eb244f8300923fc0094cf0e9e72d2eb6201097cef1ae65acede1564bf0d74039d60", 0xb09f}], 0x18) 14.282118834s ago: executing program 3 (id=1028): syz_emit_ethernet(0x3e, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd606410a6002e0001fe800000958b00000000000000000012000000200000000000000000000000012f00010400000023"], 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=@encrypted_new={'new ', 'default', 0x20, 'user:', 'syz', 0x20, 0xffd}, 0x2a, 0x0) r0 = add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x5ba8, 0xfffffffffffffffd) keyctl$read(0xb, r0, &(0x7f0000000240)=""/112, 0x349b7f55) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f0000000240)='syzkaller\x00'}, 0x94) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c0000001000010025bd7000fddbdf2500000000", @ANYRES32=r4, @ANYBLOB="10080400895504002c001280110001006272696467655f736c6176650000000014000580050028"], 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4040010) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000001c0)={&(0x7f0000000080)=@gettfilter={0x2c, 0x2e, 0x400, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x2, 0x17}, {0x6, 0x6}, {0xfff3, 0x8}}, [{0x8, 0xb, 0xa23d}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000080}, 0xc000) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, &(0x7f0000000280)={@host}) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0xffffffffffffff6b, &(0x7f0000000000)="ff", 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffff80fe}, 0x48) 13.338903782s ago: executing program 5 (id=1031): r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) unshare(0x2a060400) bind$inet6(r0, &(0x7f0000000180)={0xa, 0x4e21, 0x1, @mcast2, 0xe1c}, 0x1c) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYBLOB="6397807b8e9801ed39127bf4715df2f4934018d4deba223aa013193b954e3b53b9762127415b6744e4126cdecf8e02fc096381310b3ece9c48bfc67dd4f4564ce82744c5551c9115f6ac644187b96b622c02408acb30b1590a1849e6f854e00572ea57dfd7349be318b2d51d43f05d5e503e8a25e86a704ac0e176856b1097c8fd956a6708eb6bb14c441fc72362bb146c6fb2399844298e8a14b24162c217b00a575ca6fb8a4676fe1010182cb4c610152376ded1b03671db8ce6dc3711939dee736a8e0c01bfa09990e35de643db03f600b46fa30e5c85a16d396273d573d8a1161297c15bace15e592720a3da45f7ccbc17fa034e", @ANYRES64=r2, @ANYRESDEC=r2], 0xfc}, 0x1, 0x0, 0x0, 0x80}, 0x400000c4) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000100)=@generic={&(0x7f0000000080)='./file1\x00', 0x0, 0x8}, 0x18) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x200006, 0x8, &(0x7f0000006680)) inotify_init() r3 = gettid() rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffed]}, 0x0, 0x8) timer_create(0x2, &(0x7f0000000040)={0x0, 0x15, 0x4, @tid=r3}, &(0x7f0000000240)) timer_settime(0x0, 0x1, &(0x7f0000000340)={{0x0, 0x989680}, {0x0, 0x9}}, 0x0) rt_sigprocmask(0x2, &(0x7f00000000c0)={[0x6cb]}, &(0x7f0000000100), 0x8) rmdir(&(0x7f0000000180)='./file1\x00') setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r1, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x4) bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000180)=ANY=[@ANYRES32, @ANYRES32, @ANYBLOB=',\x00'], 0x20) sendto$inet6(0xffffffffffffffff, &(0x7f00000002c0)='\x00', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) 13.317874503s ago: executing program 4 (id=1032): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = creat(&(0x7f00000000c0)='./file0\x00', 0xecf86c37d53049cc) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000120000000800080000000100080009"], 0x4c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x48, 0x2, 0x6, 0x301, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x48}}, 0x8000) sendmsg$IPSET_CMD_PROTOCOL(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000040}, 0x4000050) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYBLOB="08b0010006820000400012800b0001006272696467650000300002800c002200000000040000000005002400010000000600080088a8"], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 13.206141263s ago: executing program 4 (id=1033): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4008840}, 0x10) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) 13.039875839s ago: executing program 6 (id=1035): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0xfffffff6}]}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000001f40)=@usbdevfs_disconnect={0x8}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x4}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x58}, 0x1, 0x0, 0x0, 0x8890}, 0x24008084) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000080bfa300000000000007030000fffeffff7a0af0fff8ffff1971a4f0ff00000000b7050000080000001e2400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x20000000000000bc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa}, 0x54) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000400)={0x0, @loopback, @empty}, &(0x7f0000000440)=0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x7, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xd, 0x1}, {0xc, 0x1}, {0xc, 0x4}, {0xd, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x9, 0x1}, {0x9, 0x5}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x5, 0x6}, @enum64={0xf, 0x4, 0x0, 0x13, 0x0, 0x0, [{0x3, 0x2, 0xa707}, {0x6, 0x63da, 0xecb}, {0x5, 0xd4c}, {0xb, 0x848, 0x6}]}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{}, {0xd, 0x1}, {0x8, 0x10000}, {0xc, 0x800}, {0xb, 0x5c}]}, @datasec={0xe, 0x4, 0x0, 0xf, 0x2, [{0x3, 0x6, 0x7}, {0x2, 0x9, 0xf3d}, {0x3, 0x8, 0x3}, {0x2, 0x40, 0x1}], "927b"}]}, {0x0, [0x5f, 0x5f, 0x61, 0x10, 0x5f]}}, &(0x7f0000000600)=""/203, 0x147, 0xcb, 0x1, 0x9, 0x10000, @value=r3}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x6, 0x7, 0x3, 0xb840, 0x1, 0x368d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000600)="8716799b2e810800b500148b1368c211d7000023268056ac8d5db0f12c23d285b18d91425a93c62676934bf2ab864fe7a500c0306b57165bc9943747acb8c56323151336b7986047bece6c74225c3dff9de2016180f21212d1e35f1a408380dfe85913bdf60eaf3c717aea06560b136351034b4a030240299b84bf3797295c635141cc473cf9efaa71a634d075c7c916a3800bfbdbfbfad341fecc89908b5918691e7b916cbb8ca23171eabb622eb244f8300923fc0094cf0e9e72d2eb6201097cef1ae65acede1564bf0d74039d60", 0xb09f}], 0x18) 12.945699794s ago: executing program 5 (id=1036): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), 0xffffffffffffffff) mkdirat(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x144) dup(0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) r1 = socket(0x28, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x9, &(0x7f0000000040)=0x20003, 0x4) epoll_create1(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x8) r2 = getpid() r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x20000, 0x0) ioctl$IOMMU_VFIO_CHECK_EXTENSION(r3, 0x3b65, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000000c0)={0x0, 0x3, 0x0, 'queue0\x00'}) write$sndseq(r6, &(0x7f00000001c0)=[{0x0, 0xe1, 0x0, 0x0, @time={0x0, 0x1}, {}, {}, @result={0x0, 0x1}}], 0x1c) r7 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000240), 0x311200, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)}) r9 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r9, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r9, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r10, 0x0}) ioctl$DRM_IOCTL_MODE_DIRTYFB(r9, 0xc01864b1, &(0x7f0000000300)={r11, 0x3, 0x101, 0x0, &(0x7f0000000180)}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r7, 0xc01864b0, &(0x7f00000003c0)={r8, r11, 0xb, 0x800000, 0x6}) 11.924216399s ago: executing program 1 (id=1037): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0xfffffff6}]}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000001f40)=@usbdevfs_disconnect={0x8}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x60}, 0x1, 0x0, 0x0, 0x8890}, 0x24008084) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000080bfa300000000000007030000fffeffff7a0af0fff8ffff1971a4f0ff00000000b7050000080000001e2400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x20000000000000bc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa}, 0x54) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000400)={0x0, @loopback, @empty}, &(0x7f0000000440)=0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x7, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xd, 0x1}, {0xc, 0x1}, {0xc, 0x4}, {0xd, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x9, 0x1}, {0x9, 0x5}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x5, 0x6}, @enum64={0xf, 0x4, 0x0, 0x13, 0x0, 0x0, [{0x3, 0x2, 0xa707}, {0x6, 0x63da, 0xecb}, {0x5, 0xd4c}, {0xb, 0x848, 0x6}]}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{}, {0xd, 0x1}, {0x8, 0x10000}, {0xc, 0x800}, {0xb, 0x5c}]}, @datasec={0xe, 0x4, 0x0, 0xf, 0x2, [{0x3, 0x6, 0x7}, {0x2, 0x9, 0xf3d}, {0x3, 0x8, 0x3}, {0x2, 0x40, 0x1}], "927b"}]}, {0x0, [0x5f, 0x5f, 0x61, 0x10, 0x5f]}}, &(0x7f0000000600)=""/203, 0x147, 0xcb, 0x1, 0x9, 0x10000, @value=r3}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x6, 0x7, 0x3, 0xb840, 0x1, 0x368d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000600)="8716799b2e810800b500148b1368c211d7000023268056ac8d5db0f12c23d285b18d91425a93c62676934bf2ab864fe7a500c0306b57165bc9943747acb8c56323151336b7986047bece6c74225c3dff9de2016180f21212d1e35f1a408380dfe85913bdf60eaf3c717aea06560b136351034b4a030240299b84bf3797295c635141cc473cf9efaa71a634d075c7c916a3800bfbdbfbfad341fecc89908b5918691e7b916cbb8ca23171eabb622eb244f8300923fc0094cf0e9e72d2eb6201097cef1ae65acede1564bf0d74039d60", 0xb09f}], 0x18) 11.922848588s ago: executing program 4 (id=1038): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080), 0x3e) setsockopt$TIPC_SRC_DROPPABLE(0xffffffffffffffff, 0x10f, 0x80, &(0x7f0000001640)=0x8, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2400, 0x0) r1 = socket(0x10, 0x803, 0x0) pipe2(&(0x7f0000000100), 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0x0, 0x20000, {0xa, 0x40, 0x22, 0x0, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_ADDRESS={0x14, 0x1, @dev={0xfe, 0x80, '\x00', 0x34}}]}, 0x40}}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x14, &(0x7f0000000300)={&(0x7f0000000240)=@ipv6_newaddr={0x40, 0x14, 0x9535393fea6295b5, 0xfffffffe, 0x0, {0xa, 0x0, 0x4, 0xfe, r3}, [@IFA_LOCAL={0x14, 0x2, @ipv4}, @IFA_ADDRESS={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}]}, 0x40}}, 0x0) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000001540), 0x0, 0xf5) 10.359008494s ago: executing program 5 (id=1039): r0 = socket$netlink(0x10, 0x3, 0x14) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x200000000006, 0x0, 0x0, 0x7ffc1ffb}]}) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000100)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000001114020026bd7000bbdbdf25080001000100000008004f000100000008004f000100000008004f0002000007db40a1b81f19ace28fe5960008004b0043000000"], 0x38}, 0x1, 0x0, 0x0, 0x8884}, 0x0) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0xffffffffffffffe9}], 0x1) 9.624087204s ago: executing program 6 (id=1040): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(0x0, &(0x7f00000000c0), &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0xfffffff6}]}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000001f40)=@usbdevfs_disconnect={0x8}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x8890}, 0x24008084) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0xe, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x7, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xd, 0x1}, {0xc, 0x1}, {0xc, 0x4}, {0xd, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x9, 0x1}, {0x9, 0x5}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x5, 0x6}, @enum64={0xf, 0x4, 0x0, 0x13, 0x0, 0x0, [{0x3, 0x2, 0xa707}, {0x6, 0x63da, 0xecb}, {0x5, 0xd4c}, {0xb, 0x848, 0x6}]}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{}, {0xd, 0x1}, {0x8, 0x10000}, {0xc, 0x800}, {0xb, 0x5c}]}, @datasec={0xe, 0x4, 0x0, 0xf, 0x2, [{0x3, 0x6, 0x7}, {0x2, 0x9, 0xf3d}, {0x3, 0x8, 0x3}, {0x2, 0x40, 0x1}], "927b"}]}, {0x0, [0x5f, 0x5f, 0x61, 0x10, 0x5f]}}, &(0x7f0000000600)=""/203, 0x147, 0xcb, 0x1, 0x9, 0x10000, @value=r2}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, &(0x7f0000000040), &(0x7f0000000140)=r3}, 0x20) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x6, 0x7, 0x3, 0xb840, 0x1, 0x368d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) r5 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) writev(r5, &(0x7f0000000280)=[{&(0x7f0000000600)="8716799b2e810800b500148b1368c211d7000023268056ac8d5db0f12c23d285b18d91425a93c62676934bf2ab864fe7a500c0306b57165bc9943747acb8c56323151336b7986047bece6c74225c3dff9de2016180f21212d1e35f1a408380dfe85913bdf60eaf3c717aea06560b136351034b4a030240299b84bf3797295c635141cc473cf9efaa71a634d075c7c916a3800bfbdbfbfad341fecc89908b5918691e7b916cbb8ca23171eabb622eb244f8300923fc0094cf0e9e72d2eb6201097cef1ae65acede1564bf0d74039d60", 0xb09f}], 0x18) 9.623387271s ago: executing program 5 (id=1041): r0 = socket$igmp(0x2, 0x3, 0x2) r1 = socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r3, @ANYBLOB="1f003300d000000008021100000108"], 0x3c}, 0x1, 0x0, 0x0, 0x4008840}, 0x10) move_pages(0x0, 0x10, &(0x7f0000000140)=[&(0x7f0000000000/0x1000)=nil], &(0x7f0000000040)=[0x1], 0x0, 0x0) 9.559555169s ago: executing program 1 (id=1042): socket$key(0xf, 0x3, 0x2) socket$vsock_stream(0x28, 0x1, 0x0) getdents64(0xffffffffffffffff, &(0x7f00000000c0)=""/40, 0xffffffffffffff73) 9.442015726s ago: executing program 4 (id=1043): r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x48c}) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000008c0)={'wlan1\x00'}) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000200)=@file={0x1, './file0\x00'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x6) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_sco_SCO_OPTIONS(r3, 0x11, 0x1, &(0x7f0000000000)=""/65, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/consoles\x00', 0x0, 0x0) sendfile(r4, r5, 0x0, 0x20000023896) mmap$binder(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x1, 0x11, r5, 0x0) 8.99744253s ago: executing program 1 (id=1044): bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) r1 = syz_open_dev$dmmidi(0x0, 0xca64, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) fcntl$notify(r1, 0x402, 0x9) writev(r2, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) syz_io_uring_submit(0x0, 0x0, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) r4 = syz_open_dev$tty1(0xc, 0x4, 0x1) r5 = dup(r4) read$FUSE(r3, &(0x7f00000030c0)={0x2020}, 0x2020) write$UHID_INPUT(r5, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) write(r3, &(0x7f00000001c0)="f300533b6d1e0e495b21fa81aed055ad5056d0c5d0e173b92187aa4455cd3c0aec5d591a67cd93283a00e9d4f1c0a01021a3ce0c3067e07c9505e69e0284094da3f63cde93de29bb2d91a160411fe0129d3ef8a311b403a9e1b79c0a786707ae6b0981c83b6a56bb380e79489291eed29590d094ac82d2cec8633b", 0x7b) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f00000005c0)=""/210) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) lseek(0xffffffffffffffff, 0x4, 0x2) sendmsg$inet6(r0, &(0x7f0000002280)={&(0x7f0000001e40)={0xa, 0x4e24, 0x0, @mcast1}, 0x1c, 0x0, 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="b005000000000000290000003600000000b2"], 0x5b0}, 0x20008001) socket$nl_route(0x10, 0x3, 0x0) 8.887984365s ago: executing program 1 (id=1045): openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="07000000040000008000000001"], 0x50) close(0xffffffffffffffff) mkdirat(0xffffffffffffff9c, 0x0, 0x1c1) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = creat(0x0, 0xecf86c37d53049cc) close(r0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000400), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01000000000000000000120000000800080000000100080009"], 0x4c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000500)={0x48, 0x2, 0x6, 0x301, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x48}}, 0x8000) sendmsg$IPSET_CMD_PROTOCOL(0xffffffffffffffff, 0x0, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x3, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x24000040}, 0x4000050) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[], 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYRES64=r2, @ANYRES32=0x0, @ANYBLOB="08b0010006820000400012800b0001006272696467650000300002800c002200000000040000000005002400010000000600080088a8"], 0x6c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) 7.809017284s ago: executing program 1 (id=1046): socket$inet6_udplite(0xa, 0x2, 0x88) r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$dmmidi(0x0, 0xca64, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) fcntl$notify(r1, 0x402, 0x9) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf01b}, {0x0}], 0x2) syz_io_uring_submit(0x0, 0x0, 0x0) r3 = syz_open_dev$vcsa(&(0x7f0000000300), 0x1, 0x102) syz_open_dev$tty1(0xc, 0x4, 0x1) read$FUSE(r3, &(0x7f00000030c0)={0x2020}, 0x2020) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000002080)={0x200f, {"20e30a30ed0d09f91b5e070987f70e06d038e7ff7fc6e5539b0d3e0e8b089b3f363063030890e0879b0af8c6e70a9b334a959b669a240d0a0af3988f7ef319520100ffe8d178708c526db51b1b5b31070d0773090acd3b78130daa61d8e8040001000000b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19300305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f6709000000a141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a027d5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf050000008000000000f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b3f3f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7af1d0e54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c01008e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2f5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d21488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e1a63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e09d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a603336c00000077cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046ca5b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe6531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e6586df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59555e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0d8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb601203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f900000930dedf800", 0x1000}}, 0x1006) write(r3, &(0x7f00000001c0)="f300533b6d1e0e495b21fa81aed055ad5056d0c5d0e173b92187aa4455cd3c0aec5d591a67cd93283a00e9d4f1c0a01021a3ce0c3067e07c9505e69e0284094da3f63cde93de29bb2d91a160411fe0129d3ef8a311b403a9e1b79c0a786707ae6b0981c83b6a56bb380e79489291eed29590d094ac82d2cec8633b", 0x7b) ioctl$EVIOCGLED(0xffffffffffffffff, 0x80404519, &(0x7f00000005c0)=""/210) openat$zero(0xffffff9c, &(0x7f00000000c0), 0x80002, 0x0) socket(0xa, 0x3, 0x3a) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000640)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="b57523cb1a2c90d8acad2e2d98dfc9ea7a5843c3b63b683ced2b3266175599b779617e66e6b3e15c042be90635a2d36160bbf9a2edcacc0bbe015b84150a1928de94397894ff36aa430fc2a0814ba634308d6d0837250dfd1eca5383f9d151449743b1a0c4ffc51242a229c5d6d06f147a61d797ea7ffeda95b76f5623", 0x7d}, {0x0}, {&(0x7f0000000300)='l3', 0x2}], 0x3}], 0x1, 0x0) lseek(r0, 0x4, 0x2) socket$nl_route(0x10, 0x3, 0x0) 7.762633596s ago: executing program 6 (id=1047): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) setxattr$security_capability(0x0, &(0x7f0000000280), 