last executing test programs: 16m6.266397472s ago: executing program 32 (id=1936): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xf}, {}, {0x7, 0x10}}}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x2008c014) 10m7.109424543s ago: executing program 3 (id=3031): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket(0x1d, 0x2, 0x6) recvmsg(r2, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014"], 0x84}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16], 0x1c}}, 0x0) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xa0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x1, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x600, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0xf401, @loopback}}, 0x100, 0x0, 0xfffffffe, 0x0, 0x54}, 0x9c) 10m6.103825793s ago: executing program 3 (id=3033): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r0, &(0x7f00000000c0)=ANY=[], 0x32600) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r0, 0x0) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_MAX_BURST(r2, 0x84, 0xc, &(0x7f0000000480)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r1, 0x84, 0x84, &(0x7f0000000380)={r3, @in={{0x2, 0x4e22, @empty}}, 0x0, 0xb7cf}, &(0x7f0000000340)=0x90) setsockopt$inet_sctp_SCTP_RESET_STREAMS(r0, 0x84, 0x77, &(0x7f0000000100)=ANY=[@ANYRES32=r3, @ANYBLOB="0400034d0c00011b4141"], 0xe) r4 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, &(0x7f0000000180)={0x0, @in6={{0xa, 0x4e20, 0x5, @local, 0x9}}, 0x2, 0x0, 0x8, 0xd}, &(0x7f0000000000)=0x98) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r4, 0x84, 0x70, &(0x7f0000000340)={r5, @in={{0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x32}}}, [0x3, 0x256023a9, 0x6, 0x8, 0x8, 0x7, 0x7d0, 0x3, 0x2, 0x9, 0x4, 0x101, 0x7, 0xfffffffffffffc01, 0x7fff]}, &(0x7f00000000c0)=0x100) r6 = syz_usb_connect$hid(0x4, 0x0, 0x0, 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) sendmsg$NL80211_CMD_CONTROL_PORT_FRAME(0xffffffffffffffff, 0x0, 0x4000080) syz_usb_control_io$hid(r6, &(0x7f0000000080)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="0022000000002dc0fc6998ed7b5b6c79a3b2483ac2fa062a9e008f9c5e379694bccc0ce8c622c617cd80319b0b111b98f5eebc3398d717"], 0x0}, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) request_key(&(0x7f00000013c0)='id_legacy\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', 0x0) unshare(0x6a040000) r7 = dup(0xffffffffffffffff) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x0, 0x41, 0x3f, 0x5f, 0x20, 0x61d, 0xc150, 0xce6f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x33, 0x0, 0x1, 0x18, 0x70, 0xfd, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x4}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) read$FUSE(r7, &(0x7f0000001400)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r7, &(0x7f0000000440)={0x50, 0x0, r9, {0x7, 0x2b, 0x5, 0x800200, 0x7a37, 0x4, 0x1, 0x8001, 0x0, 0x0, 0x192, 0x4}}, 0x50) syz_usb_ep_write$ath9k_ep1(r8, 0x82, 0xa8, &(0x7f0000000300)=ANY=[@ANYBLOB="6b0ee0b3d41b1b", @ANYRES32]) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xc3490000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r10 = socket$inet_smc(0x2b, 0x1, 0x0) r11 = syz_open_procfs(0x0, &(0x7f0000000280)='oom_score_adj\x00') write$binfmt_script(r11, 0x0, 0x0) setsockopt$EBT_SO_SET_COUNTERS(r10, 0x0, 0x81, &(0x7f00000052c0)={'filter\x00', 0x0, 0x0, 0x0, [0x9573, 0x4000000000000000, 0x3, 0x5, 0x547, 0x1], 0x1, 0x0, 0x0, [{}]}, 0x88) 10m2.910758566s ago: executing program 3 (id=3045): connect$can_bcm(0xffffffffffffffff, 0x0, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}, 0x1, 0x0, 0x0, 0x48850}, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$BTRFS_IOC_ADD_DEV(0xffffffffffffffff, 0x5000940a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, 0x0, 0x8000) r2 = socket$can_j1939(0x1d, 0x2, 0x7) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) syz_open_procfs(0xffffffffffffffff, &(0x7f0000001140)='net\x00') fcntl$F_GET_RW_HINT(r2, 0x40b, &(0x7f0000001900)) r3 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, 0x0) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r3, 0xc05064a7, &(0x7f0000000480)={0x0, 0x0, 0x0, &(0x7f0000000380)}) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x10001, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f00000000c0)={0xc}) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x300000d, 0x6052, r5, 0x1000) ioctl$TUNDETACHFILTER(r5, 0x401054d6, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x15) 10m2.240538916s ago: executing program 3 (id=3048): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='5\x00\x00\x00\a'], 0x50) mount$binderfs(0x0, 0x0, 0x0, 0x4800, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000080), 0x0, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f00000006c0)={{0x12, 0x1, 0x0, 0x26, 0x17, 0xc, 0x40, 0x1934, 0x706, 0xe29e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xd1, 0x5e, 0xa4}}]}}]}}, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_READ(r0, 0xc008551a, &(0x7f0000001100)={0x3}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) bind$alg(0xffffffffffffffff, 0x0, 0x0) pread64(0xffffffffffffffff, &(0x7f0000001600)=""/4103, 0x1007, 0x9b) pipe2$9p(0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r2, 0x29, 0x20, 0x0, 0x0) sendmsg$inet6(r2, &(0x7f0000000600)={&(0x7f0000000080)={0xa, 0x4e20, 0x1000000080000, @dev={0xfe, 0x80, '\x00', 0x25}}, 0x1c, 0x0, 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000029000000040000002b00000000000007120000000000"], 0x30}, 0x0) r3 = memfd_create(0x0, 0x7) dup(r3) fanotify_init(0x2, 0x40000) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4040aea0, &(0x7f00000000c0)=@x86={0x8, 0x1, 0x44, 0x0, 0x6, 0x58, 0x7, 0xfb, 0x3, 0x80, 0x5, 0x9, 0x0, 0x1b, 0x5, 0xb, 0x5, 0x7, 0x0, '\x00', 0x80, 0x1}) r4 = syz_open_dev$vbi(&(0x7f0000000040), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f0000000000)=0x1) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r5, &(0x7f0000000000), 0xd) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r6, 0xc018643a, &(0x7f00000000c0)={0x4000001, 0x71, 0x200000009}) 9m47.409188501s ago: executing program 1 (id=3087): creat(&(0x7f00000002c0)='./file0\x00', 0x0) r0 = io_uring_setup(0x1581, &(0x7f0000000380)={0x0, 0x5cfa, 0x40, 0x0, 0x3bd}) close_range(r0, 0xffffffffffffffff, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101b01) ioctl$USBDEVFS_CLEAR_HALT(r1, 0x4004550c, 0x0) r2 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) symlink(&(0x7f0000000080)='.\x00', &(0x7f0000000240)='./file0\x00') mkdir(&(0x7f00000000c0)='./bus\x00', 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x149) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) setsockopt$inet_tcp_int(r3, 0x6, 0x2, &(0x7f0000000040)=0x2800, 0x4) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x18}}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$KVM_GET_XSAVE(0xffffffffffffffff, 0x9000aea4, &(0x7f0000004780)) r5 = socket$inet6_udp(0xa, 0x2, 0x0) r6 = socket(0x10, 0x803, 0x0) sendto(r6, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r6, &(0x7f0000009800)=[{{0x0, 0x0, 0x0}, 0x4}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000003740)=""/4097, 0x1001}, {&(0x7f00000000c0)=""/167, 0xa7}, {&(0x7f00000032c0)=""/246, 0xf6}, {&(0x7f00000033c0)=""/231, 0xe7}, {&(0x7f0000003640)=""/202, 0xca}, {&(0x7f00000035c0)=""/76, 0x4c}, {&(0x7f0000000400)=""/241, 0xf1}, {&(0x7f0000000680)=""/148, 0x94}, {&(0x7f0000000780)=""/83, 0x53}, {&(0x7f0000000800)=""/127, 0x7f}], 0xa}, 0x4}, {{0x0, 0x0, 0x0}, 0x8}], 0x4, 0x2100, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newqdisc={0x64, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x34, 0x2, {{0x6, 0x43fb, 0x0, 0x2, 0xffffffff}, [@TCA_NETEM_CORRUPT={0xc, 0x4, {0xfffffffd}}, @TCA_NETEM_REORDER={0xc, 0x3, {0xfffffffe, 0x5}}]}}}]}, 0x64}}, 0x20000000) sendmsg$inet(r3, &(0x7f00000015c0)={0x0, 0x14, &(0x7f0000001600)=[{&(0x7f0000000240)=' ', 0xffffff1f}], 0x1}, 0x0) chdir(&(0x7f00000001c0)='./bus\x00') removexattr(&(0x7f0000000100)='./file0\x00', &(0x7f0000000180)=@known='com.apple.FinderInfo\x00') rename(&(0x7f0000000580)='./file0\x00', &(0x7f0000000780)='./file2\x00') seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0003}]}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(0xffffffffffffffff, 0xc08c5332, &(0x7f0000000280)={0x0, 0x0, 0x0, 'queue1\x00'}) 9m45.640876191s ago: executing program 1 (id=3090): openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000003c0)={0x1f, 0xffffffffffffffff, 0x5}, 0x6) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket(0x25, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) getsockopt$llc_int(r3, 0x10c, 0x3, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x3}]}}}]}, 0x3c}, 0x1, 0xffffffea, 0x0, 0x4804}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000001140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000000), 0x0) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000240)={0x0, 0x7}, 0x8) ioctl$I2C_SLAVE(0xffffffffffffffff, 0x703, 0x26b) syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000140)={'mangle\x00', 0x0, [0x7ff, 0x4000105, 0x38e, 0x3, 0x82]}, &(0x7f0000000400)=0x54) 9m43.336150681s ago: executing program 4 (id=3093): socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f0000000100)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x0, &(0x7f0000000180)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeec, 0x8031, 0xffffffffffffffff, 0x7bece000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000180), 0x0, 0x80) recvmmsg(r2, &(0x7f00000000c0), 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_usbip_server_init(0x0) r4 = socket$inet6(0xa, 0x802, 0x0) sendmsg$inet(r4, &(0x7f0000000300)={&(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10, 0x0, 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="1100000000000000000000000100000000000000000000001c00000000000000000000000700000044"], 0x38}, 0x0) unshare(0x2c020400) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x8031, 0xffffffffffffffff, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000180)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x20}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r5}, 0x10) msync(&(0x7f0000952000/0x2000)=nil, 0x87abbe8d1cc6ad9, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(0xffffffffffffffff) socketpair(0x2c, 0x3, 0x0, &(0x7f0000000740)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r6, 0x89f1, &(0x7f0000000600)={'ip6gre0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x6, 0x0, 0x39, @dev={0x12, 0x80, '\x00', 0xfe}, @mcast2={0xff, 0x3}, 0x2000, 0xba08}}) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x2, 0x13, &(0x7f0000000000)=ANY=[], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xe, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) 9m40.62126774s ago: executing program 4 (id=3098): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000700)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b704000001000000850000007800000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f00000002c0)='sys_enter\x00', r1}, 0x10) syncfs(0xffffffffffffffff) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f00000004c0)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000001c0)=[@text32={0x20, &(0x7f0000000040)="660f38105c8104b96e0300000f320f683067660f54042ef3f3dfc7c74424009b000000c74424020b000000c7442406000000000f011424260f01c28fe9b096fa263e0f01764d66baf80cb8005d2786ef66bafc0cb813000000ef", 0x5a}], 0x1, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x43, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffff8, 0x0, 0xff, 0xff}) setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)={@mcast1, 0x800, 0x0, 0x103, 0x1}, 0x20) r5 = socket(0x10, 0x3, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="480000001400b59500000000000000000a000000", @ANYRES32=r7, @ANYBLOB="14000200fe8000000000000000000000000000aa080009003f0c0000140001"], 0x48}}, 0x0) syz_open_dev$sndpcmp(&(0x7f00000000c0), 0x80000001, 0x20e880) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[], 0x50}}, 0x0) sendmmsg(r5, &(0x7f0000000000), 0x4000000000001f2, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) 9m38.32019698s ago: executing program 5 (id=3100): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) pwrite64(0xffffffffffffffff, 0x0, 0x0, 0x4fed0) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r5 = dup(r4) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600722, 0x19) connect$inet(0xffffffffffffffff, &(0x7f0000000180)={0x2, 0x0, @remote}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000540)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000000c0)="08001497733f5d3e", 0x8}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x2004000) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, 0x0, 0x4000080) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000280)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0xbb1}, 0x69) bpf$PROG_LOAD(0x5, &(0x7f00000005c0)={0x8, 0x12, &(0x7f0000000d80)=@raw=[@jmp={0x5, 0x0, 0x2, 0x7, 0x7, 0xffffffffffffffc0, 0x10}, @call={0x85, 0x0, 0x0, 0xc6}, @initr0={0x18, 0x0, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xffffffff}, @ldst={0x3, 0x1, 0x6, 0x9a899476b4002e03, 0x8, 0x50, 0xfffffffffffffffc}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x2}, @ringbuf_query={{0x18, 0x1, 0x1, 0x0, r2}}, @alu={0x4, 0x0, 0x9, 0x8, 0x2, 0x30}, @cb_func={0x18, 0xb, 0x4, 0x0, 0x8}, @tail_call={{0x18, 0x2, 0x1, 0x0, r5}}], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000900)={0x4c, 0x0, &(0x7f00000007c0)=[@reply_sg={0x40486312, {0x0, 0x0, 0x100000000000000, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x4e, 0x0, &(0x7f0000000440)="97713b46fbaa2b1044f2d408ffca802db4d770eb9874f493e0ef367e4bde497c403b450c72ff2417d079bb892435a1e107fa5c0ecd207d9e6f2a209bf148e6bc56955cb53347d1499097488fcad7"}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000002c0)={0x44, 0x0, &(0x7f0000000680)=[@reply={0x40406301, {0x3, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) 9m38.277617681s ago: executing program 1 (id=3101): socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000200)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000b40)='./file1\x00', 0x0, 0x100, 0x12345}) syz_io_uring_setup(0x81f, &(0x7f0000000480)={0x0, 0xfe15, 0x10, 0x0, 0x30f}, &(0x7f00000000c0), &(0x7f0000000540)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0xff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x79902000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, &(0x7f0000000000)={@remote}, 0x20) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/stat\x00', 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/sockstat\x00') r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x2d, &(0x7f0000000000)=0x92d2, 0x4) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000280)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r6 = accept4(r5, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r6) socket$nl_route(0x10, 0x3, 0x0) syz_io_uring_setup(0x386, &(0x7f0000000080)={0x0, 0x0, 0x13100, 0x2, 0x2de}, &(0x7f0000000100), &(0x7f0000000200)) 9m38.150130753s ago: executing program 4 (id=3102): syz_usb_connect(0x5, 0x24, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0x9, 0x28, 0xfc, 0x10, 0x5ac, 0x291, 0x4325, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x40, 0x0, [{{0x9, 0x4, 0x84, 0x0, 0x0, 0x3, 0xe1, 0x2}}]}}]}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0x4, 0x1}, 0x50) socket$nl_route(0x10, 0x3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x40, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = syz_open_dev$media(&(0x7f0000001a80), 0x3, 0x0) write$cgroup_pid(0xffffffffffffffff, &(0x7f0000000240), 0x12) ioctl$MEDIA_IOC_ENUM_LINKS(r1, 0xc0287c02, &(0x7f0000000100)={0x80000000, 0x0, &(0x7f0000000340)}) 9m37.423744068s ago: executing program 5 (id=3104): syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000"], 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x0, 0x36, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}, 0x1c) syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000080), 0xc, &(0x7f0000000380)={&(0x7f0000000340)=@newtfilter={0x2c, 0x2c, 0x100, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x7, 0x7}, {0x3, 0x7}, {0xfff3, 0x6}}, [@TCA_RATE={0x6, 0x5, {0xb, 0x4}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20000000}, 0x20008004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(&(0x7f0000000040)='./file0\x00', 0x82) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socket(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB="02000000040000000402000008"], 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xd, 0x4, 0x4, 0x7, 0x0, r2}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000200)={{r3}, &(0x7f0000000180), &(0x7f00000001c0)=r2}, 0x20) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x1, r3}, 0x38) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000980)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r4, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r5, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r4, 0x3ba0, &(0x7f0000000280)={0x48, 0x13, r6}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='dy']) 9m37.266005289s ago: executing program 1 (id=3105): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket(0x1d, 0x2, 0x6) recvmsg(r2, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014"], 0x84}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r5, @ANYBLOB="05"], 0x1c}}, 0x0) r6 = socket(0x10, 0x803, 0x0) getsockname$packet(r6, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x1, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x600, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, 0x0, 0x0) 9m36.275041422s ago: executing program 1 (id=3106): openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000003c0)={0x1f, 0xffffffffffffffff, 0x5}, 0x6) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket(0x25, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) getsockopt$llc_int(r3, 0x10c, 0x3, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x3}]}}}]}, 0x3c}, 0x1, 0xffffffea, 0x0, 0x4804}, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000001140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_ctr_aes256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000000), 0x0) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.io_wait_time_recursive\x00', 0x0, 0x0) ioctl$I2C_SLAVE(r7, 0x703, 0x26b) syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000140)={'mangle\x00', 0x0, [0x7ff, 0x4000105, 0x38e, 0x3, 0x82]}, &(0x7f0000000400)=0x54) 9m34.70826187s ago: executing program 4 (id=3107): syz_usb_connect(0x0, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) syz_usb_disconnect(0xffffffffffffffff) syz_usb_disconnect(0xffffffffffffffff) syz_usb_connect(0x0, 0x36, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x0, 0x5, @private2={0xfc, 0x2, '\x00', 0x1}, 0x5}, 0x1c) syz_usb_connect(0x0, 0x24, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20008004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x4, 0x80000001}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) creat(0x0, 0x82) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) socket(0x10, 0x3, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000980)={0xc}) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f0000000000)={0xc}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r2, 0x3ba0, &(0x7f0000000280)={0x48, 0x13}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) chdir(&(0x7f0000000340)='./file0\x00') 9m34.418981402s ago: executing program 5 (id=3108): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xb0000) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000100)={0x0, 'erspan0\x00', {0x1}, 0x26}) r4 = syz_open_dev$video(&(0x7f0000000040), 0x8, 0x0) ioctl$VIDIOC_G_SELECTION(r4, 0xc040565e, &(0x7f00000003c0)={0x2, 0x0, 0x7, {0x80000004, 0x7, 0x6, 0x8000001}}) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x12, 0x17, &(0x7f0000000140)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000011000000bf09000000000000550901000074f696e500000000000000180100002020702500000000002020207baaf8ff00000000bda100000000000027010000f8ffffffb702000008000000b7030000000000002500000006000000be91000000000000b502ecffffff00008500000005000000b70000000000000095"], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0x1e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x3, @thr={&(0x7f0000000300)="7b777ba066dedadc6c4dbef6119722090e36d781b06df547219ee881b6cb9fe79a5808b5236c24aca8114bc00274ed53a613eb7d55559ef240c7591925a9f3ef03308b3aa7f6da429d0054850302a5721ed10e82b821f5a043", &(0x7f0000000400)="d3739f9b5690af9a5bdba1eb83410d38833e3ee10428e0096fbf618521d0a3b64fa7d16f6c53bb18b7bc560b16341896ff94c480227248657c14c1f7690ce7ea41a556d8a8bfbbcf462ebd1be7d8642be4d73e2bd3a2a2119b2f83e0d8dacada62cd99f99c4aa8f59f024fd3a86d06e35f"}}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, 