last executing test programs: 7.431930659s ago: executing program 4 (id=10): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_linger(r0, 0x1, 0x3c, &(0x7f0000000340)={0x1, 0x1}, 0x8) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f00000003c0)=0x59a, 0x4) sendmmsg$inet6(r0, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e21, 0x4, @mcast2}, 0x1c, 0x0, 0x0, 0x0, 0x0, 0xf5}}], 0x1, 0x4000800) 7.213218352s ago: executing program 4 (id=11): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000000000)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000f, 0x4000010, 0xffffffffffffffff, 0x6a855000) r0 = syz_usb_connect(0x2, 0x24, &(0x7f0000000500)={{0x12, 0x1, 0x0, 0xc1, 0x66, 0xa0, 0x10, 0x483, 0x1234, 0xff76, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x7b, 0xe4, 0xa8}}]}}]}}, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) r1 = epoll_create1(0x0) epoll_pwait(r1, &(0x7f0000000000)=[{}], 0x1, 0x6e, &(0x7f00000001c0)={[0x7f]}, 0x8) ioctl$FAT_IOCTL_GET_VOLUME_ID(r1, 0x80047213, &(0x7f0000000480)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) kcmp(0x0, 0x0, 0x2, 0xffffffffffffffff, 0xffffffffffffffff) process_vm_readv(0x0, &(0x7f0000000300)=[{&(0x7f0000000040)=""/142, 0x8e}, {&(0x7f0000000100)=""/254, 0xfe}, {&(0x7f0000000200)=""/213, 0xd5}], 0x3, &(0x7f0000000440)=[{&(0x7f0000000340)=""/30, 0x1e}, {&(0x7f0000000380)=""/27, 0x1b}, {&(0x7f00000003c0)=""/25, 0x19}, {&(0x7f0000000400)=""/57, 0x39}], 0x4, 0x0) 6.808506621s ago: executing program 3 (id=15): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) r1 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffffa, 0x122c42) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = epoll_create1(0x80000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@file={0x0, './bus\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r4, &(0x7f0000000100)={0x20000014}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0e, 0xffffffff}, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'dummy0\x00'}) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000800)=ANY=[@ANYBLOB], 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_MODE_GETPROPBLOB(0xffffffffffffffff, 0xc01064ac, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r6, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f00000010c0)={0x24, r7, 0x1, 0x0, 0x0, {0xa}, [@TIPC_NLA_LINK={0x10, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}]}, 0x24}}, 0x0) set_mempolicy(0x4005, &(0x7f0000000180)=0x1004, 0x4) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x1, 0x18, &(0x7f0000000a40)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r8}}, {}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r8}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r9, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b800000500000000", &(0x7f0000000300)=""/8, 0x500, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) poll(&(0x7f0000000140)=[{r5, 0x8}, {r4, 0x2cfc08c20dafc34e}], 0x2, 0x8000007) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f0000001ac0)={r0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x3, 0x1c, "ff9f020bbe82b398b1c4369d03740250ceaac594b1b3d741dd17c1ac0d38ef2a565ef1e8336300", "a9103939c787a16c1ca43f80026d1f3c4da06963dd89d130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b7e7772fd29f35239d2", "24431a1e77a68e174f000000000000000010e200", [0xfffffffffffffffe]}}) syz_open_dev$sndctrl(&(0x7f0000000280), 0x20000, 0x800) 5.694268264s ago: executing program 1 (id=20): r0 = socket$netlink(0x10, 0x3, 0x12) socket$nl_netfilter(0x10, 0x3, 0xc) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000140)) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r0, 0x10e, 0x2, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (fail_nth: 18) 5.012111649s ago: executing program 3 (id=23): ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0xc0502100, &(0x7f0000000000)={0x0, 0x0}) tgkill(r0, 0x0, 0x12) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x2480, 0x0) ioctl$FS_IOC_GETFSMAP(r1, 0xc0c0583b, &(0x7f00000000c0)={0x0, 0x0, 0x9, 0x0, '\x00', [{0xffff3640, 0x85b, 0x2, 0x9, 0x2, 0x5}, {0x1a1, 0x40, 0x0, 0x10000, 0xfffffffffffffff9, 0x3}], ['\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00', '\x00']}) ioctl$XFS_IOC_GETVERSION(r1, 0x80087601, &(0x7f00000003c0)) getsockopt$inet_IP_IPSEC_POLICY(0xffffffffffffffff, 0x0, 0x10, &(0x7f0000001ec0)={{{@in=@broadcast, @in=@initdev, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@local}, 0x0, @in6}}, &(0x7f00000007c0)=0xe8) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000001fc0)={{{@in6=@empty, @in=@dev={0xac, 0x14, 0x14, 0x13}, 0x4e23, 0x6, 0x4e24, 0xffff, 0x2, 0x40, 0x0, 0x5e, 0x0, r2}, {0x9, 0x1, 0x3, 0x5, 0xf13, 0x10001, 0x8000000000000001, 0x6}, {0x4c7d80, 0xa, 0x8, 0xfffffffffffffffb}, 0x2, 0x6e6bbf, 0x0, 0x1, 0x0, 0x3}, {{@in6=@empty, 0x4d5, 0xff}, 0x2, @in6=@loopback, 0x0, 0x1, 0x3, 0x8, 0xf6, 0x6000000, 0x1}}, 0xe8) ioctl$XFS_IOC_GETBMAP(r1, 0xc0205826, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000440)=0xfffffffffffffffe, 0x4) fsetxattr$security_capability(r1, &(0x7f0000000480), &(0x7f00000004c0)=@v1={0x1000000, [{0x3, 0x2}]}, 0xc, 0x0) r4 = ioctl$USERFAULTFD_IOC_NEW(0xffffffffffffffff, 0xaa00) ioctl$AUTOFS_IOC_ASKUMOUNT(r4, 0x80049370, &(0x7f0000000500)) r5 = io_uring_setup(0x2a6f, &(0x7f0000000540)={0x0, 0x15a0, 0x10000, 0x0, 0x1ea}) r6 = syz_io_uring_setup(0x28a, &(0x7f00000005c0)={0x0, 0x2bf0, 0x2, 0x3, 0x285, 0x0, r5}, &(0x7f0000000640), &(0x7f0000000680)) r7 = dup(r3) recvmsg$qrtr(r7, &(0x7f0000000ec0)={&(0x7f00000006c0), 0xc, 0x0, 0x0, &(0x7f0000000e00)=[{0x90, 0x0, 0x0, ""/123}], 0x90, 0x10000}, 0x38, 0x10000) write$cgroup_int(r7, &(0x7f0000000f00)=0x80000000, 0x12) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001000)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000000f40)="46bda91006c8fc1e9bc77e348820aef5ee2a498c0268c84bd653c548ffd6fc937e5278e7fba2e820dff3bba7386a73d01a56f0c9c6f88640aef0727bb2a1e9ab3a994aab4e6fab99333657d53752011f87507d836da48ea8cb7b7a734180ece1688c900f7143996045", 0x69, r6}, 0x68) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r7, 0xc0189373, &(0x7f00000010c0)={{0x1, 0x1, 0x18, r3, {0x800}}, './file0\x00'}) syz_genetlink_get_family_id$batadv(&(0x7f0000001080), r8) ioctl$XFS_IOC_FSINUMBERS(r3, 0xc0205867, &(0x7f0000001600)={&(0x7f0000001100)=0x1001, 0x7, &(0x7f0000001140)=[{}, {}, {}, {}, {}, {}], &(0x7f00000015c0)}) io_setup(0x4, &(0x7f0000001640)) memfd_secret(0x80000) ppoll(&(0x7f0000001740)=[{r6, 0x449f}, {0xffffffffffffffff, 0x11}, {r1, 0x401}, {r8}, {r1, 0x80}, {0xffffffffffffffff, 0x411}, {r7, 0x401}, {r5, 0x4}], 0x8, &(0x7f00000017c0)={0x77359400}, &(0x7f0000001800)={[0x2]}, 0x8) ioctl$KVM_GET_MSR_FEATURE_INDEX_LIST(r8, 0xc004ae0a, &(0x7f0000001840)={0x7, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) inotify_init1(0x800) syz_usb_connect(0x0, 0x4fd, &(0x7f00000019c0)={{0x12, 0x1, 0x110, 0xcb, 0x4, 0xbd, 0x8, 0x10b8, 0x1ebc, 0x1dc0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x4eb, 0x1, 0x5, 0xc, 0xa0, 0x0, [{{0x9, 0x4, 0x13, 0x3, 0xe, 0xf6, 0xc, 0x88, 0x8, [@cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, "c9"}, {0x5, 0x24, 0x0, 0x1}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x7, 0x1, 0x2}, {0x6, 0x24, 0x1a, 0x0, 0x33ea8862aa0634e1}, [@country_functional={0xa, 0x24, 0x7, 0x7, 0xd96, [0x4, 0x0]}, @mdlm_detail={0x5b, 0x24, 0x13, 0x2, "a24883d6d9e60f9183bc5082194752d24bdbe36af692dac1d6add0bae407db24f0a648b096f1edfece76dc3f71e8a99a209f1690514f43426719d2676322cd8cf3fed25c84216f9fcb7f0c7935db9b7462f35fc8050c2a"}, @mdlm={0x15, 0x24, 0x12, 0x5}]}], [{{0x9, 0x5, 0x1, 0x1, 0x40, 0x6, 0x2, 0x2, [@generic={0x69, 0xa, "d6df469eb75cac454c6908d1365bd3cb5860352f407d243518ee8ff08402d85bb64a4b86b113ea5ea6058da703f50d3db8f27fdb8af6c3aae9f88f5e440307cd54b015c51176acb3bf730ec92244ecda0324ed9e18bf825d6b9f92f0eda04f1e61c6125466a02c"}]}}, {{0x9, 0x5, 0x7, 0x10, 0x3ff, 0x6, 0x79, 0x6, [@generic={0x1e, 0x8, "0189ce6246553820a8b6a2ff4f1ec6801a12b593b042237b18e2baf0"}]}}, {{0x9, 0x5, 0xd, 0x10, 0x10, 0x4, 0x8, 0xd2, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x9, 0x9d}]}}, {{0x9, 0x5, 0x3, 0x2, 0x248, 0x4, 0x9, 0xcd, [@generic={0xc5, 0x10, "0de8701a4e58e05d1622813480eeefa83b4f56a3c72a977703322c7f2795094570a70b239ec4ba647f7ce1db2d302ef97f24d5d0d7626e3e917baa3f6212fa96b5b33c7638929294bbf040cea3a09efc7b49e6219dd708c82e6b204975e268084492d84121dd3c54cfbe0bbbf10fcb7003f23d6a7f850a4c8bb6de097152edc4bdd4f1328514e12b1f7a132721bfbd9200278beb6f4cb7856e78aabffdb1e3938643aa09271a94165ea93decdb62c685f5bcb69887d0a7522abbbd6d2a3c33682666c6"}]}}, {{0x9, 0x5, 0x6, 0x4, 0x400, 0x6, 0x6, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x6, 0x854}]}}, {{0x9, 0x5, 0xa, 0x10, 0x3ff, 0x21, 0x6, 0x4a, [@uac_iso={0x7, 0x25, 0x1, 0x40, 0x40, 0xa51}]}}, {{0x9, 0x5, 0xb, 0x4, 0x400, 0xb, 0xfe, 0x81, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x2, 0x51f3}]}}, {{0x9, 0x5, 0x80, 0x10, 0x0, 0x2, 0x0, 0x8, [@generic={0xe3, 0x30, "0119115a667bf8f80c77874f951437a4339a7eb7f6087d1021ec9e3f3bc15ab2662f48a5b1e25dac218b42097183a85fba7cefdd83ed549207b3bc47a0e2ddcd1988e034f1f5c90c9a313aa450015dbf9f7050dcc922d71b510681ff6c6df67cd7502c01e363eb7a5e97f7d6b6a70cbb80af1168806b5b86c42e9c521b1008310eefc308f314dec325fc76aa90b60592566deb66ecb81a3102913e10cba1cebd19bf3be36400101741111316dec4ec0db629f5fa0e199d4b064e9c8490f4429915cf60713bd28fc44d7ce6291ebf3740371dec0e50bd2a93bcfaf4d489cfab4761"}]}}, {{0x9, 0x5, 0xe, 0x0, 0x40, 0x9, 0x7f, 0x0, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0xa}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x40, 0x7}]}}, {{0x9, 0x5, 0xb, 0x2, 0x200, 0xff, 0x0, 0x26, [@generic={0x69, 0xd, "1294f2ad567ff494e71d473407243603e3576c81c70ed97d336d4257ea6fb959d7de2295d5080038af62182458aa56c7fd37e81bf116c18e9acb0b7613685f743e4a5e0543710e7eeae26df9ae60a9e5d1c82b5022c2db6f6ae7e2cbe23df7bfc462b52daf5bc0"}]}}, {{0x9, 0x5, 0x7, 0x2, 0x3ff, 0x0, 0xd, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x5, 0x6}, @generic={0xde, 0x22, "b0d2c9922377609495a23b8e9ed7fc1eda28544e640d24b7f479c90b9613b321a9eba696bb4d7649df38c6f40918c6e6d666bfd81fb2f5ed7b81711804b8e8875e0d3e66eaf80c5a7654d9d2d54235bcea7ec9ff9af4d57919bc2fa900657e6b32cb0c7e59abebbef71cbbe5c1d95fbe666152f1f9631c3994ac16e39694347015fd5545a32820e712e72d9a9181de29ec7d30512eee4df48ab332cc342200b41d24ee56c26e956145e118aafb353ef958eb544f370c18b5bb02e6c306bb1c8f29654eabdcd3bf0a8a3a47c81929bf382795981c11132e4eda4e7346"}]}}, {{0x9, 0x5, 0x1, 0x1, 0x200, 0xf7, 0x7, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x83, 0x0, 0xf}]}}, {{0x9, 0x5, 0x9, 0xc, 0x200, 0x1, 0x0, 0x40, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x5}]}}, {{0x9, 0x5, 0xa, 0x10, 0x8, 0x5, 0xa, 0xd6, [@uac_iso={0x7, 0x25, 0x1, 0x103, 0x3, 0x2000}, @uac_iso={0x7, 0x25, 0x1, 0x0, 0x0, 0x1000}]}}]}}]}}]}}, &(0x7f0000002640)={0xa, &(0x7f0000002400)={0xa, 0x6, 0x300, 0x0, 0x1, 0x3a, 0x40, 0x64}, 0x3e, &(0x7f0000002440)={0x5, 0xf, 0x3e, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x5, 0x7, 0x8, 0x2}, @wireless={0xb, 0x10, 0x1, 0x4, 0x40, 0x2, 0xe, 0x3ff, 0x1}, @ptm_cap={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0x9, 0x5, 0x8, 0x3}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x0, "eeb23d29002e15590e3c14cc844d8ac8"}]}}) 4.930358154s ago: executing program 4 (id=25): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000000400)=[{{&(0x7f0000000240)={0xa, 0x4e24, 0x8000001, @private0, 0x3}, 0x1c, &(0x7f00000003c0)=[{&(0x7f00000001c0)='W', 0x1}], 0x1}}], 0x1, 0x931766f6319eed40) 4.885895172s ago: executing program 4 (id=26): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd502000000090001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000440)={{0x14}, [@NFT_MSG_NEWFLOWTABLE={0x38, 0x16, 0xa, 0x801, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}]}]}], {0x14}}, 0x60}, 0x1, 0x0, 0x0, 0xfffffff5}, 0x0) 4.804323128s ago: executing program 1 (id=27): bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b700000081000000bfa30000000000000703000000feffff720af0fff8ffffff71a4f0ff0000000072030000000000001d400500000000004704000001ed000072030200000000001d440000000000006b0a00fe000000007303000000000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710aad58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00a3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f1ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c107571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c391e97ba48db0a5adbfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed91124a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f6f096753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c2571f983e9673560000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d1abf3cb17b40ac9b10968f38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd84990453f006694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130bc01a2d61f3b39c64307f9c82b2807c9ff4a269841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef67a41b9e320146ee9f566a28"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xfffffffffffffd00}, 0x48) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000280)="eb4c", 0x2}], 0x1}, 0x4045) setsockopt$sock_attach_bpf(r0, 0x1, 0x10, &(0x7f0000001280), 0x4) r2 = io_uring_setup(0xf08, &(0x7f0000000780)={0x0, 