0x0, 0x0, 0x0) lsetxattr$security_capability(0x0, &(0x7f00000000c0), &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0xfffffff6}]}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000001f40)=@usbdevfs_disconnect={0x8}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x44, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x6c}, 0x1, 0x0, 0x0, 0x8890}, 0x24008084) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0xe, &(0x7f0000000380)=ANY=[], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x7, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xd, 0x1}, {0xc, 0x1}, {0xc, 0x4}, {0xd, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x9, 0x1}, {0x9, 0x5}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x5, 0x6}, @enum64={0xf, 0x4, 0x0, 0x13, 0x0, 0x0, [{0x3, 0x2, 0xa707}, {0x6, 0x63da, 0xecb}, {0x5, 0xd4c}, {0xb, 0x848, 0x6}]}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{}, {0xd, 0x1}, {0x8, 0x10000}, {0xc, 0x800}, {0xb, 0x5c}]}, @datasec={0xe, 0x4, 0x0, 0xf, 0x2, [{0x3, 0x6, 0x7}, {0x2, 0x9, 0xf3d}, {0x3, 0x8, 0x3}, {0x2, 0x40, 0x1}], "927b"}]}, {0x0, [0x5f, 0x5f, 0x61, 0x10, 0x5f]}}, &(0x7f0000000600)=""/203, 0x147, 0xcb, 0x1, 0x9, 0x10000, @value=r2}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r4}, &(0x7f0000000040), &(0x7f0000000140)=r3}, 0x20) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x6, 0x7, 0x3, 0xb840, 0x1, 0x368d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) r5 = syz_open_dev$mouse(&(0x7f00000000c0), 0x0, 0x2042) writev(r5, &(0x7f0000000280)=[{&(0x7f0000000600)="8716799b2e810800b500148b1368c211d7000023268056ac8d5db0f12c23d285b18d91425a93c62676934bf2ab864fe7a500c0306b57165bc9943747acb8c56323151336b7986047bece6c74225c3dff9de2016180f21212d1e35f1a408380dfe85913bdf60eaf3c717aea06560b136351034b4a030240299b84bf3797295c635141cc473cf9efaa71a634d075c7c916a3800bfbdbfbfad341fecc89908b5918691e7b916cbb8ca23171eabb622eb244f8300923fc0094cf0e9e72d2eb6201097cef1ae65acede1564bf0d74039d60", 0xb09f}], 0x18) 5.617363629s ago: executing program 4 (id=1048): ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000080)={'ip6_vti0\x00', 0x0}) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_settime(r0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x40, 0x7ffc0002}]}) timerfd_create(0x8, 0x80000) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000008c0)={&(0x7f0000000340)=ANY=[@ANYBLOB], 0x0, 0x38, 0x0, 0x1, 0xfffffff8}, 0x28) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, 0x0) prctl$PR_SET_TSC(0x1a, 0x1) 5.227865681s ago: executing program 1 (id=1049): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000018c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) setxattr$security_capability(0x0, 0x0, 0x0, 0x0, 0x0) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)=@v3={0x3000000, [{0x8}, {0x0, 0xfffffff6}]}, 0x18, 0x0) lgetxattr(&(0x7f0000000000)='./file0\x00', &(0x7f0000000280)=ANY=[], 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x200, 0x1) ioctl$USBDEVFS_DISCARDURB(r1, 0x550b, 0x0) ioctl$USBDEVFS_IOCTL(r1, 0xc0105512, &(0x7f0000001f40)=@usbdevfs_disconnect={0x8}) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWRULE={0x38, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x405}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @inner={{0xa}, @val={0x4}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x60}, 0x1, 0x0, 0x0, 0x8890}, 0x24008084) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0xe, &(0x7f0000000380)=ANY=[@ANYBLOB="b702000000000080bfa300000000000007030000fffeffff7a0af0fff8ffff1971a4f0ff00000000b7050000080000001e2400000000000045040400010000001704000001000a00b7040000000100006a0af2fe00000000850000001a000000b70000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x12}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x10, 0x20000000000000bc, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xa}, 0x54) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000400)={0x0, @loopback, @empty}, &(0x7f0000000440)=0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000700)={&(0x7f0000000480)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x126, 0x126, 0x7, [@volatile={0x4, 0x0, 0x0, 0x9, 0x4}, @func_proto={0x0, 0xa, 0x0, 0xd, 0x0, [{0xd, 0x1}, {0xc, 0x1}, {0xc, 0x4}, {0xd, 0x2}, {0x1, 0x4}, {0x0, 0x1}, {0x6, 0x4}, {0x6, 0x4}, {0x9, 0x1}, {0x9, 0x5}]}, @decl_tag={0x9, 0x0, 0x0, 0x11, 0x5, 0x6}, @enum64={0xf, 0x4, 0x0, 0x13, 0x0, 0x0, [{0x3, 0x2, 0xa707}, {0x6, 0x63da, 0xecb}, {0x5, 0xd4c}, {0xb, 0x848, 0x6}]}, @enum={0x10, 0x5, 0x0, 0x6, 0x4, [{}, {0xd, 0x1}, {0x8, 0x10000}, {0xc, 0x800}, {0xb, 0x5c}]}, @datasec={0xe, 0x4, 0x0, 0xf, 0x2, [{0x3, 0x6, 0x7}, {0x2, 0x9, 0xf3d}, {0x3, 0x8, 0x3}, {0x2, 0x40, 0x1}], "927b"}]}, {0x0, [0x5f, 0x5f, 0x61, 0x10, 0x5f]}}, &(0x7f0000000600)=""/203, 0x147, 0xcb, 0x1, 0x9, 0x10000, @value=r3}, 0x28) socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x12, 0x7, 0x4, 0x2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r5}, &(0x7f0000000040), &(0x7f0000000140)=r4}, 0x20) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000800)=@o_path={&(0x7f00000007c0)='./file0\x00', 0x0, 0x0, r0}, 0x18) bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000840)={0x0, 0x2, 0x10}, 0xc) bpf$MAP_CREATE(0x0, &(0x7f0000000880)=@bloom_filter={0x1e, 0x6, 0x7, 0x3, 0xb840, 0x1, 0x368d, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x4, 0x3}, 0x50) writev(0xffffffffffffffff, &(0x7f0000000280)=[{&(0x7f0000000600)="8716799b2e810800b500148b1368c211d7000023268056ac8d5db0f12c23d285b18d91425a93c62676934bf2ab864fe7a500c0306b57165bc9943747acb8c56323151336b7986047bece6c74225c3dff9de2016180f21212d1e35f1a408380dfe85913bdf60eaf3c717aea06560b136351034b4a030240299b84bf3797295c635141cc473cf9efaa71a634d075c7c916a3800bfbdbfbfad341fecc89908b5918691e7b916cbb8ca23171eabb622eb244f8300923fc0094cf0e9e72d2eb6201097cef1ae65acede1564bf0d74039d60", 0xb09f}], 0x18) 4.945794526s ago: executing program 5 (id=1050): ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000000000)={0x3, 0xffffffffffffffff, 'id1\x00'}) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000080)={@rand_addr, @rand_addr, 0x0}, &(0x7f00000000c0)=0xc) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000001c0)={r0, r1, 0x25, 0x1, @val=@uprobe_multi={&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)=[0x1], &(0x7f0000000180)=[0x3], 0x1, 0x1, 0x1, 0xffffffffffffffff}}, 0x40) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000200)={0x1, 0x1, 0x1, r1, 0x3}, 0xc) write$UHID_GET_REPORT_REPLY(r0, &(0x7f0000000240)={0xa, {0x4, 0x3, 0x8}}, 0xa) setsockopt$bt_BT_SECURITY(r0, 0x112, 0x4, &(0x7f0000000280)={0x6, 0x5}, 0x2) ioctl$sock_inet_SIOCDARP(r0, 0x8953, &(0x7f00000002c0)={{0x2, 0x4e22, @loopback}, {0x1, @random="bc264fb694f4"}, 0x10, {0x2, 0x4e21, @rand_addr=0x64010101}, 'gre0\x00'}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={r0, 0xe0, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000000340)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0xa, 0x3, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000400)=[0x0, 0x0, 0x0], 0x0, 0x1b, &(0x7f0000000440)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000480), &(0x7f00000004c0), 0x8, 0x31, 0x8, 0x8, &(0x7f0000000500)}}, 0x10) keyctl$set_reqkey_keyring(0xe, 0xfffffffffffffffe) preadv(r0, &(0x7f0000000980)=[{&(0x7f0000000680)=""/179, 0xb3}, {&(0x7f0000000740)}, {&(0x7f0000000780)=""/76, 0x4c}, {&(0x7f0000000800)}, {&(0x7f0000000840)=""/209, 0xd1}, {&(0x7f0000000940)=""/11, 0xb}], 0x6, 0x3, 0x1) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000a00)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) ioctl$FS_IOC_MEASURE_VERITY(r0, 0xc0046686, &(0x7f0000000a40)={0x4, 0xd7, "87131714aee9df4be63942ff299147de072d3c1fed63dc606d57d94183fc340fef2bc7964b9e0993e1237ea258d3f85a91df3681a9461525e166a51b174708dcbe410826cf84c09791d96dde95bd4f954a0eeb8274b59b49cbc86d342ab378cbeb8b355a83887086ea769cc7a7a664ce96b3812d5ead95bd09aac79466cb63947626f3642eff656af6b02ebdb31a3c45e34a1168881949d8ac9e885280d814fc477e18e57c32de6c34de18919a8d9c9948bbdcafd6cb675d35036b73570de31d58882480df5a9abd83ce139c81a6a4eb2f44f92aa5a122"}) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$RTC_PIE_OFF(r0, 0x7006) ioctl$KVM_CAP_X86_BUS_LOCK_EXIT(r0, 0x4068aea3, &(0x7f0000000b40)={0xc1, 0x0, 0x3}) r4 = getpid() sched_setscheduler(r4, 0x3, &(0x7f0000000bc0)=0x8001) socket$vsock_stream(0x28, 0x1, 0x0) socket$netlink(0x10, 0x3, 0xa) r5 = pidfd_getfd(r0, r3, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r5, 0xc0189379, &(0x7f0000000c00)={{0x1, 0x1, 0x18, r2}, './file0\x00'}) userfaultfd(0x80001) syz_usb_connect(0x0, 0x608, &(0x7f0000000c40)={{0x12, 0x1, 0x250, 0xfe, 0x63, 0xb3, 0x20, 0x19d2, 0x284, 0x3dc9, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x5f6, 0x1, 0x10, 0x3, 0x70, 0x81, "", [{{0x9, 0x4, 0x63, 0x6a, 0xc, 0xff, 0xff, 0xff, 0xd7, [@cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, "b5"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x80000000, 0xfff, 0xdb8, 0x7}, {0x6}, [@mbim_extended={0x8, 0x24, 0x1c, 0x9, 0x6, 0x1}, @obex={0x5, 0x24, 0x15, 0x929}]}, @cdc_ncm={{0x7, 0x24, 0x6, 0x0, 0x1, "17d2"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x400, 0x7, 0x3, 0x9}, {0x6, 0x24, 0x1a, 0x1, 0x2}, [@obex={0x5, 0x24, 0x15, 0x4}, @mdlm_detail={0x54, 0x24, 0x13, 0x80, "13451791ce6680f3695a4c3a67f709de3478a9776a44b4d578f97afc1eafbcbb893d0d2de311f0e321bb61b1b478ef47cb0c56fac8fcb9440c6d48af1925ea8ad4b6105172edac25ceb8b41afd5d154a"}, @call_mgmt={0x5, 0x24, 0x1, 0x0, 0xfd}, @mbim={0xc, 0x24, 0x1b, 0x1, 0x7ff, 0x1, 0x1, 0x2, 0xa7}, @obex={0x5, 0x24, 0x15, 0x1}]}], [{{0x9, 0x5, 0x80, 0x0, 0x8, 0x6, 0x3, 0xca, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x8, 0xb1ed}]}}, {{0x9, 0x5, 0x0, 0x0, 0x3ff, 0x6, 0x10, 0xf9, [@generic={0xe2, 0x4, "5a48bd6fde22d2aeac3e55d3b7e7d85ff62ab90f360a5f3c7cc4f62a82e245548298acc095845f758ede058b4596f97a6a4a39fdd19e7300c3269c543e0ecf4a6e7896c44bae74f37490f8dd2c801ac07610f60300e78b8d0756925b43360aa87e7afbb035d4a7f1fbde85930dede3eef43ca24de8c0857871e0e4be114ba3c09470a2660180a11041a8b21760fce45cf4d570f86d6af53ac3bf0824e1d32856920c3b84de18638b0fbea45b89e0341930d50a3ec722534a858d691ade4714beb6be1a97653200aba0db97750fb1c143a774901b1e5fefaf4f5b45f59d216b4b"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x2, 0x9}]}}, {{0x9, 0x5, 0x860773ebff3b0fc4, 0x3, 0x40, 0xa, 0x2, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x4, 0x31, 0x862d}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x8, 0x7}]}}, {{0x9, 0x5, 0x3, 0x2, 0x5b7, 0x9, 0xcc, 0x6, [@generic={0x4f, 0x30, "da18e47028971af1d2841c22af992450ccb138e055651b5f19489acc885b8a033c78c3b608ddf32ad5a21a094088dafdb23ce8981a20dc2bc1d8662811ca4d6a726a89a4f77f4946310fb73946"}, @generic={0x33, 0x23, "5689b0b284a931d274e27787773c78350f621f2b2fb9016adc8dd34c7f2f5dc0eb4e1de99d0eb52877ff72bf4399148fd5"}]}}, {{0x9, 0x5, 0x80, 0x10, 0x8, 0x8, 0x7f, 0xa6, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0xc, 0x8}]}}, {{0x9, 0x5, 0x7, 0x10, 0x3ff, 0x6, 0xc, 0x3, [@uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x9}]}}, {{0x9, 0x5, 0xa, 0x4, 0x3ff, 0x0, 0x0, 0x2, [@generic={0x38, 0xe, "571cd3b3a3928b7ffa1625b360b2395460351ec29dd317d89ebb5b59b9d52c26c6bf5bf161f612c30517c2585ca2b07886dca5313138"}, @generic={0x77, 0x7, "52fef790fa89da8c7d3cb835b4412663cb8e80c8b900e9979d96739e6e75c2ca380cf0ad5819ce736bceef4e710c428f53ed9071067202ae19cef9038a986f6dddb47d5dd398f943249ec97fdede0678c4291912e5f676aba9244e3fd1f3af899c42e98186f71d9352543c95d6687f8a1032e87332"}]}}, {{0x9, 0x5, 0x5, 0x10, 0x3ff, 0x1, 0x1, 0x3}}, {{0x9, 0x5, 0xc, 0x2, 0x10, 0x8, 0xf, 0xff, [@generic={0x25, 0x1, "de624e58030299aae409f283249c9840e60907909bc75512f56ba916a3730ed9c2267e"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x1, 0x9}]}}, {{0x9, 0x5, 0x5, 0x10, 0x8, 0x57, 0x8, 0x5, [@generic={0x94, 0x3, "b0a865366f1f28157bac11995e67ced992f314036ed62ed56003e03863fcf9f978fe43fbc3f88b4b43a31685d830d74b0af5cb3b86aa91e39dc48680f70aced703e2d7665975dc1ddf2b53dbd80ff50cd5ed07910494696fa62930525521b4b36a3701d8bb1e91e81748c30c56a672643ccc094090a85e81b2201f7d874db75d986e0a29c2eca386c9198587cc2c358a7632"}, @uac_iso={0x7, 0x25, 0x1, 0xc, 0x7, 0x2}]}}, {{0x9, 0x5, 0xb, 0x0, 0x3ff, 0x5, 0x1d, 0x9}}, {{0x9, 0x5, 0x6, 0x8, 0x20, 0x5, 0xc, 0x6, [@generic={0xf1, 0xb, "a9be8fa35e168ac38b1005c10d080059e2716809ea439ef941e79e7adbddd610ad2080efb7513ba8a9df2933c362e2ba97a43eeab34ec4e93719c22893671f3bca2e321f365616a33e7abe52551bafbb82a09dbd7d7c48030e5a082371b61dfa98afbd8eec499f1f5d30129c2455e1cff654ffb7aa5c680b108d511c70a07b8859be94520744c0a3f0c396777ea343f18614385f5b8316b25bc7b3b4f390ba9ab1961a612fcbee188011e527cb7523888696849dcaeeb84e06ab0a3b023a5bf24dfa51936f6a2b3f362fcd53f8e44d44c04a31bf4a7e3e1f2e40aa2bfda552e1aef6da96af4489e43a961446735918"}, @generic={0xca, 0xa, "af968ff4ab1a74979b4092971a3c4db039175a96481e21ab85baaade380818687e87dac7f47d75744af89d890fe74c91f7fd4381495ee4cf59354ab9c1d6c059cc4470343c292e0cf95d0ab317acd9ccf19c2e5238d498e119f9f024ea934d4050b29ffd3e62ee10f21ed6159a8ffe8b6a6bd799504cb50c22a8d4c37c3f15f86823de93c2458a8b50ee1f6a7a63bbf5c672df66e40f84a4ea5e8893f456e77d23a0eabc0f75c19e07ea11607c027208eee33213bdaabecc4044427ab825b64ce5234ee9e909a2db"}]}}]}}]}}]}}, &(0x7f0000001540)={0xa, &(0x7f0000001280)={0xa, 0x6, 0x110, 0x2, 0x3, 0x8, 0x8, 0x1}, 0xfe, &(0x7f00000012c0)={0x5, 0xf, 0xfe, 0x6, [@ss_container_id={0x14, 0x10, 0x4, 0xe5, "f807e5e3890d778cb6cec21131f2f4ac"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0xc, 0xe, 0xd, 0x7}, @ptm_cap={0x3}, @generic={0xc7, 0x10, 0x2, "d2bf334e5b1577af379158cb5ec6a847cae594ef4bb3f16b8b10085bca91fba4f7f6844070e6bb6dfe98608d1866f4be7bb9c9903017afb38bd7889483001e11cb61b8600a466348f26486dfffdd2ef8cd520951742d22c6ba4228c47acd7bbda1474d125725284422f42d091dc928a52de03508f94b2fc06e1891a8ca4b6c8abb9d5f3c122a257d21a887ceddf94b761648eb568573c8b964ef02d16601c5d5a91636eb0e3eea71d1d2fd1a5ec03128da1fb0182880a492251e1b09713d7d43ad45f761"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x5, 0x7, 0x6, 0x3}, @ext_cap={0x7, 0x10, 0x2, 0x8, 0x3, 0x1, 0x4}]}, 0x4, [{0x4, &(0x7f00000013c0)=@lang_id={0x4, 0x3, 0x423}}, {0x4, &(0x7f0000001400)=@lang_id={0x4, 0x3, 0x416}}, {0x94, &(0x7f0000001440)=@string={0x94, 0x3, "e00fc1c3a2bd20baef1caa87600bde126a5f4b0168585e2d6cee7ba3508c8260f9db63a4ccdfc06a407f7f765baa3b86ea305be47e56ad91307ac966162dd5d65012ae51c2346d35b5c19c9c699c98a628acde7fbbad4190ed96c74c6f25f511d353b059fd7cfb05fcea9a3b264702117b893c863121a12da845b6f79519415c326ddc922d48b95f3d7b3b178bbd3d5a9b9d"}}, {0x3e, &(0x7f0000001500)=@string={0x3e, 0x3, "f7bd225edc84b6e1eee23ca23b80ea6139b27f117bf92ef987aaf83098ca3a60f13d787e19b5f79aba859427ad258ef0adb20f6058baa0e4970207d7"}}]}) syz_usb_connect$midi(0x3, 0x95, &(0x7f00000015c0)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x499, 0x101b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x83, 0x1, 0x1, 0xd3, 0x80, 0xa, "", {{{0x9, 0x4, 0x0, 0x0, 0x1, 0x1, 0x3, 0x30, 0x0, [@midi_out_jack={0xb, 0x24, 0x3, 0x1, 0x6, 0x2, [{0xf2, 0xb4}, {0x8, 0x6}], 0x40}, @midi_out_jack={0x1b, 0x24, 0x3, 0x2, 0x3, 0xa, [{0x1}, {0x34, 0x31}, {0x99}, {0x99, 0x9}, {0x2, 0xef}, {0x1, 0x8}, {0x1}, {0x9, 0x7}, {0x6, 0x5}, {0x2, 0x6}], 0x2}, @midi_out_jack={0x15, 0x24, 0x3, 0x2, 0x99, 0x7, [{0xba, 0x67}, {0xb, 0x3}, {0x8, 0x2}, {0x1, 0xfc}, {0x6, 0x4}, {0x4, 0x2}, {0x6, 0x2}], 0x3}, @midi_in_jack={0x6, 0x24, 0x2, 0x2, 0x3}, @ms_header={0x7, 0x24, 0x1, 0x8000, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x7, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x5, 0x7}, @ms_header={0x7, 0x24, 0x1, 0x4, 0x7}], [{{0x9, 0x5, 0x7, 0x10, 0x3ff, 0xb, 0xa, 0x0, {0xb, 0x25, 0x1, 0x7, "8e20ab88d7efad"}}}]}}}}}]}}, &(0x7f00000017c0)={0xa, &(0x7f0000001680)={0xa, 0x6, 0x200, 0xf3, 0x77, 0x4, 0xff, 0x9}, 0x5, &(0x7f00000016c0)={0x5, 0xf, 0x5}, 0x1, [{0xb0, &(0x7f0000001700)=@string={0xb0, 0x3, "d6048f5de5f6c1fe47a29a259fb08bbe69b99d0a6fb3c963db3ef1b06742fc402974976873d43bacf1d0d6884f7a7d1ad7d3b152d7c0003f0a3d9f120d9f27f3e4fd9194e78920d0d9e173156c143c923c7f813796b558da38ca11312bb270e19567bdd658892cd64c3aadb2094734c0667c059d39870f47809b75d06c64a9446c981dda37cc8dc616cb9ea46e3f7d1646d5d57fd94f1a10c183d4a40cfcda58b9e371a9f6d63c3990d7b075c5c1"}}]}) statx(r0, &(0x7f0000001800)='./file0\x00', 0x6000, 0x40, &(0x7f0000001840)={0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x8, &(0x7f0000001940)=[0xee01, 0xee00, 0xffffffffffffffff, 0xee00, 0xee01, 0xee01, 0x0, 0x0]) setsockopt$sock_cred(r6, 0x1, 0x11, &(0x7f0000001980)={0x0, r7, r8}, 0xc) read$watch_queue(r0, &(0x7f00000019c0)=""/50, 0x32) fsetxattr$trusted_overlay_upper(r6, &(0x7f0000001a00), &(0x7f0000001a40)={0x0, 0xfb, 0xe5, 0x0, 0x6, "5fdf09007bcc3e000b2b9ae9f3eabdad", "9a2afd9b4409beda39a1e7d5f6c5a5a97fb72f9cb4b4dfc3041442ccdc44787eb6aa17be4994ebf321c55f3bc162307d66547b169a019c2b016450d6bbfbcdf44f032fa2c4337dc265591d4e70518bb37f52df8b88eb3b17d610f57952fd93911a037461301998558dc32dee28ca00343102780d32f4eb2ea754c002def5493cbbe9438ea938679366c4dd2eacd76d19b734528e9ee4b39aadf2a5c308b643c4b8c9be1b15fbe59e83822fc86d62373c78acad301b1c3f20fb5ac0413693d0b62ac82209ea0db4966f76035fe27e3df0"}, 0xe5, 0x3) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, &(0x7f0000001b40)={{0xa, 0x4e22, 0x80000001, @remote, 0x1}, {0xa, 0x4e23, 0x2, @mcast1, 0x8}, 0x1, {[0xe, 0x1, 0x6, 0x6, 0x9, 0xd880000, 0x101, 0x7]}}, 0x5c) 55.990233ms ago: executing program 5 (id=1051): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r0, 0x3b8c, &(0x7f00000003c0)={0x30, 0x0, 0x7ffffffe, 0x0, 0x40, 0x6, 0x3, &(0x7f00000006c0)=""/188}) 319.614µs ago: executing program 6 (id=1052): write$smackfs_change_rule(0xffffffffffffffff, 0x0, 0x0) 0s ago: executing program 4 (id=1053): socket$can_raw(0x1d, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) connect$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x0, 0x0) add_key(0x0, &(0x7f0000000280)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffe) bind$netlink(0xffffffffffffffff, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x7) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmmsg(r1, &(0x7f0000000480), 0x2e9, 0x36) kernel console output (not intermixed with test programs): =_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 277.753673][ T36] audit: type=1326 audit(1772490627.532:2759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 277.753699][ T36] audit: type=1326 audit(1772490627.532:2760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 277.753721][ T36] audit: type=1326 audit(1772490627.532:2761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 277.753741][ T36] audit: type=1326 audit(1772490627.532:2762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 277.753760][ T36] audit: type=1326 audit(1772490627.532:2763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 277.753780][ T36] audit: type=1326 audit(1772490627.532:2764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7546 comm="syz.3.484" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f16bd88c799 code=0x7ffc0000 [ 278.327219][ T5897] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 279.260173][ T5897] usb 1-1: Using ep0 maxpacket: 32 [ 279.262312][ T5897] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 279.262344][ T5897] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 279.262382][ T5897] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 279.262405][ T5897] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 279.316450][ T5897] usb 1-1: config 0 descriptor?? [ 279.359977][ T5897] hub 1-1:0.0: USB hub found [ 279.442403][ T7568] netlink: 16 bytes leftover after parsing attributes in process `syz.1.490'. [ 279.442426][ T7568] netlink: 16 bytes leftover after parsing attributes in process `syz.1.490'. [ 280.392564][ T5897] hub 1-1:0.0: config failed, can't read hub descriptor (err -22) [ 280.606245][ T5897] usbhid 1-1:0.0: can't add hid device: -71 [ 280.606368][ T5897] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 281.099853][ T5897] usb 1-1: USB disconnect, device number 12 [ 282.307340][ T7585] netlink: 24 bytes leftover after parsing attributes in process `syz.0.495'. [ 282.307366][ T7585] netlink: 24 bytes leftover after parsing attributes in process `syz.0.495'. [ 282.638426][ T7594] syz.3.498 uses obsolete (PF_INET,SOCK_PACKET) [ 286.441338][ T7608] netlink: 16 bytes leftover after parsing attributes in process `syz.0.503'. [ 286.556644][ T7608] netlink: 16 bytes leftover after parsing attributes in process `syz.0.503'. [ 287.382292][ T7614] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 287.845380][ T7614] bond1 (unregistering): Released all slaves [ 296.348059][ T7673] netlink: 8 bytes leftover after parsing attributes in process `syz.3.525'. [ 297.336905][ T5946] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 297.434344][ T7683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.527'. [ 297.434363][ T7683] netlink: 16 bytes leftover after parsing attributes in process `syz.4.527'. [ 297.767076][ T5946] usb 3-1: Using ep0 maxpacket: 32 [ 298.576302][ T5946] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 298.576337][ T5946] usb 3-1: config 0 has no interface number 0 [ 298.605135][ T5946] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 298.605166][ T5946] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 298.605186][ T5946] usb 3-1: Product: syz [ 298.605200][ T5946] usb 3-1: Manufacturer: syz [ 298.605214][ T5946] usb 3-1: SerialNumber: syz [ 298.774508][ T5946] usb 3-1: config 0 descriptor?? [ 298.803321][ T5946] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 299.874506][ T5946] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 299.886020][ T5946] usb 3-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 300.139460][ C0] usb 3-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 300.142605][ T5897] usb 3-1: USB disconnect, device number 7 [ 300.191464][ T5897] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 300.247546][ T5897] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 300.248059][ T5897] quatech2 3-1:0.51: device disconnected [ 300.302123][ T7694] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 300.787400][ T7694] bond1 (unregistering): Released all slaves [ 303.323004][ T7734] netlink: 'syz.4.541': attribute type 1 has an invalid length. [ 303.323037][ T7734] netlink: 4 bytes leftover after parsing attributes in process `syz.4.541'. [ 306.447015][ T808] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 306.596907][ T808] usb 2-1: Using ep0 maxpacket: 32 [ 306.830284][ T808] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 306.830321][ T808] usb 2-1: config 0 has no interface number 0 [ 307.005203][ T808] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 307.005240][ T808] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 307.005294][ T808] usb 2-1: Product: syz [ 307.005341][ T808] usb 2-1: Manufacturer: syz [ 307.005392][ T808] usb 2-1: SerialNumber: syz [ 307.075478][ T808] usb 2-1: config 0 descriptor?? [ 307.201792][ T808] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 307.771100][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 307.977351][ T808] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 308.023737][ T808] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 308.099999][ T808] usb 2-1: USB disconnect, device number 7 [ 308.112592][ T808] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 308.115528][ T808] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 308.116011][ T808] quatech2 2-1:0.51: device disconnected [ 310.662867][ T7785] FAULT_INJECTION: forcing a failure. [ 310.662867][ T7785] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 310.662917][ T7785] CPU: 0 UID: 0 PID: 7785 Comm: syz.0.552 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 310.662937][ T7785] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 310.662954][ T7785] Call Trace: [ 310.662965][ T7785] [ 310.662973][ T7785] dump_stack_lvl+0xe8/0x150 [ 310.663014][ T7785] should_fail_ex+0x46b/0x600 [ 310.663048][ T7785] _copy_from_user+0x2d/0xb0 [ 310.663071][ T7785] ___sys_sendmsg+0x1c6/0x360 [ 310.663100][ T7785] ? __pfx____sys_sendmsg+0x10/0x10 [ 310.663155][ T7785] ? __fget_files+0x2a/0x420 [ 310.663183][ T7785] ? __fget_files+0x3a6/0x420 [ 310.663212][ T7785] __x64_sys_sendmsg+0x1c3/0x2a0 [ 310.663238][ T7785] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 310.663268][ T7785] ? __pfx_ksys_write+0x10/0x10 [ 310.663302][ T7785] do_syscall_64+0x14d/0xf80 [ 310.663324][ T7785] ? trace_irq_disable+0x3b/0x150 [ 310.663344][ T7785] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.663362][ T7785] ? clear_bhb_loop+0x40/0x90 [ 310.663384][ T7785] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 310.663402][ T7785] RIP: 0033:0x7f1fecbfc799 [ 310.663424][ T7785] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 310.663438][ T7785] RSP: 002b:00007f1feae4e028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 310.663466][ T7785] RAX: ffffffffffffffda RBX: 00007f1fece75fa0 RCX: 00007f1fecbfc799 [ 310.663479][ T7785] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000006 [ 310.663490][ T7785] RBP: 00007f1feae4e090 R08: 0000000000000000 R09: 0000000000000000 [ 310.663501][ T7785] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 310.663512][ T7785] R13: 00007f1fece76038 R14: 00007f1fece75fa0 R15: 00007fff7f3f1098 [ 310.663540][ T7785] [ 312.955409][ T7814] netlink: 12 bytes leftover after parsing attributes in process `syz.0.561'. [ 313.319196][ T7815] FAULT_INJECTION: forcing a failure. [ 313.319196][ T7815] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 313.319229][ T7815] CPU: 0 UID: 0 PID: 7815 Comm: syz.1.560 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 313.319290][ T7815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 313.319301][ T7815] Call Trace: [ 313.319308][ T7815] [ 313.319316][ T7815] dump_stack_lvl+0xe8/0x150 [ 313.319360][ T7815] should_fail_ex+0x46b/0x600 [ 313.319409][ T7815] _copy_from_user+0x2d/0xb0 [ 313.319432][ T7815] ___sys_sendmsg+0x1c6/0x360 [ 313.319468][ T7815] ? __pfx____sys_sendmsg+0x10/0x10 [ 313.319542][ T7815] ? __fget_files+0x2a/0x420 [ 313.319564][ T7815] ? __fget_files+0x3a6/0x420 [ 313.319594][ T7815] __x64_sys_sendmsg+0x1c3/0x2a0 [ 313.319620][ T7815] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 313.319653][ T7815] ? __pfx_ksys_write+0x10/0x10 [ 313.319688][ T7815] do_syscall_64+0x14d/0xf80 [ 313.319711][ T7815] ? trace_irq_disable+0x3b/0x150 [ 313.319731][ T7815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.319749][ T7815] ? clear_bhb_loop+0x40/0x90 [ 313.319772][ T7815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 313.319789][ T7815] RIP: 0033:0x7feb0763c799 [ 313.319806][ T7815] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 313.319821][ T7815] RSP: 002b:00007feb05896028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 313.319840][ T7815] RAX: ffffffffffffffda RBX: 00007feb078b5fa0 RCX: 00007feb0763c799 [ 313.319853][ T7815] RDX: 0000000024000804 RSI: 0000200000000000 RDI: 0000000000000006 [ 313.319865][ T7815] RBP: 00007feb05896090 R08: 0000000000000000 R09: 0000000000000000 [ 313.319876][ T7815] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 313.319887][ T7815] R13: 00007feb078b6038 R14: 00007feb078b5fa0 R15: 00007ffd69f02bb8 [ 313.319916][ T7815] [ 315.999501][ T7822] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 316.038724][ T7822] bond1 (unregistering): Released all slaves [ 317.144076][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 317.144122][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 317.797331][ T1228] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 318.175827][ T1228] usb 5-1: Using ep0 maxpacket: 32 [ 318.188688][ T1228] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 318.188721][ T1228] usb 5-1: config 0 has no interface number 0 [ 318.226643][ T1228] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 318.226681][ T1228] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 318.227283][ T1228] usb 5-1: Product: syz [ 318.227332][ T1228] usb 5-1: Manufacturer: syz [ 318.227380][ T1228] usb 5-1: SerialNumber: syz [ 318.421085][ T1228] usb 5-1: config 0 descriptor?? [ 318.425436][ T1228] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 318.675438][ T1228] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 319.062982][ C1] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 319.159959][ T1228] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 319.647057][ T1228] usb 5-1: USB disconnect, device number 8 [ 319.668238][ T1228] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 319.716315][ T1228] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 319.742229][ T1228] quatech2 5-1:0.51: device disconnected [ 319.855996][ T7889] FAULT_INJECTION: forcing a failure. [ 319.855996][ T7889] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 319.856028][ T7889] CPU: 0 UID: 0 PID: 7889 Comm: syz.2.582 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 319.856048][ T7889] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 319.856059][ T7889] Call Trace: [ 319.856066][ T7889] [ 319.856074][ T7889] dump_stack_lvl+0xe8/0x150 [ 319.856105][ T7889] should_fail_ex+0x46b/0x600 [ 319.856137][ T7889] _copy_from_user+0x2d/0xb0 [ 319.856161][ T7889] ___sys_sendmsg+0x1c6/0x360 [ 319.856191][ T7889] ? __pfx____sys_sendmsg+0x10/0x10 [ 319.856247][ T7889] ? __fget_files+0x2a/0x420 [ 319.856268][ T7889] ? __fget_files+0x3a6/0x420 [ 319.856298][ T7889] __x64_sys_sendmsg+0x1c3/0x2a0 [ 319.856324][ T7889] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 319.856356][ T7889] ? __pfx_ksys_write+0x10/0x10 [ 319.856392][ T7889] do_syscall_64+0x14d/0xf80 [ 319.856415][ T7889] ? trace_irq_disable+0x3b/0x150 [ 319.856435][ T7889] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.856453][ T7889] ? clear_bhb_loop+0x40/0x90 [ 319.856475][ T7889] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 319.856493][ T7889] RIP: 0033:0x7fc9e378c799 [ 319.856511][ T7889] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 319.856532][ T7889] RSP: 002b:00007fc9e19e6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 319.856551][ T7889] RAX: ffffffffffffffda RBX: 00007fc9e3a05fa0 RCX: 00007fc9e378c799 [ 319.856564][ T7889] RDX: 0000000060008014 RSI: 0000200000000940 RDI: 0000000000000003 [ 319.856576][ T7889] RBP: 00007fc9e19e6090 R08: 0000000000000000 R09: 0000000000000000 [ 319.856588][ T7889] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 319.856598][ T7889] R13: 00007fc9e3a06038 R14: 00007fc9e3a05fa0 R15: 00007fff54816328 [ 319.856627][ T7889] [ 321.015214][ T7906] netlink: 16 bytes leftover after parsing attributes in process `syz.1.588'. [ 323.011135][ T7915] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 323.055272][ T7915] bond1 (unregistering): Released all slaves [ 323.365542][ T7932] netlink: 192 bytes leftover after parsing attributes in process `syz.2.593'. [ 326.502013][ T36] kauditd_printk_skb: 16 callbacks suppressed [ 326.502026][ T36] audit: type=1326 audit(1772490676.282:2781): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.502232][ T36] audit: type=1326 audit(1772490676.282:2782): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.519041][ T36] audit: type=1326 audit(1772490676.302:2783): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.520442][ T36] audit: type=1326 audit(1772490676.302:2784): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.521685][ T36] audit: type=1326 audit(1772490676.302:2785): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.522918][ T36] audit: type=1326 audit(1772490676.302:2786): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.527772][ T36] audit: type=1326 audit(1772490676.312:2787): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.529503][ T36] audit: type=1326 audit(1772490676.312:2788): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.530939][ T36] audit: type=1326 audit(1772490676.312:2789): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 326.532138][ T36] audit: type=1326 audit(1772490676.312:2790): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=7943 comm="syz.1.596" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7feb075ddb19 code=0x7ffc0000 [ 327.101313][ T5867] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 327.335756][ T5867] usb 5-1: Using ep0 maxpacket: 32 [ 327.388727][ T5867] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 327.388755][ T5867] usb 5-1: config 0 has no interface number 0 [ 327.455770][ T5867] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 327.455799][ T5867] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 327.455818][ T5867] usb 5-1: Product: syz [ 327.455832][ T5867] usb 5-1: Manufacturer: syz [ 327.455845][ T5867] usb 5-1: SerialNumber: syz [ 327.599108][ T5867] usb 5-1: config 0 descriptor?? [ 327.820106][ T5867] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 328.154647][ T5867] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 328.184953][ T5867] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 328.514984][ T7962] netlink: 16 bytes leftover after parsing attributes in process `syz.1.602'. [ 328.535899][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 328.536526][ T5867] usb 5-1: USB disconnect, device number 9 [ 328.575442][ T5867] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 328.604566][ T5867] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 328.605066][ T5867] quatech2 5-1:0.51: device disconnected [ 334.979049][ T5867] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 335.579153][ T5867] usb 2-1: Using ep0 maxpacket: 32 [ 335.771516][ T5867] usb 2-1: unable to get BOS descriptor or descriptor too short [ 335.970241][ T5867] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 335.970267][ T5867] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 335.977431][ T5867] usb 2-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 335.977458][ T5867] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 335.977477][ T5867] usb 2-1: Product: syz [ 335.977490][ T5867] usb 2-1: Manufacturer: syz [ 335.977504][ T5867] usb 2-1: SerialNumber: syz [ 336.265523][ T5867] usb 2-1: USB disconnect, device number 8 [ 339.886817][ T8056] netlink: 60 bytes leftover after parsing attributes in process `syz.3.631'. [ 340.670853][ T5867] usb 1-1: new full-speed USB device number 13 using dummy_hcd [ 341.492785][ T5867] usb 1-1: config 0 has an invalid descriptor of length 225, skipping remainder of the config [ 341.492812][ T5867] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 341.492847][ T5867] usb 1-1: New USB device found, idVendor=150a, idProduct=1203, bcdDevice= 0.00 [ 341.492868][ T5867] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 341.562719][ T5867] usb 1-1: config 0 descriptor?? [ 342.052805][ T8053] FAULT_INJECTION: forcing a failure. [ 342.052805][ T8053] name failslab, interval 1, probability 0, space 0, times 1 [ 342.052935][ T8053] CPU: 1 UID: 0 PID: 8053 Comm: syz.0.629 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 342.052956][ T8053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 342.052970][ T8053] Call Trace: [ 342.052977][ T8053] [ 342.052985][ T8053] dump_stack_lvl+0xe8/0x150 [ 342.053019][ T8053] should_fail_ex+0x46b/0x600 [ 342.053050][ T8053] should_failslab+0xa8/0x100 [ 342.053077][ T8053] kmem_cache_alloc_node_noprof+0x8f/0x6e0 [ 342.053099][ T8053] ? zswap_store+0xb68/0x1f80 [ 342.053122][ T8053] zswap_store+0xb68/0x1f80 [ 342.053144][ T8053] ? zswap_store+0x6ec/0x1f80 [ 342.053164][ T8053] ? irqentry_exit+0x59e/0x620 [ 342.053184][ T8053] ? rcu_is_watching+0x15/0xb0 [ 342.053208][ T8053] ? __pfx_zswap_store+0x10/0x10 [ 342.053232][ T8053] ? swap_writeout+0x4e1/0xcf0 [ 342.053252][ T8053] ? zswap_store+0x10/0x1f80 [ 342.053275][ T8053] swap_writeout+0x6f3/0xcf0 [ 342.053304][ T8053] shrink_folio_list+0x3367/0x4f40 [ 342.053347][ T8053] ? __lock_acquire+0x6b5/0x2cf0 [ 342.053373][ T8053] ? __pfx_shrink_folio_list+0x10/0x10 [ 342.053426][ T8053] ? trace_sched_exit_tp+0x3a/0x150 [ 342.053456][ T8053] ? __schedule+0x1569/0x5240 [ 342.053499][ T8053] reclaim_folio_list+0x100/0x460 [ 342.053531][ T8053] ? __pfx_reclaim_folio_list+0x10/0x10 [ 342.053554][ T8053] ? preempt_schedule_common+0x82/0xd0 [ 342.053575][ T8053] ? preempt_schedule_thunk+0x16/0x30 [ 342.053600][ T8053] reclaim_pages+0x45b/0x530 [ 342.053617][ T8053] ? _raw_spin_unlock_irqrestore+0x74/0x80 [ 342.053648][ T8053] ? __pfx_reclaim_pages+0x10/0x10 [ 342.053674][ T8053] madvise_cold_or_pageout_pte_range+0x16dd/0x1920 [ 342.053709][ T8053] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 342.053731][ T8053] ? __pfx_madvise_cold_or_pageout_pte_range+0x10/0x10 [ 342.053757][ T8053] walk_pgd_range+0x1038/0x1cf0 [ 342.053815][ T8053] ? __pfx_walk_pgd_range+0x10/0x10 [ 342.053838][ T8053] ? __walk_page_range+0x133/0x710 [ 342.053864][ T8053] __walk_page_range+0x14c/0x710 [ 342.053893][ T8053] ? __pfx___schedule+0x10/0x10 [ 342.053919][ T8053] walk_page_range_vma_unsafe+0x309/0x410 [ 342.053948][ T8053] ? __pfx_walk_page_range_vma_unsafe+0x10/0x10 [ 342.053981][ T8053] ? walk_page_range_vma+0x6b/0x90 [ 342.054005][ T8053] madvise_vma_behavior+0x27f9/0x42d0 [ 342.054032][ T8053] ? __pfx_madvise_vma_behavior+0x10/0x10 [ 342.054050][ T8053] ? trace_sched_exit_tp+0x3a/0x150 [ 342.054069][ T8053] ? __schedule+0x1569/0x5240 [ 342.054115][ T8053] ? __pfx___schedule+0x10/0x10 [ 342.054148][ T8053] ? irqentry_exit+0x59e/0x620 [ 342.054171][ T8053] ? lockdep_hardirqs_on+0x7a/0x110 [ 342.054191][ T8053] ? irqentry_exit+0x59e/0x620 [ 342.054210][ T8053] ? trace_irq_disable+0x3b/0x150 [ 342.054253][ T8053] ? mas_prev_slot+0xb34/0xbb0 [ 342.054289][ T8053] ? find_vma_prev+0x123/0x1b0 [ 342.054314][ T8053] ? __pfx_find_vma_prev+0x10/0x10 [ 342.054348][ T8053] ? __lock_acquire+0x6b5/0x2cf0 [ 342.054367][ T8053] madvise_walk_vmas+0x573/0xae0 [ 342.054394][ T8053] ? __pfx_madvise_walk_vmas+0x10/0x10 [ 342.054416][ T8053] ? blk_start_plug+0x6e/0x1b0 [ 342.054445][ T8053] madvise_do_behavior+0x386/0x540 [ 342.054479][ T8053] ? __pfx_madvise_do_behavior+0x10/0x10 [ 342.054492][ T8053] ? down_read+0x156/0x200 [ 342.054528][ T8053] do_madvise+0x1b3/0x270 [ 342.054562][ T8053] ? __pfx_do_madvise+0x10/0x10 [ 342.054608][ T8053] __x64_sys_madvise+0xa6/0xc0 [ 342.054629][ T8053] do_syscall_64+0x14d/0xf80 [ 342.054652][ T8053] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.054669][ T8053] ? clear_bhb_loop+0x40/0x90 [ 342.054689][ T8053] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 342.054706][ T8053] RIP: 0033:0x7f1fecbfc799 [ 342.054723][ T8053] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 342.054736][ T8053] RSP: 002b:00007f1feae4e028 EFLAGS: 00000246 ORIG_RAX: 000000000000001c [ 342.054761][ T8053] RAX: ffffffffffffffda RBX: 