0x0, 0x0) ioctl$sock_bt_hci(r6, 0x400448c9, 0x0) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{0x0}], 0x1, 0x1) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x10000008ebc, 0x0) sendto$inet(0xffffffffffffffff, &(0x7f0000000540)="ea61f83f6cfc709f6ff5b30a4c973da57c988d5d742598909ca546473b271aca2adc02108f8119f2c67aa8e2c6f5e5c0b3b9ccc30c1c45867b8ee9821a21563ac023ec2be75b65483ef977ffc39f7f20ee820631962f80efcde3d40e2ecd3e56e128f83fcc2269f9b2fa84f6380edc0b2c822dcea784aca1c7e1f7f47f4d51f093824bc8ca681f82b90ff3e3b9cb9f2fd5f676d4af4e5daa05ec4f8b0bec7649c823f0116488050f23cacc27c7323411c60ed46aaf67ff4a936b420c5bc84c6e95eb1d76924162e238638492343f1d6af6113d7d19be84d0f50a33", 0xdb, 0x200448c4, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$IOCTL_VMCI_NOTIFICATIONS_RECEIVE(r0, 0x7a6, &(0x7f0000000500)={0x4, 0x100000, 0x0, 0xfffffffffffffffd, 0xffffffff}) 9m33.00081686s ago: executing program 5 (id=3109): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5910fae9d6dcd3292ea54c7b6ef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000047c0)=[{{0x0, 0x0, &(0x7f0000002ac0)=[{&(0x7f0000000340)=""/1, 0x1}], 0x1, 0x0, 0x0, 0x8d}, 0xe75}], 0x3aa0, 0x60002000, 0x0) sendmsg$NL80211_CMD_ADD_NAN_FUNCTION(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000007640)=ANY=[], 0x3aa0}}, 0x0) 9m32.902026166s ago: executing program 1 (id=3110): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x4f, 0x0, 0x1, 0xfffffffe}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x4f, 0x0, 0x1, 0xfffffffe}, 0x28) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0xa, 0x1f00c00e}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="817bb97cdac2f8f819447aa4a50c293af36b43cab2641b7753df26944b52221c709e644460775e", 0x27}], 0x1}, 0x24040050) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f478e"]) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x7], 0xeeee8000, 0x2113c0}) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) preadv(r2, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000180)=""/34, 0x22}], 0x2, 0x583, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) (async) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) (async) bind$alg(r5, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) 9m31.931683183s ago: executing program 5 (id=3112): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket(0x1d, 0x2, 0x6) recvmsg(r2, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014"], 0x84}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16], 0x1c}}, 0x0) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x1, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x600, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0xf401, @loopback}}, 0x100, 0x0, 0xfffffffe, 0x0, 0x54}, 0x9c) 9m30.918939128s ago: executing program 5 (id=3114): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="002208000000a20100c3", @ANYRES8=0x0, @ANYBLOB="539513671da82cca03206e9883d1273d104e9b3d97f93ecf9754a351306d1d866b6eff10ba697f5c9858c52564ac6f4231532af799ec9795030a6c539ede071412995b9b2b01dab6a7d385ea4a2cb9f60202e59d76b0fadc3af887bd7d80c534661faf8e6365e7f745c1a3cf60a868137a21bc5cf99ed162cd72b757fb810d6eb4c43ebba714c9b248bd6f042525d5b0a838b0312bde1feeb24a6a05e8c5e951424084b3432e40e1aaf03aff816993a00f72f00d66aa648224efe2dca7682ee53f4bb21ffcdf6858ae2c2e11d74b8a83e57319ae9d54f09ed74a4785f6ea2d0498af555ef789ee5ec132c0da9f8f8fa007db3456ff376f411c27c6931b087cb8b3cf4dae48881b98d0cde89a0d381f807426909c9c77f4191eca61db813c614dcb1b359df898df25a4121a5d2f6ac39c6bd9fed3cf7139327043927cfd7888f54152e2b39d63bba53509064b4c2af8ac6e8b7f9d951c4aa79a3ba9a481b162c178552c0bbce6b9f34a884cbd927db8a44294b62f36b446196c3b0db2cb15033b50fdeb131508ebeb3ce447533cd1a703976ab84313bd599d0554c47d42a2def01891c5f50332c69a9552ddf88c17ab480544d8e66470b56f3c701919f2832097d6ac4bb26d464583541992f8ccd7bbbdf53da10cc6348e3c4e69bfb9aad119b98837d35f62f48aa86ef77752d5cf732847a3dfd5ad4490610fccdb22f89a1df8cea3219277339aa7acd71f21b4a1330495736b6f0a6cfee04e7273c7539a5526488c2cdee78734587ddcd7b9de691a16028de0f0f11a4eaa69b3daf2dbe357babf0ea225b12360ec9c59fc5c7680585856a8bc3fb5b72bb41dd4f68c3cd3304b4281f29d45c1e64dc809d32c76a9ef72101493c304fbb55047eed97c2aaf04241342a57098b511de723161725e3b58358f7bf48400ad9eeef6a837e53243e5ba9df205e444ed7401718b3e0fa9fb98e1f3fd2f3ba5fd0e00921c0f5b79514c1267b5d23b4c4b68fa31e03f79c25b969ab9930844503ea812f60c718d79da466f8234f8492190e7d7fabd6de5de8082c2f23868fe3d82e33df2d9fd6018bf21b569cb572303ed253a524acb5d8c8c3a2d6bbfb0883cdbb6bf968fb3c789e287734f4892684f72c5ac0d7d844a12dd1e3b9a613bca33d7250ba2c462cea30c6db3c657ecd779e07910dc298e79826b835f95f464a25d20647d1462ec1764f2390c28a45705c7d050fb82066e03c55c54a572d21e8f1439db051829e45569d7f7ba8e46b18c5be4205a63614c08e7ee4c70fd121675e1d1e8822105ae5eebe7319987712e91e8bc53d3f8fdf4840f2aef53451c909b008f950e3d1a2fc0c00bbd10371f09eb225ef05988dedaa2d931f68fa71ee409f09265d4363f920b8fc597e797a5a71e4d3b2ae5f63d60ad5f21dededa3b780c067b2eec2bbe3aaf87bc709b53b72d6b31041c788fcfd18a78c30726f941b2bc93b95d61aa6c63bee0ac2311dab6711ece815f0bd829887f9e44a07db1f054599cddaf1315cc362e1c2c97a6726dc09dbebe7f94031917389d1735b457a62c991b094189dcb74c8714a0635102b686dcd6f7c811543383a0b998f6ce7f94146172c5b19f6df6cdc19e1a829c329fb00516499258e1efe3c3be83edf9486e36a3a7aa8e8a0d3d5428ec3ea80b7fa037c79942be84db1e6124de4340884244b0e449147071a7ee893158407531d538bad65ce6dd5d171147a669b07ece24cbe20ee6d8ae3848625b0552dd5509d14c8e7dbf0170d70697b1f147e7fa27628c29a8cbeb2a218e2e2392f144db7bd1df1fbcf97a7d9f776acde3ab209e639982f3d2694004af949f2b4adcc4d56fdbcc7dff07fbb38f41eae626197747dda4e2fbc15d779455174ab7015ae4b423b1a93976e983b4aad082b114af9eee8adfda6cfe20a2fb726d017a2ff7becc9e80aec93087404494d3a714d8134ecdcf10b33ec2b78cb65ea108fa0c83400b461612fc63d43771be1cf241e09fbc561dfd6d69e4dd3b54341d44bd87cf2c37b4513545b08321bb6ab39bb7d7936f9d3effe44295e7fec0d3e7c835c5171750682c9a4978b49a10f37715f24e8dace5e804f4c7ce1037ebf587fb66b07d606a0d14d6573df20732119a946b42f39e4e531be7c1704ea78492dcb4f69dd878818299901e12641ebe221e82b333bce1972098617a1f4c8e88bab9a72a8eef6931d582a26e153159998d8d6f41047cd2537d8dbfd66d916dd0eaced3f675ebb15edf824c0148fd875c8b9377f8162338c38f5e29b640f1176fe0680a3239d11f3942420d469d023c1a8b413f8bf2f2ffe4c6df336a5ce9e4a1ef003765f4843760a78682d10d4416978f882988995124bdbc376b6c9841844a878b52205d0c3763c88abe0b28a35cd0584e347c5b9e04e18e5a7ece61bac5aa97210022cb77f7c19ff486c0188cb00f15066a68ef5e0ee6d0fc40fbbb3d66397eea45d7906910491787b4f9dd18a290cde56abe25346b5ab37b4b7affe880913f4fefbc57809ca9cdf352af5ab20d2c5fb03dd8d5e11800c3c64a746726d58f6511a7b40c7332136d585237d70629ec9fcb014d943e6e3756a065b055ede092e1efe97493e1d2db25c91b3c956f0245d68280c53d5de6d8c06bacf4cc3327a8eab9b609e95affb3946f7ee6afba6eb7e74a36edde5a6f83d2c535e0afde07ecaf2a6d8a67b6c86ec0935d3272589d73e3d9e65d7f6bcc14058a81432e84d96bafda3f2be27e06476e6671e1551cf52e1a093c67d0fbfbc242a2f7bc2bca9ecf3e59c86374196ba3613c24af56a1fe5a7e3f36d8351a45c6d253334977a5430eb11d0177ec2f6954fde3f9a4d0f2af2456702b25774dbf2d4684f099d7196cd6ad12a3f28e516b1face8c1fbfe20a3ea45db06c650c61edba9b136e7975872e01327e603efec31812d5d10c2290136c9067b03f641b9591a17612021480ff21f739b31b1caf4a97b4c2df8a3a35c1ff22d765a2c68323026f60c8b8c8b3df395218a781d9db6de69715189bf59ebf14ac76d6deac6cbf21f4bf5e99e323e4329718e75c5dd478b450675344a11097794791e6c7107390945fc806acbc3e0288842b7d05c4930c9ac97518bca40b6e064fe26d2554f1a4195a6981cb1d36d8cd696253c7639f0353e044fe995be68e42a117de5ba5673fe328395a781993a43ed5ab6a42b5d6d7aed4d5424408d8e3dd396daa69ac810ec268b684f92e5543d36b0a8918832aeb088b80590183c34e9c525e18ffe909333f97a2bb722b5c3cb3b0c46fdd13e4788becf2f714f74476888e77d90d561fdd3027e6d59cbff8f3bb4b34c52945f510270a1cc5bfd39ea9fbf04de5a57e6354f5df797a7f78b23ee5f411c33b1ac05dbfd1a49bce63e996953455f634efeb6b6a230bbc5f1e52e7a575b6e21795ef9de60789d2dc1a45b2ae3f472dc0a034b7fe1e56b268938f19b598463920053d9152e0f18bcff3ac625fe0ac27c0eb930098a17444658fd685fca1eb530bcb04ecdd504247ecc6c41247320cd131ad0a9730803392f9873c65493547e084d701ee2bec5e0c71ad937ae26c74113249629817f78ce9753c566faecadd6068819cf575b8dfc4aa5aedb825740ed1061842e71f22aafc1bbe2db03281fed450318fb3695369eda0dc4b41e4a7a421e33eb840e5a110378e9f4b8561aa5e8f57c04cb52d0e5771129beafb49125de71c9e11f7e49f592653217a6c14dd1a7d0e9a85255fb45b893a5182f0d343a48e38378cbe085ae5031533fb1797c7a2b63523a2f38e300407deff31cf781d25e656232b714f6c198be76d1967a9e7f2624a7feadc6cb0fdd0ec9e658e3c8d0df8ffa3283000b3b9ba4483c2e5b478983df19c498997adba1039f43efb226378b9ff687a36e18cbeec2b00bb06a96029692f0615cee7a7d388440a1eb5bceb2c0ef0f877a64de3e30ab8bfb02bff1dd989e5d5560d619d00498d809a5cbf9127f2b55a25a65fdf3aaad1d123ab1197d7c634951b96c754213458024c70514a604a89b77162db92ade1f744807a179001f6d7ba066715baf36440677328bedf54b83be8df1f2dd383409f77dfbe5653ab666a47892a7364e86aaa266016be72e61a5617cdc4cd026fddb4969e46a1a7a381921ca0089b0b520a0a69aa83960fa0b01c5500e31b651590c7d7f2fd1aacd25f2c4b33528b5c21c96f86071567f7dd97d0add4e0abd62b6d59aecd5b725e503913c000d801a55f781e2e1a581a1a7ecd1ded07b3aca36a193e9cdbe460e955805fdf06603e6b6f9b0670c36935f08dea0963ce03ed3e5a4c1bc323d45df3144c042e99ca974f6fb2fe6512000cab359a6578d5eebed5d165c96406870e9ae423bdca370306a2271771a5f37aed2e6909734f3c5c270ae71acb846785b5a92ae5219b959d5f399f1f9f8abf72d69ba144304a522e5e9294689096d721e38c3fbd49d8de44c7fd983d9b8d2005326524b17ead2e985d2e610418d7e69298bd57364bd5cb271836e010b9ffd882ee45c996b05a5d85b9bb32e09945ef0c2df49ef880690a2de172e6383ca2d34c0f6883fefd4e4327e1d47284fae9e22be28264dc3265c324a5076f65cedc9fa0af26dc8870a07e0932f6a864ac1945b22fccd0b3e0c0e095e3a0bb4908605c540196cfabb38b5045cc57f756f81fe87d412852c869f4402ac4db1f46da814150615bec13ff2c5e9a8e40f9a446c14ad68894d93736bef27d9c68f60b5a085f38ea7754e39c37f1189fc59e52282cacacdb1687981f991e13f40a833b24da4a1470d1b81bed9941e381323457cf5fb6ae80b01587198657b3bb6edc21f93af396b31b8ef5177f7f3e23f2a87a0ecf28319d0a3b69568a43f5fc7e62b906655847dcf8f7d0fdbd48a6c9b628d7553a69f012f03ca150c6b17340ad1f83581c7e9ddb72bcdad15f7837f174b375a01c51299fbacefe367668b68cda4f2cbb5af0a09ed89ccae3f02a902704d513fc6d13414852b86ea520a9190484f0a2ce569cebc1c08ced08f1a40bfb09417310fb5d76f0e3f5fbf6e6dddb91fe2166dd0f2550651ec023763ed4ec00f04868f5a7dcc3aeb1950fd3f004603fddc917d2512964f0f751f7244e62af10f672249835fcc0123007b4c292982f83ff5094c2fb85d29d6900910bdd9cfb525e46aefe58ae9817952dcc4a8753d922e0f532bce15fb359c65a8b0fef7506999cc4a5860fb1f231a74f3cbf5e7285d05b1a1a1ff23a15500613aea882e66b00d3992e4d7dfb0de0f7ee297c935a97e068d5b86214ad409bb4347ceba2e51005d515b02a2f3e521a1b3ff6a3bf94302599a25f02c011939eb46c4dab651eb5d4fdde680491fd995de61ee8a0bf2732c717258f03d4f0018711e968c902b662c4476589f8ad62cad06"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x880) ioctl$HIDIOCGVERSION(r1, 0x80044801, &(0x7f0000000180)) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r2) r4 = fsopen(&(0x7f0000000100)='vfat\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, 0x0, &(0x7f0000000340)='./file2\x00', 0xffffffffffffff9c) sendmsg$NLBL_CIPSOV4_C_REMOVE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c020000aabc04441fe945ed3c6c7ba3785cd26ecffdc5dae8876a869360aaf7541aece9469a1a4379b1840c72c2c89d2e3acacbcd8bffa7265dc4251e561240d5e400e349239c26130d39cc480ac544280bddbae170b8a158150a4f29cd83543896288656632e127dcea6ad4b7d208f9b10674b61d5b8614186115fc14ed7597748f44763bb7b785e783fd568c8e324223919856e234ab42293920711c16a556096abe8c2806e60531b6cd6d2394a9227846d598120f0463aa49a8391b17c7a512e9c8bf525da9f405ec0c7ed11c2c6a16e2190fdc3e66ab126f6f6775b4adf426ee7df4d0157a24343e927a6180bc48b7d32c74897937d06af6181343f70eb6e199474b2dfd6aa4be230e54e481ac2eaca1c85954201cba93d993a33b9ab86435f19d773cb8356940c733af4a0b73b296539caf42937ca925f5b2188daf32907367f9560ccaa15e0d9024f6b47e5ba0c4737a277ef9c12869a004c687e1c09", @ANYRES16=r3, @ANYBLOB="01002abd7000ffdbdf25020000000800010001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) open$dir(&(0x7f0000000200)='./file2\x00', 0x408180, 0x14) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, &(0x7f0000000040)='\xce\xaf&K\xf4\xdb\xf1\xabj\xa2QR\x06o\x87V`\x98v\x99W\xf5\xf4\x99L\xe3T\xcb\xdc\xa90\xdc\xa5G\xf7\xcb{\xe9\xb5\xcf\x06\xe4l\xc6k\xe9\xb8\xffo\xe1\x00\x00\x00T\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000001c0)='./file2\x00', 0xffffffffffffffff) 9m29.052164345s ago: executing program 4 (id=3116): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = socket(0x1d, 0x2, 0x6) recvmsg(r2, &(0x7f0000000740)={0x0, 0x0, 0x0}, 0x40) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000b00)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="840000000002010400000000000000000a00000004000180300003802c00018014000300fc00000000000000000000100000000014004400fe800000001f610000000000000000bb3c0002800c00028005000100000000002c00018014000300fc02000000000000000000000000000014"], 0x84}, 0x1, 0x0, 0x0, 0x40000040}, 0x0) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=ANY=[@ANYBLOB="1c000000", @ANYRES16], 0x1c}}, 0x0) r5 = socket(0x10, 0x803, 0x0) getsockname$packet(r5, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x9) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[@ANYBLOB="a000000010003b0e2a1a86eb2636037f00000000", @ANYRES32=r6], 0xa0}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000000)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x800, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) openat$sysctl(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x1, 0x0) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x600, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0xf401, @loopback}}, 0x100, 0x0, 0xfffffffe, 0x0, 0x54}, 0x9c) 9m28.258713402s ago: executing program 3 (id=3064): syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x52, 0x4007, @fd=r4, 0x6, 0x0, 0x0, 0x2, 0x1}) ioctl$TCSETSF(r2, 0x5404, &(0x7f0000000040)={0x5, 0x432, 0xa00, 0x8, 0xd, "a4c42ba02a0b3b4335931f2d038553da933b3a"}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000000000000000000000000001811", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000085000000b70000000000000095"], &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000080)='sched_switch\x00', r5}, 0x18) r6 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000800)=ANY=[@ANYBLOB="540000001200010000000000000000000a00000000004e22fcffffff000000007ecd00000000000000000000000000000000000000000000c963a35751fea7c33409a282e3386001010000e2614f962516a7158983dc9cb25880c0aeb2d2eb0b6311b75579c5b918cfd0531d06e25b2c5fb8f15b433a5a87600ae8e216588446a28c0e0dedc3eae24b4e0e38995c603f0d25cae35f751f552874a230ab14b7c8665a06f728876b4000000000000000b2d55b328adb784c74346f64eeb5a9e9af59de4ec6ee44b4df1979b27155ccd870913d23ed5c836c8e48", @ANYRES32=0x0, @ANYBLOB="010000000000000000000000002000000800030006010000"], 0x54}}, 0x20000080) 9m28.060277941s ago: executing program 4 (id=3119): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x1ff, 0x2, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x5) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x3, 0x0, 0x3}, 'syz0\x00', 0x2}) ioctl$UI_DEV_CREATE(r4, 0x5501) getdents(r3, &(0x7f0000000040)=""/227, 0xe3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010000305000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000083200300300012800c0001006d6163766c616e02200002801c000580d5b95c78aaaaaaaaaa2c00000a00e5ff0080c2547a020000"], 0x50}}, 0x80) r6 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffff9, 0x122c43) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000001ac0)={r2, 0x0, {0x0, 0x0, 0x0, 0x2ead, 0x7fff, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b39800b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174ff10000000000000010e200", [0x0, 0x5]}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010028bd70f4ffffff06d2c3bd4b874a6475060001000200000008000300ac14141c0800060003000000"], 0x30}, 0x1, 0xff07}, 0x2000000) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000228bd70dbdf2504000000400001800500020009000000060001000a000000060005004e4100000800030064010101140004000000000000000000000000000000000008000300ac1414aa0800040001000000"], 0x5c}, 0x1, 0x0, 0x0, 0x48055}, 0x11) ioctl$LOOP_GET_STATUS64(r6, 0x4c05, &(0x7f00000000c0)) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000100)={0x10, 0x1, 0x0, "ff3a55f32ec78900d10052d000200000f3018e54fa19000000ffc800001c00"}) sendto$inet(r3, &(0x7f0000000440)="7816a5bd7af1f23961f1f82ea2b8bc8b4d22d471f80f030000003c7d44a559c929ebbde5ef381d4adbc15eb037ff2438", 0x38, 0x20000844, &(0x7f0000000480)={0x2, 0x4e24, @remote}, 0x2e) r9 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') preadv(r9, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x402, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/cpu_byteorder', 0x80401, 0x8) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x400000000001, 0x0) syz_emit_ethernet(0x62, &(0x7f0000000440)=ANY=[@ANYBLOB="31c1ddb11c"], 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r10) 9m27.287798243s ago: executing program 3 (id=3122): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000200)=""/102384, 0xfffffef5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) prlimit64(0x0, 0xe, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x114, 0x271f, 0x0, 0x0) 8m47.19427033s ago: executing program 33 (id=3123): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) prctl$PR_GET_PDEATHSIG(0x2, &(0x7f0000000040)) ioctl$DRM_IOCTL_MODE_GETPLANE(r0, 0xc02064b6, &(0x7f0000000300)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f0000000400)={0x0, 0x0, r2, 0x0, 0x0, 0x1f5, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "b4bc323ef77d1f000071849800000000dfff00"}}) 8m47.110450376s ago: executing program 34 (id=3110): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x4f, 0x0, 0x1, 0xfffffffe}, 0x28) (async) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={0x0, 0x0, 0x4f, 0x0, 0x1, 0xfffffffe}, 0x28) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000001c0)="5c00000012", 0x5}], 0x1, 0x0, 0xa, 0x1f00c00e}, 0x0) sendmsg(0xffffffffffffffff, &(0x7f0000001500)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)="817bb97cdac2f8f819447aa4a50c293af36b43cab2641b7753df26944b52221c709e644460775e", 0x27}], 0x1}, 0x24040050) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01090000000000000f478e"]) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$NFT_MSG_GETOBJ_RESET(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x1000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40400c0}, 0x1) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x10000, 0x0, 0x4002004c4, 0x1000, 0x0, 0x0, 0x0, 0x5, 0x0, 0x9, 0x0, 0x7], 0xeeee8000, 0x2113c0}) ioctl$UFFDIO_WAKE(0xffffffffffffffff, 0x8010aa02, &(0x7f0000000100)={&(0x7f0000ff9000/0x4000)=nil, 0x4000}) preadv(r2, &(0x7f00000001c0)=[{&(0x7f0000000380)=""/4096, 0x1000}, {&(0x7f0000000180)=""/34, 0x22}], 0x2, 0x583, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) (async) r3 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$ethtool(&(0x7f0000000300), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) socket$packet(0x11, 0x3, 0x300) (async) socket$packet(0x11, 0x3, 0x300) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) (async) bind$alg(r5, &(0x7f0000000340)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) 8m47.005946551s ago: executing program 35 (id=3114): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000001280)=ANY=[@ANYBLOB="002208000000a20100c3", @ANYRES8=0x0, @ANYBLOB="539513671da82cca03206e9883d1273d104e9b3d97f93ecf9754a351306d1d866b6eff10ba697f5c9858c52564ac6f4231532af799ec9795030a6c539ede071412995b9b2b01dab6a7d385ea4a2cb9f60202e59d76b0fadc3af887bd7d80c534661faf8e6365e7f745c1a3cf60a868137a21bc5cf99ed162cd72b757fb810d6eb4c43ebba714c9b248bd6f042525d5b0a838b0312bde1feeb24a6a05e8c5e951424084b3432e40e1aaf03aff816993a00f72f00d66aa648224efe2dca7682ee53f4bb21ffcdf6858ae2c2e11d74b8a83e57319ae9d54f09ed74a4785f6ea2d0498af555ef789ee5ec132c0da9f8f8fa007db3456ff376f411c27c6931b087cb8b3cf4dae48881b98d0cde89a0d381f807426909c9c77f4191eca61db813c614dcb1b359df898df25a4121a5d2f6ac39c6bd9fed3cf7139327043927cfd7888f54152e2b39d63bba53509064b4c2af8ac6e8b7f9d951c4aa79a3ba9a481b162c178552c0bbce6b9f34a884cbd927db8a44294b62f36b446196c3b0db2cb15033b50fdeb131508ebeb3ce447533cd1a703976ab84313bd599d0554c47d42a2def01891c5f50332c69a9552ddf88c17ab480544d8e66470b56f3c701919f2832097d6ac4bb26d464583541992f8ccd7bbbdf53da10cc6348e3c4e69bfb9aad119b98837d35f62f48aa86ef77752d5cf732847a3dfd5ad4490610fccdb22f89a1df8cea3219277339aa7acd71f21b4a1330495736b6f0a6cfee04e7273c7539a5526488c2cdee78734587ddcd7b9de691a16028de0f0f11a4eaa69b3daf2dbe357babf0ea225b12360ec9c59fc5c7680585856a8bc3fb5b72bb41dd4f68c3cd3304b4281f29d45c1e64dc809d32c76a9ef72101493c304fbb55047eed97c2aaf04241342a57098b511de723161725e3b58358f7bf48400ad9eeef6a837e53243e5ba9df205e444ed7401718b3e0fa9fb98e1f3fd2f3ba5fd0e00921c0f5b79514c1267b5d23b4c4b68fa31e03f79c25b969ab9930844503ea812f60c718d79da466f8234f8492190e7d7fabd6de5de8082c2f23868fe3d82e33df2d9fd6018bf21b569cb572303ed253a524acb5d8c8c3a2d6bbfb0883cdbb6bf968fb3c789e287734f4892684f72c5ac0d7d844a12dd1e3b9a613bca33d7250ba2c462cea30c6db3c657ecd779e07910dc298e79826b835f95f464a25d20647d1462ec1764f2390c28a45705c7d050fb82066e03c55c54a572d21e8f1439db051829e45569d7f7ba8e46b18c5be4205a63614c08e7ee4c70fd121675e1d1e8822105ae5eebe7319987712e91e8bc53d3f8fdf4840f2aef53451c909b008f950e3d1a2fc0c00bbd10371f09eb225ef05988dedaa2d931f68fa71ee409f09265d4363f920b8fc597e797a5a71e4d3b2ae5f63d60ad5f21dededa3b780c067b2eec2bbe3aaf87bc709b53b72d6b31041c788fcfd18a78c30726f941b2bc93b95d61aa6c63bee0ac2311dab6711ece815f0bd829887f9e44a07db1f054599cddaf1315cc362e1c2c97a6726dc09dbebe7f94031917389d1735b457a62c991b094189dcb74c8714a0635102b686dcd6f7c811543383a0b998f6ce7f94146172c5b19f6df6cdc19e1a829c329fb00516499258e1efe3c3be83edf9486e36a3a7aa8e8a0d3d5428ec3ea80b7fa037c79942be84db1e6124de4340884244b0e449147071a7ee893158407531d538bad65ce6dd5d171147a669b07ece24cbe20ee6d8ae3848625b0552dd5509d14c8e7dbf0170d70697b1f147e7fa27628c29a8cbeb2a218e2e2392f144db7bd1df1fbcf97a7d9f776acde3ab209e639982f3d2694004af949f2b4adcc4d56fdbcc7dff07fbb38f41eae626197747dda4e2fbc15d779455174ab7015ae4b423b1a93976e983b4aad082b114af9eee8adfda6cfe20a2fb726d017a2ff7becc9e80aec93087404494d3a714d8134ecdcf10b33ec2b78cb65ea108fa0c83400b461612fc63d43771be1cf241e09fbc561dfd6d69e4dd3b54341d44bd87cf2c37b4513545b08321bb6ab39bb7d7936f9d3effe44295e7fec0d3e7c835c5171750682c9a4978b49a10f37715f24e8dace5e804f4c7ce1037ebf587fb66b07d606a0d14d6573df20732119a946b42f39e4e531be7c1704ea78492dcb4f69dd878818299901e12641ebe221e82b333bce1972098617a1f4c8e88bab9a72a8eef6931d582a26e153159998d8d6f41047cd2537d8dbfd66d916dd0eaced3f675ebb15edf824c0148fd875c8b9377f8162338c38f5e29b640f1176fe0680a3239d11f3942420d469d023c1a8b413f8bf2f2ffe4c6df336a5ce9e4a1ef003765f4843760a78682d10d4416978f882988995124bdbc376b6c9841844a878b52205d0c3763c88abe0b28a35cd0584e347c5b9e04e18e5a7ece61bac5aa97210022cb77f7c19ff486c0188cb00f15066a68ef5e0ee6d0fc40fbbb3d66397eea45d7906910491787b4f9dd18a290cde56abe25346b5ab37b4b7affe880913f4fefbc57809ca9cdf352af5ab20d2c5fb03dd8d5e11800c3c64a746726d58f6511a7b40c7332136d585237d70629ec9fcb014d943e6e3756a065b055ede092e1efe97493e1d2db25c91b3c956f0245d68280c53d5de6d8c06bacf4cc3327a8eab9b609e95affb3946f7ee6afba6eb7e74a36edde5a6f83d2c535e0afde07ecaf2a6d8a67b6c86ec0935d3272589d73e3d9e65d7f6bcc14058a81432e84d96bafda3f2be27e06476e6671e1551cf52e1a093c67d0fbfbc242a2f7bc2bca9ecf3e59c86374196ba3613c24af56a1fe5a7e3f36d8351a45c6d253334977a5430eb11d0177ec2f6954fde3f9a4d0f2af2456702b25774dbf2d4684f099d7196cd6ad12a3f28e516b1face8c1fbfe20a3ea45db06c650c61edba9b136e7975872e01327e603efec31812d5d10c2290136c9067b03f641b9591a17612021480ff21f739b31b1caf4a97b4c2df8a3a35c1ff22d765a2c68323026f60c8b8c8b3df395218a781d9db6de69715189bf59ebf14ac76d6deac6cbf21f4bf5e99e323e4329718e75c5dd478b450675344a11097794791e6c7107390945fc806acbc3e0288842b7d05c4930c9ac97518bca40b6e064fe26d2554f1a4195a6981cb1d36d8cd696253c7639f0353e044fe995be68e42a117de5ba5673fe328395a781993a43ed5ab6a42b5d6d7aed4d5424408d8e3dd396daa69ac810ec268b684f92e5543d36b0a8918832aeb088b80590183c34e9c525e18ffe909333f97a2bb722b5c3cb3b0c46fdd13e4788becf2f714f74476888e77d90d561fdd3027e6d59cbff8f3bb4b34c52945f510270a1cc5bfd39ea9fbf04de5a57e6354f5df797a7f78b23ee5f411c33b1ac05dbfd1a49bce63e996953455f634efeb6b6a230bbc5f1e52e7a575b6e21795ef9de60789d2dc1a45b2ae3f472dc0a034b7fe1e56b268938f19b598463920053d9152e0f18bcff3ac625fe0ac27c0eb930098a17444658fd685fca1eb530bcb04ecdd504247ecc6c41247320cd131ad0a9730803392f9873c65493547e084d701ee2bec5e0c71ad937ae26c74113249629817f78ce9753c566faecadd6068819cf575b8dfc4aa5aedb825740ed1061842e71f22aafc1bbe2db03281fed450318fb3695369eda0dc4b41e4a7a421e33eb840e5a110378e9f4b8561aa5e8f57c04cb52d0e5771129beafb49125de71c9e11f7e49f592653217a6c14dd1a7d0e9a85255fb45b893a5182f0d343a48e38378cbe085ae5031533fb1797c7a2b63523a2f38e300407deff31cf781d25e656232b714f6c198be76d1967a9e7f2624a7feadc6cb0fdd0ec9e658e3c8d0df8ffa3283000b3b9ba4483c2e5b478983df19c498997adba1039f43efb226378b9ff687a36e18cbeec2b00bb06a96029692f0615cee7a7d388440a1eb5bceb2c0ef0f877a64de3e30ab8bfb02bff1dd989e5d5560d619d00498d809a5cbf9127f2b55a25a65fdf3aaad1d123ab1197d7c634951b96c754213458024c70514a604a89b77162db92ade1f744807a179001f6d7ba066715baf36440677328bedf54b83be8df1f2dd383409f77dfbe5653ab666a47892a7364e86aaa266016be72e61a5617cdc4cd026fddb4969e46a1a7a381921ca0089b0b520a0a69aa83960fa0b01c5500e31b651590c7d7f2fd1aacd25f2c4b33528b5c21c96f86071567f7dd97d0add4e0abd62b6d59aecd5b725e503913c000d801a55f781e2e1a581a1a7ecd1ded07b3aca36a193e9cdbe460e955805fdf06603e6b6f9b0670c36935f08dea0963ce03ed3e5a4c1bc323d45df3144c042e99ca974f6fb2fe6512000cab359a6578d5eebed5d165c96406870e9ae423bdca370306a2271771a5f37aed2e6909734f3c5c270ae71acb846785b5a92ae5219b959d5f399f1f9f8abf72d69ba144304a522e5e9294689096d721e38c3fbd49d8de44c7fd983d9b8d2005326524b17ead2e985d2e610418d7e69298bd57364bd5cb271836e010b9ffd882ee45c996b05a5d85b9bb32e09945ef0c2df49ef880690a2de172e6383ca2d34c0f6883fefd4e4327e1d47284fae9e22be28264dc3265c324a5076f65cedc9fa0af26dc8870a07e0932f6a864ac1945b22fccd0b3e0c0e095e3a0bb4908605c540196cfabb38b5045cc57f756f81fe87d412852c869f4402ac4db1f46da814150615bec13ff2c5e9a8e40f9a446c14ad68894d93736bef27d9c68f60b5a085f38ea7754e39c37f1189fc59e52282cacacdb1687981f991e13f40a833b24da4a1470d1b81bed9941e381323457cf5fb6ae80b01587198657b3bb6edc21f93af396b31b8ef5177f7f3e23f2a87a0ecf28319d0a3b69568a43f5fc7e62b906655847dcf8f7d0fdbd48a6c9b628d7553a69f012f03ca150c6b17340ad1f83581c7e9ddb72bcdad15f7837f174b375a01c51299fbacefe367668b68cda4f2cbb5af0a09ed89ccae3f02a902704d513fc6d13414852b86ea520a9190484f0a2ce569cebc1c08ced08f1a40bfb09417310fb5d76f0e3f5fbf6e6dddb91fe2166dd0f2550651ec023763ed4ec00f04868f5a7dcc3aeb1950fd3f004603fddc917d2512964f0f751f7244e62af10f672249835fcc0123007b4c292982f83ff5094c2fb85d29d6900910bdd9cfb525e46aefe58ae9817952dcc4a8753d922e0f532bce15fb359c65a8b0fef7506999cc4a5860fb1f231a74f3cbf5e7285d05b1a1a1ff23a15500613aea882e66b00d3992e4d7dfb0de0f7ee297c935a97e068d5b86214ad409bb4347ceba2e51005d515b02a2f3e521a1b3ff6a3bf94302599a25f02c011939eb46c4dab651eb5d4fdde680491fd995de61ee8a0bf2732c717258f03d4f0018711e968c902b662c4476589f8ad62cad06"], 0x0}, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000000), 0x0, 0x880) ioctl$HIDIOCGVERSION(r1, 0x80044801, &(0x7f0000000180)) ioctl$HIDIOCGUSAGE(r1, 0xc018480b, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r2) r4 = fsopen(&(0x7f0000000100)='vfat\x00', 0x0) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, 0x0, &(0x7f0000000340)='./file2\x00', 0xffffffffffffff9c) sendmsg$NLBL_CIPSOV4_C_REMOVE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="1c020000aabc04441fe945ed3c6c7ba3785cd26ecffdc5dae8876a869360aaf7541aece9469a1a4379b1840c72c2c89d2e3acacbcd8bffa7265dc4251e561240d5e400e349239c26130d39cc480ac544280bddbae170b8a158150a4f29cd83543896288656632e127dcea6ad4b7d208f9b10674b61d5b8614186115fc14ed7597748f44763bb7b785e783fd568c8e324223919856e234ab42293920711c16a556096abe8c2806e60531b6cd6d2394a9227846d598120f0463aa49a8391b17c7a512e9c8bf525da9f405ec0c7ed11c2c6a16e2190fdc3e66ab126f6f6775b4adf426ee7df4d0157a24343e927a6180bc48b7d32c74897937d06af6181343f70eb6e199474b2dfd6aa4be230e54e481ac2eaca1c85954201cba93d993a33b9ab86435f19d773cb8356940c733af4a0b73b296539caf42937ca925f5b2188daf32907367f9560ccaa15e0d9024f6b47e5ba0c4737a277ef9c12869a004c687e1c09", @ANYRES16=r3, @ANYBLOB="01002abd7000ffdbdf25020000000800010001000000"], 0x1c}, 0x1, 0x0, 0x0, 0x20004004}, 0x0) open$dir(&(0x7f0000000200)='./file2\x00', 0x408180, 0x14) fsconfig$FSCONFIG_SET_PATH(r4, 0x3, &(0x7f0000000040)='\xce\xaf&K\xf4\xdb\xf1\xabj\xa2QR\x06o\x87V`\x98v\x99W\xf5\xf4\x99L\xe3T\xcb\xdc\xa90\xdc\xa5G\xf7\xcb{\xe9\xb5\xcf\x06\xe4l\xc6k\xe9\xb8\xffo\xe1\x00\x00\x00T\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000001c0)='./file2\x00', 0xffffffffffffffff) 8m46.901303954s ago: executing program 36 (id=3122): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000200)=""/102384, 0xfffffef5) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) prlimit64(0x0, 0xe, 0x0, 0x0) getsockopt(0xffffffffffffffff, 0x114, 0x271f, 0x0, 0x0) 8m46.81486736s ago: executing program 37 (id=3119): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x84042, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000500)={0x1ff, 0x2, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='fdinfo\x00') r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$UI_SET_EVBIT(r4, 0x40045564, 0x5) ioctl$UI_DEV_SETUP(r4, 0x405c5503, &(0x7f0000000480)={{0xfffc, 0x3, 0x0, 0x3}, 'syz0\x00', 0x2}) ioctl$UI_DEV_CREATE(r4, 0x5501) getdents(r3, &(0x7f0000000040)=""/227, 0xe3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5000000010000305000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0000000083200300300012800c0001006d6163766c616e02200002801c000580d5b95c78aaaaaaaaaa2c00000a00e5ff0080c2547a020000"], 0x50}}, 0x80) r6 = syz_open_dev$loop(&(0x7f0000000080), 0x47ffff9, 0x122c43) ioctl$LOOP_CONFIGURE(r6, 0x4c0a, &(0x7f0000001ac0)={r2, 0x0, {0x0, 0x0, 0x0, 0x2ead, 0x7fff, 0x0, 0x0, 0x0, 0x4, "339f020bbe82b39800b1c4369d03740250ceaac594b1b3d741dd17c1c50d38ef2a565ef1e83323691c58d66500", "a9103939c787a16c1ca43f80026d1a8554fe581b59ded130e04d528539f3d3289737f0374c72a964a02447a75df8a69ea917deb7ba193b3e7772fd29f35239d2", "24431a1e77a68e174ff10000000000000010e200", [0x0, 0x5]}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010028bd70f4ffffff06d2c3bd4b874a6475060001000200000008000300ac14141c0800060003000000"], 0x30}, 0x1, 0xff07}, 0x2000000) sendmsg$MPTCP_PM_CMD_FLUSH_ADDRS(r3, &(0x7f0000000400)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="000228bd70dbdf2504000000400001800500020009000000060001000a000000060005004e4100000800030064010101140004000000000000000000000000000000000008000300ac1414aa0800040001000000"], 0x5c}, 0x1, 0x0, 0x0, 0x48055}, 0x11) ioctl$LOOP_GET_STATUS64(r6, 0x4c05, &(0x7f00000000c0)) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000100)={0x10, 0x1, 0x0, "ff3a55f32ec78900d10052d000200000f3018e54fa19000000ffc800001c00"}) sendto$inet(r3, &(0x7f0000000440)="7816a5bd7af1f23961f1f82ea2b8bc8b4d22d471f80f030000003c7d44a559c929ebbde5ef381d4adbc15eb037ff2438", 0x38, 0x20000844, &(0x7f0000000480)={0x2, 0x4e24, @remote}, 0x2e) r9 = syz_open_procfs(0x0, &(0x7f0000000140)='coredump_filter\x00') preadv(r9, &(0x7f0000000300)=[{&(0x7f0000000040)=""/3, 0x3}, {0x0, 0x3}], 0x2, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x402, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/cpu_byteorder', 0x80401, 0x8) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6(0xa, 0x400000000001, 0x0) syz_emit_ethernet(0x62, &(0x7f0000000440)=ANY=[@ANYBLOB="31c1ddb11c"], 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f00000003c0), r10) 8m29.88676016s ago: executing program 7 (id=3131): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = semget$private(0x0, 0x6, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xe0000000, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0xfffffffffffffd5f, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000126abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3acb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c983885c93ea4ab4ca1e02d831ae162ee104"], &(0x7f0000000100)='GPL\x00'}, 0x41) pwritev(0xffffffffffffffff, &(0x7f0000001500)=[{0x0}], 0x1, 0x2, 0x2) r7 = socket$inet6(0x10, 0x3, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x84) sendmsg(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f138d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade5b175c0a9b2ce9", 0x55}], 0x1}, 0x48000) request_key(&(0x7f00000003c0)='ceph\x00', 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) semop(r1, &(0x7f0000001240)=[{0x4, 0xa}], 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth0_virt_wifi\x00', 0x2000000}, 0x18) 8m28.441067395s ago: executing program 7 (id=3132): bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xbf, 0x0, &(0x7f00000002c0)="b9ff03316844268cb89e14f008004ce0050000000000003377fbacfe1416e000030a86079f03b180ff940c0511e0845013f2325f000709170b038da1880b25181aa59d943be3f4aed50ea5a6b8686731cb89ef77123c899b699eeaa8eaa0073461119663906400f30c0600000000000059b6d3296e8ca31bce1d8392078b72f24996ae17dffc2e43c8174b54b620636894aaacf28ff62616363c70a440aec4014c0000c0adc043084617d7ecf41effff38cae870b9a1df48b238190da45029", 0x0, 0xfe, 0x60000000}, 0x50) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000500)={'syz_tun\x00', &(0x7f0000000180)=@ethtool_link_settings={0x4d, 0x400, 0xf, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, [0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x1]}}) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)={0x3c, r1, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_AUTONEG={0x5, 0x2, 0xfc}, @ETHTOOL_A_LINKMODES_SPEED={0x8, 0x5, 0x64}]}, 0x3c}}, 0x0) 8m28.184137456s ago: executing program 7 (id=3134): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r1, 0x0, 0x0) write$FUSE_DIRENT(r1, 0x0, 0x1e0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r4, @ANYBLOB="010000000000000000000100000008000100000000000400048008000c8004000b800800020001000000a00008801c0007800837d73ec300000008000600000000000800050000000000240007800800050000230000000005000000000061ff05000000000008000500000000"], 0xd0}}, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r6, &(0x7f0000000100)={0x0, 0x3a, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0xd, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x6}}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008080) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r8 = dup3(r7, r5, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r9, 0x10000000000) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) 8m27.417952691s ago: executing program 7 (id=3137): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = semget$private(0x0, 0x6, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) setsockopt$TIPC_DEST_DROPPABLE(0xffffffffffffffff, 0x10f, 0x81, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xe0000000, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0xfffffffffffffd5f, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() prlimit64(r2, 0xb, &(0x7f00000001c0)={0xd8a7, 0x1}, &(0x7f0000000240)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000126abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3acb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c983885c93ea4ab4ca1e02d831ae162ee104"], &(0x7f0000000100)='GPL\x00'}, 0x41) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000180)='fsi_master_gpio_cmd_abs_addr\x00', r5}, 0x18) pwritev(0xffffffffffffffff, &(0x7f0000001500)=[{0x0}], 0x1, 0x2, 0x2) socket$inet6(0x10, 0x3, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x84) semop(r1, &(0x7f0000001240)=[{0x4, 0xa}], 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth0_virt_wifi\x00', 0x2000000}, 0x18) 8m26.369221603s ago: executing program 7 (id=3140): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_sctp(0xa, 0x1, 0x84) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x6, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) sendmsg$NFT_MSG_GETCHAIN(r0, &(0x7f0000000180)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000340)={0x184, 0x4, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0xa}, [@NFTA_CHAIN_COUNTERS={0x40, 0x8, 0x0, 0x1, [@NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xff}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0xfffffffffffffbff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x9}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x1000}, @NFTA_COUNTER_BYTES={0xc, 0x1, 0x1, 0x0, 0x101}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54263220}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_USERDATA={0xf6, 0xc, "c3b0af1661b548f783f36b1d0b7debaca43b95c05af3f1842014b23caf78d9a967f13d17a31cd8aec7c40bf7ef84cfda53fa241184cbf1dae40fc5458a10fff6b0b302e9db5854cc9fba7e9e59d027ccba38173ca6827083b3c3a496d869fb2350a198dcff6c9fa81fdf78cb0560a8c1cf07ccc6b420d1429aa8d1013e52a151d6374e65e4d7de4264dd49eb4260c9df86abda2343651fcef1e6da3cf6a1fb70c4df4c1178a90f212be838959a4cf4b6959fc113e447894f60418e9ab7d9e2d504c20f75110177e44fc5a9664c0b0cbffefc5b3f7e38b8dc2c11210a9cf13b166524c5e424f81848e54bbacd7b9e440f312c"}]}, 0x184}, 0x1, 0x0, 0x0, 0x4000800}, 0x40880) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r4, 0xc1105517, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000002040), 0x2, 0x0) r5 = socket$inet6(0x10, 0x2, 0x6) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, 0x0, 0x0) pipe2(&(0x7f0000000300), 0x0) openat$drirender128(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f00000008c0), 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x1, 0x4, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000a000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet_tcp(0x2, 0x1, 0x0) sendmmsg$inet(r7, &(0x7f0000000280)=[{{&(0x7f0000000040)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x25}}, 0x10, 0x0}}], 0x1, 0x20000000) setsockopt$sock_int(r7, 0x1, 0xf, &(0x7f0000000000)=0x20, 0x4) setsockopt$sock_attach_bpf(r7, 0x1, 0x34, &(0x7f00000000c0)=r6, 0x4) listen(r7, 0x0) close(r7) 8m23.253327805s ago: executing program 7 (id=3147): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'veth0_to_bridge\x00', &(0x7f0000000000)=@ethtool_rxfh={0x1, 0x0, 0x0, 0x7fff, 0x0, '\x00', 0x100000}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsmount(r0, 0x0, 0x80) fchdir(r3) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') r4 = syz_io_uring_setup(0x54ff, &(0x7f0000000140)={0x0, 0x114df, 0x2, 0xfffffffd, 0x85, 0x0, r3}, &(0x7f00000003c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) io_uring_enter(r4, 0x3518, 0xaddf, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000000500000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r7}, 0x18) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0\x00') 8m7.378461499s ago: executing program 38 (id=3147): r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000080)={'veth0_to_bridge\x00', &(0x7f0000000000)=@ethtool_rxfh={0x1, 0x0, 0x0, 0x7fff, 0x0, '\x00', 0x100000}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f0000000000), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsmount(r0, 0x0, 0x80) fchdir(r3) symlink(&(0x7f0000001780)='./file0/../file0\x00', &(0x7f00000017c0)='./file0\x00') r4 = syz_io_uring_setup(0x54ff, &(0x7f0000000140)={0x0, 0x114df, 0x2, 0xfffffffd, 0x85, 0x0, r3}, &(0x7f00000003c0)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x29c780}) io_uring_enter(r4, 0x3518, 0xaddf, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x11, 0x5, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000001000000850000000e000000850000000500000095"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x9}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000480)={&(0x7f0000000040)='sys_exit\x00', r7}, 0x18) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') mount(0x0, &(0x7f0000000d40)='./file0/../file0/../file0\x00', &(0x7f00000002c0)='sysfs\x00', 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0\x00') 1m44.360468744s ago: executing program 0 (id=3571): socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='quota,grpquotz_block_hardlimit=3,\x00']) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88a8000081000000080600f807000604"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2610054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000}, 0x48) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d4000000ed03200026bd7000fbdbdf257f38ea14473e094d8f1dcc8145c88489aebcc30bc1235010f1cbb711ab54d83b2a518fe885b12fd3d6c7f211bfb521ec76edf896e74399e0dd5cdaa1db0a4705c6e7d00e86f198227851540cef9b259ce9f449a3e7fdd4ec1322d699d44c7bfb9f16e8e35806fa699711deffd7d193c9b2666b4b6275458a196ba9707546c7d6df47bdf4017ca21464d6412b7d1b505c3d6378b26a86086e36589f4684a8f465c6da1eb73203ee89dc91916c781072a703918a6264316251578553364997f879444f00002c493f6a5f98c663a30ab341199f033451f5079946b6cb2caa4b513ad5c4e46823329ed47f1b75def68a9802d8d3c360d133a251b5f371bb91bb680ff8e49a223b39421166e0e4d938f77510ebb82a4d03625f0688e69b4c27a98336d5b76949b441165e44115185683a29ecb8b1a891ff6546fa6e8010e9beb930456cdcab55a8bea2b4ceb5ff0b63a49a3fd8bb618db9f03e569233cdcd21df791d350d53b48b6d985e873fa8ddc682fcc2ec49907d7dbf179f5ebb8aaef2dd3def61014d917862b9a3cb190e1208ebe25d966ac795f17ced"], 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500a30c3eb60001000000000aa78e28cbadfb07", @ANYRES32, @ANYBLOB], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4000000000000006311100000000000040000000000000095000000000000001ab33efbdd6b0cea571543937f61b32c3d0b5bba165a07c7b51c9566fa0a7462aae72b118b2902708ad67528861c9a5b02d3e8429f540a9c177e98de5ec78d3003a473077f5d2ac67a2ab0872c041e81564321140d1f16364a0c58029326e9362fc5c7471fc95d357f95b63f27c2a47c73371fa3a4d742c270906d86ba98e6c550634a44ee0b67fb3407d67cda4217398fca4e59e31c94f47b73157cdfefc28ab92f7ca133964cda14eb1529463d0200b835ab1e87d5a4f8c8a1051e30cb06a1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 1m26.903037405s ago: executing program 0 (id=3571): socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='quota,grpquotz_block_hardlimit=3,\x00']) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88a8000081000000080600f807000604"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2610054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000}, 0x48) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d4000000ed03200026bd7000fbdbdf257f38ea14473e094d8f1dcc8145c88489aebcc30bc1235010f1cbb711ab54d83b2a518fe885b12fd3d6c7f211bfb521ec76edf896e74399e0dd5cdaa1db0a4705c6e7d00e86f198227851540cef9b259ce9f449a3e7fdd4ec1322d699d44c7bfb9f16e8e35806fa699711deffd7d193c9b2666b4b6275458a196ba9707546c7d6df47bdf4017ca21464d6412b7d1b505c3d6378b26a86086e36589f4684a8f465c6da1eb73203ee89dc91916c781072a703918a6264316251578553364997f879444f00002c493f6a5f98c663a30ab341199f033451f5079946b6cb2caa4b513ad5c4e46823329ed47f1b75def68a9802d8d3c360d133a251b5f371bb91bb680ff8e49a223b39421166e0e4d938f77510ebb82a4d03625f0688e69b4c27a98336d5b76949b441165e44115185683a29ecb8b1a891ff6546fa6e8010e9beb930456cdcab55a8bea2b4ceb5ff0b63a49a3fd8bb618db9f03e569233cdcd21df791d350d53b48b6d985e873fa8ddc682fcc2ec49907d7dbf179f5ebb8aaef2dd3def61014d917862b9a3cb190e1208ebe25d966ac795f17ced"], 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500a30c3eb60001000000000aa78e28cbadfb07", @ANYRES32, @ANYBLOB], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4000000000000006311100000000000040000000000000095000000000000001ab33efbdd6b0cea571543937f61b32c3d0b5bba165a07c7b51c9566fa0a7462aae72b118b2902708ad67528861c9a5b02d3e8429f540a9c177e98de5ec78d3003a473077f5d2ac67a2ab0872c041e81564321140d1f16364a0c58029326e9362fc5c7471fc95d357f95b63f27c2a47c73371fa3a4d742c270906d86ba98e6c550634a44ee0b67fb3407d67cda4217398fca4e59e31c94f47b73157cdfefc28ab92f7ca133964cda14eb1529463d0200b835ab1e87d5a4f8c8a1051e30cb06a1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 1m6.139955231s ago: executing program 0 (id=3571): socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='quota,grpquotz_block_hardlimit=3,\x00']) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88a8000081000000080600f807000604"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2610054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000}, 0x48) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d4000000ed03200026bd7000fbdbdf257f38ea14473e094d8f1dcc8145c88489aebcc30bc1235010f1cbb711ab54d83b2a518fe885b12fd3d6c7f211bfb521ec76edf896e74399e0dd5cdaa1db0a4705c6e7d00e86f198227851540cef9b259ce9f449a3e7fdd4ec1322d699d44c7bfb9f16e8e35806fa699711deffd7d193c9b2666b4b6275458a196ba9707546c7d6df47bdf4017ca21464d6412b7d1b505c3d6378b26a86086e36589f4684a8f465c6da1eb73203ee89dc91916c781072a703918a6264316251578553364997f879444f00002c493f6a5f98c663a30ab341199f033451f5079946b6cb2caa4b513ad5c4e46823329ed47f1b75def68a9802d8d3c360d133a251b5f371bb91bb680ff8e49a223b39421166e0e4d938f77510ebb82a4d03625f0688e69b4c27a98336d5b76949b441165e44115185683a29ecb8b1a891ff6546fa6e8010e9beb930456cdcab55a8bea2b4ceb5ff0b63a49a3fd8bb618db9f03e569233cdcd21df791d350d53b48b6d985e873fa8ddc682fcc2ec49907d7dbf179f5ebb8aaef2dd3def61014d917862b9a3cb190e1208ebe25d966ac795f17ced"], 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500a30c3eb60001000000000aa78e28cbadfb07", @ANYRES32, @ANYBLOB], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4000000000000006311100000000000040000000000000095000000000000001ab33efbdd6b0cea571543937f61b32c3d0b5bba165a07c7b51c9566fa0a7462aae72b118b2902708ad67528861c9a5b02d3e8429f540a9c177e98de5ec78d3003a473077f5d2ac67a2ab0872c041e81564321140d1f16364a0c58029326e9362fc5c7471fc95d357f95b63f27c2a47c73371fa3a4d742c270906d86ba98e6c550634a44ee0b67fb3407d67cda4217398fca4e59e31c94f47b73157cdfefc28ab92f7ca133964cda14eb1529463d0200b835ab1e87d5a4f8c8a1051e30cb06a1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 49.610738829s ago: executing program 0 (id=3571): socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='quota,grpquotz_block_hardlimit=3,\x00']) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88a8000081000000080600f807000604"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2610054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000}, 0x48) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d4000000ed03200026bd7000fbdbdf257f38ea14473e094d8f1dcc8145c88489aebcc30bc1235010f1cbb711ab54d83b2a518fe885b12fd3d6c7f211bfb521ec76edf896e74399e0dd5cdaa1db0a4705c6e7d00e86f198227851540cef9b259ce9f449a3e7fdd4ec1322d699d44c7bfb9f16e8e35806fa699711deffd7d193c9b2666b4b6275458a196ba9707546c7d6df47bdf4017ca21464d6412b7d1b505c3d6378b26a86086e36589f4684a8f465c6da1eb73203ee89dc91916c781072a703918a6264316251578553364997f879444f00002c493f6a5f98c663a30ab341199f033451f5079946b6cb2caa4b513ad5c4e46823329ed47f1b75def68a9802d8d3c360d133a251b5f371bb91bb680ff8e49a223b39421166e0e4d938f77510ebb82a4d03625f0688e69b4c27a98336d5b76949b441165e44115185683a29ecb8b1a891ff6546fa6e8010e9beb930456cdcab55a8bea2b4ceb5ff0b63a49a3fd8bb618db9f03e569233cdcd21df791d350d53b48b6d985e873fa8ddc682fcc2ec49907d7dbf179f5ebb8aaef2dd3def61014d917862b9a3cb190e1208ebe25d966ac795f17ced"], 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500a30c3eb60001000000000aa78e28cbadfb07", @ANYRES32, @ANYBLOB], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4000000000000006311100000000000040000000000000095000000000000001ab33efbdd6b0cea571543937f61b32c3d0b5bba165a07c7b51c9566fa0a7462aae72b118b2902708ad67528861c9a5b02d3e8429f540a9c177e98de5ec78d3003a473077f5d2ac67a2ab0872c041e81564321140d1f16364a0c58029326e9362fc5c7471fc95d357f95b63f27c2a47c73371fa3a4d742c270906d86ba98e6c550634a44ee0b67fb3407d67cda4217398fca4e59e31c94f47b73157cdfefc28ab92f7ca133964cda14eb1529463d0200b835ab1e87d5a4f8c8a1051e30cb06a1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 26.901174138s ago: executing program 0 (id=3571): socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='quota,grpquotz_block_hardlimit=3,\x00']) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88a8000081000000080600f807000604"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2610054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000}, 0x48) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d4000000ed03200026bd7000fbdbdf257f38ea14473e094d8f1dcc8145c88489aebcc30bc1235010f1cbb711ab54d83b2a518fe885b12fd3d6c7f211bfb521ec76edf896e74399e0dd5cdaa1db0a4705c6e7d00e86f198227851540cef9b259ce9f449a3e7fdd4ec1322d699d44c7bfb9f16e8e35806fa699711deffd7d193c9b2666b4b6275458a196ba9707546c7d6df47bdf4017ca21464d6412b7d1b505c3d6378b26a86086e36589f4684a8f465c6da1eb73203ee89dc91916c781072a703918a6264316251578553364997f879444f00002c493f6a5f98c663a30ab341199f033451f5079946b6cb2caa4b513ad5c4e46823329ed47f1b75def68a9802d8d3c360d133a251b5f371bb91bb680ff8e49a223b39421166e0e4d938f77510ebb82a4d03625f0688e69b4c27a98336d5b76949b441165e44115185683a29ecb8b1a891ff6546fa6e8010e9beb930456cdcab55a8bea2b4ceb5ff0b63a49a3fd8bb618db9f03e569233cdcd21df791d350d53b48b6d985e873fa8ddc682fcc2ec49907d7dbf179f5ebb8aaef2dd3def61014d917862b9a3cb190e1208ebe25d966ac795f17ced"], 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500a30c3eb60001000000000aa78e28cbadfb07", @ANYRES32, @ANYBLOB], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4000000000000006311100000000000040000000000000095000000000000001ab33efbdd6b0cea571543937f61b32c3d0b5bba165a07c7b51c9566fa0a7462aae72b118b2902708ad67528861c9a5b02d3e8429f540a9c177e98de5ec78d3003a473077f5d2ac67a2ab0872c041e81564321140d1f16364a0c58029326e9362fc5c7471fc95d357f95b63f27c2a47c73371fa3a4d742c270906d86ba98e6c550634a44ee0b67fb3407d67cda4217398fca4e59e31c94f47b73157cdfefc28ab92f7ca133964cda14eb1529463d0200b835ab1e87d5a4f8c8a1051e30cb06a1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 14.072392925s ago: executing program 0 (id=3571): socket$packet(0x11, 0x3, 0x300) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='memory.events\x00', 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1e, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018120000"], 0x0, 0x3, 0x0, 0x0, 0x41100, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB='quota,grpquotz_block_hardlimit=3,\x00']) chown(&(0x7f00000003c0)='./file0\x00', 0x0, 0xee01) syz_emit_ethernet(0x32, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb88a8000081000000080600f807000604"], 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="18000000020000000000000000ee000095"], &(0x7f00000002c0)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r3, 0x5, 0xb68, 0x560b0007, &(0x7f0000000000)="259a53f288476d2610054c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1000000}, 0x48) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000fdffffff850000002d00000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0xa, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) inotify_add_watch(0xffffffffffffffff, 0x0, 0x42000773) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000700)=ANY=[@ANYBLOB="9feb0100180000000000000034000000340000000c00000004000000010000840203000000000000030000000000000000000000000000010500000020000000000000000000000b02000000006100302e"], 0x0, 0x58}, 0x28) sendmsg$AUDIT_USER(0xffffffffffffffff, &(0x7f0000000240)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000000180)={&(0x7f00000004c0)=ANY=[@ANYBLOB="d4000000ed03200026bd7000fbdbdf257f38ea14473e094d8f1dcc8145c88489aebcc30bc1235010f1cbb711ab54d83b2a518fe885b12fd3d6c7f211bfb521ec76edf896e74399e0dd5cdaa1db0a4705c6e7d00e86f198227851540cef9b259ce9f449a3e7fdd4ec1322d699d44c7bfb9f16e8e35806fa699711deffd7d193c9b2666b4b6275458a196ba9707546c7d6df47bdf4017ca21464d6412b7d1b505c3d6378b26a86086e36589f4684a8f465c6da1eb73203ee89dc91916c781072a703918a6264316251578553364997f879444f00002c493f6a5f98c663a30ab341199f033451f5079946b6cb2caa4b513ad5c4e46823329ed47f1b75def68a9802d8d3c360d133a251b5f371bb91bb680ff8e49a223b39421166e0e4d938f77510ebb82a4d03625f0688e69b4c27a98336d5b76949b441165e44115185683a29ecb8b1a891ff6546fa6e8010e9beb930456cdcab55a8bea2b4ceb5ff0b63a49a3fd8bb618db9f03e569233cdcd21df791d350d53b48b6d985e873fa8ddc682fcc2ec49907d7dbf179f5ebb8aaef2dd3def61014d917862b9a3cb190e1208ebe25d966ac795f17ced"], 0xd4}, 0x1, 0x0, 0x0, 0x4}, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="1c0000001500a30c3eb60001000000000aa78e28cbadfb07", @ANYRES32, @ANYBLOB], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002}, 0x0) ioctl$UI_DEV_CREATE(0xffffffffffffffff, 0x5501) bpf$MAP_CREATE(0x0, &(0x7f00000006c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x9, 0x4, &(0x7f0000000880)=ANY=[@ANYBLOB="b4000000000000006311100000000000040000000000000095000000000000001ab33efbdd6b0cea571543937f61b32c3d0b5bba165a07c7b51c9566fa0a7462aae72b118b2902708ad67528861c9a5b02d3e8429f540a9c177e98de5ec78d3003a473077f5d2ac67a2ab0872c041e81564321140d1f16364a0c58029326e9362fc5c7471fc95d357f95b63f27c2a47c73371fa3a4d742c270906d86ba98e6c550634a44ee0b67fb3407d67cda4217398fca4e59e31c94f47b73157cdfefc28ab92f7ca133964cda14eb1529463d0200b835ab1e87d5a4f8c8a1051e30cb06a1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x5, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51}, 0x48) 9.469107998s ago: executing program 8 (id=4531): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r2 = socket$l2tp6(0xa, 0x2, 0x73) ioctl$sock_SIOCGPGRP(r2, 0x8904, &(0x7f0000000040)=0x0) prlimit64(r3, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000)=0xfe8e, 0x12) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000001c0)=@newlink={0x34, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20305, 0x7e15}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x48094) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) write$cgroup_type(0xffffffffffffffff, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB="043e110b07"], 0xec) sendmsg$NFT_BATCH(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="14000000100001005d790000000300000500000a60000000060a0b0400000000000000000200000234000480300001800b00010074617267657400002000028008000240000000010800030002b511120c0001004e465155455545000900010073797a30000000000900020073797a32000000001400000011000100"], 0x88}}, 0x0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000080)="5c00000011006bcc9e3be34c6e17aa310769876c1d0000007ea60864160af36514001ac004000202080002000600010076e6f06cea2618c3ecb525c89c32f292b156a705251e618294ff0051f60a84c9f4d4938037e786a6d00010", 0x5b}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) 8.490559587s ago: executing program 8 (id=4536): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000000c0)={0x990000, 0x6, 0x7b, 0xffffffffffffffff, 0x0, 0x0}) 8.332436354s ago: executing program 8 (id=4538): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) inotify_add_watch(r0, 0x0, 0x1000028) syz_usb_connect(0x5, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0xf2, 0x15, 0x89, 0x10, 0x22b8, 0x2c84, 0x2f28, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xd, 0x1, 0x90, 0x2, [{{0x9, 0x4, 0x60, 0xa7, 0x2, 0xf, 0xa0, 0xd9, 0x8, [], [{{0x9, 0x5, 0x8, 0x6, 0x10, 0x6, 0x4, 0x8}}, {{0x9, 0x5, 0x7, 0x2, 0x200, 0x4, 0x2, 0x66}}]}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000080)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = userfaultfd(0x801) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r4 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000034d564b0000000001"]) ioctl$KVM_RUN(r5, 0xae80, 0x0) 4.580777942s ago: executing program 9 (id=4545): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x3, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r0, 0xc0285628, &(0x7f0000000040)={0x59, 0x2, 0x0, 0x0, 0x0, 0x5, 0xc}) getsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x0) r1 = syz_clone3(&(0x7f0000004700)={0x3100800, 0x0, 0x0, 0x0, {0x2f}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) r3 = syz_open_dev$vcsu(&(0x7f0000000100), 0x6, 0x1c5100) sched_setscheduler(r1, 0x0, &(0x7f0000000200)) bind$rds(r3, &(0x7f0000000140)={0x2, 0x4e20, @broadcast}, 0x10) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x49, 0x1}, 0x48) r5 = syz_open_dev$amidi(&(0x7f0000000000), 0x2, 0x1) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r5, 0x40045730, &(0x7f0000002780)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000000)={{r4}, &(0x7f0000000580), &(0x7f00000005c0)}, 0x20) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r6}, 0xc) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001240)={&(0x7f0000000840)=ANY=[@ANYBLOB="640000001800010000000000000000001d0109004d000f80"], 0x64}}, 0x0) bind$ax25(r2, &(0x7f0000000080)={{0x3, @default, 0x8}, [@null, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) connect$ax25(r2, &(0x7f0000000240)={{0x3, @bcast}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) 4.570576714s ago: executing program 2 (id=4546): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7}, 0xfe44, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffd74, 0x40004, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='hybla\x00', 0x6) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) listen(r0, 0x0) io_uring_setup(0x30d3, &(0x7f0000000000)={0x0, 0x371b, 0x0, 0x3, 0x38d}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000d00)=@mangle={'mangle\x00', 0x64, 0x6, 0x600, 0x310, 0x1d0, 0x440, 0x310, 0x0, 0x530, 0x530, 0x530, 0x530, 0x530, 0x6, 0x0, {[{{@ipv6={@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @multicast2}, [], [], 'vcan0\x00', 'veth1_virt_wifi\x00'}, 0x0, 0xa8, 0xe8, 0x0, {0x7a00000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz0\x00', 0x0, 0x9}}}, {{@ipv6={@mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'syzkaller1\x00', 'ip6tnl0\x00'}, 0x0, 0xa8, 0xe8}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@private0}}}, {{@ipv6={@rand_addr=' \x01\x00', @mcast2, [], [0xffffff00], 'veth1_to_batadv\x00', 'vlan1\x00'}, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@ecn={{0x28}}, @common=@ipv6header={{0x28}}]}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@empty}}}, {{@ipv6={@private0, @mcast2, [], [], 'veth1_to_team\x00', 'veth0_macvtap\x00'}, 0x0, 0xf0, 0x130, 0x0, {}, [@common=@hbh={{0x48}, {0x0, 0x0, 0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe760]}}]}, @inet=@TPROXY1={0x40, 'TPROXY\x00', 0x1, {0x0, 0x0, @ipv6=@remote}}}, {{@ipv6={@dev={0xfe, 0x80, '\x00', 0x2f}, @mcast2, [0xff, 0x0, 0x7f, 0xff], [0xffffffff, 0xff, 0xffffffff, 0xff], 'veth1_to_batadv\x00', 'rose0\x00', {}, {0xff}, 0x29, 0x4c, 0x2, 0x65}, 0x0, 0xa8, 0xf0}, @DNPT={0x48, 'DNPT\x00', 0x0, {@ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @ipv4=@local}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x660) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000140)={0x0, 0xfffffffffffffef6, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYRESDEC=0x0, @ANYRES32=r0], 0x28}, 0x1, 0x0, 0x0, 0x20040899}, 0x20008070) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_BEGIN_FF_ERASE(r5, 0xc00c55ca, &(0x7f0000000000)={0x10, 0x7fff, 0x5}) 4.036433799s ago: executing program 6 (id=4547): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = dup(r0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = dup(r2) sendmsg$nl_route(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="2000000010000104fbffffff8000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000001fea2cf6baf35e66ffb3fa7261ab30bcff2f826c635952a066cd6af1edcb1664f043a0bf2c12c54ac63315ad0bf5deed84a51daa5937202ef4f518a0977019e23a0589a72000000000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x801}, 0x0) ioctl$TIOCL_SETSEL(r1, 0x541c, &(0x7f0000001900)={0x2, {0x2, 0x108, 0x100, 0x100, 0x1, 0x4000}}) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) chdir(0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0xc0000, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffff8, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000004c0)=@IORING_OP_TIMEOUT={0xb, 0x18, 0x0, 0x0, 0x4, 0x0, 0x1, 0x40, 0x1}) io_uring_enter(0xffffffffffffffff, 0x6e2, 0x3900, 0x1, 0x0, 0xe00) rt_sigsuspend(0x0, 0x0) socket$packet(0x11, 0x3, 0x300) write(0xffffffffffffffff, 0x0, 0x0) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) recvmsg(r5, 0x0, 0x0) connect$packet(r5, &(0x7f0000000000)={0x1f, 0xf8, 0x0, 0x1, 0x2, 0x6, @broadcast}, 0x14) shutdown(r5, 0x1) socket$xdp(0x2c, 0x3, 0x0) socket$rxrpc(0x21, 0x2, 0xa) socket$unix(0x1, 0x5, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 3.955347633s ago: executing program 8 (id=4548): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205649, &(0x7f00000000c0)={0x990000, 0x6, 0x7b, 0xffffffffffffffff, 0x0, 0x0}) 3.460142226s ago: executing program 9 (id=4549): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$tun(0xffffffffffffff9c, 0x0, 0x26c0, 0x0) userfaultfd(0x801) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, 0x0, &(0x7f0000000200)='asymmetric\x00', 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) 3.437419623s ago: executing program 8 (id=4550): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) r1 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r1, 0x0, 0x0) write$FUSE_DIRENT(r1, 0x0, 0x1e0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$SOUND_PCM_READ_CHANNELS(0xffffffffffffffff, 0x80045006, &(0x7f0000000280)) r4 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r3) sendmsg$NLBL_CIPSOV4_C_ADD(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000140)=ANY=[@ANYBLOB="d0000000", @ANYRES16=r4], 0xd0}}, 0x0) r5 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r5, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r6, &(0x7f0000000100)={0x0, 0x3a, &(0x7f00000000c0)={&(0x7f0000000040)={0x38, 0xd, 0x6, 0x301, 0x0, 0x0, {0x3, 0x0, 0x6}}, 0x38}, 0x1, 0x0, 0x0, 0x4000000}, 0x4008080) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000400), 0x0, 0x0, 0x0}) r8 = dup3(r7, r5, 0x0) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r9, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r5, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f0000000300)={0xfffffe65, 0x0, &(0x7f0000000800)=[@increfs], 0x0, 0x0, 0x0}) write$binfmt_misc(0xffffffffffffffff, 0x0, 0x0) 3.106142366s ago: executing program 6 (id=4551): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_open_dev$sg(&(0x7f0000000080), 0x0, 0x0) ioctl$SCSI_IOCTL_SEND_COMMAND(r2, 0x1, &(0x7f00000000c0)=ANY=[@ANYRES64=r0, @ANYRES8=r1]) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000280)={0xffffffffffffffff, 0x0, 0x31, 0xa8, &(0x7f0000000000)="43f1cee3dc9d551b21939c0b4d5b116eb62289a5564f8d0ad0e60afb6a95622e09be4efe956fe35d8ed152029876fa9cc8", &(0x7f0000000100)=""/168, 0x8, 0x0, 0x61, 0x0, &(0x7f0000000200)="b1e6cba7adde1272d6a4063f10e3608860e4ecd55678cb92fc1fb8d0282121a003bffea207f154f6d93982d9bf0a6af6a1c0e9dcbebc9ba65caf55d71bdb22a736d710b41a330e752a4345261e073e4d2cc67c67f1afbb6b2b4a0881f0047ab1e9", 0xfffffffffffffffc, 0x2}, 0x50) 3.016276553s ago: executing program 2 (id=4552): ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x7, 0xe17}}, './file0\x00'}) sendmsg$inet(r0, &(0x7f0000000340)={&(0x7f0000000040)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10, &(0x7f0000000300)=[{&(0x7f0000000180)="1dfdded52441d1109ee9389c0caeac1af373a12d7c0d1ebe7186bf3b4c688db96c1a847961b11ce49695fefc5a79795f0406ff8cbb99291f5afa777f6612fc1ce45e7916314d5f81ee72147618d6e9e37f2eb24f1301b0938b6f7ed5b8fdff8f964f14af5e8c77a059b6fa7f4dd4fcb5b362c48cf84c697f79", 