0x80003125, 0x3cd0, 0x4004, 0x181}) io_uring_register$IORING_REGISTER_FILES(r2, 0x20, 0x0, 0x0) recvmsg$unix(r0, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x2122) sendmsg$inet(r1, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000640)=[{&(0x7f00000012c0)="f9", 0x1}], 0x1}, 0x48844) r3 = socket$inet6(0xa, 0x1, 0x8010000000000084) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e21, 0x0, @empty}, 0x1c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000000c0)={0x1b, 0x0, 0x0, 0x3, 0x0, 0xffffffffffffffff, 0x8001, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x5}, 0x50) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x14}}}, 0x1c) 4.60099273s ago: executing program 4 (id=29): openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/profiling', 0x0, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff6000/0x3000)=nil, &(0x7f0000ff2000/0x1000)=nil, &(0x7f0000ff8000/0x8000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ff6000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = socket$vsock_stream(0x28, 0x1, 0x0) getsockopt(r0, 0x38, 0xffffffef, 0x0, 0x0) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89d, 0x100, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x0, 0xfff0}, {0xe, 0xffff}}}, 0x24}}, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) r1 = socket$inet_sctp(0x2, 0x1, 0x84) socket$nl_route(0x10, 0x3, 0x0) socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) dup(0xffffffffffffffff) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r6 = syz_io_uring_setup(0x2221, &(0x7f0000000100)={0x0, 0x6e7f, 0x800, 0x0, 0x5cc}, &(0x7f0000000280)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffa, 0x0, 0x4) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r6, 0x9, 0x0, 0x0) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_TEE={0x21, 0x20, 0x0, @fd_index=0xa, 0x0, 0x0, 0xffffffdc, 0x2, 0x1, {0x0, r9}}) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_CONNECT={0x10, 0x42, 0x0, r0, 0x80, &(0x7f00000002c0)=@pppol2tpv3={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x4e24, @multicast1}, 0x4, 0x2, 0x2, 0x3}}, 0x0, 0x0, 0x0, {0x0, r9}}) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, 0x0, &(0x7f0000000040)) syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x4, 0x0) migrate_pages(0x0, 0x5, 0x0, &(0x7f0000000040)=0x272) socket$rds(0x15, 0x5, 0x0) syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cf}, &(0x7f0000000240)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) 4.577761673s ago: executing program 2 (id=30): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) (async) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="fb2c54d949e9002f37dd75c13bdb4e060b738722f773d9623a70c5d8fe95afa2d1493da77b", 0x25) r1 = socket(0x2, 0x3, 0xff) bind$inet(r1, &(0x7f00000000c0)={0x2, 0x4e24, @broadcast}, 0x10) (async) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e000100000000000000000000000000000000000000000a0060", @ANYRESOCT], 0xb8}}, 0x20040014) syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r1) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0x2, 0x0, 0x25dfdbfe, {{@in6=@private0, @in=@remote, 0x0, 0x4, 0x0, 0x0, 0xa, 0x60, 0x80, 0x3b, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd}, {0xfffffffffffffffe}, 0x9, 0x0, 0x0, 0x0, 0x2}}, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$nl_xfrm(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc000000000000000100000000000000ac1e0001"], 0xb8}}, 0x0) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x0) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x101800, 0x0) (async, rerun: 32) syz_usb_connect(0x2, 0x2d, &(0x7f0000000800)=ANY=[@ANYBLOB="12010000965d06403e131508667e0102030109021b0001000000000904000001ff872800090505"], 0x0) (async, rerun: 32) sendmsg$nl_xfrm(r2, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@updpolicy={0xb8, 0x13, 0xcb23c9c9931e99e9, 0x0, 0x0, {{@in6=@private0, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa, 0x40, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0xaa3, 0xfffffffffffffff8, 0x4}, {0x0, 0x8}}}, 0xb8}}, 0x0) 4.38271008s ago: executing program 2 (id=32): landlock_create_ruleset(&(0x7f0000000180)={0x90d1, 0x3}, 0x18, 0x1) socket(0x9, 0x5, 0x9) socket$inet_tcp(0x2, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x600180, 0x0) fcntl$setlease(r0, 0x406, 0x3) fsopen(&(0x7f0000000080)='ext3\x00', 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r1, 0x8000, 0xffffffffffffffff, 0x2}) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 4.266462154s ago: executing program 2 (id=33): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) socket$xdp(0x2c, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00'}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r2, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000)=""/74, 0x328000, 0x1000}, 0x1c) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000080)=0x1, 0x4) r3 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$XDP_RX_RING(r2, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000180)={'batadv_slave_0\x00', 0x0}) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000000300)=0x1, 0x4) bind$xdp(r2, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10) 4.181922982s ago: executing program 1 (id=34): syz_emit_ethernet(0x5e, &(0x7f0000002e40)={@local, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x21}, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "7428dd", 0x28, 0x3a, 0xff, @remote, @mcast2, {[], @ndisc_na={0x89, 0x0, 0x0, 0x0, '\x00', @remote, [{0x0, 0x2, "122b472e41e24b11f34b608816e5"}]}}}}}}, 0x0) r0 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000040), 0xc900, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000b80)=ANY=[@ANYBLOB="140000001000010000000000000000000000000aa4000000060a09040000000000000000020000007800048020000180080001006c6f670014000280070002405c4000000600044000080000540001800a0001006d617463680000004400028008000240000000002c000300346384ea362eefeec3c408bf3afba7aea68ac4de901d71dbb01843fcb3eaa0221283bd05c74e44300a0001006c696d69740000000900010073797a30000000000900020073797a32"], 0xcc}}, 0x0) recvfrom(r0, &(0x7f0000000080)=""/165, 0xa5, 0x0, &(0x7f0000000140)=@un=@abs={0x0, 0x0, 0x4e22}, 0x80) r2 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_int(r2, 0x29, 0x18, &(0x7f0000000000)=0x1ff, 0x4) 3.815805567s ago: executing program 1 (id=37): unshare(0x42000000) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x1b1c, 0xc10, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x60, 0x0, [{{0x9, 0x4, 0x0, 0x80, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x406, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x9, 0x8, 0x7}}}}}]}}]}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="1400000010130100000000001b0000000000000a20000000000a01030000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a30000000"], 0xf8}}, 0x0) 3.573912213s ago: executing program 0 (id=38): r0 = socket$netlink(0x10, 0x3, 0x12) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000340)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x200000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x93ea05013bd5580e) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd6016000000102b00fc0100000000000000e2ff0000000000fe8000000000000000000400000000aa"], 0x0) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) sendmsg$IPVS_CMD_NEW_DEST(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x5000002}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20040804}, 0x4048080) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socket(0x840000000002, 0x3, 0x100) semget(0x3, 0x1, 0x200) semget(0x3, 0x3, 0x3) socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x3, 0x0, 0x11019000, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1000, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text16={0x10, 0x0}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000240)="f7790066baa00066b86b4266ba2100ed66ba420066ef0f29902cbb0000c4e2b1ba8c88d90000000f83001000000f7842280f07b801000000c4033921820f47a753fd", 0x42}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) syz_kvm_setup_cpu$x86(r2, r6, &(0x7f0000fd9000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f0000000040)="0f2003b8010000000f01d99aa4270000ae00f30fa7d0660f8d01003e650f22db0ffecec4c28dbed9c744240000000000c744240200000100c7442406000000000f011424", 0x44}], 0x1, 0x71, 0x0, 0x0) ioctl$FE_DISEQC_RECV_SLAVE_REPLY(0xffffffffffffffff, 0x800c6f40, &(0x7f0000000300)={""/4, 0x4}) ioctl$KVM_RUN(r6, 0xae80, 0x0) 2.810199402s ago: executing program 3 (id=39): r0 = syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$binfmt(0xffffffffffffff9c, r0, 0x42, 0x1ff) openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0xa6c81, 0xc0) writev(r1, &(0x7f0000000400)=[{&(0x7f0000001580)="03", 0x1}], 0x1) socket$unix(0x1, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) openat$dlm_monitor(0xffffffffffffff9c, &(0x7f0000000240), 0x20000, 0x0) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000d40)) openat2(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', &(0x7f0000001440)={0x122640, 0x10b, 0x7}, 0x18) socket$nl_xfrm(0x10, 0x3, 0x6) socket$nl_route(0x10, 0x3, 0x0) epoll_create(0x401) socket(0x28, 0x801, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000040)={0x28, 0x0, 0x2710}, 0x10) listen(r2, 0x0) r3 = socket$vsock_stream(0x28, 0x1, 0x0) write$sndseq(0xffffffffffffffff, &(0x7f0000001380), 0x0) connect$vsock_stream(r3, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) r4 = gettid() timer_create(0x4, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000040)=0x0) timer_settime(r5, 0x0, &(0x7f0000000100)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r6 = dup(r3) write$6lowpan_enable(r6, &(0x7f0000000000)='0', 0xfffffd2c) 2.723280194s ago: executing program 0 (id=40): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) (async, rerun: 64) r2 = socket(0x10, 0x803, 0x0) (async, rerun: 64) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_SET_INFO(r3, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) (async) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, r4, 0xb0615}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_ALL_SLAVES_ACTIVE={0x5, 0x11, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x690}, 0x20048040) (async, rerun: 64) r5 = socket$nl_route(0x10, 0x3, 0x0) (async, rerun: 64) r6 = socket(0x1, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x300}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0xc, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}]}}}, @IFLA_LINK={0x8, 0x5, r7}, @IFLA_MASTER={0x8, 0xa, r7}]}, 0x4c}}, 0x0) 2.573325708s ago: executing program 2 (id=41): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000480)=ANY=[@ANYBLOB="94000000", @ANYRES16=r1, @ANYBLOB="010000000000000000000a000000800004801300010062726f6164636173742d6c696e6b"], 0x94}}, 0x0) socket$netlink(0x10, 0x3, 0x12) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000600)=@IORING_OP_UNLINKAT={0x24, 0x8, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200}) sendmsg$FOU_CMD_DEL(r0, &(0x7f00000007c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000700)={&(0x7f0000000680)={0x48, 0x0, 0x4, 0x70bd25, 0x25dfdbfc, {}, [@FOU_ATTR_PORT={0x6, 0x1, 0x4e24}, @FOU_ATTR_PEER_PORT={0x6, 0xa, 0x4e24}, @FOU_ATTR_LOCAL_V4={0x8, 0x6, @initdev={0xac, 0x1e, 0x0, 0x0}}, @FOU_ATTR_TYPE={0x5, 0x4, 0x1}, @FOU_ATTR_LOCAL_V6={0x14, 0x7, @rand_addr=' \x01\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000001}, 0x8010) io_uring_enter(0xffffffffffffffff, 0x46f3, 0x0, 0x0, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) connect$l2tp6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x0, @empty, 0xa, 0x4}, 0x20) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x8801, 0x0) r3 = socket$key(0xf, 0x3, 0x2) getsockopt$sock_int(r3, 0x1, 0xb, 0x0, &(0x7f0000000080)) syz_open_dev$I2C(&(0x7f0000000440), 0x9, 0x2020) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000500)=@newtaction={0x14c, 0x30, 0x0, 0x70bd2a, 0x0, {0x9}, [{0x138, 0x1, [@m_pedit={0x134, 0x14, 0x0, 0x0, {{0xa}, {0x100, 0x2, 0x0, 0x1, [@TCA_PEDIT_KEYS_EX={0x4}, @TCA_PEDIT_KEYS_EX={0xf8, 0x5, 0x0, 0x1, [{0x1c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}]}, {0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0xc, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x7}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}]}]}, {0xb, 0x6, "e98bdfd370f1b0"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x6, 0x2}}}}]}]}, 0x14c}, 0x1, 0x0, 0x0, 0x40040}, 0x20040000) r4 = socket$nl_route(0x10, 0x3, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0) r5 = syz_io_uring_setup(0x3aec, &(0x7f0000000240)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r6, r7, &(0x7f0000000040)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xfffffffffffffdc0}) io_uring_enter(r5, 0x7a98, 0x0, 0x0, 0x0, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="14000000100004000000000000000000000000f743000000090a01040000000000000000070000000900020073797a31000000000900010073797a3000000000080005400000001c08000a400000000008000f4000000006140000001000010000000000000000000084000a42416557f29cc7478ff34d987be191ac2cf678134f5db21f0115d83d8d6d3000faa65aeff325ab76f45858ea3e78ca3647e06869252c24b61b53c282bac522abd49ff600f46e01f44963ed65"], 