00007f1fece75fa0 RCX: 00007f1fecbfc799 [ 342.054774][ T8053] RDX: 0000000000000015 RSI: 0000000000600003 RDI: 0000200000000000 [ 342.054785][ T8053] RBP: 00007f1feae4e090 R08: 0000000000000000 R09: 0000000000000000 [ 342.054796][ T8053] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 342.054807][ T8053] R13: 00007f1fece76038 R14: 00007f1fece75fa0 R15: 00007fff7f3f1098 [ 342.054835][ T8053] [ 342.326916][ T5867] usb 1-1: string descriptor 0 read error: -71 [ 342.633967][ T5867] usb 1-1: USB disconnect, device number 13 [ 343.532838][ T8090] netlink: 40 bytes leftover after parsing attributes in process `syz.1.640'. [ 343.784912][ T8085] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 343.892261][ T8085] bond1 (unregistering): Released all slaves [ 344.836809][ T8101] netlink: 60 bytes leftover after parsing attributes in process `syz.1.643'. [ 345.121813][ T5897] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 345.944442][ T5897] usb 1-1: Using ep0 maxpacket: 32 [ 345.945967][ T5897] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 345.945982][ T5897] usb 1-1: config 0 has no interface number 0 [ 345.952379][ T5897] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 345.952407][ T5897] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 345.952426][ T5897] usb 1-1: Product: syz [ 345.952440][ T5897] usb 1-1: Manufacturer: syz [ 345.952453][ T5897] usb 1-1: SerialNumber: syz [ 345.968813][ T5897] usb 1-1: config 0 descriptor?? [ 345.985964][ T5897] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 346.250724][ T5897] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 346.717853][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 346.827823][ T5897] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 346.863088][ T5897] usb 1-1: USB disconnect, device number 14 [ 346.904275][ T5897] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 346.945209][ T5897] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 346.946114][ T5897] quatech2 1-1:0.51: device disconnected [ 346.974169][ T8114] netlink: 40 bytes leftover after parsing attributes in process `syz.2.648'. [ 349.353709][ T8145] netlink: 60 bytes leftover after parsing attributes in process `syz.1.656'. [ 351.327753][ T8158] netlink: 32 bytes leftover after parsing attributes in process `syz.0.659'. [ 351.387486][ T8160] netlink: 16 bytes leftover after parsing attributes in process `syz.3.661'. [ 351.446834][ T5860] usb 5-1: new full-speed USB device number 10 using dummy_hcd [ 351.599912][ T5860] usb 5-1: unable to get BOS descriptor or descriptor too short [ 351.600422][ T5860] usb 5-1: not running at top speed; connect to a high speed hub [ 351.601522][ T5860] usb 5-1: config 10 has an invalid interface number: 173 but max is 1 [ 351.601536][ T5860] usb 5-1: config 10 has an invalid interface number: 3 but max is 1 [ 351.601546][ T5860] usb 5-1: config 10 has no interface number 0 [ 351.601555][ T5860] usb 5-1: config 10 has no interface number 1 [ 351.601578][ T5860] usb 5-1: config 10 interface 3 has no altsetting 0 [ 351.603437][ T5860] usb 5-1: New USB device found, idVendor=11ba, idProduct=1003, bcdDevice=14.c2 [ 351.603452][ T5860] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 351.603462][ T5860] usb 5-1: Product: syz [ 351.603470][ T5860] usb 5-1: Manufacturer: syz [ 351.603477][ T5860] usb 5-1: SerialNumber: syz [ 351.666889][ T37] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 351.767295][ T5897] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 351.958494][ T37] usb 1-1: Using ep0 maxpacket: 32 [ 352.021964][ T5897] usb 2-1: Using ep0 maxpacket: 32 [ 352.121582][ T5897] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 352.121778][ T5897] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 352.121982][ T5897] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 352.122061][ T5897] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 352.126221][ T37] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 352.126329][ T37] usb 1-1: config 0 has no interface number 0 [ 352.265538][ T37] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 352.265567][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 352.265587][ T37] usb 1-1: Product: syz [ 352.265600][ T37] usb 1-1: Manufacturer: syz [ 352.265613][ T37] usb 1-1: SerialNumber: syz [ 352.280829][ T5860] pvrusb2: Hardware description: OnAir Creator Hybrid USB tuner [ 352.301643][ T37] usb 1-1: config 0 descriptor?? [ 352.317128][ T5897] usb 2-1: config 0 descriptor?? [ 352.334267][ T37] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 352.354609][ T5897] hub 2-1:0.0: USB hub found [ 352.365480][ T2368] pvrusb2: Invalid write control endpoint [ 352.414260][ T5860] pvrusb2: Hardware description: OnAir Creator Hybrid USB tuner [ 352.414705][ T5860] usb 5-1: selecting invalid altsetting 0 [ 352.449036][ T5860] usb 5-1: USB disconnect, device number 10 [ 352.589624][ T5897] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 352.592242][ T37] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 352.663323][ T37] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 352.687090][ T8172] netlink: 'syz.3.665': attribute type 1 has an invalid length. [ 352.687127][ T8172] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 352.921055][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 352.922180][ T5874] usb 1-1: USB disconnect, device number 15 [ 353.113827][ T5897] hid-generic 0003:046D:C31C.0001: item fetching failed at offset 0/1 [ 353.139057][ T5897] hid-generic 0003:046D:C31C.0001: probe with driver hid-generic failed with error -22 [ 353.144798][ T8180] netlink: 68 bytes leftover after parsing attributes in process `syz.4.668'. [ 353.436514][ T2368] pvrusb2: Invalid write control endpoint [ 353.436536][ T2368] pvrusb2: Invalid write control endpoint [ 353.436545][ T2368] pvrusb2: Invalid write control endpoint [ 353.436554][ T2368] pvrusb2: Invalid write control endpoint [ 353.436561][ T2368] pvrusb2: Invalid write control endpoint [ 353.436568][ T2368] pvrusb2: Invalid write control endpoint [ 353.436575][ T2368] pvrusb2: Invalid write control endpoint [ 353.436581][ T2368] pvrusb2: Invalid write control endpoint [ 353.436588][ T2368] pvrusb2: Invalid write control endpoint [ 353.436595][ T2368] pvrusb2: Invalid write control endpoint [ 353.436602][ T2368] pvrusb2: Invalid write control endpoint [ 353.436608][ T2368] pvrusb2: Invalid write control endpoint [ 353.436615][ T2368] pvrusb2: Invalid write control endpoint [ 353.436621][ T2368] pvrusb2: Invalid write control endpoint [ 353.436628][ T2368] pvrusb2: Invalid write control endpoint [ 353.436635][ T2368] pvrusb2: Invalid write control endpoint [ 353.436641][ T2368] pvrusb2: Invalid write control endpoint [ 353.436648][ T2368] pvrusb2: Invalid write control endpoint [ 353.436654][ T2368] pvrusb2: Invalid write control endpoint [ 353.436661][ T2368] pvrusb2: Invalid write control endpoint [ 353.436668][ T2368] pvrusb2: Invalid write control endpoint [ 353.436674][ T2368] pvrusb2: Invalid write control endpoint [ 353.436681][ T2368] pvrusb2: Invalid write control endpoint [ 353.436687][ T2368] pvrusb2: Invalid write control endpoint [ 353.436694][ T2368] pvrusb2: Invalid write control endpoint [ 353.442602][ T2368] pvrusb2: Invalid write control endpoint [ 353.442620][ T2368] pvrusb2: Invalid write control endpoint [ 353.442633][ T2368] pvrusb2: Invalid write control endpoint [ 353.442645][ T2368] pvrusb2: Invalid write control endpoint [ 353.442658][ T2368] pvrusb2: Invalid write control endpoint [ 353.442670][ T2368] pvrusb2: Invalid write control endpoint [ 353.442683][ T2368] pvrusb2: Invalid write control endpoint [ 354.733657][ T5874] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 354.836150][ T2368] pvrusb2: Module ID 3 (saa7115) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 354.869620][ T5874] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 354.870609][ T5874] quatech2 1-1:0.51: device disconnected [ 355.007111][ T5897] usb 2-1: USB disconnect, device number 9 [ 356.480236][ T2368] cs53l32a 1-0011: chip found @ 0x22 (pvrusb2_a) [ 356.480318][ T2368] pvrusb2: Invalid write control endpoint [ 356.480328][ T2368] pvrusb2: Invalid write control endpoint [ 356.480335][ T2368] pvrusb2: Invalid write control endpoint [ 356.480342][ T2368] pvrusb2: Invalid write control endpoint [ 356.480349][ T2368] pvrusb2: Invalid write control endpoint [ 356.480356][ T2368] pvrusb2: Invalid write control endpoint [ 356.480363][ T2368] pvrusb2: Invalid write control endpoint [ 356.481251][ T2368] pvrusb2: Invalid write control endpoint [ 356.481261][ T2368] pvrusb2: Invalid write control endpoint [ 356.481268][ T2368] pvrusb2: Invalid write control endpoint [ 356.481274][ T2368] pvrusb2: Invalid write control endpoint [ 356.481281][ T2368] pvrusb2: Invalid write control endpoint [ 356.481288][ T2368] pvrusb2: Invalid write control endpoint [ 356.481294][ T2368] pvrusb2: Invalid write control endpoint [ 356.481301][ T2368] pvrusb2: Invalid write control endpoint [ 356.481308][ T2368] pvrusb2: Invalid write control endpoint [ 356.481315][ T2368] pvrusb2: Invalid write control endpoint [ 356.481321][ T2368] pvrusb2: Invalid write control endpoint [ 356.481328][ T2368] pvrusb2: Invalid write control endpoint [ 356.481335][ T2368] pvrusb2: Invalid write control endpoint [ 356.481341][ T2368] pvrusb2: Invalid write control endpoint [ 356.491968][ T2368] pvrusb2: Attached sub-driver cs53l32a [ 356.575741][ T8202] netlink: 32 bytes leftover after parsing attributes in process `syz.1.673'. [ 356.816570][ T2368] pvrusb2: Invalid write control endpoint [ 356.816601][ T2368] pvrusb2: Invalid write control endpoint [ 356.816623][ T2368] pvrusb2: Invalid write control endpoint [ 356.816643][ T2368] pvrusb2: Invalid write control endpoint [ 356.816653][ T2368] pvrusb2: Module ID 4 (tuner) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 356.817382][ T2368] pvrusb2: Device being rendered inoperable [ 356.817394][ T2368] pvrusb2: ***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules. [ 356.817400][ T2368] pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem. [ 356.817432][ T2368] pvrusb2: Invalid write control endpoint [ 357.034389][ T2368] pvrusb2: Invalid write control endpoint [ 357.034404][ T2368] pvrusb2: Invalid write control endpoint [ 357.034411][ T2368] pvrusb2: Invalid write control endpoint [ 357.034418][ T2368] pvrusb2: Invalid write control endpoint [ 357.034425][ T2368] pvrusb2: Invalid write control endpoint [ 357.034432][ T2368] pvrusb2: Invalid write control endpoint [ 357.034438][ T2368] pvrusb2: Invalid write control endpoint [ 357.034445][ T2368] pvrusb2: Invalid write control endpoint [ 357.034452][ T2368] pvrusb2: Invalid write control endpoint [ 357.034458][ T2368] pvrusb2: Invalid write control endpoint [ 357.034465][ T2368] pvrusb2: Invalid write control endpoint [ 357.034472][ T2368] pvrusb2: Invalid write control endpoint [ 357.034478][ T2368] pvrusb2: Invalid write control endpoint [ 357.034485][ T2368] pvrusb2: Invalid write control endpoint [ 357.034492][ T2368] pvrusb2: Invalid write control endpoint [ 357.034498][ T2368] pvrusb2: Invalid write control endpoint [ 357.034505][ T2368] pvrusb2: Invalid write control endpoint [ 357.034512][ T2368] pvrusb2: Invalid write control endpoint [ 357.034518][ T2368] pvrusb2: Invalid write control endpoint [ 357.034525][ T2368] pvrusb2: Invalid write control endpoint [ 357.034532][ T2368] pvrusb2: Invalid write control endpoint [ 357.034538][ T2368] pvrusb2: Invalid write control endpoint [ 357.034545][ T2368] pvrusb2: Invalid write control endpoint [ 357.034551][ T2368] pvrusb2: Invalid write control endpoint [ 357.034558][ T2368] pvrusb2: Invalid write control endpoint [ 357.034565][ T2368] pvrusb2: Invalid write control endpoint [ 357.034571][ T2368] pvrusb2: Invalid write control endpoint [ 357.034578][ T2368] pvrusb2: Invalid write control endpoint [ 357.034584][ T2368] pvrusb2: Invalid write control endpoint [ 357.034591][ T2368] pvrusb2: Invalid write control endpoint [ 357.034597][ T2368] pvrusb2: Invalid write control endpoint [ 357.034604][ T2368] pvrusb2: Invalid write control endpoint [ 357.036009][ T2368] pvrusb2: Module ID 3 (saa7115) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 357.336533][ T2368] cs53l32a 2-0011: chip found @ 0x22 (pvrusb2_b) [ 357.336584][ T2368] pvrusb2: Invalid write control endpoint [ 357.336599][ T2368] pvrusb2: Invalid write control endpoint [ 357.346980][ T2368] pvrusb2: Invalid write control endpoint [ 357.346998][ T2368] pvrusb2: Invalid write control endpoint [ 357.347010][ T2368] pvrusb2: Invalid write control endpoint [ 357.347023][ T2368] pvrusb2: Invalid write control endpoint [ 357.347035][ T2368] pvrusb2: Invalid write control endpoint [ 357.347228][ T2368] pvrusb2: Invalid write control endpoint [ 357.347240][ T2368] pvrusb2: Invalid write control endpoint [ 357.347253][ T2368] pvrusb2: Invalid write control endpoint [ 357.347265][ T2368] pvrusb2: Invalid write control endpoint [ 357.347343][ T2368] pvrusb2: Invalid write control endpoint [ 357.347356][ T2368] pvrusb2: Invalid write control endpoint [ 357.347369][ T2368] pvrusb2: Invalid write control endpoint [ 357.347381][ T2368] pvrusb2: Invalid write control endpoint [ 357.347394][ T2368] pvrusb2: Invalid write control endpoint [ 357.347406][ T2368] pvrusb2: Invalid write control endpoint [ 357.347418][ T2368] pvrusb2: Invalid write control endpoint [ 357.347431][ T2368] pvrusb2: Invalid write control endpoint [ 357.347443][ T2368] pvrusb2: Invalid write control endpoint [ 357.347456][ T2368] pvrusb2: Invalid write control endpoint [ 357.358284][ T2368] pvrusb2: Attached sub-driver cs53l32a [ 357.384494][ T13] Bluetooth: hci5: Frame reassembly failed (-84) [ 357.501622][ T2368] pvrusb2: Invalid write control endpoint [ 357.501652][ T2368] pvrusb2: Invalid write control endpoint [ 357.501673][ T2368] pvrusb2: Invalid write control endpoint [ 357.501695][ T2368] pvrusb2: Invalid write control endpoint [ 357.501704][ T2368] pvrusb2: Module ID 4 (tuner) for device OnAir Creator Hybrid USB tuner failed to load. Possible missing sub-device kernel module or initialization failure within module. [ 357.501723][ T2368] pvrusb2: Device being rendered inoperable [ 357.501743][ T2368] pvrusb2: ***WARNING*** pvrusb2 driver initialization failed due to the failure of one or more sub-device kernel modules. [ 357.501754][ T2368] pvrusb2: You need to resolve the failing condition before this driver can function. There should be some earlier messages giving more information about the problem. [ 357.626854][ T5878] usb 3-1: new high-speed USB device number 8 using dummy_hcd [ 357.770169][ T8225] netlink: 'syz.4.680': attribute type 1 has an invalid length. [ 357.770207][ T8225] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 357.801432][ T5878] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 357.801459][ T5878] usb 3-1: config 0 has no interface number 0 [ 357.803791][ T5878] usb 3-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 357.803817][ T5878] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 357.803833][ T5878] usb 3-1: Product: syz [ 357.803845][ T5878] usb 3-1: Manufacturer: syz [ 357.803857][ T5878] usb 3-1: SerialNumber: syz [ 357.814513][ T5878] usb 3-1: config 0 descriptor?? [ 358.024106][ T5878] usb 3-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 358.069529][ T5878] usb 3-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 358.072829][ T5878] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 358.073068][ T5878] usb 3-1: media controller created [ 358.169857][ T5878] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 359.446253][ T60] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 360.077284][ T5878] i2c i2c-1: ec100: i2c rd failed=-32 reg=33 [ 360.209731][ T8243] netlink: 16 bytes leftover after parsing attributes in process `syz.3.684'. [ 360.280764][ T5878] usb 3-1: USB disconnect, device number 8 [ 360.302752][ T8247] netlink: 32 bytes leftover after parsing attributes in process `syz.4.686'. [ 360.625517][ T8252] netlink: 16 bytes leftover after parsing attributes in process `syz.3.687'. [ 361.079103][ T5878] usb 1-1: new high-speed USB device number 16 using dummy_hcd [ 361.256878][ T5878] usb 1-1: Using ep0 maxpacket: 32 [ 361.262574][ T5878] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 361.262606][ T5878] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 361.262642][ T5878] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 361.262665][ T5878] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 361.317324][ T5878] usb 1-1: config 0 descriptor?? [ 361.323386][ T5878] hub 1-1:0.0: USB hub found [ 361.602599][ T5878] hub 1-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 362.714174][ T8276] FAULT_INJECTION: forcing a failure. [ 362.714174][ T8276] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 362.714203][ T8276] CPU: 1 UID: 0 PID: 8276 Comm: syz.1.695 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 362.714220][ T8276] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 362.714229][ T8276] Call Trace: [ 362.714235][ T8276] [ 362.714242][ T8276] dump_stack_lvl+0xe8/0x150 [ 362.714353][ T8276] should_fail_ex+0x46b/0x600 [ 362.714493][ T8276] _copy_to_user+0x31/0xb0 [ 362.714541][ T8276] simple_read_from_buffer+0xe1/0x170 [ 362.714610][ T8276] proc_fail_nth_read+0x1be/0x230 [ 362.714688][ T8276] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 362.714705][ T8276] ? rw_verify_area+0x2ac/0x4e0 [ 362.714771][ T8276] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 362.714787][ T8276] vfs_read+0x212/0xa80 [ 362.714811][ T8276] ? __pfx_vfs_read+0x10/0x10 [ 362.714829][ T8276] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 362.714918][ T8276] ? lockdep_hardirqs_on+0x7a/0x110 [ 362.714983][ T8276] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 362.715004][ T8276] ? mutex_lock_nested+0x152/0x1d0 [ 362.715021][ T8276] ? fdget_pos+0x252/0x320 [ 362.715076][ T8276] ksys_read+0x156/0x270 [ 362.715101][ T8276] ? __pfx_ksys_read+0x10/0x10 [ 362.715134][ T8276] do_syscall_64+0x14d/0xf80 [ 362.715184][ T8276] ? trace_irq_disable+0x3b/0x150 [ 362.715229][ T8276] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.715266][ T8276] ? clear_bhb_loop+0x40/0x90 [ 362.715288][ T8276] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 362.715306][ T8276] RIP: 0033:0x7feb075fcfce [ 362.715324][ T8276] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 362.715338][ T8276] RSP: 002b:00007feb05895fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 362.715359][ T8276] RAX: ffffffffffffffda RBX: 00007feb058966c0 RCX: 00007feb075fcfce [ 362.715372][ T8276] RDX: 000000000000000f RSI: 00007feb058960a0 RDI: 0000000000000004 [ 362.715383][ T8276] RBP: 00007feb05896090 R08: 0000000000000000 R09: 0000000000000000 [ 362.715394][ T8276] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 362.715405][ T8276] R13: 00007feb078b6038 R14: 00007feb078b5fa0 R15: 00007ffd69f02bb8 [ 362.715435][ T8276] [ 363.238244][ T5878] hid-generic 0003:046D:C31C.0002: item fetching failed at offset 0/1 [ 363.238855][ T5878] hid-generic 0003:046D:C31C.0002: probe with driver hid-generic failed with error -22 [ 363.520827][ T8284] netlink: 32 bytes leftover after parsing attributes in