0x79}, {&(0x7f0000000200)="dd6aa631a1f7f664ba08d76097791d11da80366edf82a9a349b99a0ccdc02003ff39f2e8b1828d0a9df2df5c276bb880ef01355f4a56d7905fa71b40cd74aa1886811c7a3de09fc5d766f7be8b21beb0a480e50f099c54110c962d0f3326bfda53b3f44fb91f2cde20283d11873b5f98bd042d82ceb312cf72b10be521eaacf37bf335c6c4fb84cc40e0ce989411c4e8dd74ff768c4fe2f462970b955ddca9840674446f9a44937d24c65ef86f87a5", 0xaf}, {&(0x7f00000000c0)="2719900026fef9f637ce2af7cf10232c4f16d488a6f3d875411c0fd6ae084672bbf5d6f759eb8f865841f20c4485d08ecc3b3b988dc4c37cc7", 0x39}, {&(0x7f00000002c0)}], 0x4}, 0x5) r1 = syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_MODULATOR(r1, 0x40445637, &(0x7f0000000100)={0x3, "947a31e882eb835a5e25cad79cd79ecce3be908b9f1eb457fe2facc04b279ec2", 0x80, 0x6, 0x6, 0x8, 0x2}) 2.867244824s ago: executing program 6 (id=4553): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = semget$private(0x0, 0x6, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x161642, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x1e, 0x2, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r3, 0x10f, 0x81, 0x0, 0x0) syz_emit_ethernet(0x86, &(0x7f00000010c0)={@broadcast, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x78, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010102, @local}, @redirect={0x3, 0x4, 0x0, @broadcast=0x1000000, {0x17, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xe0000000, @empty, {[@timestamp_addr={0x44, 0xc, 0x0, 0x1, 0x0, [{@remote, 0x4e210000}]}, @timestamp_addr={0x44, 0xfffffffffffffd5f, 0x0, 0x1, 0x0, [{@multicast1}, {}, {@dev}, {@private}, {@empty}, {@initdev={0xac, 0x1e, 0x0, 0x0}}, {@dev}]}]}}}}}}}, 0x0) write(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r4 = getpid() prlimit64(r4, 0xb, &(0x7f00000001c0)={0xd8a7, 0x1}, &(0x7f0000000240)) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000a80)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1088d8b8588d72ec29c48f0af5f2d9f51c4b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d40224edc5465ad32b77a74e802a0dc6bf25cca242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000126abfb0767042361448279b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae645ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f57000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb7a2c8cb482bac0ac502d9ba96ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1fb8f72cd317902f19e385be9e48dccf1f9f3282830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa7956488bef241875f3b4b6ab7929a57affe760e797724f4fce1093b62d7e8c7123d890decacec55bf404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c70600000000000000b7561301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c542c9062ece84c99a061887a20639b41c8c12ee86c50804042b3eac1f870b136345cf67ca3fb5aac518a75f9e7d7101da841735e186c489b3a06fb99e0347f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af403269b4a39ce40293947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f91e358c3b377327ac9ecc34f24c9ae153ec60ac0694da85bff9f5f4df90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e669261192899d4562db0e22d564ae09bb6d163118e401e024fd452277c3887d6116c6cc9d8046c216c1f895778cb26e22a2a998de44aeadea2a40da8daccf080842a486721737390cbf3acb2003016f154772f514216bdf57d2a40d40b51ab67903ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99a3594191e104d417e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1594e32409e2a3bce109b6000000000000a1fec9000000d694210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137ab79a404abde7750898b59270bb29b81367ac91bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f00fb8191bbab2dc591dda61f0868afc4294859323e7a45319f18101288a0268893373750d1a8fe64680b0a3fc22dd704e4214d00000000d6c98cd1a9fbe1e7d58c08acaf30065b928a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ce21d69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821a00e8c5c39609ff854356cb490000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66018d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466ac96e0d0b3bc19faa5449209b085f3c334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c471c784ae7da7eaa69eb7f7f80572fdd11bb1d070080fbc22bf73468788df51710eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331ff5e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab84875f2c50ba830d3f474b079b407000000deff000040430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71b967ce7daac4be290159f6bcd75f0dda9de5532e66ae9e48b0ed1254a81faae79b6af6fbb869604d51de44c4e0973171ad47d6c00ebc7603093f000000fdec30cd6db49a47613808bad959719c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f15d6533f78a1f4e2df4ca23d867693fd42de9b49a1b36d48a44ba6a4530e59bec53e876dc660dd63bed8d31c31c37a373d4efd89f0000377b1b1292a893a516dab183ee65744fb8fc4f9ce2242e0f0059161c5e0000000000000000000057d77480e0345effff6413258d1f6eb190aa28cbb4bafe34124172e436b176c7ed4b132fb805d5edd9d188daf28d89c014c3ecca10ae55704544673e1fa03b84f63e022fe755f4007a4a899eaf52c4f491d8e97c862e29e457060000007ac691faee1e0c8fe056a07474e6e5490a7d3c3402000000b60600d837c6befc63ddf2f594ad7cbc56a1e44d218c956a5392a995f1fae8e9f206efbb33854dc70104ebc1581848f9745cb796da2dfb714a0500000000000000faed94fc39acfb3fd25dfa8116a154cd1226e1bb72b59fed817072a0da60160761fd3dffda0f7c592eabd8ab68334d2a1693cb187539049e331272bf5135044df8161400211b8012b6eb1ed5656e83f65509bb4b323c5bd61bff949d3bade2f6ffda1360c2786e16937ab61d6dcafed319c716357d0885f9c6d1f442954c167dd9b4acd9468ce3674c82bbb2e31389179b025dbe063b7f906217b2cf8410c7023aa3e5cc3ba1000000000000000000000000000000006ae6301a2da44394275c582a6516bb92ea1980a0a659f2f1811c8b281c209647c4241f292b20508b215dde27bb2487a6e2b5e4a8ccfab90c23827ef06cbe364073005f8a6d1456aaeb85ffb7858f24eced67a67ab825e863928ed64c83f62ffdaa997657335b63c6b4163aff094059e626766845fd779c9e6cdbbd64c24936615ee68538e8fddd0d90f3a7579579a142c0f7b318264d5c13c31cf475829528267ead38523cab7e1664e8426ca85e82ccf821c8a02a7e7d954d05b68a9c28f79429b09e2bb3681ae2b831e27c735123361c193d66ed4d71f19b199d371ec6bfada7cd370e3fdd3cd980fa1e145fd3f3e96b1feb53c865e1ad6acf5d16ed652ee0c7f45352222692fbd679212c225d097aa90f7e1fb1f983415f43e75a19ecf7fd21bfa150ef563aa72ba1c43c5f3d9be128ec26b691f31f9cab931631606a81622f120675c962be2d3b5e95f74f0b209e42e6bdd76e6e725295b1d78d928f6f63c41cbde2ba66ad81168070c8c6e18a6e452a31bdc4a60d637545ed4c8a1c649c3ce54ad3e16304d06a234f5f9311ef0f78924b68dbb4712efdb6974667bdb54f16fd2061b9ba93638dd177227e94e4ebd0ec1d437db948062bf41742000000000000000000305f70dd02fa0c61d5fe6d8ff35389246037e18d34c1375ae04f44f0c2543c772c5ccb137be7dc1874c5140200000054d77d4ea5ed144a648257f4a0301067bbcd9b91072659d872f26b796e2b81025edb5f45f785e2c2602b248ecdd80f019ca659be7e8ae953325a27564f33c9d458a60be3dab38baab7eb1a66ab1ffd6308f7fd51beb356fe75eb985b7581bb5584c53984ba9c7340f97e8d3825681c53de5f554e595b00000000000000006a8fa9f05d64c4be42f981f00051a3bc38613067dbd1427e01bfec016e51844cefa8a855bf23ac887b4a88eed6d9443857242f28e31a41d20105fbf3394ff910e734b4d9101265ff729c426e01c1ab13dda8c388b9e6626f19eecb87e39175e85e17000000000000000000009431807e43886903526074e6b40244c938a4c68a38c25ddd7c143b3f14eafe4b28ec66815cf8d1f56aa1424bc9b5d58790298e5b310969e50c222563b54e60854e1bfeef448aca8c5ccbf5546ce4c3cd5a733fec25fb94e1e0f966bcbd28a4d8fe4f556eaa1104a793006619700798354c6ae0040965e3083562bfa20968c04007d21dc02c9fd1f75e1ff40f439bdde4e784012e52049b483f02f81b88f5f57816b3fecec79cfca8d37203e769759d6b6a56b7605ced8ee18475a77ff0963a565fb6021d216c01b1098e40550a1cfd80e9180100000000000000654cd76ca61fe5ad8a31ec558fdbfa706d5e738bceae81fe777c307d5bc72183a4c2d35732e74dd690c57bdfdc1f069f9491bca7a8c59363799be70018c25ece5ad7307dc7a95c51bc25a8bbe2cf5ddf6aa161693782b0e7feb8a768f391b49d4c978c96dbb52f21c122eba9f17c8bed10591958cf06321a248b5f76ceedfe0d080d6aeadc11b237b3326dd04b86ac37c0d131544888db9e128d059761ad9a393e96c3b41c13c5a381bff187a75de560ba6eb3faa5ff8d2bb3c88f8de5efc2fb2200cfda6d07ceae22577064334fbf76a23e62e6059211d995b879f6b7d3f7fcf03652b81e6b7cdeff947ad185d3c6269ca247b429c3b872a8f1ef60407d29a874f4ec31c9effed55543a65a6b4d778cebcd43b7905f3960140bd783540a7353014bda8e9c7a34a5f428fd1f8eb11e837dd9d586487fdebcb1ecd3a003ff0fda4be617fecf1ff0ef2cdfb7fea73ca18874664d60a4b9423f3297bc8eb91b4ee1d73272ab28a7d7ab055a8eb58fe379de85338304e26e3620941b463e9049fd105c74c91cc4d71b0f76e2c2e4825106aa7ce2a3adbbc7a0443ece98c077b358e752b439132a0f27080ece2a94c320b002c77f82662675a7713c7067081cac15994698c41ff4754268ae2676384ff799783f55d7e5a1a092a01b965dc99cb7a9d98440c355927629f2bcf9dc2396eb2f5d25829715b24327642ac48f1201014a95e0e65e12cdf27e19043e3c5d3e798375cead35b9a93190a52cdecaaccc854a1d41ef365303f0e9b4fc969c9dab6df5e8a795b140fcc09e8a7b694d12932917facd8ceaa4e2d0d16bb0b95387fcd5ff136d8abddf94daf442bbff744591931872a36cf921ad69f2127386e8b0f9afee4da8d3fbec809fbb3ca0fded2859cf25d4c6155d396c5b9bd1a928923123f63f4c40688eae69990a9419456247bbaeb7948de84d2ff875414883bb1e503d4bfebc01bc12a53ea06bf38e571157bd642dac25dbee7832c58378374a39483d6721eec96c28911db21c0c006b42afc90000000000000000000000700000000000000000008ce4ea442c1a207108b35511186c5e860278f6463f52f3990ce08b1bfccc3cff4b5ae27b610aa9ba11b47d4f94c439e055cdbb2b12c9"], &(0x7f0000000100)='GPL\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000180)='fsi_master_gpio_cmd_abs_addr\x00', r7}, 0x18) pwritev(0xffffffffffffffff, &(0x7f0000001500)=[{0x0}], 0x1, 0x2, 0x2) r8 = socket$inet6(0x10, 0x3, 0x0) mkdir(&(0x7f0000000280)='./file0\x00', 0x84) sendmsg(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000100)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f138d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade5b175c0a9b2ce9", 0x55}], 0x1}, 0x48000) request_key(&(0x7f00000003c0)='ceph\x00', 0x0, 0x0, 0xfffffffffffffffe) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) semop(r1, &(0x7f0000001240)=[{0x4, 0xa}], 0x1) setsockopt$IP_VS_SO_SET_STARTDAEMON(r0, 0x0, 0x48b, &(0x7f0000000000)={0x1, 'veth0_virt_wifi\x00', 0x2000000}, 0x18) 2.658503945s ago: executing program 2 (id=4554): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) openat$tun(0xffffffffffffff9c, 0x0, 0x26c0, 0x0) r1 = add_key$keyring(&(0x7f0000000540), &(0x7f0000000180)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r1, &(0x7f0000000200)='asymmetric\x00', &(0x7f0000000340)=@chain) r2 = socket$alg(0x26, 0x5, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWSET={0x3c, 0x12, 0xa, 0x201, 0x0, 0x0, {0x2}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_KEY_TYPE={0x8}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}], {0x14}}, 0x64}, 0x1, 0x0, 0x0, 0x890}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)={0x1c, 0x13, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x1}]}, 0x1c}}, 0x4040040) bind$alg(r2, &(0x7f0000000280)={0x26, 'aead\x00', 0x0, 0x0, 'authenc(cmac(aes),lrw-camellia-asm)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r4 = accept4(r2, 0x0, 0x0, 0x80000) syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r4) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0x5, &(0x7f0000001300)=ANY=[@ANYBLOB="18000000000000000400000000000000850000000f000000850000005000000095a783b51d9eb3e6a0a7048046f4ef86315006914a6816154efbc49e38c69cb1b7873fb0011f658e52a76a1ad24a50d46fb4784940720db65d4154823bb80eefd88c62787fd8d8bad29ffc47efa81d2bd897c0e73d6862c53a67218adea3a7b3f0abda76a92bcad8eb6b152a4de2d02f53defd757e17d3b10967f166f01918fead3ccd2197f373708710a8b7973c439c30bc939ab9b0dd9d45727813dd3fe2bafb209a439f1d8c1dbd518f23c8cea89085e55d1103b255e63b0464c4866788653fcc24c29a2444b5e77be0a705e7d7c5f4cad7a60fb82a47fd10401afe61eade88160c95b3477490bbd1677851"], &(0x7f0000000280)='syzkaller\x00', 0xfffffffc, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) writev(r4, &(0x7f0000000200)=[{&(0x7f0000000300)="a4eac90f8e3ae7580e2e693731ef6b447fc2057d9a84e61f40c79e10218d131f865d68b23cd7c3f2b681e2205f67f140252abcc3b8015e176881d81a9e61b6a2c92a9d8e1f51861b64e7b61bf9a131e197f5a6c6d4d887d86c79836e81c69e211d2bf4c595b01c94de464ff9aa72b6058fe774c81142bbce9bd0d83f6239362c3347e3daadb292cf3fee4766a2d43cf006a476ce0e4dd221acdcdefcf67733ed2978c2cd564772844077920cf54543db03688079168e36709dbbf84933a2415a32617f7de4336d89967c2cbcd76a973d88a3c440862bc11e51df6f1cd25f1aa711b721c33703645bcf93b775f1eb28c7640d1b7cbe44b9fc0e55d1a4d8f83b8fd537a231fe75ebb7255387d089ae7924c86b36f11d4c09d27626fd8cd62dbee1662558322e3dffdb4c4816e8ee2501b8e73eda5a8caf70487ea6edede6b8337d5ff348bd874de5b9a5058b85c0659031d237abfcdc40bd6b45d4845b08adc7bdaefa8099bef8d5f6cae07abc605dc651a21b04ae53f6d89d9fac3ec696ca9508a681ca65a4524242fae4d79e40840ce54330107125a916b03459f58e4e6c3215a97e391c069926a24d9486909ef1f0c210514e2cd81cbaa6352a2de4f5829eb670a6500c83eb8c8bd5edbe4005bfb524fce3d4796d028acf27fb9df67851db5d59b2f88d97aa591d607d602dbb9bb4211abbc8641610aae237e8d47f8381dced80019a4e9b3d0e6e2a978ffeec19fe0a6077eb48d3d4d478801eb1902bb3f8552d402dd8de49cb6bb7c78600c75e3bcf53bf58e391d6484423cbfe17cf95f3b30a41b849af63ffd6a7b5aaab0ce5ac6d78519430c27415fd46f150671ee860341b9c473937c498cc9aae0cb64a73f24780b4771b1ea51816bd68f19c49747c4caf0acd418517e88e1f82cd9d2d870abb33624483670269aac3d2fe75fff726d60fe1be2fc2abc47b98eb75ef2f7f4eca0b50450ef48d71921cd10307563d120eed0416e3dcf4b198ec8424d857ab872d9de56e614e3fba275bae2c21793bebe86cdfbe822bffd2c9be6e623fcbb441e202cf8107da69cb06f93f7956a4ee88de99dc881fac8894ea5acaf4cac4c65de055017ab0dcd1adab2a22e1c2a12e73316be0f4d07b405d6bf4adda88fac3f081f8f180b403a0671d4b26e35860e1064d87748390e6f63217d7db40f002f85c57c125be768d68600e2c795a83a3477481a41b8392a6ae2c3a51cec2da15980c299f528e658641960ef2983ae3e30955586dd9e6a6591d81645ed451dfc14b2c648a89655af1f66067350c6fb356610469ae7b20ccd14cbb0fb04f58bfda8f28f90ebade9b6f8017094f1d467d9df73dfcc48cea0307ca833b72978e64651c8eb429f2b36adab59251452b4abaa2ecb42eaf674b12b49081b40c324d6da586212f187c51e32c42b00622b3fcb1acfecaeb603cec87a0010c199a80cf184894b0992fe709613c672ec91587afe94c637cce86a50dfe9c695c8398e963e68156537014405962d20610846691a352dad6204a33f07f175e5dbdc89aab549ef4150320084fd999a090d86affac5ac371dfe5dd595b7459b39bd78ba5bb77469da251d4f9906356667a27ac58025eed8d0ded3a69cd2a6cae52ac4dd5799802421fd8a818c5bc787da162a42f5dec2175b4ff37a543d214bdf0cc071de0b77c9902ce7dbb42ace340e64a020100b677a73bc4449655f4165f074cb1b85cd491f18f3fbeb03ca708a91fe041a46433d8d8e1693dbff6333981c243b1d412c87741aca8e790f3ebb3151e3b44870ba74c64cc5c3011d7ac138ef0bd48f197a32c31fac8d53ba54ae114119328eb9e8825555ba29e9d45cbe656eeff1b4e39600695d3911ab4f5075c3d5691b731c50adc226d3ebf50d3c38561a5d0cef2c9d16e071bb8221ab4f85a802a63b7071402f88c7cf39cfc916f8622357b3234f3761f89cfbf3aded40c512a614702ae867e197510d3bdb4ee60df96c4e51b5a338b58b07e8ee62be9822e0d166ff874b8d1f9e4486c601d9b56a26eb0b83a80704dee19d10cc05c63b95f7d1efef88177645bc30d8473983ed552926d219bd0c3dbcb0fb464649624ba7a57f5163f49f33fb79a46e7ac9797e300262a843f15f644f5230546f3c62450242fe12a79bd44c61fd946165662b0bfbcffd12deb93e0cb82dc8cc66bebf0721b94a5fa0d66381540246ff78c6225a952ab984c06c07902ed42e40fcc9151b0a59be83f454698f302f349014082ff08bcecbf0b9dea7e32b063449d573ca1b6efc812acf382ef7b7e6cd206185e063c985b8c44fe38d62d4a8d3d15228406f3abed51fe90bae3ddc283069d46e0ebd3a8bb87e4e0eb116dff6fc881e8fd0e5032e6a6494cadfd85652ed1c9c2d7aa00e18ccbde0aa3c857c50ee86975aff735f633471ab8e6db33bfcefeae661bd1bd6dfb55a9a4b4f9be01fd15e27e03fc943ccdb91a799d2eb168d9fdeecd32c19169cc0443ebb8e2f681d773efff72530f61a288cfb49c0217b9a9223ceb3798390e15fbe9475975c05f22a7c4d1990f9400a249d32eec4a5773bea0d15cc0df06d223e057b3693ac906cf632da8c9092e52718bd9f16af452dacfab22cfc2c58a3168de9914570f1035ae9b3092346db21dda270393a992cb967dc074ae2fe8b545df855b9e8b251cac7935a842bda9e850a9efb5309cc0fb83a630dcb3684fec4999ed6c4cc91aea72961420523be74711ff4c3f16a5f6ee906dae87d2bbc194b2d8b7743c157f6c8d80e6f4e377cf05810bef82e51fa5c1e442018466071f7d572cae794fab5cfbbd8e8d398c3a2823e8ce4357572a32123312d0d3976d63dc2a00b2d474ad288762e768e31ab7b4f09e7f3cfcb7a48adbdbca43d30c9bc8f67d115bc34f24eaf0318bb5e2994ff0f8b62c13f46abebdd0846da71a5d106e62266ec3e5a3f2c7166628220568807b595dc73920a0a7a9f2644db70fc53fac0a547cf6cbefe7aee975e0159fe8f413eab912925757581d2fe97cc5f19343f329b2ef081397737414a822432b5f9fa2044aebda92c1d6a065401b70c20a6867fb93e8f6f575aa9fae3e67b6fc6e0418f58731d932b3e5bd1dddbb9854a25144a334d00bea2995d7a751d40a06c37372b05cc584aaf62b90fdd95f87ff53eab367600d50eebbbb4cf04f225824086cfaca6aa82b3e3433881f7ec32cd419780ed0de6fb2234368983282fb93b9d1a6bd96c3d14aff8272328db634b02bbbc5b8957c695e469f80fc50eac333b88303d0bf29c42c13a92a58a9bf30391cfe6a0c5df40cd5b7a8637cbece9a4f251e5aa4aa2fdf883d82d2a430f06416f0372911e426620b25d8839d2ac9d73cb782194f0daddd4caa68f1ff6892981c00d6812d21ffb5fcd9b1cd187d519040968aa2d7f4ccfcc236ffe2cae8d349f39feb3fa574272a428dfbfba0a735a349188b1396b96d1fc2e86069fc797de98985bf338e495d66cbed89c2f5f2cc78ec2b880f04627e5cd49e93bb606d241149b936ab29b790e22022361c483d760e07cabdfdd204114fc3808b7bb7cf977ffe0b8c58584364571578084f1dfbb592e47e0f01c020d02aafc8c83a56299f31836574923a706e7a46861502dfbf0e9d2893a38aca39a16cec44664541e092ec489abfa28128ebd73e7bbe062515384c69c656268ef42c37632ce2db76afd09e6de7928136cfaae1b4fdeaab590617584831a7eb19af64625ec2ca635f79f50caa48524b0fcd1e08a09bcf52e231f3487ab54fc77ae44e13a966976e9e9deaf8ab9da7f804fe6290e16629c6f83110f54e5c206798033c614be334a5ee04f4ecb30f58371eeb3664eab1d00f52725992897279d21d475cefbe2345a7f1df6e916a806e7c39b651866f6c1108d00990673ca858d8af73a26a74e1f8d7818859e7d0123224f866ed0745382b2a29f5374d7c6c0fa54ddf743d89c85dc56cfab74ee786d054a5f4f1db15d85e9fe1a7fdaa3746d9e7429735f2253cb2a600b81f969c7c7e56f22b47f15aa700b3369102ea105106b96cebd1161673ae4725a4d96421833f65f76c64de5aa7957b0df8ab64583e8d5018faa1f4e0376f1d38103ac78403f65f809619c3a9fe43c6b3493d29c52d4c230a39914b1b49c627fba1612c6479205c256ef023cb52ca142c6c37391ec9f74ba334ddebce6438cdf6e99527e68585324cbf6547872366d2d0b7db30a33528a745cbc8820e52a3cf77e50a76935ff4a7f41dfc58c86ff05e24436faf28f423467105b314bd6e4edbf1a352840728e8fe4dd79ee5f770dd987eb62ba3ff5c26c9de6685afefa5a227a4a6dfc1d23ba09eefab45402b138b53b83873a3797096d4b62450c579a894be0c05b947646ef2039ed37955155b58fae377c727605979505b037a0a72e622b883cd1001f69da95ffdd143e68e1fc2cc42db37bde33184ff85c89713a722e1eba4ad292ec9ccd1c8c18674e77bf6394edd47ad635b278ec09921020507104485a6453585c385d0cd4cf611d0c6da50ec3d34eecaf3bba0ae5051a55450ae2e40c4fd0ba420b04b2e1b4d1592e8b80f92d40d42de588e719fe2b022c30a5187c64cc5c48679f680387464d3681edea585006a2e852be2266e8c4230a6bf60dd8efb0e3c1b4dcfed2844d495957ae734470d0199a0e0278f80018a39e9c82c15cb9c73a3deb2579444b414ca7061bfb4f599fe3968334c0ebde54b9a046370bb7d3227c9dd23e8edcf8b07aabf328bb164c79c6df5f0bd46a276413dee370e32da823d5e9839937e72b6480ac0439d104cadba1a8d6d0542f73f720ecdafece52fc6fa291e44b3852af376a3aceb05c2c293a2576175a3b4135ff6799a232d9c3907fcdd49e0d97e80ece0135dac08c37a16a93046d7ca3f3db91d0c28447522759017980f4d3321981ab53000fbe5293b396f6163e3ae016329bc42f6c958d648a30ed5c6e14eeef235fb74cbc24e183a0f89ee89b3c51a8b7106afefb2e406a026619793fe4c3f4bdc7d66fbf98a740afb32485ae5451b905c22bf63f9b3b42b30a3287f266559db4067d1c00d2ffee58378a44614dafed9107d97d9c3048f2bdba374ccc827f302dae2a4637354cedfc0a2d7f2d2462f5ed43f1b682e8167a2081a20741ed8bb94791526355e14a6b191aee05ef45f5d5cd83cf8fa66e5c5b4f38d7bedc90da431a285b239e13a3f9e68399da38eda883b4e443c1d557fc4cec84ce9bccf67a652e7d94c8ff57c277fb0ce233ea35929d98467ea8643cfc0464827aa26e381293c0efc049b4707416551c7d57c40d232a660b2c8d722dcd1cde8629e2b30b476c2ea9da3beec02a6b38f507230ee700f871338007cdb06d3be80450fb20f8493668183d776c902d044d4152c8a4e9ffa909d82d1b6aa27ca390706d7690b307436de72b4a81c094688397281810e98053b8c622bdc1194f54aab47fe1d3d9512733ee3e6b5b7688a90960929a0afee9580440b8964c450e3caeefcbe24c1bf6e74336ad4954f62c874a4a1ba019cae59bd1eb2ffee6174e04324348d92b588a31271a3ac59b91adb5eb22cf5af39d7cb8a7d3d8916aa9cb772c53217c18c7caa1442f9046ea806e48c6b3542d97916091d9424c7839d2757aabd0f675cd221cce0228e272e23531b6e0163b4182c267868ae1ccab3872d36085f7be61930c5fd261d045eb3dde49f646f40c313cfe4c8d5", 0xfd1}], 0x1) shmctl$IPC_STAT(0x0, 0x2, &(0x7f0000000100)=""/205) 2.065775708s ago: executing program 9 (id=4555): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000003ec0), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_TSINFO_GET(r2, &(0x7f0000003fc0)={0x0, 0x0, &(0x7f0000003f80)={&(0x7f0000000100)=ANY=[@ANYRES8=r0, @ANYRES16=r3, @ANYRESOCT=r0], 0x34}, 0x1, 0x0, 0x0, 0x42084}, 0x40004) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$kcm(0x29, 0x2, 0x0) r5 = memfd_create(&(0x7f0000000240)='e\xf4E\x88-\x00', 0x0) pwritev(r5, &(0x7f0000000040)=[{&(0x7f0000000480)="db", 0x1}], 0x1, 0x4000001, 0x0) sendfile(r4, r5, 0x0, 0x8000fb00) 1.439962928s ago: executing program 6 (id=4556): r0 = socket$alg(0x26, 0x5, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={0x0}, 0x18) r1 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x8946, &(0x7f0000000040)={'wlan0\x00', &(0x7f0000000200)=@ethtool_regs={0x11}}) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000004850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000340)='kfree\x00', r2}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r4, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000080)="1400000016000b63d25a80648c2566e506bce1e8", 