0x6c}}, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r8], 0x90}}, 0x0) r10 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r10, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r11 = ioctl$KVM_CREATE_VCPU(r10, 0xae41, 0x0) ioctl$KVM_RUN(r11, 0xae80, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, &(0x7f0000000180)="66b80e010f00d0b0060f21a20f01c40f009b2700000066b80c008ee00f3235008000000f30b80e0000000f23d80f21f835800000a00f23f8c9b9490300000f60b932c00a00b9730200000f32328fe858b660002fb90d090000b800680000ba000000000f30", 0x65}], 0x1, 0x0, 0x0, 0x0) 2.520669885s ago: executing program 0 (id=42): r0 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x6000, 0x0) ioctl$RTC_ALM_SET(r0, 0x40247007, &(0x7f0000000580)={0xf, 0x0, 0xd, 0x4, 0x0, 0x0, 0x3, 0x10d, 0xffffffffffffffff}) 2.427743283s ago: executing program 0 (id=43): landlock_create_ruleset(&(0x7f0000000180)={0x90d1, 0x3}, 0x18, 0x1) socket(0x9, 0x5, 0x9) socket$inet_tcp(0x2, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000100)) r0 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000080), 0x600180, 0x0) fcntl$setlease(r0, 0x406, 0x3) fsopen(&(0x7f0000000080)='ext3\x00', 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) socket$packet(0x11, 0x3, 0x300) socket$packet(0x11, 0x3, 0x300) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={r1, 0x8000, 0xffffffffffffffff, 0x2}) writev(r1, &(0x7f00000000c0)=[{&(0x7f0000000080), 0xfffffebe}], 0x1) 2.309438473s ago: executing program 0 (id=44): r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_int(r1, 0x6, 0x17, 0x0, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f0000000180), 0x4) getpeername$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000840)=0x14) getresuid(&(0x7f00000008c0)=0x0, &(0x7f0000000900), &(0x7f0000000940)) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000ac0)={{{@in6=@remote, @in=@multicast2, 0x4e24, 0x72ff, 0x4e24, 0x165, 0x2, 0xe0, 0x20, 0xc, r2, r3}, {0x8, 0x1, 0xfffffffffffffff6, 0x7, 0x7, 0xc, 0x2, 0xa}, {0x1, 0x0, 0x1, 0x4}, 0x7, 0x6e6bbb, 0x2, 0x0, 0x1, 0x2}, {{@in=@multicast2, 0x4d4, 0xff}, 0x2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3500, 0x2, 0x0, 0x7, 0xdd8a, 0xfffffffd, 0x1}}, 0xe8) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20}, [@RTA_UID={0x8, 0x19, 0xffffffffffffffff}]}, 0x24}}, 0x0) r4 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000880), 0x7, 0x8101) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f00000008c0)={0x0, 0x200}) syz_usb_control_io(r4, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x40, 0x6, 0x2, "41fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r4, &(0x7f0000000540)={0x24, &(0x7f0000000440)={0x20, 0x8, 0x15, {0x15, 0x10, "45919ec23077c9d44d73c5e60d84085ea7128f"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc0c}}, &(0x7f00000004c0)={0x0, 0x22, 0x8, {[@global=@item_012={0x0, 0x1, 0x9}, @local=@item_012={0x0, 0x2, 0x4}, @global=@item_012={0x0, 0x1, 0xa}, @main=@item_4={0x3, 0x0, 0xc, "e1ea3ca2"}]}}, &(0x7f0000000500)={0x0, 0x21, 0x9, {0x9, 0x21, 0x287b, 0x4, 0x1, {0x22, 0xc63}}}}, &(0x7f0000000700)={0x2c, &(0x7f0000000580)={0x0, 0x8, 0x79, "c75ca0db516b96f89664cd37e4e368eb23e2e0a93c19a2f03b13c006bc2ce4a2c890451be10266ae99ce6337a01390eac983398ff605ac5182f46a49e93ad6b2472516eca385b5e656b56f9a134d8ebd21045b9e3d0aec86a11cf5ee33d096087d525133473e315aa19cd191210535eeaee7e62e6dc34fa094"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0xfc}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000680)={0x20, 0x1, 0x1c, "a52f95828ba308186ecb470ffbc112d55d2d0f8f7bba7724c8662129"}, &(0x7f00000006c0)={0x20, 0x3, 0x1, 0x29}}) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000240)={0x2c, &(0x7f0000000340)={0x0, 0x21, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000a00)={0x84, &(0x7f0000000280)={0x20, 0x18, 0x3, "36bca9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r4, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x20, 0x0, 0xa2, {0xa2, 0xe, "3493796fe903b602a259259de522dd1cfe2c586dc336fccbff793c183356c09c3dcc258a5aaf56b6e9203b67ca763e0115e6dd839fec6ac1ade759cab3d415236628260a2de9fca05d2077f13cba157f07782d30f1d21aa03c9929c572ce0769d51be6634a866b2ef5e7683dd84de93a2468538e5501de9f12378a974e5aa22f29a4e07a1f238a6fbf631aa899c21715c2466286563ac6276eac97b193312e5f"}}, &(0x7f00000000c0)={0x0, 0x3, 0x57, @string={0x57, 0x3, "ac6d4a910ac466d62e80fbdc49d406d193f43e80aad3ff37a6467c0130781260235b53c575f4b0bc6741f8f4ec1fa0fdcf93216543170016dac9d453077dc5e196763f69d9235699ec98777c5988f1bb45445bd4e4"}}}, &(0x7f0000000400)={0x34, &(0x7f0000000180)={0x40, 0x11, 0x1a, "413b9700fefdf3ef8377e2384ba15c908375aefcf66024aa6db1"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000200)={0x0, 0x8, 0x1, 0xe6}, &(0x7f0000000300)={0xc0, 0xa1, 0x4, 0x470e}, &(0x7f0000000380)={0x40, 0xa0, 0x4}, &(0x7f00000003c0)={0xc0, 0xa2, 0x2f, "04c633708563bc6cf14fc93ad40a9de032b3cedb1e62dcc91102c45050c4224727fe31a845671bdf50bc005b68d8f3"}}) socket(0x10, 0x3, 0x0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) getsockopt$inet6_tcp_int(r1, 0x6, 0x17, 0x0, 0x0) (async) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x3f, &(0x7f0000000180), 0x4) (async) getpeername$packet(r0, &(0x7f0000000740)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000840)=0x14) (async) getresuid(&(0x7f00000008c0), &(0x7f0000000900), &(0x7f0000000940)) (async) setsockopt$inet6_IPV6_IPSEC_POLICY(r1, 0x29, 0x22, &(0x7f0000000ac0)={{{@in6=@remote, @in=@multicast2, 0x4e24, 0x72ff, 0x4e24, 0x165, 0x2, 0xe0, 0x20, 0xc, r2, r3}, {0x8, 0x1, 0xfffffffffffffff6, 0x7, 0x7, 0xc, 0x2, 0xa}, {0x1, 0x0, 0x1, 0x4}, 0x7, 0x6e6bbb, 0x2, 0x0, 0x1, 0x2}, {{@in=@multicast2, 0x4d4, 0xff}, 0x2, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x3500, 0x2, 0x0, 0x7, 0xdd8a, 0xfffffffd, 0x1}}, 0xe8) (async) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) (async) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)=@ipv6_getroute={0x24, 0x1a, 0x1, 0x0, 0x0, {0x2, 0x20}, [@RTA_UID={0x8, 0x19, 0xffffffffffffffff}]}, 0x24}}, 0x0) (async) syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) (async) syz_usb_control_io(r4, 0x0, 0x0) (async) syz_open_dev$loop(&(0x7f0000000880), 0x7, 0x8101) (async) ioctl$BLKZEROOUT(r5, 0x127f, &(0x7f00000008c0)={0x0, 0x200}) (async) syz_usb_control_io(r4, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000002c0)={0x40, 0x6, 0x2, "41fe"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$hid(r4, &(0x7f0000000540)={0x24, &(0x7f0000000440)={0x20, 0x8, 0x15, {0x15, 0x10, "45919ec23077c9d44d73c5e60d84085ea7128f"}}, &(0x7f0000000480)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xc0c}}, &(0x7f00000004c0)={0x0, 0x22, 0x8, {[@global=@item_012={0x0, 0x1, 0x9}, @local=@item_012={0x0, 0x2, 0x4}, @global=@item_012={0x0, 0x1, 0xa}, @main=@item_4={0x3, 0x0, 0xc, "e1ea3ca2"}]}}, &(0x7f0000000500)={0x0, 0x21, 0x9, {0x9, 0x21, 0x287b, 0x4, 0x1, {0x22, 0xc63}}}}, &(0x7f0000000700)={0x2c, &(0x7f0000000580)={0x0, 0x8, 0x79, "c75ca0db516b96f89664cd37e4e368eb23e2e0a93c19a2f03b13c006bc2ce4a2c890451be10266ae99ce6337a01390eac983398ff605ac5182f46a49e93ad6b2472516eca385b5e656b56f9a134d8ebd21045b9e3d0aec86a11cf5ee33d096087d525133473e315aa19cd191210535eeaee7e62e6dc34fa094"}, &(0x7f0000000600)={0x0, 0xa, 0x1, 0xfc}, &(0x7f0000000640)={0x0, 0x8, 0x1, 0x7}, &(0x7f0000000680)={0x20, 0x1, 0x1c, "a52f95828ba308186ecb470ffbc112d55d2d0f8f7bba7724c8662129"}, &(0x7f00000006c0)={0x20, 0x3, 0x1, 0x29}}) (async) syz_usb_control_io$hid(r4, 0x0, 0x0) (async) syz_usb_control_io(r4, 0x0, 0x0) (async) syz_usb_control_io(r4, &(0x7f0000000240)={0x2c, &(0x7f0000000340)={0x0, 0x21, 0x2, {0x2, 0xa}}, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000a00)={0x84, &(0x7f0000000280)={0x20, 0x18, 0x3, "36bca9"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000880)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$lan78xx(r4, &(0x7f0000000140)={0x14, &(0x7f0000000000)={0x20, 0x0, 0xa2, {0xa2, 0xe, "3493796fe903b602a259259de522dd1cfe2c586dc336fccbff793c183356c09c3dcc258a5aaf56b6e9203b67ca763e0115e6dd839fec6ac1ade759cab3d415236628260a2de9fca05d2077f13cba157f07782d30f1d21aa03c9929c572ce0769d51be6634a866b2ef5e7683dd84de93a2468538e5501de9f12378a974e5aa22f29a4e07a1f238a6fbf631aa899c21715c2466286563ac6276eac97b193312e5f"}}, &(0x7f00000000c0)={0x0, 0x3, 0x57, @string={0x57, 0x3, "ac6d4a910ac466d62e80fbdc49d406d193f43e80aad3ff37a6467c0130781260235b53c575f4b0bc6741f8f4ec1fa0fdcf93216543170016dac9d453077dc5e196763f69d9235699ec98777c5988f1bb45445bd4e4"}}}, &(0x7f0000000400)={0x34, &(0x7f0000000180)={0x40, 0x11, 0x1a, "413b9700fefdf3ef8377e2384ba15c908375aefcf66024aa6db1"}, &(0x7f00000001c0)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000200)={0x0, 0x8, 0x1, 0xe6}, &(0x7f0000000300)={0xc0, 0xa1, 0x4, 0x470e}, &(0x7f0000000380)={0x40, 0xa0, 0x4}, &(0x7f00000003c0)={0xc0, 0xa2, 0x2f, "04c633708563bc6cf14fc93ad40a9de032b3cedb1e62dcc91102c45050c4224727fe31a845671bdf50bc005b68d8f3"}}) (async) 2.288721555s ago: executing program 2 (id=45): r0 = fsopen(&(0x7f0000000940)='9p\x00', 0x1) socket$packet(0x11, 0x2, 0x300) syz_usb_connect(0x3, 0x394, &(0x7f00000004c0)={{0x12, 0x1, 0x0, 0xe7, 0x36, 0x22, 0x40, 0x2833, 0x211, 0xc0be, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x382, 0x2, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x35, 0x4, 0x1, 0xff, 0x1, 0x0, 0x8, [@cdc_ncm={{0x6, 0x24, 0x6, 0x0, 0x1, "b7"}, {0x5, 0x24, 0x0, 0x359e}, {0xd, 0x24, 0xf, 0x1, 0x1, 0x6, 0x6, 0x34}, {0x6, 0x24, 0x1a, 0x0, 0x2}, [@mbim={0xc, 0x24, 0x1b, 0x2, 0x200, 0x0, 0x3, 0x419, 0x8d}, @network_terminal={0x7, 0x24, 0xa, 0x81, 0x4, 0x8, 0xf2}, @network_terminal={0x7, 0x24, 0xa, 0x9, 0x6, 0x4, 0x6}, @country_functional={0x6, 0x24, 0x7, 0x6, 0x7f}, @mdlm_detail={0x81, 0x24, 0x13, 0x8, "00c82834f9f824f4bf1b049b88db965dae57a38bacdfaa6b111f02e8e8b3418aee97d82108cf85ae21edbf0e0370cf3912136924674a016827a38ed62c71f382bb6a8e952ee9bb80c81d355fafba456d6be6a30ae922949bba3607ea708b45af0e0f661649f1f5aecc2fb80a43da76ac8c9f46089312994c4c57018774"}]}, @cdc_ecm={{0xb, 0x24, 0x6, 0x0, 0x0, "85def3806b93"}, {0x5, 0x24, 0x0, 0x3}, {0xd, 0x24, 0xf, 0x1, 0x3, 0x90c, 0x6, 0xfa}, [@dmm={0x7, 0x24, 0x14, 0x51}]}], [{{0x9, 0x5, 0x3, 0x3, 0x40, 0x7e, 0xff, 0x5}}]}}, {{0x9, 0x4, 0x78, 0x9b, 0x8, 0x8c, 0xf5, 0xed, 0xe, [], [{{0x9, 0x5, 0x0, 0x0, 0x0, 0x5, 0x2, 0x9, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x6, 0x72cc}, @uac_iso={0x7, 0x25, 0x1, 0x81, 0xfc, 0x4bac}]}}, {{0x9, 0x5, 0xd, 0x2, 0x8, 0x4, 0x3, 0x1, [@generic={0xcb, 0x1, "22d7b00a6e031093e5dbc0bc8fc0d81e599c35bc8f5613e255e80ed6bbb69d97a74d5ab632c30dd644fb53cffe3147399d8070728496f4d661c64612da3acaf7501676bfc0f02497b8843df95e4f2931812ce407e817dca79cbe28f32eb5b17b540e377fc91080fa3fe11554ee3d23799b8b3811146a855c5e1cbe28c38c7fadc098b15cc8396edb78430044eb0cc4fd0046b5325531d380eb56859852ff9e03fb1d2a0fff62b07103ee79f509793fdd10a73f18d829924c32767d3c3f01b05d2b593706ee0bc57d41"}, @uac_iso={0x7, 0x25, 0x1, 0x1, 0x3, 0x3}]}}, {{0x9, 0x5, 0xb, 0xc, 0x8, 0x48, 0x5, 0x3a, [@generic={0x45, 0x13, "f0efb343adf6a9d179f5797a3bb64dae7ca404dda8a54201620df07557c45fdbc20342a81dd92b85d6aabbb77f1d7dc475fee88a2afc7025c9f5080e05a06e51749f7e"}]}}, {{0x9, 0x5, 0xf, 0xb, 0x7ab72ad925da3109, 0x8, 0xf, 0x7}}, {{0x9, 0x5, 0x8, 0x0, 0x20, 0x40, 0x6, 0x7, [@generic={0x59, 0x1, "94e88824ef17554bb01ebd764e49cb53ff6c3aca292e59da2c4661ea1c5e68fcfd6354c2cc6f390a651b14fe7cede5e61cbec0ab3b03f85baf3607af99cf9d8e601a883bcb745645d71d8f058d9aebcfd9fddda160697a"}]}}, {{0x9, 0x5, 0x4, 0x8, 0x40, 0x2, 0xc, 0x2, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x14, 0x101}]}}, {{0x9, 0x5, 0x8, 0x0, 0x400, 0x69, 0x4, 0x7, [@generic={0xae, 0x8, "de426e51999d9fe9b3b1eccae1dedca20f13412884b9766a9b11ab1ce84108ed75744e235165bc627482a232e9d4a1d2ab62a9880320b3eec99b67e1cf10b012e47e93eec286565f1a860b2a5133c1eb52c40a024ece2ba10d61e975a474e29fea5a5532e330a608f9f21c5c0f8ba89b70229b28797df8a236d7205d772edeb7a0378d014f6b791cdc6963c785db5df79f60f698d6fd3b93cb3b0f606309d51ed6bbbfef1ca35ae83327f9bc"}]}}, {{0x9, 0x5, 0x0, 0x8, 0x20, 0x5, 0x6, 0x5}}]}}]}}]}}, 0x0) pipe(&(0x7f00000007c0)={0xffffffffffffffff, 0xffffffffffffffff}) vmsplice(r2, &(0x7f00000000c0)=[{&(0x7f0000000180)='w', 0x1}], 0x1, 0x1) close(r2) splice(r1, 0x0, r2, 0x0, 0xfffd, 0x0) io_uring_register$IORING_REGISTER_CLONE_BUFFERS(r2, 0x1e, &(0x7f0000000180)={r0}, 0x1) r3 = syz_open_dev$vim2m(&(0x7f0000000140), 0x200000001003, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r3, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMON(r3, 0x40045612, &(0x7f0000000080)=0x2) ioctl$VIDIOC_DECODER_CMD(r3, 0xc0485660, &(0x7f0000000000)={0x1, 0x1, @stop_pts=0x5}) ioctl$VIDIOC_DECODER_CMD(0xffffffffffffffff, 0xc0485660, &(0x7f0000000380)={0x1, 0x1, @start={0x3}}) syz_open_dev$swradio(&(0x7f0000000280), 0x0, 0x2) syz_open_procfs(0x0, &(0x7f0000000200)='net/mcfilter6\x00') openat$cuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) r4 = syz_open_dev$dri(&(0x7f0000000280), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f0000000480)={0x0, 0x0, 0x84000}) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x18, 0xfa00, {0x3, &(0x7f00000000c0), 0x111, 0x6}}, 0x20) socket$packet(0x11, 0x3, 0x300) socket(0x10, 0x803, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2000, 