process `syz.2.699'. [ 363.576380][ T5860] usb 1-1: USB disconnect, device number 16 [ 364.548422][ T8302] syz_tun: entered allmulticast mode [ 364.649453][ T8302] FAULT_INJECTION: forcing a failure. [ 364.649453][ T8302] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 364.649476][ T8302] CPU: 1 UID: 0 PID: 8302 Comm: syz.3.704 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 364.649488][ T8302] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 364.649495][ T8302] Call Trace: [ 364.649499][ T8302] [ 364.649504][ T8302] dump_stack_lvl+0xe8/0x150 [ 364.649525][ T8302] should_fail_ex+0x46b/0x600 [ 364.649547][ T8302] _copy_from_user+0x2d/0xb0 [ 364.649561][ T8302] copy_from_sockptr+0x48/0x70 [ 364.649700][ T8302] ip_mroute_setsockopt+0x7c1/0xff0 [ 364.649720][ T8302] ? __pfx_ip_mroute_setsockopt+0x10/0x10 [ 364.649746][ T8302] do_ip_setsockopt+0xf1e/0x2ea0 [ 364.649790][ T8302] ? __pfx_do_ip_setsockopt+0x10/0x10 [ 364.649803][ T8302] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 364.649819][ T8302] ? lockdep_hardirqs_on+0x7a/0x110 [ 364.649839][ T8302] ? __fget_files+0x2a/0x420 [ 364.649854][ T8302] ip_setsockopt+0x66/0x110 [ 364.649888][ T8302] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 364.649945][ T8302] do_sock_setsockopt+0x17c/0x1b0 [ 364.649983][ T8302] __x64_sys_setsockopt+0x143/0x1b0 [ 364.649999][ T8302] do_syscall_64+0x14d/0xf80 [ 364.650013][ T8302] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.650024][ T8302] ? clear_bhb_loop+0x40/0x90 [ 364.650037][ T8302] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 364.650047][ T8302] RIP: 0033:0x7f16bd88c799 [ 364.650059][ T8302] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 364.650068][ T8302] RSP: 002b:00007f16bbabd028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 364.650079][ T8302] RAX: ffffffffffffffda RBX: 00007f16bdb06090 RCX: 00007f16bd88c799 [ 364.650087][ T8302] RDX: 00000000000000d2 RSI: 0000000000000000 RDI: 0000000000000005 [ 364.650093][ T8302] RBP: 00007f16bbabd090 R08: 000000000000003c R09: 0000000000000000 [ 364.650099][ T8302] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000001 [ 364.650105][ T8302] R13: 00007f16bdb06128 R14: 00007f16bdb06090 R15: 00007fffce353b38 [ 364.650120][ T8302] [ 364.695720][ T8299] syz_tun: left allmulticast mode [ 366.817033][ T8327] netlink: 32 bytes leftover after parsing attributes in process `syz.0.712'. [ 368.091411][ T8350] netlink: 'syz.1.719': attribute type 1 has an invalid length. [ 368.091450][ T8350] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 368.116832][ T5897] usb 3-1: new high-speed USB device number 9 using dummy_hcd [ 368.278694][ T5897] usb 3-1: Using ep0 maxpacket: 32 [ 368.353206][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 368.353242][ T5897] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 368.353290][ T5897] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 368.353313][ T5897] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 368.358326][ T5897] usb 3-1: config 0 descriptor?? [ 368.428148][ T5897] hub 3-1:0.0: USB hub found [ 372.058508][ T5897] hub 3-1:0.0: config failed, can't read hub descriptor (err -22) [ 372.063187][ T5897] usbhid 3-1:0.0: can't add hid device: -71 [ 372.063257][ T5897] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 372.088365][ T5897] usb 3-1: USB disconnect, device number 9 [ 372.329144][ T8372] netlink: 32 bytes leftover after parsing attributes in process `syz.4.724'. [ 375.148725][ T8411] netlink: 192 bytes leftover after parsing attributes in process `syz.4.735'. [ 375.357626][ T5878] usb 3-1: new high-speed USB device number 10 using dummy_hcd [ 375.405525][ T8417] netlink: 192 bytes leftover after parsing attributes in process `syz.0.738'. [ 375.556829][ T5878] usb 3-1: Using ep0 maxpacket: 32 [ 375.560003][ T5878] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 375.560035][ T5878] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 375.560077][ T5878] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 375.560100][ T5878] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 375.567721][ T5878] usb 3-1: config 0 descriptor?? [ 375.575653][ T5878] hub 3-1:0.0: USB hub found [ 375.833666][ T5878] hub 3-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 376.301700][ T5878] hid-generic 0003:046D:C31C.0003: item fetching failed at offset 0/1 [ 376.318000][ T5878] hid-generic 0003:046D:C31C.0003: probe with driver hid-generic failed with error -22 [ 377.107438][ T5878] usb 3-1: USB disconnect, device number 10 [ 378.584386][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.584457][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 378.986635][ T8446] netlink: 192 bytes leftover after parsing attributes in process `syz.0.747'. [ 380.047918][ T8460] netlink: 'syz.0.751': attribute type 1 has an invalid length. [ 380.047956][ T8460] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 380.674862][ T8468] FAULT_INJECTION: forcing a failure. [ 380.674862][ T8468] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 380.674903][ T8468] CPU: 0 UID: 0 PID: 8468 Comm: syz.1.754 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 380.674925][ T8468] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 380.674938][ T8468] Call Trace: [ 380.674949][ T8468] [ 380.674957][ T8468] dump_stack_lvl+0xe8/0x150 [ 380.674987][ T8468] should_fail_ex+0x46b/0x600 [ 380.675019][ T8468] _copy_from_user+0x2d/0xb0 [ 380.675040][ T8468] core_sys_select+0x57a/0xc30 [ 380.675104][ T8468] ? __pfx_core_sys_select+0x10/0x10 [ 380.675125][ T8468] ? __pfx_set_user_sigmask+0x10/0x10 [ 380.675154][ T8468] ? rt_mutex_slowunlock+0x1cb/0x300 [ 380.675166][ T8468] ? __pfx_rt_mutex_slowunlock+0x10/0x10 [ 380.675181][ T8468] __se_sys_pselect6+0x267/0x320 [ 380.675195][ T8468] ? __pfx___se_sys_pselect6+0x10/0x10 [ 380.675206][ T8468] ? __pfx_ksys_write+0x10/0x10 [ 380.675226][ T8468] ? __x64_sys_pselect6+0x21/0xf0 [ 380.675238][ T8468] do_syscall_64+0x14d/0xf80 [ 380.675252][ T8468] ? trace_irq_disable+0x3b/0x150 [ 380.675264][ T8468] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.675274][ T8468] ? clear_bhb_loop+0x40/0x90 [ 380.675292][ T8468] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 380.675303][ T8468] RIP: 0033:0x7feb0763c799 [ 380.675313][ T8468] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 380.675323][ T8468] RSP: 002b:00007feb05896028 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 380.675334][ T8468] RAX: ffffffffffffffda RBX: 00007feb078b5fa0 RCX: 00007feb0763c799 [ 380.675342][ T8468] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000040 [ 380.675349][ T8468] RBP: 00007feb05896090 R08: 0000000000000000 R09: 0000000000000000 [ 380.675355][ T8468] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 380.675361][ T8468] R13: 00007feb078b6038 R14: 00007feb078b5fa0 R15: 00007ffd69f02bb8 [ 380.675376][ T8468] [ 380.737462][ T8470] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 381.031567][ T8470] bond1 (unregistering): Released all slaves [ 381.040451][ T8472] netlink: 1624 bytes leftover after parsing attributes in process `syz.0.755'. [ 382.795840][ T8496] netlink: 192 bytes leftover after parsing attributes in process `syz.0.760'. [ 384.895175][ T8519] netlink: 1624 bytes leftover after parsing attributes in process `syz.1.767'. [ 385.250460][ T8526] netlink: 40 bytes leftover after parsing attributes in process `syz.1.770'. [ 385.936678][ T8530] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 385.982802][ T8530] bond1 (unregistering): Released all slaves [ 386.318346][ T41] Bluetooth: hci5: Frame reassembly failed (-84) [ 386.566858][ T5867] usb 1-1: new high-speed USB device number 17 using dummy_hcd [ 386.722292][ T5867] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 386.722360][ T5867] usb 1-1: config 0 has no interface number 0 [ 386.839237][ T5867] usb 1-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 386.839269][ T5867] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 386.839321][ T5867] usb 1-1: Product: syz [ 386.839336][ T5867] usb 1-1: Manufacturer: syz [ 386.839390][ T5867] usb 1-1: SerialNumber: syz [ 386.870767][ T5867] usb 1-1: config 0 descriptor?? [ 387.081722][ T5867] usb 1-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 387.124075][ T5867] usb 1-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 387.124403][ T5867] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 387.124468][ T5867] usb 1-1: media controller created [ 387.333989][ T5867] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 388.348865][ T60] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 388.349588][ T5792] Bluetooth: hci5: command 0x1003 tx timeout [ 388.637647][ T5867] i2c i2c-1: ec100: i2c rd failed=-32 reg=33 [ 388.975391][ T8563] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 389.259167][ T8563] bond1 (unregistering): Released all slaves [ 389.373530][ T8570] netlink: 1624 bytes leftover after parsing attributes in process `syz.2.780'. [ 389.448683][ T5867] usb 1-1: USB disconnect, device number 17 [ 390.248537][ T8575] netlink: 40 bytes leftover after parsing attributes in process `syz.0.782'. [ 390.809447][ T8582] netlink: 'syz.0.784': attribute type 21 has an invalid length. [ 392.556489][ T8595] netlink: 12 bytes leftover after parsing attributes in process `syz.3.785'. [ 394.135035][ T8605] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 394.203435][ T8605] bond1 (unregistering): Released all slaves [ 395.034957][ T8620] netlink: 40 bytes leftover after parsing attributes in process `syz.3.794'. [ 396.145873][ T8625] ======================================================= [ 396.145873][ T8625] WARNING: The mand mount option has been deprecated and [ 396.145873][ T8625] and is ignored by this kernel. Remove the mand [ 396.145873][ T8625] option from the mount to silence this warning. [ 396.145873][ T8625] ======================================================= [ 396.146476][ T8630] netlink: 68 bytes leftover after parsing attributes in process `syz.3.796'. [ 396.240388][ T8625] netlink: 'syz.2.795': attribute type 11 has an invalid length. [ 396.240409][ T8625] netlink: 'syz.2.795': attribute type 23 has an invalid length. [ 396.240421][ T8625] netlink: 224 bytes leftover after parsing attributes in process `syz.2.795'. [ 397.432624][ T8640] openvswitch: netlink: IP tunnel dst address not specified [ 397.434966][ T8640] netlink: 'syz.0.798': attribute type 10 has an invalid length. [ 397.617528][ T5878] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 397.966922][ T5878] usb 4-1: Using ep0 maxpacket: 32 [ 397.996262][ T5878] usb 4-1: unable to get BOS descriptor or descriptor too short [ 397.998898][ T5878] usb 4-1: config 1 descriptor has 1 excess byte, ignoring [ 397.998922][ T5878] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 397.998962][ T5878] usb 4-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 398.001360][ T5878] usb 4-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 398.001387][ T5878] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 398.001402][ T5878] usb 4-1: Product: syz [ 398.001410][ T5878] usb 4-1: Manufacturer: syz [ 398.001418][ T5878] usb 4-1: SerialNumber: syz [ 398.329993][ T5878] usb 4-1: 0:2 : does not exist [ 398.463351][ T5878] usb 4-1: USB disconnect, device number 9 [ 398.529579][ T8647] FAULT_INJECTION: forcing a failure. [ 398.529579][ T8647] name failslab, interval 1, probability 0, space 0, times 0 [ 398.529613][ T8647] CPU: 1 UID: 0 PID: 8647 Comm: syz.0.803 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 398.529634][ T8647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 398.529646][ T8647] Call Trace: [ 398.529653][ T8647] [ 398.529662][ T8647] dump_stack_lvl+0xe8/0x150 [ 398.529695][ T8647] should_fail_ex+0x46b/0x600 [ 398.529729][ T8647] should_failslab+0xa8/0x100 [ 398.529830][ T8647] kmem_cache_alloc_noprof+0x87/0x680 [ 398.529895][ T8647] ? fuse_get_req+0x7da/0x10d0 [ 398.530000][ T8647] fuse_get_req+0x7da/0x10d0 [ 398.530020][ T8647] ? __lock_acquire+0x6b5/0x2cf0 [ 398.530059][ T8647] ? __pfx_fuse_get_req+0x10/0x10 [ 398.530078][ T8647] ? unwind_next_frame+0xa5/0x23c0 [ 398.530118][ T8647] __fuse_simple_request+0x2cc/0x1c60 [ 398.530150][ T8647] ? __lock_acquire+0x6b5/0x2cf0 [ 398.530166][ T8647] ? __pfx___fuse_simple_request+0x10/0x10 [ 398.530189][ T8647] ? kernel_text_address+0xa5/0xe0 [ 398.530216][ T8647] ? __kernel_text_address+0xd/0x30 [ 398.530236][ T8647] ? unwind_get_return_address+0x4d/0x90 [ 398.530258][ T8647] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 398.530287][ T8647] ? arch_stack_walk+0xfb/0x150 [ 398.530317][ T8647] ? __lock_acquire+0x6b5/0x2cf0 [ 398.530346][ T8647] fuse_do_getattr+0x378/0x6a0 [ 398.530371][ T8647] ? __pfx_fuse_do_getattr+0x10/0x10 [ 398.530387][ T8647] ? do_raw_spin_lock+0x12b/0x2f0 [ 398.530425][ T8647] ? lockdep_hardirqs_on+0x7a/0x110 [ 398.530450][ T8647] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 398.530493][ T8647] ? try_to_take_rt_mutex+0x840/0xb00 [ 398.530525][ T8647] fuse_update_get_attr+0x601/0x12d0 [ 398.530558][ T8647] ? __lock_acquire+0x6b5/0x2cf0 [ 398.530577][ T8647] ? __pfx_fuse_update_get_attr+0x10/0x10 [ 398.530604][ T8647] ? __lock_acquire+0x6b5/0x2cf0 [ 398.530629][ T8647] ? __lock_acquire+0x6b5/0x2cf0 [ 398.530649][ T8647] ? do_raw_spin_lock+0x12b/0x2f0 [ 398.530672][ T8647] ? arch_stack_walk+0xe3/0x150 [ 398.530690][ T8647] ? unwind_next_frame+0xa5/0x23c0 [ 398.530707][ T8647] ? rcu_is_watching+0x15/0xb0 [ 398.530732][ T8647] ? unwind_next_frame+0xa5/0x23c0 [ 398.530748][ T8647] ? lock_release+0x4b/0x3d0 [ 398.530764][ T8647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.530785][ T8647] ? unwind_next_frame+0xa5/0x23c0 [ 398.530802][ T8647] ? rcu_is_watching+0x15/0xb0 [ 398.530828][ T8647] ? rcu_is_watching+0x15/0xb0 [ 398.530848][ T8647] ? lock_release+0x4b/0x3d0 [ 398.530864][ T8647] ? lock_release+0x4b/0x3d0 [ 398.530886][ T8647] ? is_bpf_text_address+0x292/0x2b0 [ 398.530922][ T8647] ? is_bpf_text_address+0x26/0x2b0 [ 398.530948][ T8647] ? kernel_text_address+0xa5/0xe0 [ 398.530970][ T8647] ? __kernel_text_address+0xd/0x30 [ 398.530989][ T8647] ? unwind_get_return_address+0x4d/0x90 [ 398.531006][ T8647] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 398.531030][ T8647] ? arch_stack_walk+0xfb/0x150 [ 398.531062][ T8647] fuse_file_write_iter+0x41b/0x1130 [ 398.531090][ T8647] ? __pfx_fuse_file_write_iter+0x10/0x10 [ 398.531113][ T8647] ? save_trace+0x2c4/0x390 [ 398.531134][ T8647] ? lockdep_unlock+0x5d/0xd0 [ 398.531161][ T8647] ? lockdep_unlock+0x5d/0xd0 [ 398.531183][ T8647] ? __lock_acquire+0x146e/0x2cf0 [ 398.531220][ T8647] do_iter_readv_writev+0x62b/0x8d0 [ 398.531248][ T8647] ? __pfx_do_iter_readv_writev+0x10/0x10 [ 398.531290][ T8647] vfs_writev+0x345/0x9a0 [ 398.531318][ T8647] ? __pfx_vfs_writev+0x10/0x10 [ 398.531352][ T8647] ? __fget_files+0x2a/0x420 [ 398.531377][ T8647] ? __fget_files+0x3a6/0x420 [ 398.531396][ T8647] ? __fget_files+0x2a/0x420 [ 398.531425][ T8647] do_writev+0x15a/0x2e0 [ 398.531447][ T8647] ? __pfx_do_writev+0x10/0x10 [ 398.531477][ T8647] do_syscall_64+0x14d/0xf80 [ 398.531500][ T8647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.531524][ T8647] ? clear_bhb_loop+0x40/0x90 [ 398.531547][ T8647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 398.531566][ T8647] RIP: 0033:0x7f1fecbfc799 [ 398.531584][ T8647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 398.531600][ T8647] RSP: 002b:00007f1feae4e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 398.531620][ T8647] RAX: ffffffffffffffda RBX: 00007f1fece75fa0 RCX: 00007f1fecbfc799 [ 398.531634][ T8647] RDX: 0000000000000001 RSI: 0000200000000140 RDI: 0000000000000005 [ 398.531646][ T8647] RBP: 00007f1feae4e090 R08: 0000000000000000 R09: 0000000000000000 [ 398.531658][ T8647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 398.531668][ T8647] R13: 00007f1fece76038 R14: 00007f1fece75fa0 R15: 00007fff7f3f1098 [ 398.531698][ T8647] [ 398.781377][ T5839] udevd[5839]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 399.177479][ T8654] netlink: 40 bytes leftover after parsing attributes in process `syz.1.806'. [ 399.431129][ T8660] netlink: 68 bytes leftover after parsing attributes in process `syz.3.809'. [ 400.438312][ T8671] netlink: 296 bytes leftover after parsing attributes in process `syz.1.814'. [ 400.652310][ T8671] netlink: 28 bytes leftover after parsing attributes in process `syz.1.814'. [ 401.117334][ T8682] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 401.282834][ T8682] bond1 (unregistering): Released all slaves [ 401.333389][ T5792] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 401.404154][ T5792] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 401.406265][ T5792] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 401.412174][ T5792] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 401.415385][ T5792] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 401.593631][ T8693] netlink: 40 bytes leftover after parsing attributes in process `syz.1.817'. [ 401.789099][ T8698] netlink: 68 bytes leftover after parsing attributes in process `syz.1.821'. [ 402.423912][ T8709] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 402.571991][ T8709] bond1 (unregistering): Released all slaves [ 403.538973][ T60] Bluetooth: hci2: command tx timeout [ 404.102343][ T8686] chnl_net:caif_netlink_parms(): no params data found [ 405.377415][ T8686] bridge0: port 1(bridge_slave_0) entered blocking state [ 405.379236][ T8686] bridge0: port 1(bridge_slave_0) entered disabled state [ 405.379482][ T8686] bridge_slave_0: entered allmulticast mode [ 405.413289][ T8686] bridge_slave_0: entered promiscuous mode [ 405.434869][ T8686] bridge0: port 2(bridge_slave_1) entered blocking state [ 405.434991][ T8686] bridge0: port 2(bridge_slave_1) entered disabled state [ 405.435107][ T8686] bridge_slave_1: entered allmulticast mode [ 405.474879][ T8686] bridge_slave_1: entered promiscuous mode [ 406.296771][ T60] Bluetooth: hci2: command tx timeout [ 406.418313][ T8686] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 406.449050][ T8686] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 407.019599][ T8686] team0: Port device team_slave_0 added [ 407.025906][ T8686] team0: Port device team_slave_1 added [ 407.129563][ T8686] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 407.129579][ T8686] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.129604][ T8686] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 407.132485][ T8686] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 407.132499][ T8686] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 407.132525][ T8686] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 407.465739][ T8686] hsr_slave_0: entered promiscuous mode [ 407.476691][ T8686] hsr_slave_1: entered promiscuous mode [ 407.537275][ T8686] debugfs: 'hsr0' already exists in 'hsr' [ 407.537304][ T8686] Cannot create hsr debugfs directory [ 408.336997][ T60] Bluetooth: hci2: command tx timeout [ 408.524634][ T8358] Bluetooth: hci5: Frame reassembly failed (-84) [ 408.783038][ T5897] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 408.939428][ T5897] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 408.939456][ T5897] usb 5-1: config 0 has no interface number 0 [ 408.941923][ T5897] usb 