0x14}], 0x1}, 0x0) 1.403892669s ago: executing program 9 (id=4557): r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x6, 0x4, 0x4, 0xf, 0x0, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="0b00000007000000010001000900000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000180)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0xf, &(0x7f0000000340)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000080)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x4, [@func={0x2, 0x0, 0x0, 0xc, 0x2}, @func_proto]}, {0x0, [0x0, 0x5f]}}, 0x0, 0x34}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r7, 0x8, &(0x7f0000000040)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x62, 0x0, 0x0, 0xfffffffffffffdc3}, 0x77) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r6}, 0x2d) r8 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r8, &(0x7f0000000080)={0x2, 0x0, @multicast1}, 0x10) connect$inet(r8, &(0x7f0000000040)={0x2, 0xfffe, @empty}, 0x10) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r1}, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) 1.150269907s ago: executing program 6 (id=4558): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x20}, 0x94) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000340)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_sfeatures={0x51}}) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = openat$cgroup_type(0xffffffffffffffff, &(0x7f0000000040), 0x2, 0x0) write$cgroup_type(r2, &(0x7f0000000080), 0x9) r3 = syz_open_dev$rtc(&(0x7f00000000c0), 0x7ff, 0x954addc14109690c) ioctl$RTC_WIE_ON(r3, 0x700f) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000300)="2e00000010008188040f80ec59acbc0413a181010100000000010000000000000e000a000f00000002800600121f", 0x2e}], 0x1}, 0x0) 637.61096ms ago: executing program 2 (id=4559): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newtaction={0x18, 0x30, 0x800, 0x70bd2b, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(r0, 0x6, &(0x7f0000000080)=0x400c) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x4000084) r3 = fsmount(r1, 0x0, 0x0) r4 = openat$cgroup_subtree(r3, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f00000001c0)=ANY=[@ANYBLOB="fbbfe8e47d4d000000"], 0x6) r5 = openat$sysfs(0xffffffffffffff9c, 0x0, 0x212282, 0x2d) r6 = syz_open_dev$vim2m(&(0x7f0000000100), 0x80000000, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r6, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) r7 = syz_open_dev$vim2m(&(0x7f0000000140), 0x8, 0x2) ioctl$vim2m_VIDIOC_EXPBUF(r7, 0xc0405668, &(0x7f0000000100)={0x20, 0x6, 0x2}) read$char_usb(r5, &(0x7f0000000000)=""/158, 0x9e) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) futex(0x0, 0xd, 0x0, 0x0, 0x0, 0x1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f0000000280)={0x8, 0x8, 0x1, 0x0, 0x4}) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x400000000000041, 0x0) 384.055728ms ago: executing program 2 (id=4560): set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) capset(0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1, 0x23, 0x8, 0x7ffd, 0x1000000}, 0x50) 380.877371ms ago: executing program 9 (id=4561): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = getpid() syz_pidfd_open(r2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r5 = socket$kcm(0x2, 0x200000000000001, 0x0) ioctl$int_in(r5, 0x5452, &(0x7f0000000000)=0xf) (async) sendmsg$inet(r5, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0x4}}, 0x10, 0x0}, 0x30004081) (async) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async, rerun: 32) r6 = syz_io_uring_setup(0x88e, &(0x7f0000000140)={0x0, 0x54ea, 0x0, 0x1, 0x3b9}, &(0x7f0000000000)=0x0, &(0x7f00000001c0)=0x0) (rerun: 32) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) (async) io_uring_enter(r6, 0x47f6, 0x0, 0x2, 0x0, 0x0) (async) bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c) (async) listen(r1, 0x0) (async) r9 = openat(0xffffffffffffff9c, &(0x7f0000004d00)='./file1\x00', 0x351142, 0x1cd) quotactl_fd$Q_GETQUOTA(r9, 0xffffffff80000701, 0xffffffffffffffff, 0x0) (async) ioctl$HIDIOCGFEATURE(r9, 0xc0404807, &(0x7f0000000200)={0x5, "6d707950ebf63fbc188dbaaccf5059c3737fe83e2a8769b06682585229967ac6d110717fd3e65961adf84a21cc1892362297de811caf707d8fe03ddf1ab7933a"}) (async) syz_emit_ethernet(0x4a, &(0x7f00000000c0)={@local, @random="618e38850ee1", @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0xff, @remote, @local, {[], {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x5, 0x2}}}}}}}, 0x0) (async, rerun: 64) syz_emit_ethernet(0x56, &(0x7f00000000c0)={@local, @multicast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "09c4ff", 0x20, 0x6, 0x0, @dev={0xfe, 0x80, '\x00', 0xd}, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0xc2, 0x0, 0x0, 0x87, {[@mptcp=@syn={0x1e, 0xc, 0x2, 0x1, 0x1, 0x8001, 0x4}]}}}}}}}}, 0x0) (rerun: 64) 220.085874ms ago: executing program 2 (id=4562): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0x12) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c000000200001000000000000000f000a002040000000070000000014000200fc0200000000000000000000000000001400030076"], 0x4c}, 0x1, 0x0, 0x0, 0x24040804}, 0x0) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$sock_SIOCOUTQ(r3, 0x5411, 0xffffffffffffffff) sendmsg$nl_route(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r2], 0x5c}}, 0x0) r4 = fanotify_init(0x2, 0xfd36ea1081710d42) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r6 = open$dir(&(0x7f0000000100)='./file0\x00', 0x149800, 0x0) ppoll(&(0x7f00000001c0)=[{r6, 0x1}], 0x1, 0x0, 0x0, 0x0) open(&(0x7f0000000140)='./file0\x00', 0x4182, 0x3f00) bind$bt_sco(r5, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x11}}, 0x8) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0x7, 0x0, 0x0) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000001c0)='fdinfo\x00') fchdir(r7) lchown(&(0x7f0000000040)='./file0\x00', 0xffffffffffffffff, 0x0) fanotify_mark(r4, 0x6c6, 0x10, 0xffffffffffffffff, &(0x7f00000000c0)='./file0\x00') r8 = socket$phonet(0x23, 0x2, 0x1) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYRESHEX=r8, @ANYRES8=0x0, @ANYRESDEC=r3], 0x92fc}}, 0x4010) 189.479642ms ago: executing program 9 (id=4563): r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0, 0x0) inotify_add_watch(r0, 0x0, 0x1000028) syz_usb_connect(0x5, 0x36, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0xf2, 0x15, 0x89, 0x10, 0x22b8, 0x2c84, 0x2f28, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0xd, 0x1, 0x90, 0x2, [{{0x9, 0x4, 0x60, 0xa7, 0x2, 0xf, 0xa0, 0xd9, 0x8, [], [{{0x9, 0x5, 0x8, 0x6, 0x10, 0x6, 0x4, 0x8}}, {{0x9, 0x5, 0x7, 0x2, 0x200, 0x4, 0x2, 0x66}}]}}]}}]}}, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0}) ioctl$BLKIOOPT(r0, 0x1279, &(0x7f0000000080)) socket$netlink(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) pselect6(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000140)={0x5, 0x0, 0x0, 0x2000, &(0x7f0000fe5000/0x2000)=nil}) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)=ANY=[@ANYBLOB="0100000000000000034d564b0000000001"]) ioctl$KVM_RUN(r4, 0xae80, 0x0) 96.089569ms ago: executing program 8 (id=4564): r0 = fsopen(&(0x7f0000000000)='fuse\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r0, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b 1 [ 1534.387398][T18662] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1534.396675][T18662] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1534.414791][T18662] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1534.427854][T18662] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1534.979574][ T6267] team0 (unregistering): Port device team_slave_1 removed [ 1535.020322][ T6267] team0 (unregistering): Port device team_slave_0 removed [ 1535.296256][T23702] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4195'. [ 1535.355415][T23704] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4196'. [ 1535.652626][T23704] pimreg: entered allmulticast mode [ 1535.715909][T23692] lo speed is unknown, defaulting to 1000 [ 1535.723992][T23692] virt_wifi0 speed is unknown, defaulting to 1000 [ 1535.824112][T23715] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4201'. [ 1536.039571][ T30] audit: type=1400 audit(1752498007.581:6324): avc: denied { lock } for pid=23714 comm="syz.6.4201" path="socket:[97208]" dev="sockfs" ino=97208 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 1536.044490][T23715] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=23715 comm=syz.6.4201 [ 1536.551321][T23710] DRBG: could not allocate digest TFM handle: hmac(sha512) [ 1536.592610][T23692] chnl_net:caif_netlink_parms(): no params data found [ 1536.753115][ T5842] Bluetooth: hci3: command tx timeout [ 1537.064903][T23692] bridge0: port 1(bridge_slave_0) entered blocking state [ 1537.076583][T23692] bridge0: port 1(bridge_slave_0) entered disabled state [ 1537.087474][T23692] bridge_slave_0: entered allmulticast mode [ 1537.096496][T23692] bridge_slave_0: entered promiscuous mode [ 1537.113963][T23692] bridge0: port 2(bridge_slave_1) entered blocking state [ 1537.126182][T23692] bridge0: port 2(bridge_slave_1) entered disabled state [ 1537.134417][T23692] bridge_slave_1: entered allmulticast mode [ 1537.154435][T23692] bridge_slave_1: entered promiscuous mode [ 1537.277122][T23745] netlink: 92 bytes leftover after parsing attributes in process `syz.6.4206'. [ 1537.286582][T23745] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4206'. [ 1537.295661][T23745] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4206'. [ 1537.326445][T23745] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4206'. [ 1537.361837][ T30] audit: type=1400 audit(1752498008.771:6325): avc: denied { read } for pid=23740 comm="syz.8.4205" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1537.367646][T23744] netlink: 72 bytes leftover after parsing attributes in process `syz.8.4205'. [ 1537.416616][T23745] binder: 23742:23745 ioctl c0306201 200000000240 returned -11 [ 1537.429853][T23745] binder: 23742:23745 ioctl c0306201 200000000300 returned -22 [ 1537.590466][ T30] audit: type=1400 audit(1752498008.771:6326): avc: denied { open } for pid=23740 comm="syz.8.4205" path="/dev/input/mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1537.619488][T23692] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1537.630134][T23692] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1537.715455][T23692] team0: Port device team_slave_0 added [ 1537.722741][T23749] x_tables: ip6_tables: TPROXY.1 target: invalid size 32 (kernel) != (user) 22 [ 1537.731967][T23692] team0: Port device team_slave_1 added [ 1537.841163][T23692] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1537.852466][T23692] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1537.878829][T23692] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1537.903396][T23692] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1537.927384][T23692] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1538.009821][T23692] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1538.044718][T23760] lo speed is unknown, defaulting to 1000 [ 1538.054816][T23760] virt_wifi0 speed is unknown, defaulting to 1000 [ 1538.083002][ T30] audit: type=1400 audit(1752498009.581:6327): avc: denied { write } for pid=23759 comm="syz.8.4212" path="socket:[97651]" dev="sockfs" ino=97651 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 1538.260597][T23692] hsr_slave_0: entered promiscuous mode [ 1538.266825][T23692] hsr_slave_1: entered promiscuous mode [ 1538.320967][T23768] netlink: 92 bytes leftover after parsing attributes in process `syz.6.4213'. [ 1538.363893][T23768] binder: 23766:23768 ioctl c0306201 200000000300 returned -22 [ 1538.496554][T23771] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=23771 comm=syz.9.4214 [ 1538.777630][ T5842] Bluetooth: hci3: command tx timeout [ 1539.761031][ T30] audit: type=1326 audit(1752498011.301:6328): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23779 comm="syz.2.4217" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6d2318e929 code=0x0 [ 1539.852237][T23777] uprobe: syz.8.4216:23777 failed to unregister, leaking uprobe [ 1539.870238][T16443] libceph: connect (1)[c::]:6789 error -101 [ 1539.878315][T16443] libceph: mon0 (1)[c::]:6789 connect error [ 1539.957448][T23786] __nla_validate_parse: 3 callbacks suppressed [ 1539.957458][T23786] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4218'. [ 1540.148058][T16443] libceph: connect (1)[c::]:6789 error -101 [ 1540.154090][T16443] libceph: mon0 (1)[c::]:6789 connect error [ 1540.242566][T23692] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1540.334487][T23692] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1540.555892][T23692] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1540.580458][T23692] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1540.591479][T23781] ceph: No mds server is up or the cluster is laggy [ 1540.681094][T16443] libceph: connect (1)[c::]:6789 error -101 [ 1540.687602][T16443] libceph: mon0 (1)[c::]:6789 connect error [ 1540.919028][ T5842] Bluetooth: hci3: command tx timeout [ 1541.368111][T23810] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1541.481478][T23813] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4223'. [ 1541.496675][T23692] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1541.513312][T23692] 8021q: adding VLAN 0 to HW filter on device team0 [ 1541.546056][T23692] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1541.617238][T23692] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1541.689068][T18006] bridge0: port 1(bridge_slave_0) entered blocking state [ 1541.696363][T18006] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1541.772737][T18006] bridge0: port 2(bridge_slave_1) entered blocking state [ 1541.779906][T18006] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1542.050429][ T30] audit: type=1400 audit(1752498013.591:6329): avc: denied { override_creds } for pid=23829 comm="syz.9.4226" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1542.111767][T13180] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 1542.114577][T23692] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1542.267258][T13180] usb 7-1: Using ep0 maxpacket: 16 [ 1542.474061][T23692] veth0_vlan: entered promiscuous mode [ 1542.569426][T23692] veth1_vlan: entered promiscuous mode [ 1542.924017][T23692] veth0_macvtap: entered promiscuous mode [ 1542.937321][ T5842] Bluetooth: hci3: command tx timeout [ 1542.939006][T23838] 9pnet_fd: Insufficient options for proto=fd [ 1542.986325][T13180] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1542.995692][T13180] usb 7-1: config 13 has an invalid interface number: 96 but max is 0 [ 1543.001465][T23692] veth1_macvtap: entered promiscuous mode [ 1543.003988][T13180] usb 7-1: config 13 has no interface number 0 [ 1543.016567][T13180] usb 7-1: config 13 interface 96 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 1543.026937][T13180] usb 7-1: config 13 interface 96 has no altsetting 0 [ 1543.044327][T23692] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1543.082801][T23692] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1543.093090][T13180] usb 7-1: New USB device found, idVendor=22b8, idProduct=2c84, bcdDevice=2f.28 [ 1543.094562][T23692] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.111552][T23692] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.120325][T23692] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.122278][T13180] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1543.131304][T23692] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1543.170129][T13180] usb 7-1: Product: syz [ 1543.174587][T13180] usb 7-1: Manufacturer: syz [ 1543.200197][T13180] usb 7-1: SerialNumber: syz [ 1543.231637][T23817] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1543.320118][T21387] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1543.361438][T21387] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1543.411241][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1543.419627][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1543.477382][T19710] usb 9-1: new full-speed USB device number 29 using dummy_hcd [ 1543.506597][T23817] netlink: 'syz.6.4224': attribute type 10 has an invalid length. [ 1543.516154][T23817] team0: Device ipvlan1 failed to register rx_handler [ 1543.604841][T13180] usb_serial_simple 7-1:13.96: moto_modem converter detected [ 1543.670898][T13180] usb 7-1: moto_modem converter now attached to ttyUSB0 [ 1543.691012][T13180] usb 7-1: USB disconnect, device number 25 [ 1543.701352][T19710] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1543.722683][T19710] usb 9-1: New USB device found, idVendor=0458, idProduct=0153, bcdDevice= 0.00 [ 1543.736632][T13180] moto_modem ttyUSB0: moto_modem converter now disconnected from ttyUSB0 [ 1543.749887][T19710] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1543.758173][T13180] usb_serial_simple 7-1:13.96: device disconnected [ 1543.772628][T19710] usb 9-1: config 0 descriptor?? [ 1544.196065][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.206167][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.213878][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.263509][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.270988][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.281983][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.289788][T19710] kye 0003:0458:0153.002F: unknown main item tag 0x0 [ 1544.320177][T19710] kye 0003:0458:0153.002F: hidraw0: USB HID v0.06 Device [HID 0458:0153] on usb-dummy_hcd.8-1/input0 [ 1544.599777][T19710] usb 9-1: USB disconnect, device number 29 [ 1544.734499][T23854] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4234'. [ 1544.766631][T23858] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1544.956443][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.073355][T23862] fuse: Bad value for 'group_id' [ 1545.078390][T23862] fuse: Bad value for 'group_id' [ 1545.562595][T21387] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1545.678414][T23866] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4236'. [ 1546.038818][T21387] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.121855][T21387] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.224970][T21387] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1546.313839][T21387] bridge_slave_1: left allmulticast mode [ 1546.319683][T21387] bridge_slave_1: left promiscuous mode [ 1546.325304][T21387] bridge0: port 2(bridge_slave_1) entered disabled state [ 1546.333561][T21387] bridge_slave_0: left allmulticast mode [ 1546.339417][T21387] bridge_slave_0: left promiscuous mode [ 1546.345032][T21387] bridge0: port 1(bridge_slave_0) entered disabled state [ 1546.610888][T21387] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1546.621053][T21387] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1546.630398][T21387] bond0 (unregistering): Released all slaves [ 1546.842196][T21387] hsr_slave_0: left promiscuous mode [ 1546.848243][T21387] hsr_slave_1: left promiscuous mode [ 1546.853857][T21387] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1546.862424][T21387] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1546.870231][T21387] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1546.878985][T21387] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1546.894479][T21387] veth1_macvtap: left promiscuous mode [ 1546.900078][T21387] veth0_macvtap: left promiscuous mode [ 1546.905584][T21387] veth1_vlan: left promiscuous mode [ 1546.910856][T21387] veth0_vlan: left promiscuous mode [ 1547.231616][T21387] team0 (unregistering): Port device team_slave_1 removed [ 1547.266577][T21387] team0 (unregistering): Port device team_slave_0 removed [ 1547.740098][T23876] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4237'. [ 1548.367713][T18662] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1548.398154][T18662] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1548.407318][T18662] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1548.415725][T18662] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1548.423494][T18662] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1548.773925][T23896] fuse: Unknown parameter 'ˇk°#Ôg' [ 1549.191027][T23889] lo speed is unknown, defaulting to 1000 [ 1549.209248][T23889] virt_wifi0 speed is unknown, defaulting to 1000 [ 1549.209248][T23897] lo speed is unknown, defaulting to 1000 [ 1549.271416][T23897] virt_wifi0 speed is unknown, defaulting to 1000 [ 1549.406612][T23902] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4244'. [ 1549.533524][T23909] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4244'. [ 1549.682203][T23889] chnl_net:caif_netlink_parms(): no params data found [ 1549.689164][ T5982] usb 