0x0) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000940), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) r6 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={@cgroup=r7, 0x33, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) writev(r5, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 2.233932552s ago: executing program 1 (id=46): ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000100)={'sit0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x7, 0x83e, 0x80000001}, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000300)={r2, 0xa, 0x2, 0x9}, 0x10) syz_open_dev$sndpcmc(0x0, 0x0, 0x42c001) syz_open_procfs(0x0, 0x0) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a40)=ANY=[@ANYBLOB="5c030000", @ANYRES16, @ANYBLOB="010026bd70000000000008000000bc00048034000780080002000b000000080004000000010008000300070000000800010018000000080003007f000000080003000600000009000100"], 0x35c}}, 0x20000010) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000e0ff00000000000000bd0000000000000000000000e4ec010000000040000000000000000000000000000000000000013da51fd47aa2e2f70000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}, 0x1, 0x1, [{{0xa, 0x0, 0x3000000, @empty}}]}, 0x110) 1.781548325s ago: executing program 3 (id=47): ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000100)={'sit0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x7, 0x83e, 0x80000001}, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000300)={r2, 0xa, 0x2, 0x9}, 0x10) syz_open_dev$sndpcmc(0x0, 0x0, 0x42c001) r3 = syz_open_procfs(0x0, 0x0) pread64(r3, 0x0, 0x0, 0xadc) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a40)=ANY=[@ANYBLOB="5c030000", @ANYRES16, @ANYBLOB="010026bd70000000000008000000bc00048034000780080002000b000000080004000000010008000300070000000800010018000000080003007f000000080003000600000009000100"], 0x35c}}, 0x20000010) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000e0ff00000000000000bd0000000000000000000000e4ec010000000040000000000000000000000000000000000000013da51fd47aa2e2f70000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}, 0x1, 0x1, [{{0xa, 0x0, 0x3000000, @empty}}]}, 0x110) 1.517219062s ago: executing program 4 (id=48): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000240)={'ip6tnl0\x00', 0x0}) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000600)=ANY=[@ANYBLOB="1201000047ff4f40d3131132677a010203010902120001760fb30f09040001"], 0x0) syz_usb_control_io$cdc_ecm(r4, &(0x7f0000000080)={0x14, 0x0, &(0x7f0000000040)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f0000000300)={0x2c, &(0x7f00000000c0)={0x40, 0x31, 0x42, {0x42, 0x11, "f320b82cae8485cd196158f55a7f32bdc129f930d64926506d4065843d3c088c60d2e4853b7acd052984bb3af71d8d96fd726bf3ac878d947eff76a8f73de36b"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0xf0ff}}, &(0x7f0000000180)={0x0, 0xf, 0xaa, {0x5, 0xf, 0xaa, 0x6, [@ext_cap={0x7, 0x10, 0x2, 0xa, 0x6, 0x9, 0xffff}, @ss_container_id={0x14, 0x10, 0x4, 0x4, "34933355edaa9a274c4751996d0a4c1e"}, @generic={0x74, 0x10, 0x3, "db96fb0746e1a242dedd730d7c4458021dd91a92606ec76a3e9157435b9916c362c1c0a49f0ec1a8772440f9f9f1640f791beeacb823b16480681f3c7689c95bfc8ee3efd0c8d56f96081f97cae207348d56d56e8fccb91745ecc4e5c6f548f853de043629903629e5c6fd3f5e7c9e1efc"}, @ext_cap={0x7, 0x10, 0x2, 0x0, 0x9, 0xb, 0x8}, @wireless={0xb, 0x10, 0x1, 0x2, 0x40, 0x2, 0x8, 0x1ff, 0x7}, @generic={0x4, 0x10, 0x4, "a6"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x9, 0x80, 0x8, 0xe9, "02058b10", "6aa14655"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x40, 0x8, 0xe5, 0x8, 0x9, 0x6, 0x9}}}, &(0x7f0000000880)={0x84, &(0x7f0000000380)={0x60, 0x31, 0x7e, "df5e200cd35b53d9a7efc1a4eeff574f7bd4e0c6d67919cad73ae793178f009d0c315b0e305b736e177445c3601b168d5a11a9faea7d663d0073896e7165b1dc8d23622c43aa1efc97c0b765e21cd0bee920824cbaafd2693eb62c89fce1dfca1e24146f9b1224f9169b1773844d6d806c7bbd493251607947a9d3152080"}, &(0x7f0000000440)={0x0, 0xa, 0x1, 0x3}, &(0x7f0000000480)={0x0, 0x8, 0x1, 0xfb}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x1}}, &(0x7f0000000500)={0x20, 0x0, 0x4, {0xe0, 0xbd}}, &(0x7f0000000580)={0x40, 0x7, 0x2, 0xcfe3}, &(0x7f00000005c0)={0x40, 0x9, 0x1, 0x2}, &(0x7f0000000640)={0x40, 0xb, 0x2, "8e83"}, &(0x7f0000000680)={0x40, 0xf, 0x2, 0x1}, &(0x7f00000006c0)={0x40, 0x13, 0x6, @random="27316fc18787"}, &(0x7f0000000700)={0x40, 0x17, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}, &(0x7f0000000740)={0x40, 0x19, 0x2, "df22"}, &(0x7f0000000780)={0x40, 0x1a, 0x2, 0xc9}, &(0x7f00000007c0)={0x40, 0x1c, 0x1, 0x1}, &(0x7f0000000800)={0x40, 0x1e, 0x1, 0xc}, &(0x7f0000000840)={0x40, 0x21, 0x1, 0x69}}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=@newqdisc={0x3c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r3, {0x3}, {0xffff, 0xffff}, {0x2, 0xa}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}, @TCA_RATE={0x6}]}, 0x3c}, 0x1, 0x0, 0x0, 0x2004009c}, 0x10) 591.018874ms ago: executing program 1 (id=49): ioctl$sock_ipv6_tunnel_SIOCDELPRL(0xffffffffffffffff, 0x89f6, &(0x7f0000000100)={'sit0\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_sctp6_SCTP_RTOINFO(r1, 0x84, 0x0, &(0x7f00000000c0)={0x0, 0x7, 0x83e, 0x80000001}, 0x0) setsockopt$inet_sctp_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000000300)={r2, 0xa, 0x2, 0x9}, 0x10) syz_open_dev$sndpcmc(0x0, 0x0, 0x42c001) r3 = syz_open_procfs(0x0, 0x0) pread64(r3, 0x0, 0x0, 0xadc) syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) sendmsg$TIPC_NL_LINK_GET(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000a40)=ANY=[@ANYBLOB="5c030000", @ANYRES16, @ANYBLOB="010026bd70000000000008000000bc00048034000780080002000b000000080004000000010008000300070000000800010018000000080003007f000000080003000600000009000100"], 0x35c}}, 0x20000010) r4 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r4, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000e0ff00000000000000bd0000000000000000000000e4ec010000000040000000000000000000000000000000000000013da51fd47aa2e2f70000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) setsockopt$inet6_MCAST_MSFILTER(r4, 0x29, 0x30, &(0x7f0000000500)={0x1, {{0xa, 0x4e20, 0x0, @mcast1}}, 0x1, 0x1, [{{0xa, 0x0, 0x3000000, @empty}}]}, 0x110) 361.585415ms ago: executing program 3 (id=50): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$L2TP_CMD_TUNNEL_CREATE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=ANY=[@ANYBLOB="5c00000016034e73bef7983238e81849f0aef32c01", @ANYRES16=r1, @ANYBLOB="170900000000000000000100000008000900fcffffff14001f00ff010000000000000000000000000001060002000100000008000a000000000005000700000000001400200000000000000000000000ffffe0000001"], 0x5c}, 0x1, 0x0, 0x0, 0x100008c5}, 0x20000810) socketpair(0x2d, 0x5, 0x1, &(0x7f00000000c0)) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f0000001200)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff810000400e227f000001925aa80020007b00090080007f000006e809000000ff0000f03ac7100206000000ffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x0, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0xe0, 0x16, 0xa, 0x1, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0xb4, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x90, 0x3, 0x0, 0x1, [{0x14, 0x1, 'gretap0\x00'}, {0x14, 0x1, 'bond0\x00'}, {0x14, 0x1, 'vxcan1\x00'}, {0x14, 0x1, 'nicvf0\x00'}, {0x14, 0x1, 'ip6_vti0\x00'}, {0x14, 0x1, 'bridge_slave_0\x00'}, {0x14, 0x1, 'wlan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'veth1_to_bond\x00'}]}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x98, 0x16, 0xa, 0x3, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x6c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vcan0\x00'}, {0x14, 0x1, 'pim6reg1\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}, {0x14}, {0x14, 0x1, 'veth0_vlan\x00'}]}]}]}], {0x14, 0x10}}, 0x1c0}}, 0x44) r3 = syz_open_dev$vim2m(&(0x7f0000000080), 0xb15, 0x2) r4 = fsmount(0xffffffffffffffff, 0x0, 0x1) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, 0x0, 0x0) ioctl$vim2m_VIDIOC_S_CTRL(r3, 0xc008561c, &(0x7f0000000000)={0xf0f003, 0x1}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_serviced\x00', 0x26e1, 0x0) close(r5) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) syz_open_dev$I2C(&(0x7f0000000040), 0x0, 0x44401) ioctl$VIDIOC_S_DV_TIMINGS(r6, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x0, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x6, 0x8, 0x722, 0x6, 0x7, 0x7f, 0x27, 0x20, {0x0, 0xf}, 0x3, 0xed}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, 0x0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) r10 = dup3(r9, r8, 0x0) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000000)={0x4c, 0x0, &(0x7f0000000300)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000001640)={0x0, 0x0, 0x0, 0x1, 0xfdfd, &(0x7f0000001540)='\t'}) syz_io_uring_complete(0x0) r11 = bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0x13, &(0x7f00000005c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r11}}, {}, [@ringbuf_query={{0x18, 0x1, 0x1, 0x0, r11}}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_emit_ethernet(0x56, &(0x7f0000000880)={@link_local, @multicast, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x20, 0x3a, 0xff, @local, @local, {[], @ndisc_na={0x88, 0x0, 0x0, 0x0, '\x00', @remote, [{0x2, 0x1, "36dad83aea8d"}]}}}}}}, 0x0) 213.454339ms ago: executing program 3 (id=51): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x458, 0x5017, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x9, 0x4, 0x1, {0x22, 0xa0}}, {{{0x9, 0x5, 0x81, 0x3, 0x40}}}}}]}}]}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./file0\x00', 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x404, 0x0) syz_usb_control_io(r0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) personality(0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) creat(0x0, 0x122) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r4, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r4, &(0x7f0000000040)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000400)=0x7) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket(0x5, 0x6, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) socket$nl_route(0x10, 0x3, 0x0) socket(0x1, 0x803, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r8, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r7, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r9], 0x5c}}, 0x40) 196.277608ms ago: executing program 0 (id=52): syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x300, 0x97, 0xfe, 0x5d, 0x10, 0x5ac, 0x262, 0x8994, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x5, 0x20, 0xc0, 0x2, [{{0x9, 0x4, 0xe1, 0x7, 0x0, 0x3, 0xbd, 0x2}}]}}]}}, &(0x7f0000000580)={0x0, 0x0, 0x0, 0x0}) syz_usb_connect$uac1(0x6, 0xd8, &(0x7f0000000040)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0xff, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xc6, 0x3, 0x1, 0x41, 0x50, 0x1, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x5, 0xfb}, [@mixer_unit={0x6, 0x24, 0x4, 0x2, 0x5, 'P'}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x204, 0x4, 0x9, 0x10, 0x5, 0xc}, @selector_unit={0x5, 0x24, 0x5, 0x2, 0x9}, @extension_unit={0xb, 0x24, 0x8, 0x4, 0x9, 0x0, "97782a8c"}, @feature_unit={0x11, 0x24, 0x6, 0x6, 0x6, 0x5, [0x5, 0x3, 0x8, 0x3, 0x8], 0x7}, @input_terminal={0xc, 0x24, 0x2, 0x5, 0x206, 0x3, 0x3, 0x0, 0x13, 0x2}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x6, 0x3, 0x3, 0x3, "44329277d5"}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x92, 0x5, 0x7, {0x7, 0x25, 0x1, 0x83, 0x7, 0x6a}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_ii_discrete={0xa, 0x24, 0x2, 0x2, 0xb, 0xa, 0x6, "f8"}, @as_header={0x7, 0x24, 0x1, 0x4, 0xd1, 0x5}, @format_type_i_continuous={0xa, 0x24, 0x2, 0x1, 0x4, 0x3, 0x4, 0xb, "", "68e9"}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0xfd, 0x2, 0x6, {0x7, 0x25, 0x1, 0x3, 0x7, 0x8}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x201, 0x50, 0x5, 0x0, 0x20, 0x3}, 0xf, &(0x7f0000000180)={0x5, 0xf, 0xf, 0x1, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x1, 0x8, 0xbd, 0x5a}]}, 0x5, [{0x4, &(0x7f00000001c0)=@lang_id={0x4}}, {0xb0, &(0x7f0000000200)=@string={0xb0, 0x3, "a3e7cb4921e8dc1449ba7bb179c29aec3128c0ff856f1e328deb932c72115d430415471681391248bf432f64f8b9a41e18332f39d81a99803667f70e94d52b9d6fa7683f668bc896217d600140cccaaeca59191737d2b51c0b4fdbed75ada92e5c02f9f54e675b4d25e9dd36d2e2defafa042e8448a65081f452c7364788a35bdec5724f61a797839c0bd77533990355116fdd0c895b9665502889c2a80115f25eecba8502586482e690efba377f"}}, {0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0xfcff}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x140a}}, {0xca, &(0x7f0000000340)=@string={0xca, 0x3, "81771e85faaa5ea9cb2c029635884c0a53545d9509d06fd02dd6186289d6ed63249ddf8f1d4e08d8e7758ae05af571da4f229fabb13e3e2fb9c0c0c207360083c130f27af0325c730254de53c4ed53bc196b59c25c5f3f5be077d575cd1f2056473e2e1f0d5e4532249b3135e60c0be97b8a27f2de08ad81b005b09a2151db25e43c3bcf44b4c155c83b8fa21e12a05f26f3a9735f869754d554ebce62db07a3a7bd22d89ea4f51be9d6930a71a8bae03ba6329851ef296eb79739225a1ab520c036af92bbbb5386"}}]}) 0s ago: executing program 2 (id=53): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x42, 0x0, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) r2 = creat(&(0x7f0000000100)='./file0\x00', 0xd931d3864d39dcca) syz_usb_connect$uac1(0x0, 0xa4, &(0x7f0000001200)=ANY=[@ANYBLOB="2a01000020000040b708008000000000030109029200030172e5000904000000010100000a24010000000201020c0d2405000005000000000000000c240000e9fffff5ffffffff092403f3", @ANYRES8=r2, @ANYRES32=r1], 0x0) ioctl$SNDRV_CTL_IOCTL_HWDEP_NEXT_DEVICE(r2, 0xc0045520, &(0x7f0000000000)=0x8cf1) getsockopt$sock_buf(r2, 0x1, 0x1a, &(0x7f00000000c0)=""/53, &(0x7f0000000140)=0x35) r3 = userfaultfd(0x1) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1000000, &(0x7f0000006680)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x1, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18000000000000000000000005000000850000007d00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback=0x13, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) setsockopt$sock_attach_bpf(r4, 0x1, 0x32, &(0x7f00000000c0)=r5, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000380)={&(0x7f0000000040)={0xa, 0xa, @local}, 0x10, &(0x7f0000000180)=[{&(0x7f0000004540)="a2", 0x1}], 0x1, 0x0, 0x0, 0xa6820000}, 0xafe6) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4000, 0xd3) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000340)=ANY=[], 0x84}, 0x1, 0x0, 0x0, 0x40010}, 0x4008000) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000001c0)={'ip_vti0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x0, 0x20, 0x80000001, 0x1, {{0x5, 0x4, 0x0, 0x21, 0x14, 0x64, 0x0, 0x80, 0x2f, 0x0, @multicast2, @remote}}}}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000340)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) sendmsg$NL80211_CMD_JOIN_MESH(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x8000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4004081}, 0x4004001) ioctl$KVM_RUN(r8, 0xae80, 0x0) r9 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x48082) ioctl$SCSI_IOCTL_GET_PCI(r9, 0x5393, &(0x7f0000000000)) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.181' (ED25519) to the list of known hosts. [ 65.955129][ T5808] cgroup: Unknown subsys name 'net' [ 66.043329][ T5808] cgroup: Unknown subsys name 'cpuset' [ 66.052087][ T5808] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 67.402082][ T5808] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.300750][ T5822] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 71.308692][ T5822] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 71.317458][ T5822] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 71.325381][ T5822] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 71.325775][ T5826] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 71.343893][ T5826] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 71.351638][ T5826] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 71.359814][ T5828] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 71.362683][ T5826] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 71.367708][ T5828] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 71.375347][ T5826] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 71.390023][ T5826] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 71.398495][ T5826] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 71.409180][ T5829] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 71.411312][ T5826] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 71.424663][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.426786][ T5829] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 71.432679][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.441243][ T5829] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 71.453782][ T5141] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 71.454141][ T5829] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 71.461855][ T5141] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 71.476957][ T5832] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 71.477638][ T5141] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 71.492693][ T5141] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 71.504178][ T5832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 71.523880][ T5824] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 72.047023][ T5834] chnl_net:caif_netlink_parms(): no params data found [ 72.161727][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 72.190256][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 72.243564][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 72.368380][ T5838] chnl_net:caif_netlink_parms(): no params data found [ 72.389152][ T5834] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.396954][ T5834] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.404995][ T5834] bridge_slave_0: entered allmulticast mode [ 72.412196][ T5834] bridge_slave_0: entered promiscuous mode [ 72.445545][ T5834] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.452767][ T5834] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.460159][ T5834] bridge_slave_1: entered allmulticast mode [ 72.467069][ T5834] bridge_slave_1: entered promiscuous mode [ 72.536403][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.543656][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.551100][ T5835] bridge_slave_0: entered allmulticast mode [ 72.557934][ T5835] bridge_slave_0: entered promiscuous mode [ 72.597978][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.606209][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.613480][ T5835] bridge_slave_1: entered allmulticast mode [ 72.620726][ T5835] bridge_slave_1: entered promiscuous mode [ 72.631267][ T5834] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.642997][ T5834] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.653315][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.660525][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.667680][ T5836] bridge_slave_0: entered allmulticast mode [ 72.675106][ T5836] bridge_slave_0: entered promiscuous mode [ 72.687348][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.694604][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.701852][ T5837] bridge_slave_0: entered allmulticast mode [ 72.709014][ T5837] bridge_slave_0: entered promiscuous mode [ 72.734530][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.741852][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.749020][ T5836] bridge_slave_1: entered allmulticast mode [ 72.756317][ T5836] bridge_slave_1: entered promiscuous mode [ 72.767854][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.775306][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 72.782654][ T5837] bridge_slave_1: entered allmulticast mode [ 72.789502][ T5837] bridge_slave_1: entered promiscuous mode [ 72.819844][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.871641][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 72.882946][ T5834] team0: Port device team_slave_0 added [ 72.918965][ T5838] bridge0: port 1(bridge_slave_0) entered blocking state [ 72.926463][ T5838] bridge0: port 1(bridge_slave_0) entered disabled state [ 72.933722][ T5838] bridge_slave_0: entered allmulticast mode [ 72.940788][ T5838] bridge_slave_0: entered promiscuous mode [ 72.958298][ T5834] team0: Port device team_slave_1 added [ 72.965461][ T5835] team0: Port device team_slave_0 added [ 72.976888][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 72.986165][ T5838] bridge0: port 2(bridge_slave_1) entered blocking state [ 72.993768][ T5838] bridge0: port 2(bridge_slave_1) entered disabled state [ 73.001267][ T5838] bridge_slave_1: entered allmulticast mode [ 73.008174][ T5838] bridge_slave_1: entered promiscuous mode [ 73.017159][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.037621][ T5835] team0: Port device team_slave_1 added [ 73.045234][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.064555][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.141475][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.148449][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.174557][ T5834] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.197641][ T5838] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 73.209128][ T5836] team0: Port device team_slave_0 added [ 73.216799][ T5837] team0: Port device team_slave_0 added [ 73.225032][ T5837] team0: Port device team_slave_1 added [ 73.231182][ T5834] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.238138][ T5834] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.264780][ T5834] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.276564][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.283963][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.310639][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.323757][ T5838] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 73.334546][ T5836] team0: Port device team_slave_1 added [ 73.368312][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.375347][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.402072][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.444645][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.451728][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.477732][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.491002][ T5828] Bluetooth: hci1: command tx timeout [ 73.505727][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.512807][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.539218][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.551848][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.558802][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.584829][ T5828] Bluetooth: hci0: command tx timeout [ 73.590008][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.590636][ T5828] Bluetooth: hci3: command tx timeout [ 73.606646][ T5828] Bluetooth: hci4: command tx timeout [ 73.612498][ T5828] Bluetooth: hci2: command tx timeout [ 73.618916][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.626129][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.652531][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.665708][ T5838] team0: Port device team_slave_0 added [ 73.706100][ T5838] team0: Port device team_slave_1 added [ 73.742827][ T5834] hsr_slave_0: entered promiscuous mode [ 73.749370][ T5834] hsr_slave_1: entered promiscuous mode [ 73.786859][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 73.793964][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.820357][ T5838] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 73.832660][ T5838] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 73.839620][ T5838] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 73.866398][ T5838] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 73.882873][ T5835] hsr_slave_0: entered promiscuous mode [ 73.889129][ T5835] hsr_slave_1: entered promiscuous mode [ 73.895480][ T5835] debugfs: 'hsr0' already exists in 'hsr' [ 73.901350][ T5835] Cannot create hsr debugfs directory [ 73.912296][ T5837] hsr_slave_0: entered promiscuous mode [ 73.918633][ T5837] hsr_slave_1: entered promiscuous mode [ 73.924880][ T5837] debugfs: 'hsr0' already exists in 'hsr' [ 73.930781][ T5837] Cannot create hsr debugfs directory [ 74.033420][ T5836] hsr_slave_0: entered promiscuous mode [ 74.039673][ T5836] hsr_slave_1: entered promiscuous mode [ 74.046290][ T5836] debugfs: 'hsr0' already exists in 'hsr' [ 74.052103][ T5836] Cannot create hsr debugfs directory [ 74.080767][ T5838] hsr_slave_0: entered promiscuous mode [ 74.086974][ T5838] hsr_slave_1: entered promiscuous mode [ 74.093322][ T5838] debugfs: 'hsr0' already exists in 'hsr' [ 74.099051][ T5838] Cannot create hsr debugfs directory [ 74.559191][ T5834] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 74.571396][ T5834] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 74.581983][ T5834] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 74.594401][ T5834] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 74.661056][ T5835] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 74.675305][ T5835] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 74.687976][ T5835] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 74.698368][ T5835] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 74.807687][ T5836] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 74.821717][ T5836] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 74.832380][ T5836] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 74.843561][ T5836] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 74.944249][ T5834] 8021q: adding VLAN 0 to HW filter on device bond0 [ 74.971779][ T5837] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 74.987135][ T5837] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 75.012752][ T5837] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 75.023875][ T5837] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 75.050605][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.067648][ T5834] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.096959][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.104359][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.148131][ T35] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.155316][ T35] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.168745][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.177356][ T5838] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 75.196688][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.203869][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.215820][ T5838] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 75.244307][ T5838] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 75.255843][ T5838] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 75.284785][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.291939][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.333367][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.384495][ T5834] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 75.425800][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.452158][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.459292][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.489417][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.496584][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.533579][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.560803][ T5824] Bluetooth: hci1: command tx timeout [ 75.567488][ T5834] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.590694][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.633836][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.641899][ T5824] Bluetooth: hci2: command tx timeout [ 75.647321][ T5824] Bluetooth: hci4: command tx timeout [ 75.650680][ T5832] Bluetooth: hci0: command tx timeout [ 75.658607][ T5828] Bluetooth: hci3: command tx timeout [ 75.701097][ T35] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.708215][ T35] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.733560][ T5835] veth0_vlan: entered promiscuous mode [ 75.741799][ T5834] veth0_vlan: entered promiscuous mode [ 75.761684][ T5835] veth1_vlan: entered promiscuous mode [ 75.773069][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.780270][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.803007][ T5838] 8021q: adding VLAN 0 to HW filter on device bond0 [ 75.829860][ T5838] 8021q: adding VLAN 0 to HW filter on device team0 [ 75.855507][ T124] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.862627][ T124] bridge0: port 1(bridge_slave_0) entered forwarding state [ 75.877243][ T5834] veth1_vlan: entered promiscuous mode [ 75.891173][ T124] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.898330][ T124] bridge0: port 2(bridge_slave_1) entered forwarding state [ 75.936042][ T5835] veth0_macvtap: entered promiscuous mode [ 75.949464][ T5835] veth1_macvtap: entered promiscuous mode [ 75.964133][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 75.998317][ T5837] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 76.025181][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.063488][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.075495][ T5834] veth0_macvtap: entered promiscuous mode [ 76.096998][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.105988][ T5834] veth1_macvtap: entered promiscuous mode [ 76.133026][ T35] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.143501][ T35] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.178212][ T35] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.188065][ T35] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.205701][ T5836] veth0_vlan: entered promiscuous mode [ 76.219087][ T5836] veth1_vlan: entered promiscuous mode [ 76.235356][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.249098][ T5834] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.282727][ T179] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.292893][ T179] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.333143][ T179] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.346727][ T179] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.377191][ T5837] veth0_vlan: entered promiscuous mode [ 76.415260][ T5836] veth0_macvtap: entered promiscuous mode [ 76.424956][ T5838] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 76.438947][ T5836] veth1_macvtap: entered promiscuous mode [ 76.446064][ T179] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.462493][ T179] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.486968][ T5837] veth1_vlan: entered promiscuous mode [ 76.523877][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.554572][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 76.565040][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.580167][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.630671][ T5837] veth0_macvtap: entered promiscuous mode [ 76.648261][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.663757][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.672191][ T5835] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 76.684391][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.703896][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.713533][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.722688][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 76.737558][ T5837] veth1_macvtap: entered promiscuous mode [ 76.746328][ T5838] veth0_vlan: entered promiscuous mode [ 76.780910][ T5838] veth1_vlan: entered promiscuous mode [ 76.856487][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 76.869594][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 76.880604][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 76.904056][ T5838] veth0_macvtap: entered promiscuous mode [ 76.926618][ T5838] veth1_macvtap: entered promiscuous mode [ 76.963828][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 77.024372][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.051431][ T5838] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 77.069664][ T29] audit: type=1326 audit(1772241679.161:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.106148][ T179] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.122137][ T29] audit: type=1326 audit(1772241679.191:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.144993][ T29] audit: type=1326 audit(1772241679.191:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.252706][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 77.261734][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 77.318381][ T29] audit: type=1326 audit(1772241679.191:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.410547][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.419047][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.427840][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.436730][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.445555][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.467839][ T124] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 77.469361][ T29] audit: type=1326 audit(1772241679.191:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.484278][ T124] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 77.505260][ T29] audit: type=1326 audit(1772241679.191:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=250 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.534406][ T29] audit: type=1326 audit(1772241679.191:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.564241][ T179] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.586129][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.596258][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.638635][ T29] audit: type=1326 audit(1772241679.191:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.661379][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 77.687381][ T5828] Bluetooth: hci1: command tx timeout [ 77.703864][ T5918] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 77.720912][ T5828] Bluetooth: hci3: command tx timeout [ 77.735032][ T5832] Bluetooth: hci0: command tx timeout [ 77.735930][ T5824] Bluetooth: hci4: command tx timeout [ 77.742789][ T5832] Bluetooth: hci2: command tx timeout [ 77.754378][ T35] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.770781][ T35] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.786309][ T29] audit: type=1326 audit(1772241679.211:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.861465][ T29] audit: type=1326 audit(1772241679.211:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=5910 comm="syz.2.3" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7fdde0b9c799 code=0x7ffc0000 [ 77.919600][ T35] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 77.978364][ T35] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.005353][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.021011][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.057898][ T35] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.070435][ T35] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.177839][ T3464] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.189431][ T3464] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.256455][ T35] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.274889][ T35] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.358885][ T35] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.382737][ T35] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.402033][ T9] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 78.411186][ T5909] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 78.509209][ T179] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.523912][ T179] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.601276][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 78.608674][ T5909] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 78.619539][ T5909] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 78.631742][ T9] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 78.646506][ T9] usb 3-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 78.659243][ T5909] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 78.671333][ T5909] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 78.691777][ T9] usb 3-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 78.710783][ T9] usb 3-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 78.724398][ T5909] usb 4-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 78.738487][ T9] usb 3-1: Product: syz [ 78.748575][ T5909] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 78.751878][ T981] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 78.766820][ T9] usb 3-1: Manufacturer: syz [ 78.786249][ T5909] usb 4-1: Product: syz [ 78.809405][ T9] hub 3-1:4.0: USB hub found [ 78.819003][ T5909] usb 4-1: Manufacturer: syz [ 78.831631][ T5909] usb 4-1: SerialNumber: syz [ 78.853924][ T5909] usb 4-1: config 0 descriptor?? [ 78.876383][ T5909] ums-isd200 4-1:0.0: USB Mass Storage device detected [ 78.953309][ T981] usb 1-1: Using ep0 maxpacket: 16 [ 78.972823][ T981] usb 1-1: config index 0 descriptor too short (expected 526, got 367) [ 78.990505][ T981] usb 1-1: config 0 has an invalid interface number: 209 but max is 0 [ 79.018208][ T981] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 79.041686][ T9] hub 3-1:4.0: config failed, hub doesn't have any ports! (err -19) [ 79.052194][ T981] usb 1-1: config 0 has no interface number 0 [ 79.078472][ T5909] scsi host1: usb-storage 4-1:0.0 [ 79.093531][ T981] usb 1-1: config 0 interface 209 altsetting 2 has a duplicate endpoint with address 0x1, skipping [ 79.127132][ T981] usb 1-1: config 0 interface 209 altsetting 2 endpoint 0xE has invalid wMaxPacketSize 0 [ 79.144618][ T5909] usb 4-1: USB disconnect, device number 2 [ 79.159604][ T981] usb 1-1: config 0 interface 209 altsetting 2 has 3 endpoint descriptors, different from the interface descriptor's value: 9 [ 79.214813][ T981] usb 1-1: config 0 interface 209 has no altsetting 0 [ 79.265631][ T981] usb 1-1: New USB device found, idVendor=0424, idProduct=cf19, bcdDevice=a4.96 [ 79.299831][ T981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.318788][ T981] usb 1-1: Product: syz [ 79.347362][ T981] usb 1-1: Manufacturer: syz [ 79.360271][ T981] usb 1-1: SerialNumber: syz [ 79.405661][ T24] usb 3-1: USB disconnect, device number 2 [ 79.427132][ T981] usb 1-1: config 0 descriptor?? [ 79.600121][ T24] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 79.720407][ T5832] Bluetooth: hci1: command tx timeout [ 79.764537][ T24] usb 5-1: New USB device found, idVendor=0483, idProduct=1234, bcdDevice=ff.76 [ 79.772541][ T5960] netlink: 840 bytes leftover after parsing attributes in process `syz.1.14'. [ 79.777643][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 79.792375][ T24] usb 5-1: Product: syz [ 79.797552][ T5936] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 79.810469][ T5832] Bluetooth: hci2: command tx timeout [ 79.810594][ T5824] Bluetooth: hci4: command tx timeout [ 79.816184][ T5832] Bluetooth: hci3: command tx timeout [ 79.816208][ T5832] Bluetooth: hci0: command tx timeout [ 79.816313][ T24] usb 5-1: Manufacturer: syz [ 79.816329][ T24] usb 5-1: SerialNumber: syz [ 79.843098][ T24] usb 5-1: config 0 descriptor?? [ 80.030961][ T5960] netlink: 840 bytes leftover after parsing attributes in process `syz.1.14'. [ 80.217389][ T24] usb 5-1: ignoring: not an USB2CAN converter [ 80.276856][ T1209] usb 1-1: USB disconnect, device number 2 [ 80.464196][ T5978] netlink: 4 bytes leftover after parsing attributes in process `syz.2.19'. [ 80.545292][ T5933] usb 5-1: USB disconnect, device number 2 [ 80.902898][ T5983] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 80.947477][ T5981] FAULT_INJECTION: forcing a failure. [ 80.947477][ T5981] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 80.961167][ T5981] CPU: 0 UID: 0 PID: 5981 Comm: syz.1.20 Not tainted syzkaller #0 PREEMPT(full) [ 80.961192][ T5981] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 80.961212][ T5981] Call Trace: [ 80.961219][ T5981] [ 80.961226][ T5981] dump_stack_lvl+0xe8/0x150 [ 80.961258][ T5981] should_fail_ex+0x412/0x560 [ 80.961283][ T5981] __kvm_read_guest_page+0x18d/0x240 [ 80.961306][ T5981] kvm_fetch_guest_virt+0x12b/0x170 [ 80.961332][ T5981] ? __pfx_kvm_fetch_guest_virt+0x10/0x10 [ 80.961354][ T5981] __do_insn_fetch_bytes+0x31c/0x700 [ 80.961379][ T5981] ? __pfx___do_insn_fetch_bytes+0x10/0x10 [ 80.961398][ T5981] ? __pfx___up_read+0x10/0x10 [ 80.961415][ T5981] ? get_user_pages_unlocked+0x5ca/0x710 [ 80.961444][ T5981] x86_decode_insn+0x38e/0x5df0 [ 80.961467][ T5981] ? kvm_is_mmio_pfn+0x169/0x720 [ 80.961493][ T5981] ? trace_kvm_tdp_mmu_spte_changed+0x8a/0x260 [ 80.961517][ T5981] ? handle_changed_spte+0x3f8/0x14a0 [ 80.961542][ T5981] ? __pfx_x86_decode_insn+0x10/0x10 [ 80.961562][ T5981] ? kvm_tdp_mmu_map+0x3bf/0x1ed0 [ 80.961585][ T5981] ? vmx_read_guest_seg_ar+0x38f/0x5b0 [ 80.961605][ T5981] ? __asan_memset+0x22/0x50 [ 80.961629][ T5981] ? init_decode_cache+0xea/0x160 [ 80.961649][ T5981] ? init_emulate_ctxt+0x4e7/0x680 [ 80.961676][ T5981] ? __pfx_init_emulate_ctxt+0x10/0x10 [ 80.961698][ T5981] ? kvm_mmu_faultin_pfn+0xebd/0x15e0 [ 80.961730][ T5981] ? folio_mark_accessed+0x42e/0x8c0 [ 80.961753][ T5981] x86_emulate_instruction+0x64a/0x2100 [ 80.961783][ T5981] ? do_raw_read_unlock+0x3d/0x80 [ 80.961799][ T5981] ? _raw_read_unlock+0x28/0x50 [ 80.961823][ T5981] ? __pfx_x86_emulate_instruction+0x10/0x10 [ 80.961844][ T5981] ? vmx_handle_exit_irqoff+0x100/0xa00 [ 80.961866][ T5981] ? rcu_qs+0x5e/0xe0 [ 80.961887][ T5981] ? __pfx_vmx_handle_exit_irqoff+0x10/0x10 [ 80.961915][ T5981] handle_ud+0x189/0x590 [ 80.961941][ T5981] ? __pfx_handle_ud+0x10/0x10 [ 80.961977][ T5981] ? __pfx_handle_exception_nmi+0x10/0x10 [ 80.962001][ T5981] vmx_handle_exit+0xfd1/0x16c0 [ 80.962037][ T5981] vcpu_run+0x5fa2/0x7b90 [ 80.962079][ T5981] ? vcpu_run+0x4ca8/0x7b90 [ 80.962141][ T5981] ? __pfx_vcpu_run+0x10/0x10 [ 80.962158][ T5981] ? fpu_swap_kvm_fpstate+0xc1/0x4f0 [ 80.962186][ T5981] ? rcu_is_watching+0x15/0xb0 [ 80.962212][ T5981] kvm_arch_vcpu_ioctl_run+0x11e6/0x20d0 [ 80.962241][ T5981] ? kvm_arch_vcpu_ioctl_run+0x2e8/0x20d0 [ 80.962260][ T5981] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 80.962280][ T5981] ? rcu_is_watching+0x15/0xb0 [ 80.962302][ T5981] ? trace_contention_end+0x3d/0x150 [ 80.962328][ T5981] ? __mutex_lock+0x319/0x1300 [ 80.962351][ T5981] ? kasan_quarantine_put+0xbb/0x1f0 [ 80.962370][ T5981] ? kvm_vcpu_ioctl+0x280/0xfd0 [ 80.962391][ T5981] ? __pfx___mutex_lock+0x10/0x10 [ 80.962408][ T5981] ? tomoyo_path_number_perm+0x219/0x630 [ 80.962430][ T5981] ? do_vfs_ioctl+0x1166/0x1530 [ 80.962452][ T5981] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 80.962471][ T5981] kvm_vcpu_ioctl+0xa62/0xfd0 [ 80.962493][ T5981] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 80.962508][ T5981] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 80.962544][ T5981] ? __fget_files+0x2a/0x420 [ 80.962569][ T5981] ? __fget_files+0x2a/0x420 [ 80.962590][ T5981] ? __fget_files+0x3a0/0x420 [ 80.962611][ T5981] ? __fget_files+0x2a/0x420 [ 80.962635][ T5981] ? bpf_lsm_file_ioctl+0x9/0x20 [ 80.962656][ T5981] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 80.962672][ T5981] __se_sys_ioctl+0xfc/0x170 [ 80.962691][ T5981] do_syscall_64+0x14d/0xf80 [ 80.962707][ T5981] ? trace_irq_disable+0x3b/0x150 [ 80.962736][ T5981] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.962753][ T5981] ? clear_bhb_loop+0x40/0x90 [ 80.962774][ T5981] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 80.962791][ T5981] RIP: 0033:0x7fe74099c799 [ 80.962816][ T5981] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 80.962829][ T5981] RSP: 002b:00007fe7417ba028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 80.962848][ T5981] RAX: ffffffffffffffda RBX: 00007fe740c15fa0 RCX: 00007fe74099c799 [ 80.962860][ T5981] RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000007 [ 80.962870][ T5981] RBP: 00007fe7417ba090 R08: 0000000000000000 R09: 0000000000000000 [ 80.962880][ T5981] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 80.962890][ T5981] R13: 00007fe740c16038 R14: 00007fe740c15fa0 R15: 00007fe740d3fa48 [ 80.962915][ T5981] [ 81.503360][ T5986] netlink: 'syz.2.22': attribute type 1 has an invalid length. [ 81.549772][ T5986] macvlan0: entered promiscuous mode [ 81.573936][ T5986] batman_adv: batadv0: Adding interface: macvlan0 [ 81.667441][ T5986] batman_adv: batadv0: The MTU of interface macvlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 81.700308][ T5996] netlink: 8 bytes leftover after parsing attributes in process `syz.4.26'. [ 81.710170][ T5986] batman_adv: batadv0: Not using interface macvlan0 (retrying later): interface not active [ 81.891934][ T5933] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 82.050498][ T5933] usb 4-1: Using ep0 maxpacket: 8 [ 82.100463][ T5933] usb 4-1: config 5 has an invalid interface number: 19 but max is 0 [ 82.113156][ T5933] usb 4-1: config 5 has no interface number 0 [ 82.135060][ T5933] usb 4-1: config 5 interface 19 altsetting 3 endpoint 0x7 has invalid maxpacket 1023, setting to 64 [ 82.173758][ T5933] usb 4-1: config 5 interface 19 altsetting 3 bulk endpoint 0x3 has invalid maxpacket 584 [ 82.211766][ T5933] usb 4-1: config 5 interface 19 altsetting 3 endpoint 0x6 has invalid maxpacket 1024, setting to 64 [ 82.244680][ T5933] usb 4-1: config 5 interface 19 altsetting 3 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 82.270219][ T5908] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 82.274056][ T5933] usb 4-1: config 5 interface 19 altsetting 3 endpoint 0xB has invalid maxpacket 1024, setting to 64 [ 82.324371][ T5933] usb 4-1: config 5 interface 19 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 82.354009][ T5933] usb 4-1: config 5 interface 19 altsetting 3 has a duplicate endpoint with address 0xB, skipping [ 82.389251][ T5933] usb 4-1: config 5 interface 19 altsetting 3 has a duplicate endpoint with address 0x7, skipping [ 82.434707][ T5933] usb 4-1: config 5 interface 19 altsetting 3 has a duplicate endpoint with address 0x1, skipping [ 82.451762][ T5908] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 82.480341][ T5908] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 82.499655][ T5908] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 82.513461][ T5908] usb 5-1: Manufacturer: syz [ 82.594234][ T5933] usb 4-1: config 5 interface 19 altsetting 3 endpoint 0x9 has invalid maxpacket 512, setting to 64 [ 82.595720][ T5908] usb 5-1: config 0 descriptor?? [ 82.611077][ T5933] usb 4-1: config 5 interface 19 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 82.625170][ T5933] usb 4-1: config 5 interface 19 has no altsetting 0 [ 82.665556][ T5933] usb 4-1: New USB device found, idVendor=10b8, idProduct=1ebc, bcdDevice=1d.c0 [ 82.709966][ T5933] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.745604][ T5933] usb 4-1: Product: syz [ 82.764974][ T5933] usb 4-1: Manufacturer: syz [ 82.778704][ T5933] usb 4-1: SerialNumber: syz [ 82.802264][ T5908] rc_core: IR keymap rc-hauppauge not found [ 82.814541][ T5989] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 82.818594][ T5908] Registered IR keymap rc-empty [ 82.825424][ T5989] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 82.844686][ T5908] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0 [ 82.995771][ T5908] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/rc/rc0/input5 [ 83.050234][ T5883] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 83.109811][ T5933] dvb-usb: found a 'DiBcom STK7070P reference design' in cold state, will try to load a firmware [ 83.245928][ T5883] usb 2-1: Using ep0 maxpacket: 32 [ 83.263616][ T5883] usb 2-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 83.286452][ T5883] usb 2-1: config 0 interface 0 has no altsetting 0 [ 83.325499][ T5883] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 83.353329][ T5933] dvb-usb: downloading firmware from file 'dvb-usb-dib0700-1.20.fw' [ 83.368682][ T5883] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.394276][ T5933] dib0700: firmware download failed at 7 with -22 [ 83.416096][ T5883] usb 2-1: config 0 descriptor?? [ 83.509449][ T5933] usb 4-1: USB disconnect, device number 3 [ 83.716726][ T5883] usbhid 2-1:0.0: can't add hid device: -71 [ 83.731970][ T5883] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 83.776963][ T5883] usb 2-1: USB disconnect, device number 2 [ 83.896544][ T6050] Zero length message leads to an empty skb [ 83.955264][ T6053] netlink: 104 bytes leftover after parsing attributes in process `syz.2.41'. [ 83.979368][ T6053] netlink: 28 bytes leftover after parsing attributes in process `syz.2.41'. [ 84.015842][ T6053] netlink: 28 bytes leftover after parsing attributes in process `syz.2.41'. [ 84.036356][ T6053] bridge0: entered promiscuous mode [ 84.064963][ T6053] bridge0: left promiscuous mode [ 84.420072][ T5933] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 84.554317][ T5908] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 84.589987][ T5933] usb 1-1: Using ep0 maxpacket: 32 [ 84.602392][ T5933] usb 1-1: config 0 has an invalid interface number: 132 but max is 0 [ 84.611653][ T5933] usb 1-1: config 0 has no interface number 0 [ 84.618132][ T5933] usb 1-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 84.642812][ T5933] usb 1-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 84.663935][ T5933] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 84.689230][ T5933] usb 1-1: Product: syz [ 84.706340][ T5933] usb 1-1: Manufacturer: syz [ 84.724351][ T5933] usb 1-1: SerialNumber: syz [ 84.744852][ T5933] usb 1-1: config 0 descriptor?? [ 84.763177][ T5908] usb 3-1: config 0 has an invalid interface number: 53 but max is 1 [ 84.764890][ T5933] em28xx 1-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 84.776547][ T5908] usb 3-1: config 0 has an invalid interface number: 120 but max is 1 [ 84.782958][ T5933] em28xx 1-1:0.132: Video interface 132 found: [ 84.840614][ T5908] usb 3-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 84.861202][ T5908] usb 3-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 84.877587][ T5908] usb 3-1: config 0 has no interface number 0 [ 84.903446][ T5908] usb 3-1: config 0 has no interface number 1 [ 84.915047][ T5908] usb 3-1: config 0 interface 53 altsetting 4 endpoint 0x3 has an invalid bInterval 126, changing to 10 [ 84.953463][ T981] usb 5-1: USB disconnect, device number 3 [ 84.997075][ T5908] usb 3-1: config 0 interface 120 altsetting 155 has an invalid descriptor for endpoint zero, skipping [ 85.036606][ T5908] usb 3-1: config 0 interface 120 altsetting 155 bulk endpoint 0xD has invalid maxpacket 8 [ 85.054124][ T5908] usb 3-1: config 0 interface 120 altsetting 155 endpoint 0xF has invalid maxpacket 8457, setting to 1024 [ 85.094428][ T5908] usb 3-1: config 0 interface 120 altsetting 155 has a duplicate endpoint with address 0x8, skipping [ 85.117999][ T5908] usb 3-1: config 0 interface 120 altsetting 155 has an invalid descriptor for endpoint zero, skipping [ 85.144432][ T5908] usb 3-1: config 0 interface 53 has no altsetting 0 [ 85.156368][ T5908] usb 3-1: config 0 interface 120 has no altsetting 0 [ 85.165342][ T5933] em28xx 1-1:0.132: chip ID is em2874 [ 85.205929][ T5908] usb 3-1: New USB device found, idVendor=2833, idProduct=0211, bcdDevice=c0.be [ 85.215353][ T5908] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.224798][ T5908] usb 3-1: Product: syz [ 85.229099][ T5908] usb 3-1: Manufacturer: syz [ 85.237681][ T5908] usb 3-1: SerialNumber: syz [ 85.248692][ T5908] usb 3-1: config 0 descriptor?? [ 85.559816][ T5883] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 85.562503][ T5908] uvcvideo 3-1:0.53: Found Unit with invalid ID 0 [ 85.682182][ T5908] uvcvideo 3-1:0.53: Found Unit with invalid ID 0 [ 85.690766][ T5908] uvcvideo 3-1:0.53: Found UVC 0.00 device syz (2833:0211) [ 85.701887][ T5908] uvcvideo 3-1:0.53: No valid video chain found. [ 85.769166][ T5933] em28xx 1-1:0.132: reading from i2c device at 0xa0 failed: couldn't get the received message from the bridge (error=-5) [ 85.777777][ T5908] usb 3-1: USB disconnect, device number 3 [ 85.782862][ T5933] em28xx 1-1:0.132: board has no eeprom [ 85.841785][ T5883] usb 5-1: config 118 interface 0 has no altsetting 0 [ 85.856655][ T5883] usb 5-1: New USB device found, idVendor=13d3, idProduct=3211, bcdDevice=7a.67 [ 85.879264][ T5883] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 85.888896][ T5933] em28xx 1-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 85.937473][ T5933] em28xx 1-1:0.132: analog set to bulk mode. [ 85.943876][ T5883] usb 5-1: Product: syz [ 85.948061][ T5883] usb 5-1: Manufacturer: syz [ 85.959489][ T5909] em28xx 1-1:0.132: Registering V4L2 extension [ 85.990324][ T5883] usb 5-1: SerialNumber: syz [ 86.219195][ T5883] dvb-usb: found a 'Pinnacle PCTV 310e' in warm state. [ 86.243258][ T5883] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 86.272060][ T6061] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 86.282611][ T6061] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 86.301880][ T5933] usb 1-1: USB disconnect, device number 3 [ 86.307787][ T5909] em28xx 1-1:0.132: failed to get i2c transfer status from bridge register (error=-5) [ 86.319363][ T5933] em28xx 1-1:0.132: Disconnecting em28xx [ 86.370120][ T5883] dvbdev: DVB: registering new adapter (Pinnacle PCTV 310e) [ 86.497163][ T5883] usb 5-1: media controller created [ 86.734814][ T5883] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 86.768507][ T5909] usb 1-1: Decoder not found [ 86.928791][ T5905] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 86.950772][ T42] cfg80211: failed to load regulatory.db [ 86.982305][ T5909] em28xx 1-1:0.132: failed to create media graph [ 87.003422][ T5909] em28xx 1-1:0.132: V4L2 device video103 deregistered [ 87.044381][ T5909] em28xx 1-1:0.132: Remote control support is not available for this card. [ 87.044477][ T6093] ================================================================== [ 87.061051][ T6093] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 87.061477][ T5933] em28xx 1-1:0.132: Closing input extension [ 87.068513][ T6093] Read of size 8 at addr ffff888033680748 by task v4l_id/6093 [ 87.068533][ T6093] [ 87.068544][ T6093] CPU: 1 UID: 0 PID: 6093 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 87.068560][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 87.068569][ T6093] Call Trace: [ 87.068577][ T6093] [ 87.068584][ T6093] dump_stack_lvl+0xe8/0x150 [ 87.068607][ T6093] print_report+0xba/0x230 [ 87.068623][ T6093] ? v4l2_fh_open+0xac/0x420 [ 87.068657][ T6093] kasan_report+0x117/0x150 [ 87.068674][ T6093] ? v4l2_fh_open+0xac/0x420 [ 87.068688][ T6093] v4l2_fh_open+0xac/0x420 [ 87.068703][ T6093] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 87.068722][ T6093] em28xx_v4l2_open+0x157/0x9a0 [ 87.068743][ T6093] ? do_raw_spin_lock+0x12b/0x2f0 [ 87.068771][ T6093] v4l2_open+0x1bf/0x3a0 [ 87.068790][ T6093] chrdev_open+0x4cd/0x5e0 [ 87.068808][ T6093] ? __pfx_chrdev_open+0x10/0x10 [ 87.068824][ T6093] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 87.068851][ T6093] ? __pfx_chrdev_open+0x10/0x10 [ 87.068867][ T6093] do_dentry_open+0x785/0x14e0 [ 87.068892][ T6093] vfs_open+0x3b/0x340 [ 87.068910][ T6093] ? path_openat+0x2df0/0x3860 [ 87.068926][ T6093] path_openat+0x2e08/0x3860 [ 87.068948][ T6093] ? __pfx_stack_trace_save+0x10/0x10 [ 87.068966][ T6093] ? stack_depot_save_flags+0x33/0x810 [ 87.068988][ T6093] ? __pfx_path_openat+0x10/0x10 [ 87.069002][ T6093] ? __x64_sys_openat+0x138/0x170 [ 87.069020][ T6093] ? do_syscall_64+0x14d/0xf80 [ 87.069034][ T6093] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.069053][ T6093] ? __lock_acquire+0x6b5/0x2cf0 [ 87.069075][ T6093] do_file_open+0x23e/0x4a0 [ 87.069093][ T6093] ? __pfx_do_file_open+0x10/0x10 [ 87.069116][ T6093] ? _raw_spin_unlock+0x28/0x50 [ 87.069136][ T6093] ? alloc_fd+0x64b/0x6c0 [ 87.069159][ T6093] do_sys_openat2+0x113/0x200 [ 87.069180][ T6093] ? __pfx_do_sys_openat2+0x10/0x10 [ 87.069201][ T6093] ? exc_page_fault+0x6a/0xc0 [ 87.069223][ T6093] ? do_user_addr_fault+0xc6f/0x1340 [ 87.069244][ T6093] __x64_sys_openat+0x138/0x170 [ 87.069273][ T6093] do_syscall_64+0x14d/0xf80 [ 87.069287][ T6093] ? trace_irq_disable+0x3b/0x150 [ 87.069308][ T6093] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.069324][ T6093] ? clear_bhb_loop+0x40/0x90 [ 87.069341][ T6093] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.069358][ T6093] RIP: 0033:0x7fdbe03cb407 [ 87.069374][ T6093] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 87.069387][ T6093] RSP: 002b:00007ffc9474fcb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 87.069405][ T6093] RAX: ffffffffffffffda RBX: 00007fdbe033f880 RCX: 00007fdbe03cb407 [ 87.069417][ T6093] RDX: 0000000000000000 RSI: 00007ffc94750f1c RDI: ffffffffffffff9c [ 87.069428][ T6093] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 87.069437][ T6093] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 87.069447][ T6093] R13: 00007ffc9474ff00 R14: 00007fdbe0624000 R15: 000055690816f4d8 [ 87.069466][ T6093] [ 87.069472][ T6093] [ 87.378974][ T6093] Allocated by task 5909: [ 87.383288][ T6093] kasan_save_track+0x3e/0x80 [ 87.388002][ T6093] __kasan_kmalloc+0x93/0xb0 [ 87.392724][ T6093] __kmalloc_cache_noprof+0x31c/0x660 [ 87.398167][ T6093] em28xx_v4l2_init+0x10b/0x2e70 [ 87.403097][ T6093] em28xx_init_extension+0x120/0x1c0 [ 87.408380][ T6093] process_scheduled_works+0xb02/0x1830 [ 87.413911][ T6093] worker_thread+0xa50/0xfc0 [ 87.418499][ T6093] kthread+0x388/0x470 [ 87.422633][ T6093] ret_from_fork+0x51e/0xb90 [ 87.427204][ T6093] ret_from_fork_asm+0x1a/0x30 [ 87.431957][ T6093] [ 87.434259][ T6093] Freed by task 5909: [ 87.438649][ T6093] kasan_save_track+0x3e/0x80 [ 87.443308][ T6093] kasan_save_free_info+0x46/0x50 [ 87.448313][ T6093] __kasan_slab_free+0x5c/0x80 [ 87.453052][ T6093] kfree+0x1c1/0x630 [ 87.456933][ T6093] em28xx_v4l2_init+0x1683/0x2e70 [ 87.462026][ T6093] em28xx_init_extension+0x120/0x1c0 [ 87.467289][ T6093] process_scheduled_works+0xb02/0x1830 [ 87.472814][ T6093] worker_thread+0xa50/0xfc0 [ 87.477385][ T6093] kthread+0x388/0x470 [ 87.481431][ T6093] ret_from_fork+0x51e/0xb90 [ 87.486003][ T6093] ret_from_fork_asm+0x1a/0x30 [ 87.490750][ T6093] [ 87.493058][ T6093] The buggy address belongs to the object at ffff888033680000 [ 87.493058][ T6093] which belongs to the cache kmalloc-8k of size 8192 [ 87.507207][ T6093] The buggy address is located 1864 bytes inside of [ 87.507207][ T6093] freed 8192-byte region [ffff888033680000, ffff888033682000) [ 87.521168][ T6093] [ 87.523479][ T6093] The buggy address belongs to the physical page: [ 87.529886][ T6093] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x33680 [ 87.538637][ T6093] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 87.547115][ T6093] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 87.554648][ T6093] page_type: f5(slab) [ 87.558612][ T6093] raw: 00fff00000000040 ffff88813fea9280 dead000000000100 dead000000000122 [ 87.567175][ T6093] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 87.575741][ T6093] head: 00fff00000000040 ffff88813fea9280 dead000000000100 dead000000000122 [ 87.584566][ T6093] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 87.593221][ T6093] head: 00fff00000000003 ffffea0000cda001 00000000ffffffff 00000000ffffffff [ 87.601993][ T6093] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 87.610650][ T6093] page dumped because: kasan: bad access detected [ 87.617063][ T6093] page_owner tracks the page as allocated [ 87.622755][ T6093] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5646, tgid 5646 (dhcpcd-run-hook), ts 52405385392, free_ts 52405061812 [ 87.643578][ T6093] post_alloc_hook+0x231/0x280 [ 87.648331][ T6093] get_page_from_freelist+0x24dc/0x2580 [ 87.653857][ T6093] __alloc_frozen_pages_noprof+0x18d/0x380 [ 87.659658][ T6093] allocate_slab+0x77/0x660 [ 87.664175][ T6093] refill_objects+0x331/0x3c0 [ 87.668851][ T6093] __pcs_replace_empty_main+0x2b9/0x620 [ 87.674386][ T6093] __kmalloc_cache_noprof+0x392/0x660 [ 87.679831][ T6093] tomoyo_init_log+0x112e/0x1fb0 [ 87.684754][ T6093] tomoyo_supervisor+0x353/0x1570 [ 87.689848][ T6093] tomoyo_env_perm+0x151/0x1f0 [ 87.694598][ T6093] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 87.700219][ T6093] tomoyo_bprm_check_security+0x11b/0x180 [ 87.705948][ T6093] security_bprm_check+0x85/0x240 [ 87.710995][ T6093] bprm_execve+0x896/0x1460 [ 87.715480][ T6093] do_execveat_common+0x50d/0x690 [ 87.720486][ T6093] __x64_sys_execve+0x97/0xc0 [ 87.725240][ T6093] page last free pid 5646 tgid 5646 stack trace: [ 87.731552][ T6093] __free_frozen_pages+0xc2b/0xdb0 [ 87.736647][ T6093] __slab_free+0x263/0x2b0 [ 87.741131][ T6093] qlist_free_all+0x97/0x100 [ 87.745700][ T6093] kasan_quarantine_reduce+0x148/0x160 [ 87.751138][ T6093] __kasan_slab_alloc+0x22/0x80 [ 87.755969][ T6093] __kmalloc_noprof+0x316/0x760 [ 87.760798][ T6093] tomoyo_supervisor+0xc22/0x1570 [ 87.765805][ T6093] tomoyo_env_perm+0x151/0x1f0 [ 87.770635][ T6093] tomoyo_find_next_domain+0x15cb/0x1aa0 [ 87.776331][ T6093] tomoyo_bprm_check_security+0x11b/0x180 [ 87.782124][ T6093] security_bprm_check+0x85/0x240 [ 87.787144][ T6093] bprm_execve+0x896/0x1460 [ 87.791733][ T6093] do_execveat_common+0x50d/0x690 [ 87.796766][ T6093] __x64_sys_execve+0x97/0xc0 [ 87.801444][ T6093] do_syscall_64+0x14d/0xf80 [ 87.806101][ T6093] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 87.812006][ T6093] [ 87.814323][ T6093] Memory state around the buggy address: [ 87.819979][ T6093] ffff888033680600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.828030][ T6093] ffff888033680680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.836075][ T6093] >ffff888033680700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.844303][ T6093] ^ [ 87.850883][ T6093] ffff888033680780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.858955][ T6093] ffff888033680800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 87.867107][ T6093] ================================================================== [ 87.891649][ T5883] DVB: Unable to find symbol mt352_attach() [ 87.898409][ T5883] dvb-usb: no frontend was attached by 'Pinnacle PCTV 310e' [ 87.908681][ T5908] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 87.917009][ T5883] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.4/usb5/5-1/input/input6 [ 87.935444][ T6093] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 87.942672][ T6093] CPU: 1 UID: 0 PID: 6093 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 87.951617][ T6093] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 [ 87.961677][ T6093] Call Trace: [ 87.964955][ T6093] [ 87.967885][ T6093] vpanic+0x56c/0xa60 [ 87.971869][ T6093] ? __pfx_vpanic+0x10/0x10 [ 87.976571][ T6093] panic+0xc5/0xd0 [ 87.980308][ T6093] ? __pfx_panic+0x10/0x10 [ 87.984818][ T6093] ? preempt_schedule_thunk+0x16/0x30 [ 87.990264][ T6093] ? preempt_schedule_thunk+0x16/0x30 [ 87.995620][ T6093] ? v4l2_fh_open+0xac/0x420 [ 88.000201][ T6093] check_panic_on_warn+0x89/0xb0 [ 88.005136][ T6093] ? v4l2_fh_open+0xac/0x420 [ 88.009732][ T6093] end_report+0x73/0x180 [ 88.013972][ T6093] ? v4l2_fh_open+0xac/0x420 [ 88.018566][ T6093] kasan_report+0x128/0x150 [ 88.023057][ T6093] ? v4l2_fh_open+0xac/0x420 [ 88.027639][ T6093] v4l2_fh_open+0xac/0x420 [ 88.032042][ T6093] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 88.038004][ T6093] em28xx_v4l2_open+0x157/0x9a0 [ 88.042853][ T6093] ? do_raw_spin_lock+0x12b/0x2f0 [ 88.047885][ T6093] v4l2_open+0x1bf/0x3a0 [ 88.052134][ T6093] chrdev_open+0x4cd/0x5e0 [ 88.056566][ T6093] ? __pfx_chrdev_open+0x10/0x10 [ 88.061505][ T6093] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 88.067847][ T6093] ? __pfx_chrdev_open+0x10/0x10 [ 88.072887][ T6093] do_dentry_open+0x785/0x14e0 [ 88.077662][ T6093] vfs_open+0x3b/0x340 [ 88.081736][ T6093] ? path_openat+0x2df0/0x3860 [ 88.086495][ T6093] path_openat+0x2e08/0x3860 [ 88.091087][ T6093] ? __pfx_stack_trace_save+0x10/0x10 [ 88.096445][ T6093] ? stack_depot_save_flags+0x33/0x810 [ 88.101902][ T6093] ? __pfx_path_openat+0x10/0x10 [ 88.106914][ T6093] ? __x64_sys_openat+0x138/0x170 [ 88.111953][ T6093] ? do_syscall_64+0x14d/0xf80 [ 88.116705][ T6093] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.122764][ T6093] ? __lock_acquire+0x6b5/0x2cf0 [ 88.127700][ T6093] do_file_open+0x23e/0x4a0 [ 88.132205][ T6093] ? __pfx_do_file_open+0x10/0x10 [ 88.137236][ T6093] ? _raw_spin_unlock+0x28/0x50 [ 88.142475][ T6093] ? alloc_fd+0x64b/0x6c0 [ 88.146909][ T6093] do_sys_openat2+0x113/0x200 [ 88.151596][ T6093] ? __pfx_do_sys_openat2+0x10/0x10 [ 88.156793][ T6093] ? exc_page_fault+0x6a/0xc0 [ 88.161543][ T6093] ? do_user_addr_fault+0xc6f/0x1340 [ 88.166840][ T6093] __x64_sys_openat+0x138/0x170 [ 88.171696][ T6093] do_syscall_64+0x14d/0xf80 [ 88.176282][ T6093] ? trace_irq_disable+0x3b/0x150 [ 88.181311][ T6093] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.187364][ T6093] ? clear_bhb_loop+0x40/0x90 [ 88.192025][ T6093] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.198006][ T6093] RIP: 0033:0x7fdbe03cb407 [ 88.202428][ T6093] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 88.222032][ T6093] RSP: 002b:00007ffc9474fcb0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 88.230536][ T6093] RAX: ffffffffffffffda RBX: 00007fdbe033f880 RCX: 00007fdbe03cb407 [ 88.238509][ T6093] RDX: 0000000000000000 RSI: 00007ffc94750f1c RDI: ffffffffffffff9c [ 88.246477][ T6093] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 88.254606][ T6093] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 88.262570][ T6093] R13: 00007ffc9474ff00 R14: 00007fdbe0624000 R15: 000055690816f4d8 [ 88.270645][ T6093] [ 88.274348][ T6093] Kernel Offset: disabled [ 88.278677][ T6093] Rebooting in 86400 seconds..