5-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 408.941951][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 408.941972][ T5897] usb 5-1: Product: syz [ 408.941987][ T5897] usb 5-1: Manufacturer: syz [ 408.942001][ T5897] usb 5-1: SerialNumber: syz [ 409.002562][ T5897] usb 5-1: config 0 descriptor?? [ 409.297561][ T5897] usb 5-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 409.318593][ T5897] usb 5-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 409.318929][ T5897] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 409.318985][ T5897] usb 5-1: media controller created [ 409.401694][ T5897] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 410.018378][ T1228] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 410.126988][ T8686] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 410.186041][ T8686] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 410.199357][ T1228] usb 4-1: Using ep0 maxpacket: 32 [ 410.225431][ T1228] usb 4-1: unable to get BOS descriptor or descriptor too short [ 410.235198][ T1228] usb 4-1: config 1 contains an unexpected descriptor of type 0x2, skipping [ 410.235215][ T1228] usb 4-1: config 1 has an invalid descriptor of length 156, skipping remainder of the config [ 410.235226][ T1228] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 410.273934][ T8686] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 410.284803][ T1228] usb 4-1: string descriptor 0 read error: -22 [ 410.284997][ T1228] usb 4-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 410.285012][ T1228] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 410.349493][ T1228] usb 4-1: 0:2 : does not exist [ 410.417156][ T5792] Bluetooth: hci2: command tx timeout [ 410.439503][ T8686] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 410.497375][ T5897] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 410.577024][ T5792] Bluetooth: hci5: command 0x1003 tx timeout [ 410.577201][ T60] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 410.647265][ T5878] usb 4-1: USB disconnect, device number 10 [ 410.702420][ T5897] usb 5-1: USB disconnect, device number 11 [ 411.520891][ T8686] 8021q: adding VLAN 0 to HW filter on device bond0 [ 411.966838][ T8686] 8021q: adding VLAN 0 to HW filter on device team0 [ 412.155575][ T585] bridge0: port 1(bridge_slave_0) entered blocking state [ 412.165630][ T585] bridge0: port 1(bridge_slave_0) entered forwarding state [ 412.208855][ T585] bridge0: port 2(bridge_slave_1) entered blocking state [ 412.215480][ T585] bridge0: port 2(bridge_slave_1) entered forwarding state [ 412.849242][ T5852] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 413.567259][ T5852] usb 5-1: Using ep0 maxpacket: 32 [ 413.572017][ T5852] usb 5-1: unable to get BOS descriptor or descriptor too short [ 413.574646][ T5852] usb 5-1: config 1 descriptor has 1 excess byte, ignoring [ 413.574670][ T5852] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 413.625078][ T5852] usb 5-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 413.637098][ T5852] usb 5-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 413.637127][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 413.637146][ T5852] usb 5-1: Product: syz [ 413.637156][ T5852] usb 5-1: Manufacturer: syz [ 413.637164][ T5852] usb 5-1: SerialNumber: syz [ 413.881843][ T5852] usb 5-1: 0:2 : does not exist [ 414.005009][ T5852] usb 5-1: USB disconnect, device number 12 [ 414.128360][ T8820] netlink: 7064 bytes leftover after parsing attributes in process `syz.1.852'. [ 414.128390][ T8820] openvswitch: netlink: EtherType 0 is less than min 600 [ 414.170164][ T5839] udevd[5839]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 414.198846][ T8820] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 414.307047][ T37] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 414.461955][ T8686] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 414.477705][ T37] usb 1-1: Using ep0 maxpacket: 32 [ 414.485526][ T37] usb 1-1: config 0 has an invalid interface number: 51 but max is 0 [ 414.485555][ T37] usb 1-1: config 0 has no interface number 0 [ 414.489260][ T37] usb 1-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 414.489289][ T37] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 414.489308][ T37] usb 1-1: Product: syz [ 414.489323][ T37] usb 1-1: Manufacturer: syz [ 414.489336][ T37] usb 1-1: SerialNumber: syz [ 414.503409][ T37] usb 1-1: config 0 descriptor?? [ 414.553043][ T37] quatech2 1-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 414.847823][ T37] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 414.874645][ T37] usb 1-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 414.921998][ C1] quatech-serial ttyUSB0: qt2_process_read_urb - unsupported command 7 [ 415.129579][ C1] usb 1-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 415.131035][ T5897] usb 1-1: USB disconnect, device number 18 [ 415.138465][ T5897] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 415.182432][ T5897] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 415.183293][ T5897] quatech2 1-1:0.51: device disconnected [ 415.186953][ T37] usb 5-1: new high-speed USB device number 13 using dummy_hcd [ 415.341544][ T37] usb 5-1: unable to get BOS descriptor or descriptor too short [ 415.344568][ T37] usb 5-1: config 0 has an invalid interface number: 181 but max is 0 [ 415.344596][ T37] usb 5-1: config 0 has no interface number 0 [ 415.344627][ T37] usb 5-1: config 0 interface 181 has no altsetting 0 [ 415.358314][ T37] usb 5-1: New USB device found, idVendor=054c, idProduct=002e, bcdDevice= 1.08 [ 415.358344][ T37] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 415.358364][ T37] usb 5-1: Product: syz [ 415.358378][ T37] usb 5-1: Manufacturer: syz [ 415.358392][ T37] usb 5-1: SerialNumber: syz [ 415.414709][ T8686] veth0_vlan: entered promiscuous mode [ 415.432089][ T8686] veth1_vlan: entered promiscuous mode [ 415.456071][ T37] usb 5-1: config 0 descriptor?? [ 415.620890][ T8686] veth0_macvtap: entered promiscuous mode [ 415.667318][ T37] usb-storage 5-1:0.181: USB Mass Storage device detected [ 415.690621][ T8686] veth1_macvtap: entered promiscuous mode [ 415.709972][ T37] usb-storage 5-1:0.181: Quirks match for vid 054c pid 002e: 1 [ 415.771606][ T8686] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 415.856350][ T8686] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 415.866303][ T37] usb 5-1: USB disconnect, device number 13 [ 415.889509][ T2950] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.911449][ T2950] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.917367][ T2950] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 415.950094][ T2950] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 416.275095][ T37] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 416.426957][ T37] usb 2-1: Using ep0 maxpacket: 32 [ 416.430268][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 416.430365][ T37] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 416.430432][ T37] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 416.430482][ T37] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 416.560425][ T37] usb 2-1: config 0 descriptor?? [ 416.565086][ T37] hub 2-1:0.0: USB hub found [ 416.705970][ T8846] netlink: 192 bytes leftover after parsing attributes in process `syz.4.857'. [ 416.783424][ T37] hub 2-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 417.410906][ T8852] netlink: 32 bytes leftover after parsing attributes in process `syz.4.859'. [ 417.433626][ T1479] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 417.433648][ T1479] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.504762][ T37] hid-generic 0003:046D:C31C.0004: item fetching failed at offset 0/1 [ 417.505537][ T37] hid-generic 0003:046D:C31C.0004: probe with driver hid-generic failed with error -22 [ 417.789864][ T2950] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 417.789885][ T2950] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 417.829501][ T5874] usb 2-1: USB disconnect, device number 10 [ 417.988929][ T808] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 418.210236][ T808] usb 4-1: Using ep0 maxpacket: 32 [ 418.221485][ T808] usb 4-1: unable to get BOS descriptor or descriptor too short [ 418.405961][ T808] usb 4-1: config 1 descriptor has 1 excess byte, ignoring [ 418.406015][ T808] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 418.406134][ T808] usb 4-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 418.729459][ T808] usb 4-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 418.729496][ T808] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 418.729552][ T808] usb 4-1: Product: syz [ 418.729566][ T808] usb 4-1: Manufacturer: syz [ 418.729616][ T808] usb 4-1: SerialNumber: syz [ 419.464381][ T8863] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.863'. [ 419.772864][ T808] usb 4-1: 0:2 : does not exist [ 419.856456][ T8869] FAULT_INJECTION: forcing a failure. [ 419.856456][ T8869] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 419.856489][ T8869] CPU: 1 UID: 0 PID: 8869 Comm: syz.1.864 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 419.856511][ T8869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 419.856522][ T8869] Call Trace: [ 419.856530][ T8869] [ 419.856538][ T8869] dump_stack_lvl+0xe8/0x150 [ 419.856570][ T8869] should_fail_ex+0x46b/0x600 [ 419.856604][ T8869] _copy_to_user+0x31/0xb0 [ 419.856629][ T8869] simple_read_from_buffer+0xe1/0x170 [ 419.856655][ T8869] proc_fail_nth_read+0x1be/0x230 [ 419.856680][ T8869] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 419.856707][ T8869] ? rw_verify_area+0x2ac/0x4e0 [ 419.856728][ T8869] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 419.856747][ T8869] vfs_read+0x212/0xa80 [ 419.856777][ T8869] ? __pfx_vfs_read+0x10/0x10 [ 419.856800][ T8869] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 419.856829][ T8869] ? lockdep_hardirqs_on+0x7a/0x110 [ 419.856852][ T8869] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 419.856875][ T8869] ? mutex_lock_nested+0x152/0x1d0 [ 419.856894][ T8869] ? fdget_pos+0x252/0x320 [ 419.856923][ T8869] ksys_read+0x156/0x270 [ 419.856949][ T8869] ? __pfx_ksys_read+0x10/0x10 [ 419.856991][ T8869] do_syscall_64+0x14d/0xf80 [ 419.857012][ T8869] ? trace_irq_disable+0x3b/0x150 [ 419.857032][ T8869] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.857052][ T8869] ? clear_bhb_loop+0x40/0x90 [ 419.857075][ T8869] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 419.857092][ T8869] RIP: 0033:0x7feb075fcfce [ 419.857110][ T8869] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 419.857126][ T8869] RSP: 002b:00007feb05874fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 419.857147][ T8869] RAX: ffffffffffffffda RBX: 00007feb058756c0 RCX: 00007feb075fcfce [ 419.857161][ T8869] RDX: 000000000000000f RSI: 00007feb058750a0 RDI: 0000000000000008 [ 419.857173][ T8869] RBP: 00007feb05875090 R08: 0000000000000000 R09: 0000000000000000 [ 419.857185][ T8869] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 419.857196][ T8869] R13: 00007feb078b6128 R14: 00007feb078b6090 R15: 00007ffd69f02bb8 [ 419.857226][ T8869] [ 420.088166][ T808] usb 4-1: USB disconnect, device number 11 [ 420.165595][ T5839] udevd[5839]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 420.477748][ T58] Bluetooth: hci5: Frame reassembly failed (-84) [ 420.634858][ T5860] IPVS: starting estimator thread 0... [ 420.669951][ T5867] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 420.806894][ T8889] IPVS: using max 9 ests per chain, 21600 per kthread [ 420.837892][ T5852] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 420.869607][ T5867] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 420.869645][ T5867] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 420.869738][ T5867] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 420.869841][ T5867] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 420.989814][ T5852] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 420.989842][ T5852] usb 4-1: config 0 has no interface number 0 [ 420.993300][ T5852] usb 4-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 420.993330][ T5852] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.993351][ T5852] usb 4-1: Product: syz [ 420.993365][ T5852] usb 4-1: Manufacturer: syz [ 420.993386][ T5852] usb 4-1: SerialNumber: syz [ 421.060576][ T5852] usb 4-1: config 0 descriptor?? [ 421.063674][ T8881] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 421.243464][ T5867] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 421.263783][ T5852] usb 4-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 421.301881][ T5852] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 421.302130][ T5852] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 421.302171][ T5852] usb 4-1: media controller created [ 421.346271][ T8878] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 421.347002][ T8878] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 421.414595][ T5852] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 421.448395][ T808] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 421.667688][ T808] usb 5-1: Using ep0 maxpacket: 32 [ 421.766287][ T808] usb 5-1: config 0 has an invalid interface number: 51 but max is 0 [ 421.766315][ T808] usb 5-1: config 0 has no interface number 0 [ 421.909217][ T808] usb 5-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 421.909236][ T808] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 421.909247][ T808] usb 5-1: Product: syz [ 421.909254][ T808] usb 5-1: Manufacturer: syz [ 421.909262][ T808] usb 5-1: SerialNumber: syz [ 422.121578][ T808] usb 5-1: config 0 descriptor?? [ 422.184125][ T808] quatech2 5-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 422.414435][ T808] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 422.431690][ T5867] usb 2-1: USB disconnect, device number 11 [ 422.434196][ T808] usb 5-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 422.497907][ T5792] Bluetooth: hci5: command 0x1003 tx timeout [ 422.499156][ T60] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 422.544178][ T5852] i2c i2c-1: ec100: i2c rd failed=-32 reg=33 [ 422.630513][ T8909] FAULT_INJECTION: forcing a failure. [ 422.630513][ T8909] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 422.630544][ T8909] CPU: 1 UID: 0 PID: 8909 Comm: syz.1.875 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 422.630566][ T8909] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 422.630576][ T8909] Call Trace: [ 422.630583][ T8909] [ 422.630591][ T8909] dump_stack_lvl+0xe8/0x150 [ 422.630623][ T8909] should_fail_ex+0x46b/0x600 [ 422.630658][ T8909] _copy_to_user+0x31/0xb0 [ 422.630682][ T8909] simple_read_from_buffer+0xe1/0x170 [ 422.630706][ T8909] proc_fail_nth_read+0x1be/0x230 [ 422.630730][ T8909] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 422.630758][ T8909] ? rw_verify_area+0x2ac/0x4e0 [ 422.630781][ T8909] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 422.630814][ T8909] vfs_read+0x212/0xa80 [ 422.630846][ T8909] ? __pfx_vfs_read+0x10/0x10 [ 422.630870][ T8909] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 422.630896][ T8909] ? lockdep_hardirqs_on+0x7a/0x110 [ 422.630920][ T8909] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 422.630943][ T8909] ? mutex_lock_nested+0x152/0x1d0 [ 422.630961][ T8909] ? fdget_pos+0x252/0x320 [ 422.630992][ T8909] ksys_read+0x156/0x270 [ 422.631018][ T8909] ? __pfx_ksys_read+0x10/0x10 [ 422.631051][ T8909] do_syscall_64+0x14d/0xf80 [ 422.631074][ T8909] ? trace_irq_disable+0x3b/0x150 [ 422.631094][ T8909] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.631113][ T8909] ? clear_bhb_loop+0x40/0x90 [ 422.631136][ T8909] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 422.631154][ T8909] RIP: 0033:0x7feb075fcfce [ 422.631172][ T8909] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 422.631187][ T8909] RSP: 002b:00007feb05874fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 422.631207][ T8909] RAX: ffffffffffffffda RBX: 00007feb058756c0 RCX: 00007feb075fcfce [ 422.631221][ T8909] RDX: 000000000000000f RSI: 00007feb058750a0 RDI: 0000000000000004 [ 422.631233][ T8909] RBP: 00007feb05875090 R08: 0000000000000000 R09: 0000000000000000 [ 422.631244][ T8909] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 422.631255][ T8909] R13: 00007feb078b6128 R14: 00007feb078b6090 R15: 00007ffd69f02bb8 [ 422.631285][ T8909] [ 422.864547][ C0] usb 5-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 422.967637][ T5874] usb 5-1: USB disconnect, device number 14 [ 423.292899][ T5874] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 423.314625][ T5852] usb 4-1: USB disconnect, device number 12 [ 423.392643][ T8902] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 423.394635][ T5874] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 423.414341][ T5874] quatech2 5-1:0.51: device disconnected [ 423.445935][ T8902] bond1 (unregistering): Released all slaves [ 423.446894][ T37] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 423.606921][ T37] usb 6-1: Using ep0 maxpacket: 32 [ 423.618714][ T37] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 423.618758][ T37] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 423.618797][ T37] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 423.618820][ T37] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 423.784525][ T37] usb 6-1: config 0 descriptor?? [ 423.794631][ T8914] netlink: 16 bytes leftover after parsing attributes in process `syz.1.877'. [ 423.854687][ T37] hub 6-1:0.0: USB hub found [ 424.010455][ T37] hub 6-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 434.717167][ T37] usbhid 6-1:0.0: can't add hid device: -32 [ 434.717279][ T37] usbhid 6-1:0.0: probe with driver usbhid failed with error -32 [ 435.301112][ T5860] usb 6-1: USB disconnect, device number 2 [ 436.797398][ T8958] netlink: 'syz.5.891': attribute type 72 has an invalid length. [ 436.944731][ T585] Bluetooth: hci5: Frame reassembly failed (-84) [ 437.358806][ T5802] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 437.396674][ T5802] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 437.396872][ T5852] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 437.412167][ T5802] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 437.422033][ T5802] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 437.429141][ T5802] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 437.558680][ T5852] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 437.558697][ T5852] usb 2-1: config 0 has no interface number 0 [ 437.561334][ T5852] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 437.561361][ T5852] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 437.561378][ T5852] usb 2-1: Product: syz [ 437.561389][ T5852] usb 2-1: Manufacturer: syz [ 437.561401][ T5852] usb 2-1: SerialNumber: syz [ 437.630083][ T5852] usb 2-1: config 0 descriptor?? [ 437.807505][ T8973] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 437.898318][ T5852] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 437.990401][ T8973] bond1 (unregistering): Released all slaves [ 438.067003][ T5852] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 438.067341][ T5852] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 438.067393][ T5852] usb 2-1: media controller created [ 438.228207][ T5852] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 438.987894][ T5802] Bluetooth: hci5: command 0x1003 tx timeout [ 439.003337][ T60] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 439.170193][ T5852] i2c i2c-1: ec100: i2c rd failed=-32 reg=33 [ 439.464005][ T60] Bluetooth: hci6: command tx timeout [ 439.567290][ T5852] usb 2-1: USB disconnect, device number 12 [ 439.676863][ T5860] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 439.829375][ T5860] usb 6-1: Using ep0 maxpacket: 32 [ 439.842726][ T5860] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 439.842747][ T5860] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 439.842769][ T5860] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 439.842781][ T5860] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 439.895571][ T5860] usb 6-1: config 0 descriptor?? [ 439.915463][ T5860] hub 6-1:0.0: USB hub found [ 440.027437][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.027482][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.288257][ T5860] hub 6-1:0.0: config failed, can't read hub descriptor (err -22) [ 440.326314][ T5860] usbhid 6-1:0.0: can't add hid device: -71 [ 440.326432][ T5860] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 440.363424][ T8966] chnl_net:caif_netlink_parms(): no params data found [ 440.397947][ T5860] usb 6-1: USB disconnect, device number 3 [ 441.325465][ T8966] bridge0: port 1(bridge_slave_0) entered blocking state [ 441.325584][ T8966] bridge0: port 1(bridge_slave_0) entered disabled state [ 441.325818][ T8966] bridge_slave_0: entered allmulticast mode [ 441.330143][ T8966] bridge_slave_0: entered promiscuous mode [ 441.364713][ T8966] bridge0: port 2(bridge_slave_1) entered blocking state [ 441.382249][ T8966] bridge0: port 2(bridge_slave_1) entered disabled state [ 441.382475][ T8966] bridge_slave_1: entered allmulticast mode [ 441.394996][ T8966] bridge_slave_1: entered promiscuous mode [ 441.511256][ T8966] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 441.514217][ T8966] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 441.537167][ T60] Bluetooth: hci6: command tx timeout [ 441.671739][ T8966] team0: Port device team_slave_0 added [ 441.673928][ T8966] team0: Port device team_slave_1 added [ 441.764394][ T8966] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 441.764409][ T8966] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.764434][ T8966] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 441.765973][ T8966] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 441.765981][ T8966] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 441.765995][ T8966] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 441.888938][ T9007] support for cryptoloop has been removed. Use dm-crypt instead. [ 441.980044][ T8966] hsr_slave_0: entered promiscuous mode [ 441.980891][ T8966] hsr_slave_1: entered promiscuous mode [ 441.981425][ T8966] debugfs: 'hsr0' already exists in 'hsr' [ 441.981441][ T8966] Cannot create hsr debugfs directory [ 442.026981][ T5852] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 442.193567][ T5852] usb 5-1: New USB device found, idVendor=13d8, idProduct=0010, bcdDevice=8f.72 [ 442.193597][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 442.193616][ T5852] usb 5-1: Product: syz [ 442.193627][ T5852] usb 5-1: Manufacturer: syz [ 442.193635][ T5852] usb 5-1: SerialNumber: syz [ 442.201319][ T5852] usb 5-1: config 0 descriptor?? [ 442.540723][ T9020] netlink: 'syz.1.903': attribute type 72 has an invalid length. [ 442.553192][ T5852] usb 5-1: selecting invalid altsetting 1 [ 442.553216][ T5852] comedi comedi5: could not switch to alternate setting 1 [ 442.553232][ T5852] usbduxfast 5-1:0.0: driver 'usbduxfast' failed to auto-configure device. [ 442.582971][ T5852] usb 5-1: USB disconnect, device number 15 [ 443.616913][ T60] Bluetooth: hci6: command tx timeout [ 444.213211][ T60] Bluetooth: Frame is too long (len 16, expected len 4) [ 445.225224][ T8966] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 445.367861][ T8966] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 445.435570][ T8966] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 445.517933][ T8966] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 445.696849][ T60] Bluetooth: hci6: command tx timeout [ 446.587449][ T8966] 8021q: adding VLAN 0 to HW filter on device bond0 [ 446.622429][ T8966] 8021q: adding VLAN 0 to HW filter on device team0 [ 446.654293][ T8391] bridge0: port 1(bridge_slave_0) entered blocking state [ 446.654422][ T8391] bridge0: port 1(bridge_slave_0) entered forwarding state [ 446.707305][ T8391] bridge0: port 2(bridge_slave_1) entered blocking state [ 446.707510][ T8391] bridge0: port 2(bridge_slave_1) entered forwarding state [ 446.867187][ T5852] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 447.024855][ T9067] netlink: 7064 bytes leftover after parsing attributes in process `syz.5.915'. [ 447.024876][ T9067] openvswitch: netlink: EtherType 0 is less than min 600 [ 447.146881][ T5852] usb 5-1: Using ep0 maxpacket: 16 [ 447.151142][ T5852] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x84 has invalid wMaxPacketSize 0 [ 447.153315][ T5852] usb 5-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 447.153343][ T5852] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 447.153356][ T5852] usb 5-1: Product: syz [ 447.153363][ T5852] usb 5-1: Manufacturer: syz [ 447.153371][ T5852] usb 5-1: SerialNumber: syz [ 447.199842][ T9063] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 447.238497][ T5852] usb 5-1: config 0 descriptor?? [ 447.256594][ T5852] em28xx 5-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 447.256637][ T5852] em28xx 5-1:0.0: DVB interface 0 found: bulk [ 447.691919][ T9063] bond1 (unregistering): Released all slaves [ 448.489385][ T5852] em28xx 5-1:0.0: unknown em28xx chip ID (0) [ 448.914819][ T5852] em28xx 5-1:0.0: reading from i2c device at 0xa0 failed (error=-5) [ 448.914851][ T5852] em28xx 5-1:0.0: board has no eeprom [ 449.760805][ T8966] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 450.076935][ T5852] em28xx 5-1:0.0: Identified as PCTV tripleStick (292e) (card=94) [ 450.077075][ T5852] em28xx 5-1:0.0: dvb set to bulk mode. [ 450.077823][ T5867] em28xx 5-1:0.0: Binding DVB extension [ 450.207050][ T9059] em28xx 5-1:0.0: reading from i2c device at 0xfffe failed (error=-5) [ 450.467064][ T5860] usb 5-1: USB disconnect, device number 16 [ 450.469217][ T5860] em28xx 5-1:0.0: Disconnecting em28xx [ 450.778829][ T5867] em28xx 5-1:0.0: Registering input extension [ 450.793768][ T5860] em28xx 5-1:0.0: Closing input extension [ 451.009829][ T9100] netlink: 256 bytes leftover after parsing attributes in process `syz.4.923'. [ 451.146962][ T5860] em28xx 5-1:0.0: Freeing device [ 451.345985][ T9108] netlink: 8 bytes leftover after parsing attributes in process `syz.4.924'. [ 451.738602][ T8966] veth0_vlan: entered promiscuous mode [ 451.784331][ T8966] veth1_vlan: entered promiscuous mode [ 451.941596][ T8966] veth0_macvtap: entered promiscuous mode [ 451.968759][ T8966] veth1_macvtap: entered promiscuous mode [ 452.064455][ T8966] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 452.111416][ T8966] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 452.530713][ T7024] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.556024][ T8358] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.556068][ T8358] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 452.556100][ T8358] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 453.068228][ T7024] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 453.068251][ T7024] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 453.158632][ T9121] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 453.216199][ T9121] bond1 (unregistering): Released all slaves [ 453.495284][ T31] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 453.853037][ T31] usb 5-1: Using ep0 maxpacket: 32 [ 453.999605][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.999639][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.999719][ T31] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 453.999742][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 454.745354][ T31] usb 5-1: config 0 descriptor?? [ 454.870614][ T31] usb 5-1: can't set config #0, error -71 [ 454.880542][ T31] usb 5-1: USB disconnect, device number 17 [ 454.942593][ T7024] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 454.942614][ T7024] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 455.354440][ T9149] capability: warning: `syz.4.937' uses 32-bit capabilities (legacy support in use) [ 456.184405][ T5867] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 456.773512][ T5867] usb 5-1: Using ep0 maxpacket: 16 [ 456.947960][ T5867] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 456.947993][ T5867] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 456.948012][ T5867] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 456.948054][ T5867] usb 5-1: New USB device found, idVendor=09da, idProduct=000a, bcdDevice= 0.00 [ 456.948077][ T5867] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 456.969645][ T5867] usb 5-1: config 0 descriptor?? [ 457.059077][ T9155] FAULT_INJECTION: forcing a failure. [ 457.059077][ T9155] name failslab, interval 1, probability 0, space 0, times 0 [ 457.059110][ T9155] CPU: 0 UID: 0 PID: 9155 Comm: syz.6.888 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 457.059134][ T9155] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 457.059145][ T9155] Call Trace: [ 457.059153][ T9155] [ 457.059161][ T9155] dump_stack_lvl+0xe8/0x150 [ 457.059197][ T9155] should_fail_ex+0x46b/0x600 [ 457.059231][ T9155] should_failslab+0xa8/0x100 [ 457.059261][ T9155] __kmalloc_noprof+0xdf/0x7b0 [ 457.059287][ T9155] ? kfree+0x4d/0x6c0 [ 457.059308][ T9155] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 457.059461][ T9155] tomoyo_realpath_from_path+0xe3/0x5d0 [ 457.059497][ T9155] ? tomoyo_path_number_perm+0x219/0x630 [ 457.059520][ T9155] tomoyo_path_number_perm+0x246/0x630 [ 457.059546][ T9155] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 457.059570][ T9155] ? __lock_acquire+0x6b5/0x2cf0 [ 457.059620][ T9155] ? __fget_files+0x2a/0x420 [ 457.059645][ T9155] ? __fget_files+0x2a/0x420 [ 457.059664][ T9155] ? __fget_files+0x3a6/0x420 [ 457.059684][ T9155] ? __fget_files+0x2a/0x420 [ 457.059708][ T9155] security_file_ioctl+0xc3/0x2a0 [ 457.059786][ T9155] __se_sys_ioctl+0x47/0x170 [ 457.059846][ T9155] do_syscall_64+0x14d/0xf80 [ 457.059869][ T9155] ? trace_irq_disable+0x3b/0x150 [ 457.059891][ T9155] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.059911][ T9155] ? clear_bhb_loop+0x40/0x90 [ 457.059943][ T9155] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 457.059961][ T9155] RIP: 0033:0x7fa40f2dc799 [ 457.059979][ T9155] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 457.059995][ T9155] RSP: 002b:00007fa40d536028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 457.060016][ T9155] RAX: ffffffffffffffda RBX: 00007fa40f555fa0 RCX: 00007fa40f2dc799 [ 457.060030][ T9155] RDX: 0000200000000040 RSI: 0000000000003b85 RDI: 0000000000000003 [ 457.060042][ T9155] RBP: 00007fa40d536090 R08: 0000000000000000 R09: 0000000000000000 [ 457.060054][ T9155] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 457.060066][ T9155] R13: 00007fa40f556038 R14: 00007fa40f555fa0 R15: 00007ffde5856088 [ 457.060096][ T9155] [ 457.074401][ T9155] ERROR: Out of memory at tomoyo_realpath_from_path. [ 457.128274][ T9154] trusted_key: encrypted_key: insufficient parameters specified [ 458.211537][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211579][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211606][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211632][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211658][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211684][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211709][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211734][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211759][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.211785][ T5867] a4tech 0003:09DA:000A.0005: unknown main item tag 0x0 [ 458.274166][ T5867] a4tech 0003:09DA:000A.0005: hidraw0: USB HID v0.00 Device [HID 09da:000a] on usb-dummy_hcd.4-1/input0 [ 458.322424][ T5867] usb 5-1: USB disconnect, device number 18 [ 460.491522][ T9193] netlink: 8 bytes leftover after parsing attributes in process `syz.4.949'. [ 460.781143][ T9186] fido_id[9186]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 461.942714][ T9210] FAULT_INJECTION: forcing a failure. [ 461.942714][ T9210] name failslab, interval 1, probability 0, space 0, times 0 [ 461.942747][ T9210] CPU: 1 UID: 0 PID: 9210 Comm: syz.4.951 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 461.942768][ T9210] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 461.942779][ T9210] Call Trace: [ 461.942787][ T9210] [ 461.942795][ T9210] dump_stack_lvl+0xe8/0x150 [ 461.942826][ T9210] should_fail_ex+0x46b/0x600 [ 461.942857][ T9210] should_failslab+0xa8/0x100 [ 461.942884][ T9210] __kmalloc_noprof+0xdf/0x7b0 [ 461.942906][ T9210] ? kfree+0x4d/0x6c0 [ 461.942925][ T9210] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 461.942955][ T9210] tomoyo_realpath_from_path+0xe3/0x5d0 [ 461.942997][ T9210] ? tomoyo_path_number_perm+0x219/0x630 [ 461.943019][ T9210] tomoyo_path_number_perm+0x246/0x630 [ 461.943044][ T9210] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 461.943070][ T9210] ? __lock_acquire+0x6b5/0x2cf0 [ 461.943120][ T9210] ? __fget_files+0x2a/0x420 [ 461.943144][ T9210] ? __fget_files+0x2a/0x420 [ 461.943164][ T9210] ? __fget_files+0x3a6/0x420 [ 461.943182][ T9210] ? __fget_files+0x2a/0x420 [ 461.943207][ T9210] security_file_ioctl+0xc3/0x2a0 [ 461.943233][ T9210] __se_sys_ioctl+0x47/0x170 [ 461.943260][ T9210] do_syscall_64+0x14d/0xf80 [ 461.943283][ T9210] ? trace_irq_disable+0x3b/0x150 [ 461.943303][ T9210] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.943322][ T9210] ? clear_bhb_loop+0x40/0x90 [ 461.943345][ T9210] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 461.943362][ T9210] RIP: 0033:0x7f65026ec799 [ 461.943379][ T9210] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 461.943395][ T9210] RSP: 002b:00007f650093e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 461.943416][ T9210] RAX: ffffffffffffffda RBX: 00007f6502965fa0 RCX: 00007f65026ec799 [ 461.943429][ T9210] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000006 [ 461.943440][ T9210] RBP: 00007f650093e090 R08: 0000000000000000 R09: 0000000000000000 [ 461.943452][ T9210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 461.943462][ T9210] R13: 00007f6502966038 R14: 00007f6502965fa0 R15: 00007ffea1e6aad8 [ 461.943492][ T9210] [ 461.943565][ T9210] ERROR: Out of memory at tomoyo_realpath_from_path. [ 463.166989][ T9230] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 463.293389][ T9195] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 464.035795][ T9243] netlink: 68 bytes leftover after parsing attributes in process `syz.5.963'. [ 464.233228][ T5937] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.022792][ T1228] IPVS: starting estimator thread 0... [ 465.242864][ T9263] IPVS: using max 9 ests per chain, 21600 per kthread [ 465.790817][ T9267] netlink: 4 bytes leftover after parsing attributes in process `syz.6.970'. [ 465.823327][ T5937] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 465.867500][ T9268] netlink: 20 bytes leftover after parsing attributes in process `syz.6.970'. [ 466.851233][ T5937] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 467.697019][ T1228] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 467.859047][ T1228] usb 2-1: config 0 has an invalid interface number: 1 but max is 0 [ 467.859076][ T1228] usb 2-1: config 0 has no interface number 0 [ 467.863035][ T1228] usb 2-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 467.863063][ T1228] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.863082][ T1228] usb 2-1: Product: syz [ 467.863096][ T1228] usb 2-1: Manufacturer: syz [ 467.863111][ T1228] usb 2-1: SerialNumber: syz [ 468.061601][ T1228] usb 2-1: config 0 descriptor?? [ 468.125527][ T5937] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 468.311869][ T1228] usb 2-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 468.375938][ T1228] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 468.376138][ T1228] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 468.376192][ T1228] usb 2-1: media controller created [ 468.441915][ T9299] bond1: option arp_validate: mode dependency failed, not supported in mode balance-alb(6) [ 468.460968][ T1228] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 468.547651][ T9299] bond1 (unregistering): Released all slaves [ 469.537750][ T1228] i2c i2c-1: ec100: i2c rd failed=-110 reg=33 [ 469.800129][ T1228] usb 2-1: USB disconnect, device number 13 [ 470.013221][ T5937] bridge_slave_1: left allmulticast mode [ 470.013405][ T5937] bridge_slave_1: left promiscuous mode [ 470.046764][ T5937] bridge0: port 2(bridge_slave_1) entered disabled state [ 470.140097][ T9318] netlink: 4 bytes leftover after parsing attributes in process `syz.3.979'. [ 470.168900][ T5937] bridge_slave_0: left allmulticast mode [ 470.168928][ T5937] bridge_slave_0: left promiscuous mode [ 470.169184][ T5937] bridge0: port 1(bridge_slave_0) entered disabled state [ 470.286865][ T9] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 470.382646][ T9328] netlink: 40 bytes leftover after parsing attributes in process `syz.6.984'. [ 470.448175][ T9] usb 5-1: Using ep0 maxpacket: 32 [ 470.456215][ T9] usb 5-1: config 0 has an invalid interface number: 136 but max is 0 [ 470.456243][ T9] usb 5-1: config 0 has no interface number 0 [ 470.456288][ T9] usb 5-1: config 0 interface 136 altsetting 0 bulk endpoint 0xA has invalid maxpacket 32 [ 470.456312][ T9] usb 5-1: config 0 interface 136 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 470.456335][ T9] usb 5-1: config 0 interface 136 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 470.463330][ T9] usb 5-1: New USB device found, idVendor=10cf, idProduct=8063, bcdDevice=d1.d2 [ 470.463359][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 470.463379][ T9] usb 5-1: Product: syz [ 470.463392][ T9] usb 5-1: Manufacturer: syz [ 470.463405][ T9] usb 5-1: SerialNumber: syz [ 470.500964][ T9] usb 5-1: config 0 descriptor?? [ 470.502083][ T9313] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 470.592974][ T9] vmk80xx 5-1:0.136: driver 'vmk80xx' failed to auto-configure device. [ 470.622023][ T9] vmk80xx 5-1:0.136: probe with driver vmk80xx failed with error -22 [ 472.725269][ T5937] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 473.257556][ T5937] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 473.738784][ T5937] bond0 (unregistering): Released all slaves [ 473.783672][ T5860] usb 5-1: USB disconnect, device number 19 [ 474.137039][ T31] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 474.288780][ T31] usb 2-1: device descriptor read/64, error -71 [ 474.316820][ T5897] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 474.346016][ T9369] netlink: 40 bytes leftover after parsing attributes in process `syz.3.995'. [ 474.499383][ T5897] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 474.499415][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 474.499435][ T5897] usb 5-1: Product: syz [ 474.499449][ T5897] usb 5-1: Manufacturer: syz [ 474.499464][ T5897] usb 5-1: SerialNumber: syz [ 474.526870][ T31] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 474.636158][ T5897] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 474.682843][ T31] usb 2-1: device descriptor read/64, error -71 [ 474.788358][ T31] usb usb2-port1: attempt power cycle [ 474.975389][ T5897] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 475.147382][ T31] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 475.181209][ T31] usb 2-1: device descriptor read/8, error -71 [ 475.427287][ T31] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 475.448100][ T31] usb 2-1: device descriptor read/8, error -71 [ 475.466953][ T37] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 475.498280][ T9403] FAULT_INJECTION: forcing a failure. [ 475.498280][ T9403] name failslab, interval 1, probability 0, space 0, times 0 [ 475.498312][ T9403] CPU: 0 UID: 0 PID: 9403 Comm: syz.6.1003 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 475.498332][ T9403] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 475.498343][ T9403] Call Trace: [ 475.498350][ T9403] [ 475.498358][ T9403] dump_stack_lvl+0xe8/0x150 [ 475.498388][ T9403] should_fail_ex+0x46b/0x600 [ 475.498423][ T9403] should_failslab+0xa8/0x100 [ 475.498451][ T9403] kmem_cache_alloc_noprof+0x87/0x680 [ 475.498476][ T9403] ? rcu_is_watching+0x15/0xb0 [ 475.498494][ T9403] ? security_file_alloc+0x34/0x310 [ 475.498521][ T9403] security_file_alloc+0x34/0x310 [ 475.498542][ T9403] init_file+0x96/0x2d0 [ 475.498655][ T9403] alloc_empty_file+0x6e/0x1d0 [ 475.498675][ T9403] path_openat+0x11b/0x38a0 [ 475.498708][ T9403] ? try_to_take_rt_mutex+0x840/0xb00 [ 475.498728][ T9403] ? arch_stack_walk+0xfb/0x150 [ 475.498753][ T9403] ? rtlock_slowlock_locked+0xfb/0x3c80 [ 475.498781][ T9403] ? __pfx_path_openat+0x10/0x10 [ 475.498806][ T9403] ? __lock_acquire+0x6b5/0x2cf0 [ 475.498825][ T9403] ? kmem_cache_alloc_noprof+0x33b/0x680 [ 475.498854][ T9403] ? do_raw_spin_lock+0x12b/0x2f0 [ 475.498887][ T9403] do_file_open+0x23e/0x4a0 [ 475.498910][ T9403] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 475.498938][ T9403] ? __pfx_do_file_open+0x10/0x10 [ 475.498959][ T9403] ? rt_mutex_slowunlock+0x4a7/0x8b0 [ 475.498996][ T9403] ? alloc_fd+0x64e/0x6c0 [ 475.499026][ T9403] do_sys_openat2+0x113/0x200 [ 475.499056][ T9403] ? __pfx_do_sys_openat2+0x10/0x10 [ 475.499076][ T9403] ? ksys_write+0x248/0x270 [ 475.499102][ T9403] ? __pfx_ksys_write+0x10/0x10 [ 475.499129][ T9403] __x64_sys_openat+0x138/0x170 [ 475.499154][ T9403] do_syscall_64+0x14d/0xf80 [ 475.499177][ T9403] ? trace_irq_disable+0x3b/0x150 [ 475.499196][ T9403] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.499214][ T9403] ? clear_bhb_loop+0x40/0x90 [ 475.499235][ T9403] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 475.499252][ T9403] RIP: 0033:0x7fa40f29cfce [ 475.499269][ T9403] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 475.499284][ T9403] RSP: 002b:00007fa40d535f18 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 475.499304][ T9403] RAX: ffffffffffffffda RBX: 00007fa40d5366c0 RCX: 00007fa40f29cfce [ 475.499317][ T9403] RDX: 0000000000000000 RSI: 00007fa40f372270 RDI: ffffffffffffff9c [ 475.499330][ T9403] RBP: 00007fa40d536090 R08: 0000000000000000 R09: 0000000000000000 [ 475.499341][ T9403] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 475.499352][ T9403] R13: 00007fa40f556038 R14: 00007fa40f555fa0 R15: 00007ffde5856088 [ 475.499380][ T9403] [ 475.557547][ T31] usb usb2-port1: unable to enumerate USB device [ 475.637813][ T37] usb 6-1: Using ep0 maxpacket: 32 [ 475.645729][ T37] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 475.645755][ T37] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 475.664819][ T37] usb 6-1: New USB device found, idVendor=17cc, idProduct=1021, bcdDevice= 0.40 [ 475.665619][ T37] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 475.665642][ T37] usb 6-1: Product: syz [ 475.665657][ T37] usb 6-1: Manufacturer: syz [ 475.665670][ T37] usb 6-1: SerialNumber: syz [ 476.177611][ T9408] loop6: detected capacity change from 0 to 7 [ 476.630133][ T5897] usb 5-1: Service connection timeout for: 256 [ 476.630610][ T5897] ath9k_htc 5-1:1.0: ath9k_htc: Unable to initialize HTC services [ 476.904520][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.905235][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.914613][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.926410][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.932737][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.934750][ T5897] ath9k_htc: Failed to initialize the device [ 476.939747][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.940444][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 476.940591][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 476.952434][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.952967][ T37] usb 6-1: unable to issue vendor read request (ret = -71) [ 476.999825][ T5897] usb 5-1: ath9k_htc: USB layer deinitialized [ 478.060741][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.060815][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.097851][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.097904][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.135856][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.135942][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.168285][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.168326][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.543964][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.544033][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.601729][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.601765][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.605037][ T9408] ldm_validate_partition_table(): Disk read failed. [ 478.704316][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.704351][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.821053][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.821106][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.895106][ C1] I/O error, dev loop6, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 478.895201][ C1] Buffer I/O error on dev loop6, logical block 0, async page read [ 478.896127][ T9408] Dev loop6: unable to read RDB block 0 [ 478.902983][ T9408] loop6: unable to read partition table [ 478.907261][ T9408] loop6: partition table beyond EOD, truncated [ 478.908982][ T9408] loop_reread_partitions: partition scan of loop6 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 480.070647][ T9419] netlink: 40 bytes leftover after parsing attributes in process `syz.5.1007'. [ 480.084323][ T5937] hsr_slave_0: left promiscuous mode [ 480.157792][ T37] usb 6-1: USB disconnect, device number 4 [ 480.169904][ T5937] hsr_slave_1: left promiscuous mode [ 480.171238][ T5937] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 480.171331][ T5937] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 480.272277][ T5937] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 480.318356][ T808] usb 5-1: USB disconnect, device number 20 [ 480.334763][ T5937] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 480.349634][ T9412] udevd[9412]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 480.619091][ T5937] veth1_macvtap: left promiscuous mode [ 480.619251][ T5937] veth0_macvtap: left promiscuous mode [ 480.620320][ T5937] veth1_vlan: left promiscuous mode [ 480.620528][ T5937] veth0_vlan: left promiscuous mode [ 480.756942][ T808] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 480.968952][ T36] kauditd_printk_skb: 214 callbacks suppressed [ 480.968974][ T36] audit: type=1800 audit(1772490830.712:3005): pid=9434 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz.5.1010" name="file0" dev="overlay" ino=192 res=0 errno=0 [ 480.997034][ T808] usb 7-1: Using ep0 maxpacket: 16 [ 481.002172][ T808] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 1024 [ 481.013615][ T808] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 481.013644][ T808] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 481.013664][ T808] usb 7-1: Product: syz [ 481.013678][ T808] usb 7-1: Manufacturer: ᔌကན栃ᯄ卉빃왅眪赞䇾蕢鑍盏䐯びꛝ혫㘀䁩ꥆ얲Ꙏ⁎흵ꦁḠߝ簰∔煑䎔嬌㧥ړ鉙푹Ի胢뭡㲵嶭꼆ᴇ秆溽౐톇荆暄坂䱆닃ﬧ㗾砗⅕鱴蹱㒟濇ആ貆莭䝞ᐆ㏗뀉位쉾唚⧾ꍼ哛晽笭鼡資럙볲㈜滇ṅ씝⍟䳚쀾咋뉳䛂䫉첧믂य儏㻩≒ሜ媎 [ 481.013709][ T808] usb 7-1: SerialNumber: syz [ 481.292361][ T9436] dlm: no local IP address has been set [ 481.292375][ T9436] dlm: cannot start dlm midcomms -107 [ 481.544985][ T808] cdc_ncm 7-1:1.0: bind() failure [ 481.592624][ T808] cdc_ncm 7-1:1.1: CDC Union missing and no IAD found [ 481.592671][ T808] cdc_ncm 7-1:1.1: bind() failure [ 481.703753][ T808] usb 7-1: USB disconnect, device number 2 [ 481.807531][ T5937] pim6reg (unregistering): left allmulticast mode [ 483.877698][ T9032] usb 7-1: new high-speed USB device number 3 using dummy_hcd [ 484.147006][ T9032] usb 7-1: Using ep0 maxpacket: 32 [ 484.196650][ T9032] usb 7-1: unable to get BOS descriptor or descriptor too short [ 484.227387][ T9032] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 484.227446][ T9032] usb 7-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 484.227669][ T9032] usb 7-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 484.658344][ T9032] usb 7-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 484.658363][ T9032] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.658373][ T9032] usb 7-1: Product: syz [ 484.658381][ T9032] usb 7-1: Manufacturer: syz [ 484.658388][ T9032] usb 7-1: SerialNumber: syz [ 484.988290][ T9032] usb 7-1: 0:2 : does not exist [ 485.041645][ T9461] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1018'. [ 485.063847][ T5937] team0 (unregistering): Port device team_slave_1 removed [ 485.109742][ T9032] usb 7-1: USB disconnect, device number 3 [ 485.129071][ T5937] team0 (unregistering): Port device team_slave_0 removed [ 485.175985][ T9463] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1020'. [ 485.329520][ T9412] udevd[9412]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 485.560058][ T5897] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 486.486832][ T5897] usb 6-1: Using ep0 maxpacket: 32 [ 486.489313][ T5897] usb 6-1: unable to get BOS descriptor or descriptor too short [ 486.490831][ T5897] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 486.490856][ T5897] usb 6-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 486.490903][ T5897] usb 6-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 486.542899][ T5897] usb 6-1: New USB device found, idVendor=0b05, idProduct=17a0, bcdDevice= 0.40 [ 486.542930][ T5897] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.542949][ T5897] usb 6-1: Product: syz [ 486.542963][ T5897] usb 6-1: Manufacturer: syz [ 486.542977][ T5897] usb 6-1: SerialNumber: syz [ 486.884534][ T5897] usb 6-1: 0:2 : does not exist [ 487.103628][ T9482] netlink: 224 bytes leftover after parsing attributes in process `syz.4.1025'. [ 487.331426][ T9436] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 487.349235][ T5897] usb 6-1: USB disconnect, device number 5 [ 487.590377][ T9490] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1027'. [ 487.725145][ T9412] udevd[9412]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 488.931959][ T9507] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1032'. [ 489.107629][ T9512] netlink: 68 bytes leftover after parsing attributes in process `syz.5.1031'. [ 489.141761][ T5937] IPVS: stop unused estimator thread 0... [ 489.255341][ T5802] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 489.274480][ T5802] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 489.275629][ T5802] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 489.276665][ T5802] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 489.305007][ T5802] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 491.790794][ T60] Bluetooth: hci0: command tx timeout [ 492.458912][ T36] audit: type=1326 audit(1772490842.242:3006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9539 comm="syz.5.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f97174ac799 code=0x7ffc0000 [ 492.458963][ T36] audit: type=1326 audit(1772490842.242:3007): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9539 comm="syz.5.1039" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f97174ac799 code=0x7ffc0000 [ 494.015416][ T60] Bluetooth: hci0: command tx timeout [ 495.017480][ T5937] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 496.097155][ T60] Bluetooth: hci0: command tx timeout [ 498.186927][ T60] Bluetooth: hci0: command tx timeout [ 498.985997][ T36] audit: type=1326 audit(1772490848.662:3008): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65026ec799 code=0x7ffc0000 [ 498.986037][ T36] audit: type=1326 audit(1772490848.662:3009): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65026ec799 code=0x7ffc0000 [ 498.986060][ T36] audit: type=1326 audit(1772490848.662:3010): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986082][ T36] audit: type=1326 audit(1772490848.662:3011): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986103][ T36] audit: type=1326 audit(1772490848.662:3012): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986124][ T36] audit: type=1326 audit(1772490848.662:3013): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986145][ T36] audit: type=1326 audit(1772490848.662:3014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986166][ T36] audit: type=1326 audit(1772490848.662:3015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986186][ T36] audit: type=1326 audit(1772490848.662:3016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 498.986207][ T36] audit: type=1326 audit(1772490848.662:3017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=9570 comm="syz.4.1048" exe="/root/syz-executor" sig=0 arch=c000003e syscall=15 compat=0 ip=0x7f650268db19 code=0x7ffc0000 [ 501.463586][ T1318] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.463654][ T1318] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.211577][ T37] ================================================================== [ 502.211594][ T37] BUG: KASAN: vmalloc-out-of-bounds in __list_del_entry_valid_or_report+0xb5/0x190 [ 502.211739][ T37] Read of size 8 at addr ffffc9000f423008 by task kworker/1:1/37 [ 502.211755][ T37] [ 502.211765][ T37] CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 502.211787][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 502.211800][ T37] Workqueue: usb_hub_wq hub_event [ 502.211858][ T37] Call Trace: [ 502.211865][ T37] [ 502.211874][ T37] dump_stack_lvl+0xe8/0x150 [ 502.211899][ T37] print_report+0xba/0x230 [ 502.211934][ T37] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 502.211958][ T37] kasan_report+0x117/0x150 [ 502.212014][ T37] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 502.212041][ T37] __list_del_entry_valid_or_report+0xb5/0x190 [ 502.212068][ T37] kcov_remote_start+0x2af/0x710 [ 502.212090][ T37] hub_event+0x150/0x4f60 [ 502.212118][ T37] ? __pfx___schedule+0x10/0x10 [ 502.212219][ T37] ? irqentry_exit+0x59e/0x620 [ 502.212242][ T37] ? lockdep_hardirqs_on+0x7a/0x110 [ 502.212264][ T37] ? irqentry_exit+0x59e/0x620 [ 502.212289][ T37] ? __pfx_hub_event+0x10/0x10 [ 502.212312][ T37] ? process_scheduled_works+0xa25/0x1830 [ 502.212338][ T37] ? lock_acquire+0x20b/0x2e0 [ 502.212361][ T37] ? process_scheduled_works+0xa25/0x1830 [ 502.212383][ T37] ? process_scheduled_works+0xa25/0x1830 [ 502.212405][ T37] process_scheduled_works+0xb02/0x1830 [ 502.212439][ T37] ? __pfx_process_scheduled_works+0x10/0x10 [ 502.212465][ T37] ? assign_work+0x3d5/0x5e0 [ 502.212488][ T37] worker_thread+0xa50/0xfc0 [ 502.212522][ T37] kthread+0x388/0x470 [ 502.212540][ T37] ? __pfx_worker_thread+0x10/0x10 [ 502.212562][ T37] ? __pfx_kthread+0x10/0x10 [ 502.212585][ T37] ret_from_fork+0x51e/0xb90 [ 502.212610][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 502.212631][ T37] ? __switch_to+0xc7d/0x1450 [ 502.212664][ T37] ? __pfx_kthread+0x10/0x10 [ 502.212682][ T37] ret_from_fork_asm+0x1a/0x30 [ 502.212705][ T37] [ 502.212712][ T37] [ 502.212717][ T37] The buggy address belongs to a vmalloc virtual mapping [ 502.212733][ T37] Memory state around the buggy address: [ 502.212743][ T37] ffffc9000f422f00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 502.212755][ T37] ffffc9000f422f80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 502.212768][ T37] >ffffc9000f423000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 502.212777][ T37] ^ [ 502.212787][ T37] ffffc9000f423080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 502.212799][ T37] ffffc9000f423100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 502.212808][ T37] ================================================================== [ 502.212877][ T37] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 502.212891][ T37] CPU: 1 UID: 0 PID: 37 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} [ 502.212911][ T37] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 502.212923][ T37] Workqueue: usb_hub_wq hub_event [ 502.212946][ T37] Call Trace: [ 502.212954][ T37] [ 502.212961][ T37] vpanic+0x56c/0xa60 [ 502.212987][ T37] ? __pfx_vpanic+0x10/0x10 [ 502.213014][ T37] panic+0xc5/0xd0 [ 502.213036][ T37] ? __pfx_panic+0x10/0x10 [ 502.213060][ T37] ? preempt_schedule_thunk+0x16/0x30 [ 502.213081][ T37] ? preempt_schedule_thunk+0x16/0x30 [ 502.213099][ T37] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 502.213124][ T37] check_panic_on_warn+0x89/0xb0 [ 502.213144][ T37] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 502.213169][ T37] end_report+0x73/0x180 [ 502.213193][ T37] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 502.213217][ T37] kasan_report+0x128/0x150 [ 502.213242][ T37] ? __list_del_entry_valid_or_report+0xb5/0x190 [ 502.213270][ T37] __list_del_entry_valid_or_report+0xb5/0x190 [ 502.213296][ T37] kcov_remote_start+0x2af/0x710 [ 502.213318][ T37] hub_event+0x150/0x4f60 [ 502.213354][ T37] ? __pfx___schedule+0x10/0x10 [ 502.213380][ T37] ? irqentry_exit+0x59e/0x620 [ 502.213400][ T37] ? lockdep_hardirqs_on+0x7a/0x110 [ 502.213421][ T37] ? irqentry_exit+0x59e/0x620 [ 502.213445][ T37] ? __pfx_hub_event+0x10/0x10 [ 502.213469][ T37] ? process_scheduled_works+0xa25/0x1830 [ 502.213492][ T37] ? lock_acquire+0x20b/0x2e0 [ 502.213509][ T37] ? process_scheduled_works+0xa25/0x1830 [ 502.213530][ T37] ? process_scheduled_works+0xa25/0x1830 [ 502.213553][ T37] process_scheduled_works+0xb02/0x1830 [ 502.213586][ T37] ? __pfx_process_scheduled_works+0x10/0x10 [ 502.213611][ T37] ? assign_work+0x3d5/0x5e0 [ 502.213635][ T37] worker_thread+0xa50/0xfc0 [ 502.213668][ T37] kthread+0x388/0x470 [ 502.213686][ T37] ? __pfx_worker_thread+0x10/0x10 [ 502.213706][ T37] ? __pfx_kthread+0x10/0x10 [ 502.213724][ T37] ret_from_fork+0x51e/0xb90 [ 502.213747][ T37] ? __pfx_ret_from_fork+0x10/0x10 [ 502.213769][ T37] ? __switch_to+0xc7d/0x1450 [ 502.213790][ T37] ? __pfx_kthread+0x10/0x10 [ 502.213808][ T37] ret_from_fork_asm+0x1a/0x30 [ 502.213828][ T37] [ 502.214119][ T37] Kernel Offset: disabled