9-1: new high-speed USB device number 30 using dummy_hcd [ 1549.859909][ T5982] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1549.891074][ T5982] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1549.903599][ T5982] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.921739][ T5982] usb 9-1: config 0 descriptor?? [ 1550.066131][T23889] bridge0: port 1(bridge_slave_0) entered blocking state [ 1550.125456][T23889] bridge0: port 1(bridge_slave_0) entered disabled state [ 1550.193007][T23889] bridge_slave_0: entered allmulticast mode [ 1550.276304][T23889] bridge_slave_0: entered promiscuous mode [ 1550.413303][ T5982] keytouch 0003:0926:3333.0030: fixing up Keytouch IEC report descriptor [ 1550.477734][T18662] Bluetooth: hci3: command tx timeout [ 1550.511338][ T5982] input: HID 0926:3333 as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/0003:0926:3333.0030/input/input92 [ 1550.622552][T23905] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1550.631193][T23905] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1551.557025][T23889] bridge0: port 2(bridge_slave_1) entered blocking state [ 1551.605256][ T5982] keytouch 0003:0926:3333.0030: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.8-1/input0 [ 1551.717417][T23889] bridge0: port 2(bridge_slave_1) entered disabled state [ 1551.724653][T23889] bridge_slave_1: entered allmulticast mode [ 1551.735453][T23889] bridge_slave_1: entered promiscuous mode [ 1551.824250][T23889] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1552.371061][T23889] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1552.425351][T23889] team0: Port device team_slave_0 added [ 1552.450071][T23889] team0: Port device team_slave_1 added [ 1552.496904][T23889] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1552.504089][T23889] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1552.620334][ T5982] usb 9-1: USB disconnect, device number 30 [ 1552.629656][T23889] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1552.652616][T23889] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1552.728073][T18662] Bluetooth: hci3: command tx timeout [ 1552.893717][T23889] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1552.956173][T23889] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1553.575661][T23960] lo speed is unknown, defaulting to 1000 [ 1553.582315][T23960] virt_wifi0 speed is unknown, defaulting to 1000 [ 1553.767006][T23889] hsr_slave_0: entered promiscuous mode [ 1553.798276][T23889] hsr_slave_1: entered promiscuous mode [ 1554.018664][T23973] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4258'. [ 1554.043526][T23973] binder: BINDER_SET_CONTEXT_MGR already set [ 1554.049633][T23973] binder: 23967:23973 ioctl 4018620d 200000000040 returned -16 [ 1554.067362][T23973] binder: 23967:23973 ioctl c0306201 200000000240 returned -11 [ 1554.075535][T23973] binder: 23967:23973 unknown command 0 [ 1554.081294][T23973] binder: 23967:23973 ioctl c0306201 200000000300 returned -22 [ 1554.281172][T23977] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4261'. [ 1554.328830][ T5982] usb 10-1: new high-speed USB device number 31 using dummy_hcd [ 1554.485019][ T30] audit: type=1400 audit(1752498026.021:6330): avc: denied { connect } for pid=23987 comm="syz.6.4264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1554.512568][ T5982] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1554.524241][ T30] audit: type=1400 audit(1752498026.051:6331): avc: denied { read } for pid=23987 comm="syz.6.4264" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 1554.548796][ T5982] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1554.559586][ T5982] usb 10-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1554.607300][T13180] usb 9-1: new high-speed USB device number 31 using dummy_hcd [ 1554.626053][ T5982] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1554.644315][ T30] audit: type=1400 audit(1752498026.181:6332): avc: denied { watch } for pid=23987 comm="syz.6.4264" path="/270/file1" dev="tmpfs" ino=1428 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 [ 1554.673263][ T5982] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1554.681674][ T5982] usb 10-1: Product: syz [ 1554.686045][ T5982] usb 10-1: Manufacturer: syz [ 1554.687858][ T30] audit: type=1400 audit(1752498026.181:6333): avc: denied { watch_sb watch_reads } for pid=23987 comm="syz.6.4264" path="/270/file1" dev="tmpfs" ino=1428 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=file permissive=1 [ 1554.705240][ T5982] usb 10-1: SerialNumber: syz [ 1554.727776][ T5982] cdc_mbim 10-1:1.0: MBIM functional descriptor missing [ 1554.734853][ T5982] cdc_mbim 10-1:1.0: bind() failure [ 1554.778618][T13180] usb 9-1: Using ep0 maxpacket: 8 [ 1554.783797][T18662] Bluetooth: hci3: command tx timeout [ 1554.792506][T13180] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1554.803856][T13180] usb 9-1: string descriptor 0 read error: -22 [ 1554.813238][T13180] usb 9-1: New USB device found, idVendor=0789, idProduct=0160, bcdDevice=82.fe [ 1554.833562][T13180] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1554.942571][ T10] usb 10-1: USB disconnect, device number 31 [ 1554.994768][T23889] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1555.004306][T23889] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1555.014252][T23889] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1555.024057][T23889] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1555.046913][T23984] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1555.056884][T23984] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1555.071713][T13180] asix 9-1:7.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 1555.085176][T13180] asix 9-1:7.0: probe with driver asix failed with error -61 [ 1555.086875][T23889] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1555.109923][T23889] 8021q: adding VLAN 0 to HW filter on device team0 [ 1555.123057][ T6267] bridge0: port 1(bridge_slave_0) entered blocking state [ 1555.130159][ T6267] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1555.142112][ T6267] bridge0: port 2(bridge_slave_1) entered blocking state [ 1555.149232][ T6267] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1555.291782][T23889] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1555.322293][T23889] veth0_vlan: entered promiscuous mode [ 1555.331279][T23889] veth1_vlan: entered promiscuous mode [ 1555.353923][T23889] veth0_macvtap: entered promiscuous mode [ 1555.363176][T23889] veth1_macvtap: entered promiscuous mode [ 1555.375795][T23889] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1555.388268][T23889] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1555.402223][T23889] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1555.411902][T23889] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1555.421235][T23889] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1555.430001][T23889] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1555.508778][ T6267] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1555.524456][ T6267] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1555.545976][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1555.554854][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1555.748585][T24019] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=24019 comm=syz.2.4268 [ 1555.762973][ T10] usb 10-1: new full-speed USB device number 32 using dummy_hcd [ 1555.918858][ T10] usb 10-1: config 0 has an invalid interface number: 29 but max is 0 [ 1555.928291][ T10] usb 10-1: config 0 has no interface number 0 [ 1555.934446][ T10] usb 10-1: config 0 interface 29 has no altsetting 0 [ 1555.943857][ T10] usb 10-1: New USB device found, idVendor=0c72, idProduct=0014, bcdDevice=39.ac [ 1555.953346][ T10] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1555.961512][ T10] usb 10-1: Product: syz [ 1555.965788][ T10] usb 10-1: Manufacturer: syz [ 1555.970532][ T10] usb 10-1: SerialNumber: syz [ 1555.976697][ T10] usb 10-1: config 0 descriptor?? [ 1556.185825][ T10] peak_usb 10-1:0.29 can0: unable to request usb[type=0 value=1] err=-32 [ 1557.291703][ T10] peak_usb 10-1:0.29: unable to read PCAN-USB X6 firmware info (err -32) [ 1557.386074][T18897] usb 9-1: USB disconnect, device number 31 [ 1557.408736][ T10] peak_usb 10-1:0.29: probe with driver peak_usb failed with error -32 [ 1557.452177][ T10] usb 10-1: USB disconnect, device number 32 [ 1557.665888][ T30] audit: type=1400 audit(1752498029.201:6334): avc: denied { setattr } for pid=24022 comm="syz.2.4269" path="socket:[99488]" dev="sockfs" ino=99488 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1 [ 1558.144717][ T6267] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1558.540088][T24038] lo speed is unknown, defaulting to 1000 [ 1558.550568][T24038] virt_wifi0 speed is unknown, defaulting to 1000 [ 1559.678721][ T6267] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1559.830559][ T6267] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1559.914898][ T6267] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1560.013370][ T6267] bridge_slave_1: left allmulticast mode [ 1560.019133][ T6267] bridge_slave_1: left promiscuous mode [ 1560.024758][ T6267] bridge0: port 2(bridge_slave_1) entered disabled state [ 1560.033828][ T6267] bridge_slave_0: left allmulticast mode [ 1560.040305][ T6267] bridge_slave_0: left promiscuous mode [ 1560.045929][ T6267] bridge0: port 1(bridge_slave_0) entered disabled state [ 1560.370323][T24046] loop4: detected capacity change from 0 to 7 [ 1560.388657][T24053] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4277'. [ 1560.400397][T24046] Dev loop4: unable to read RDB block 7 [ 1560.406530][T24046] loop4: unable to read partition table [ 1560.455744][T24046] loop4: partition table beyond EOD, truncated [ 1560.489095][T24055] overlayfs: failed to resolve './file0': -2 [ 1560.759099][T24046] loop_reread_partitions: partition scan of loop4 (ţ被xü—źŃŕ– ) failed (rc=-5) [ 1561.158505][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1561.170753][ T5842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1561.179481][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1561.217640][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1561.238080][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1562.274214][ T6267] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1562.289814][ T6267] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1562.413287][ T6267] bond0 (unregistering): Released all slaves [ 1562.546756][T24081] netlink: 'syz.9.4280': attribute type 4 has an invalid length. [ 1562.554951][T24081] netlink: 17 bytes leftover after parsing attributes in process `syz.9.4280'. [ 1562.898946][T24064] lo speed is unknown, defaulting to 1000 [ 1562.905869][T24064] virt_wifi0 speed is unknown, defaulting to 1000 [ 1563.187690][T24087] fuse: Bad value for 'user_id' [ 1563.205671][T24087] fuse: Bad value for 'user_id' [ 1563.295260][T24088] mmap: syz.8.4283 (24088): VmData 37597184 exceed data ulimit 8. Update limits or use boot option ignore_rlimit_data. [ 1563.325631][T24092] lo speed is unknown, defaulting to 1000 [ 1563.332125][T24092] virt_wifi0 speed is unknown, defaulting to 1000 [ 1563.549831][T24064] chnl_net:caif_netlink_parms(): no params data found [ 1563.577308][T18662] Bluetooth: hci3: command tx timeout [ 1563.635551][T18897] usb 10-1: new high-speed USB device number 33 using dummy_hcd [ 1563.729045][ T6267] hsr_slave_0: left promiscuous mode [ 1563.737106][ T6267] hsr_slave_1: left promiscuous mode [ 1563.744609][ T6267] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1563.752171][ T6267] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1563.760245][ T6267] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1563.777639][ T6267] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1563.787376][T18897] usb 10-1: Using ep0 maxpacket: 8 [ 1563.806067][T18897] usb 10-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1563.837038][ T30] audit: type=1400 audit(1752498035.361:6335): avc: denied { map } for pid=24100 comm="syz.8.4286" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1563.909377][T18897] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1563.929715][T18897] usb 10-1: Product: syz [ 1563.937781][T18897] usb 10-1: Manufacturer: syz [ 1563.946758][T18897] usb 10-1: SerialNumber: syz [ 1563.955937][ T30] audit: type=1400 audit(1752498035.371:6336): avc: denied { execute } for pid=24100 comm="syz.8.4286" path="/dev/nullb0" dev="devtmpfs" ino=696 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 1563.960461][T18897] usb 10-1: config 0 descriptor?? [ 1564.170860][T18897] gspca_main: se401-2.14.0 probing 047d:5003 [ 1564.296519][ T6267] veth1_macvtap: left promiscuous mode [ 1564.310664][ T6267] veth0_macvtap: left promiscuous mode [ 1564.325931][ T6267] veth1_vlan: left promiscuous mode [ 1564.337338][ T6267] veth0_vlan: left promiscuous mode [ 1565.420589][T18897] gspca_se401: write req failed req 0x57 val 0x00 error -110 [ 1565.438280][T18897] se401 10-1:0.0: probe with driver se401 failed with error -110 [ 1565.657304][T18662] Bluetooth: hci3: command tx timeout [ 1566.244648][ T6267] team0 (unregistering): Port device team_slave_1 removed [ 1566.300545][ T6267] team0 (unregistering): Port device team_slave_0 removed [ 1567.238322][T24131] Falling back ldisc for ttyprintk. [ 1567.494701][ T10] usb 10-1: USB disconnect, device number 33 [ 1567.505761][T24140] tipc: Enabling of bearer rejected, failed to enable media [ 1567.692560][T24150] FAULT_INJECTION: forcing a failure. [ 1567.692560][T24150] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1567.706493][T24150] CPU: 0 UID: 0 PID: 24150 Comm: syz.6.4296 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 1567.706519][T24150] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1567.706530][T24150] Call Trace: [ 1567.706536][T24150] [ 1567.706543][T24150] dump_stack_lvl+0x16c/0x1f0 [ 1567.706574][T24150] should_fail_ex+0x512/0x640 [ 1567.706602][T24150] should_fail_alloc_page+0xe7/0x130 [ 1567.706631][T24150] prepare_alloc_pages+0x3c2/0x610 [ 1567.706650][T24150] ? rcu_is_watching+0x12/0xc0 [ 1567.706676][T24150] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 1567.706706][T24150] ? __schedule+0x1181/0x5de0 [ 1567.706741][T24150] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1567.706783][T24150] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1567.706807][T24150] ? policy_nodemask+0xea/0x4e0 [ 1567.706836][T24150] alloc_pages_mpol+0x1fb/0x550 [ 1567.706863][T24150] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1567.706896][T24150] folio_alloc_noprof+0x20/0x2d0 [ 1567.706915][T24150] filemap_alloc_folio_noprof+0x3a1/0x470 [ 1567.706939][T24150] ? __pfx_filemap_alloc_folio_noprof+0x10/0x10 [ 1567.706967][T24150] __filemap_get_folio+0x5e1/0xc30 [ 1567.706998][T24150] ioctx_alloc+0x761/0x2120 [ 1567.707036][T24150] ? __pfx_ioctx_alloc+0x10/0x10 [ 1567.707057][T24150] ? __might_fault+0x13b/0x190 [ 1567.707088][T24150] __x64_sys_io_setup+0xc9/0x210 [ 1567.707114][T24150] do_syscall_64+0xcd/0x4c0 [ 1567.707143][T24150] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1567.707161][T24150] RIP: 0033:0x7f6148f8e929 [ 1567.707179][T24150] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1567.707196][T24150] RSP: 002b:00007f6149d4f038 EFLAGS: 00000246 ORIG_RAX: 00000000000000ce [ 1567.707213][T24150] RAX: ffffffffffffffda RBX: 00007f61491b6080 RCX: 00007f6148f8e929 [ 1567.707224][T24150] RDX: 0000000000000000 RSI: 0000200000000500 RDI: 00000000000003ff [ 1567.707235][T24150] RBP: 00007f6149d4f090 R08: 0000000000000000 R09: 0000000000000000 [ 1567.707246][T24150] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1567.707257][T24150] R13: 0000000000000000 R14: 00007f61491b6080 R15: 00007fff975b26e8 [ 1567.707283][T24150] [ 1567.923904][ C0] vkms_vblank_simulate: vblank timer overrun [ 1567.995541][T18662] Bluetooth: hci3: command tx timeout [ 1568.596521][T24064] bridge0: port 1(bridge_slave_0) entered blocking state [ 1568.635715][T24064] bridge0: port 1(bridge_slave_0) entered disabled state [ 1568.643170][T24064] bridge_slave_0: entered allmulticast mode [ 1568.663172][T24064] bridge_slave_0: entered promiscuous mode [ 1568.683145][T24064] bridge0: port 2(bridge_slave_1) entered blocking state [ 1568.733799][T24064] bridge0: port 2(bridge_slave_1) entered disabled state [ 1568.779134][T24064] bridge_slave_1: entered allmulticast mode [ 1568.788081][T24064] bridge_slave_1: entered promiscuous mode [ 1568.931617][T24064] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1568.974910][T24064] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1569.089179][T24064] team0: Port device team_slave_0 added [ 1569.113201][T24064] team0: Port device team_slave_1 added [ 1569.192860][T24064] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1569.218219][T24064] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1569.247856][T18897] usb 9-1: new full-speed USB device number 32 using dummy_hcd [ 1569.296356][T24064] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1569.337693][T24064] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1569.363380][T24064] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1569.417401][T24064] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1569.430316][T18897] usb 9-1: no configurations [ 1569.434920][T18897] usb 9-1: can't read configurations, error -22 [ 1569.577580][T18897] usb 9-1: new full-speed USB device number 33 using dummy_hcd [ 1569.602851][ T30] audit: type=1400 audit(1752498041.142:6337): avc: denied { read } for pid=24175 comm="syz.9.4301" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1569.723608][T24064] hsr_slave_0: entered promiscuous mode [ 1569.746512][T24064] hsr_slave_1: entered promiscuous mode [ 1569.757764][T18897] usb 9-1: no configurations [ 1569.762533][T18897] usb 9-1: can't read configurations, error -22 [ 1569.779895][T18897] usb usb9-port1: attempt power cycle [ 1569.861498][T16443] usb 10-1: new high-speed USB device number 34 using dummy_hcd [ 1570.069727][T18662] Bluetooth: hci3: command tx timeout [ 1570.117528][T16443] usb 10-1: Using ep0 maxpacket: 8 [ 1570.117691][T18897] usb 9-1: new full-speed USB device number 34 using dummy_hcd [ 1570.124134][T16443] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 1570.148173][T16443] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1570.158389][T16443] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1570.170643][T16443] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1570.182571][T16443] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1570.196099][T16443] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1570.232937][T16443] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1570.241356][ T5982] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 1570.437968][ T5982] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1570.452887][ T5982] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1570.461388][T18897] usb 9-1: no configurations [ 1570.466142][ T5982] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1570.476399][T18897] usb 9-1: can't read configurations, error -22 [ 1570.480794][T16443] usb 10-1: usb_control_msg returned -32 [ 1570.490177][T16443] usbtmc 10-1:16.0: can't read capabilities [ 1570.498242][ T5982] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1570.513320][ T5982] usb 7-1: Product: syz [ 1570.517536][ T5982] usb 7-1: Manufacturer: syz [ 1570.522198][ T5982] usb 7-1: SerialNumber: syz [ 1570.607280][T18897] usb 9-1: new full-speed USB device number 35 using dummy_hcd [ 1570.638286][T18897] usb 9-1: no configurations [ 1570.643411][T18897] usb 9-1: can't read configurations, error -22 [ 1570.653306][T18897] usb usb9-port1: unable to enumerate USB device [ 1570.679273][T24064] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1570.688454][T24064] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1570.697492][T24064] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1570.706171][T24064] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1570.769529][T24064] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1570.786588][T24064] 8021q: adding VLAN 0 to HW filter on device team0 [ 1570.799158][T18006] bridge0: port 1(bridge_slave_0) entered blocking state [ 1570.806357][T18006] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1570.822330][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 1570.829473][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1570.896699][T24064] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1570.907569][T24064] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1571.125529][T24064] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1571.182680][T24064] veth0_vlan: entered promiscuous mode [ 1571.192869][T24064] veth1_vlan: entered promiscuous mode [ 1571.215491][T24064] veth0_macvtap: entered promiscuous mode [ 1571.557788][T24064] veth1_macvtap: entered promiscuous mode [ 1571.743850][T24064] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1571.759434][T24064] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1571.780995][T24064] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.814784][T24064] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.834995][T24064] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1571.930936][T24064] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1572.182344][ T5982] cdc_mbim 7-1:1.0: bind() failure [ 1572.204652][ T5982] cdc_ncm 7-1:1.1: CDC Union missing and no IAD found [ 1572.219838][T21387] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1572.290820][ T5982] cdc_ncm 7-1:1.1: bind() failure [ 1572.307264][T21387] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1572.375145][T21387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1572.388552][T21387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1572.598874][ T5982] usb 10-1: USB disconnect, device number 34 [ 1572.977526][T24228] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4312'. [ 1573.337666][T18897] usb 7-1: USB disconnect, device number 26 [ 1573.454071][T24235] lo speed is unknown, defaulting to 1000 [ 1573.471388][T24237] fuse: Unknown parameter 'grouplýd' [ 1573.487378][T24235] virt_wifi0 speed is unknown, defaulting to 1000 [ 1573.933776][T24242] IPv4: Oversized IP packet from 127.202.26.0 [ 1577.062097][T24264] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4320'. [ 1577.205486][T18006] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1577.290753][T24261] lo speed is unknown, defaulting to 1000 [ 1577.328112][T18006] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1577.365176][T24261] virt_wifi0 speed is unknown, defaulting to 1000 [ 1577.440812][T18006] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1577.515936][T18006] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1577.611914][T18006] bridge_slave_1: left allmulticast mode [ 1577.617729][T18006] bridge_slave_1: left promiscuous mode [ 1577.623461][T18006] bridge0: port 2(bridge_slave_1) entered disabled state [ 1577.635217][T18006] bridge_slave_0: left allmulticast mode [ 1577.647282][T18006] bridge_slave_0: left promiscuous mode [ 1577.652938][T18006] bridge0: port 1(bridge_slave_0) entered disabled state [ 1577.951517][T18006] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1577.961877][T18006] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1577.971221][T18006] bond0 (unregistering): Released all slaves [ 1578.211845][T18006] hsr_slave_0: left promiscuous mode [ 1578.218647][T18006] hsr_slave_1: left promiscuous mode [ 1578.224256][T18006] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1578.231768][T18006] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1578.239826][T18006] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1578.247717][T18006] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1578.262585][T18006] veth1_macvtap: left promiscuous mode [ 1578.268250][T18006] veth0_macvtap: left promiscuous mode [ 1578.273763][T18006] veth1_vlan: left promiscuous mode [ 1578.279039][T18006] veth0_vlan: left promiscuous mode [ 1578.592555][T18006] team0 (unregistering): Port device team_slave_1 removed [ 1578.670342][T18006] team0 (unregistering): Port device team_slave_0 removed [ 1579.332858][T24278] netlink: 92 bytes leftover after parsing attributes in process `syz.8.4322'. [ 1579.342244][T24278] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4322'. [ 1579.352204][T24278] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4322'. [ 1579.414514][T24278] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4322'. [ 1579.434739][T24278] binder: BINDER_SET_CONTEXT_MGR already set [ 1579.440905][T24278] binder: 24268:24278 ioctl 4018620d 200000000040 returned -16 [ 1579.454473][T24278] binder: 24268:24278 unknown command 0 [ 1579.460247][T24278] binder: 24268:24278 ioctl c0306201 200000000300 returned -22 [ 1579.999702][T24290] binder: 24288:24290 unknown command 0 [ 1580.005528][ T30] audit: type=1400 audit(1752498051.542:6338): avc: denied { append } for pid=24288 comm="syz.6.4327" name="binder0" dev="binder" ino=10 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=chr_file permissive=1 [ 1580.048619][T24290] binder: 24288:24290 ioctl c0306201 200000000080 returned -22 [ 1580.083723][T24290] SELinux: security_context_str_to_sid (unconfined_u) failed with errno=-22 [ 1580.117290][ T30] audit: type=1400 audit(1752498051.602:6339): avc: denied { create } for pid=24284 comm="syz.8.4326" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 1580.137016][ C0] vkms_vblank_simulate: vblank timer overrun [ 1580.217268][ T30] audit: type=1400 audit(1752498051.622:6340): avc: denied { ioctl } for pid=24288 comm="syz.6.4327" path="/dev/ptyr0" dev="devtmpfs" ino=135 ioctlcmd=0x540b scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:bsdpty_device_t tclass=chr_file permissive=1 [ 1580.242379][ C0] vkms_vblank_simulate: vblank timer overrun [ 1580.897636][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1580.917234][ T5842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1580.937070][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1580.992387][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1581.013864][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1582.538316][T24325] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.4334'. [ 1582.783707][T24297] lo speed is unknown, defaulting to 1000 [ 1582.838554][T24297] virt_wifi0 speed is unknown, defaulting to 1000 [ 1583.177554][T18662] Bluetooth: hci3: command tx timeout [ 1583.826965][T24344] netlink: 92 bytes leftover after parsing attributes in process `syz.6.4337'. [ 1583.837857][T24344] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4337'. [ 1583.846968][T24344] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4337'. [ 1583.892999][T24344] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4337'. [ 1583.994464][T24344] binder: 24338:24344 ioctl c0306201 200000000300 returned -22 [ 1584.494258][T24297] chnl_net:caif_netlink_parms(): no params data found [ 1585.203651][T24362] netlink: 92 bytes leftover after parsing attributes in process `syz.8.4341'. [ 1585.257367][T18662] Bluetooth: hci3: command tx timeout [ 1585.266988][T24362] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4341'. [ 1585.267067][T24362] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4341'. [ 1585.405992][T24297] bridge0: port 1(bridge_slave_0) entered blocking state [ 1585.476706][T24297] bridge0: port 1(bridge_slave_0) entered disabled state [ 1585.507826][T24297] bridge_slave_0: entered allmulticast mode [ 1585.518487][T24297] bridge_slave_0: entered promiscuous mode [ 1585.540742][T24297] bridge0: port 2(bridge_slave_1) entered blocking state [ 1585.549331][T24297] bridge0: port 2(bridge_slave_1) entered disabled state [ 1585.579803][T24297] bridge_slave_1: entered allmulticast mode [ 1585.909400][T24297] bridge_slave_1: entered promiscuous mode [ 1585.990558][T24297] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1586.126971][T24297] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1586.165112][T24297] team0: Port device team_slave_0 added [ 1586.277910][T24382] autofs: Bad value for 'fd' [ 1586.718114][T24297] team0: Port device team_slave_1 added [ 1586.979267][T24297] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1587.101421][T24390] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4349'. [ 1587.147680][T24390] binder: BINDER_SET_CONTEXT_MGR already set [ 1587.153698][T24390] binder: 24388:24390 ioctl 4018620d 200000000040 returned -16 [ 1587.173992][T24390] binder: 24388:24390 ioctl c0306201 200000000240 returned -11 [ 1587.189117][T24390] binder: 24388:24390 unknown command 0 [ 1587.194720][T24390] binder: 24388:24390 ioctl c0306201 200000000300 returned -22 [ 1587.318168][T24297] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1587.344218][T18662] Bluetooth: hci3: command tx timeout [ 1587.350048][T24297] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1587.366383][T24297] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1587.373523][T24297] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1587.867361][T24297] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1588.014570][T24297] hsr_slave_0: entered promiscuous mode [ 1588.042571][T24297] hsr_slave_1: entered promiscuous mode [ 1588.068031][T24391] lo speed is unknown, defaulting to 1000 [ 1588.172414][T24391] virt_wifi0 speed is unknown, defaulting to 1000 [ 1588.469592][T24399] netlink: 'syz.6.4350': attribute type 4 has an invalid length. [ 1588.477383][T24399] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4350'. [ 1588.749082][T24401] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4351'. [ 1588.808804][T24401] binder: BINDER_SET_CONTEXT_MGR already set [ 1588.814947][T24401] binder: 24397:24401 ioctl 4018620d 200000000040 returned -16 [ 1588.851897][T24401] binder: 24397:24401 unknown command 0 [ 1588.857846][T24401] binder: 24397:24401 ioctl c0306201 200000000300 returned -22 [ 1588.865461][T24403] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4352'. [ 1589.000636][T24403] netlink: 32 bytes leftover after parsing attributes in process `syz.2.4352'. [ 1589.032673][T24403] netlink: 28 bytes leftover after parsing attributes in process `syz.2.4352'. [ 1589.067912][T24403] bond1: entered promiscuous mode [ 1589.073443][T24403] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1589.336564][T24420] netlink: 92 bytes leftover after parsing attributes in process `syz.6.4356'. [ 1589.427469][T24416] kvm: MWAIT instruction emulated as NOP! [ 1589.427855][T18662] Bluetooth: hci3: command tx timeout [ 1589.675775][T24422] syz.9.4358 (24422): drop_caches: 2 [ 1589.687291][T24422] syz.9.4358 (24422): drop_caches: 2 [ 1590.328870][T24438] __nla_validate_parse: 2 callbacks suppressed [ 1590.328895][T24438] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4360'. [ 1590.444182][T24297] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1590.459102][T24297] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1590.467847][T24438] binder: 24431:24438 ioctl c0306201 200000000240 returned -11 [ 1590.476409][T24438] binder: 24431:24438 ioctl c0306201 200000000300 returned -22 [ 1590.690856][T24297] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1590.743504][T24297] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1590.830527][T24453] mac80211_hwsim hwsim32 wlan0: entered promiscuous mode [ 1590.899911][T24297] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1590.935030][T24297] 8021q: adding VLAN 0 to HW filter on device team0 [ 1590.953294][T21387] bridge0: port 1(bridge_slave_0) entered blocking state [ 1590.960392][T21387] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1591.071595][T21387] bridge0: port 2(bridge_slave_1) entered blocking state [ 1591.078675][T21387] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1591.109557][T24297] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1591.597480][T24297] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1593.589123][T24297] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1593.615021][T24297] veth0_vlan: entered promiscuous mode [ 1593.623562][T24297] veth1_vlan: entered promiscuous mode [ 1593.644378][T24297] veth0_macvtap: entered promiscuous mode [ 1593.656848][T24297] veth1_macvtap: entered promiscuous mode [ 1593.729034][T24297] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1593.740733][T24297] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1593.750909][T24297] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.760317][T24297] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.769407][T24297] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.778262][T24297] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1593.850223][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1593.860413][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1593.896994][ T3584] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1593.923307][ T3584] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1594.887324][ T976] usb 10-1: new high-speed USB device number 35 using dummy_hcd [ 1594.997733][T24481] netlink: 92 bytes leftover after parsing attributes in process `syz.8.4371'. [ 1595.011965][T24481] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4371'. [ 1595.032162][T24481] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4371'. [ 1595.057893][ T976] usb 10-1: Using ep0 maxpacket: 16 [ 1595.107709][ T976] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1595.179074][ T976] usb 10-1: config 13 has an invalid interface number: 96 but max is 0 [ 1595.193310][ T976] usb 10-1: config 13 has no interface number 0 [ 1595.202377][ T976] usb 10-1: config 13 interface 96 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 1595.216583][ T976] usb 10-1: config 13 interface 96 has no altsetting 0 [ 1595.290020][ T976] usb 10-1: New USB device found, idVendor=22b8, idProduct=2c84, bcdDevice=2f.28 [ 1595.319229][ T976] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.354541][ T976] usb 10-1: Product: syz [ 1595.358918][ T976] usb 10-1: Manufacturer: syz [ 1595.378097][ T976] usb 10-1: SerialNumber: syz [ 1595.392779][T24478] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1595.520026][T24487] syz.8.4372 (24487): drop_caches: 2 [ 1595.531660][T24487] syz.8.4372 (24487): drop_caches: 2 [ 1596.345677][T24478] netlink: 'syz.9.4370': attribute type 10 has an invalid length. [ 1596.437772][T24478] team0: Device ipvlan1 failed to register rx_handler [ 1596.523313][ T976] usb_serial_simple 10-1:13.96: moto_modem converter detected [ 1596.549097][ T976] usb 10-1: moto_modem converter now attached to ttyUSB0 [ 1596.550641][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1596.576624][ T976] usb 10-1: USB disconnect, device number 35 [ 1596.600271][ T976] moto_modem ttyUSB0: moto_modem converter now disconnected from ttyUSB0 [ 1596.611450][ T976] usb_serial_simple 10-1:13.96: device disconnected [ 1597.403381][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1597.457861][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1597.524303][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1597.611496][ T13] bridge_slave_1: left allmulticast mode [ 1597.617131][ T13] bridge_slave_1: left promiscuous mode [ 1597.622868][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1597.633530][ T13] bridge_slave_0: left allmulticast mode [ 1597.639501][ T13] bridge_slave_0: left promiscuous mode [ 1597.645117][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1597.904741][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1597.915832][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1597.925360][ T13] bond0 (unregistering): Released all slaves [ 1598.149742][ T13] hsr_slave_0: left promiscuous mode [ 1598.155368][ T13] hsr_slave_1: left promiscuous mode [ 1598.160963][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1598.171116][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1598.229367][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1598.236759][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1598.617065][ T13] veth1_macvtap: left promiscuous mode [ 1598.684705][ T13] veth0_macvtap: left promiscuous mode [ 1598.693125][ T13] veth1_vlan: left promiscuous mode [ 1598.702710][ T13] veth0_vlan: left promiscuous mode [ 1598.952009][T24509] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4377'. [ 1599.226058][T24513] netlink: 212408 bytes leftover after parsing attributes in process `syz.2.4379'. [ 1599.272921][T24513] netlink: zone id is out of range [ 1599.297209][T24513] netlink: zone id is out of range [ 1599.318031][T24513] netlink: zone id is out of range [ 1599.344365][T24513] netlink: zone id is out of range [ 1599.356918][T24513] netlink: zone id is out of range [ 1599.368127][T24513] netlink: zone id is out of range [ 1599.374736][T24513] netlink: get zone limit has 8 unknown bytes [ 1599.680471][ T5842] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1599.704255][ T5842] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1599.877981][T24532] netlink: 'syz.6.4380': attribute type 4 has an invalid length. [ 1600.142130][T24532] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4380'. [ 1600.161845][ T5842] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1600.170871][ T5842] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1600.178401][ T5842] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1600.624631][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1601.170592][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1601.574676][T24529] lo speed is unknown, defaulting to 1000 [ 1601.912331][T24529] virt_wifi0 speed is unknown, defaulting to 1000 [ 1601.924550][T24541] netlink: 4 bytes leftover after parsing attributes in process `syz.9.4383'. [ 1602.329991][ T5842] Bluetooth: hci3: command tx timeout [ 1602.836390][T24562] syz.6.4387 (24562): drop_caches: 2 [ 1602.849911][T24562] syz.6.4387 (24562): drop_caches: 2 [ 1603.754740][T24529] chnl_net:caif_netlink_parms(): no params data found [ 1603.885140][T24529] bridge0: port 1(bridge_slave_0) entered blocking state [ 1603.892907][T24529] bridge0: port 1(bridge_slave_0) entered disabled state [ 1603.902948][T24529] bridge_slave_0: entered allmulticast mode [ 1603.911429][T24529] bridge_slave_0: entered promiscuous mode [ 1603.921806][T24529] bridge0: port 2(bridge_slave_1) entered blocking state [ 1603.929584][T24529] bridge0: port 2(bridge_slave_1) entered disabled state [ 1603.936703][T24529] bridge_slave_1: entered allmulticast mode [ 1603.946794][T24529] bridge_slave_1: entered promiscuous mode [ 1603.992446][T24529] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1604.004155][T24529] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1604.007416][T18897] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 1604.036869][T24529] team0: Port device team_slave_0 added [ 1604.037360][ T5904] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 1604.052910][T24529] team0: Port device team_slave_1 added [ 1604.128277][T24579] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1604.379540][ T5842] Bluetooth: hci3: command tx timeout [ 1604.538369][T24529] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1604.545337][T24529] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1604.571552][T24529] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1604.584571][T24529] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1604.591630][T18897] usb 9-1: Using ep0 maxpacket: 16 [ 1604.596830][ T5904] usb 7-1: Using ep0 maxpacket: 32 [ 1604.602030][T24529] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1604.630757][T18897] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1604.640572][ T5904] usb 7-1: config 0 has an invalid interface number: 67 but max is 0 [ 1604.649621][T18897] usb 9-1: config 13 has an invalid interface number: 96 but max is 0 [ 1604.657954][T18897] usb 9-1: config 13 has no interface number 0 [ 1604.664244][ T5904] usb 7-1: config 0 has no interface number 0 [ 1604.674520][T24529] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1604.687351][T18897] usb 9-1: config 13 interface 96 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 1605.117964][T24529] hsr_slave_0: entered promiscuous mode [ 1605.199968][T18897] usb 9-1: config 13 interface 96 has no altsetting 0 [ 1605.211661][ T5904] usb 7-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1605.226628][ T5904] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1605.235245][ T5904] usb 7-1: Product: syz [ 1605.239729][ T5904] usb 7-1: Manufacturer: syz [ 1605.244645][ T5904] usb 7-1: SerialNumber: syz [ 1605.250150][T18897] usb 9-1: New USB device found, idVendor=22b8, idProduct=2c84, bcdDevice=2f.28 [ 1605.261817][ T5904] usb 7-1: config 0 descriptor?? [ 1605.266812][T18897] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1605.275193][T18897] usb 9-1: Product: syz [ 1605.281099][ T5904] smsc95xx v2.0.0 [ 1605.284922][T18897] usb 9-1: Manufacturer: syz [ 1605.289943][T18897] usb 9-1: SerialNumber: syz [ 1605.297979][T24566] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1605.323554][T24529] hsr_slave_1: entered promiscuous mode [ 1606.098055][T24566] netlink: 'syz.8.4388': attribute type 10 has an invalid length. [ 1606.141511][T24592] xt_CT: No such helper "snmp" [ 1606.154192][T24566] team0: Device ipvlan1 failed to register rx_handler [ 1606.398709][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1606.467827][ T5842] Bluetooth: hci3: command tx timeout [ 1606.476804][T18897] usb_serial_simple 9-1:13.96: moto_modem converter detected [ 1606.510165][T18897] usb 9-1: moto_modem converter now attached to ttyUSB0 [ 1606.567934][T18897] usb 9-1: USB disconnect, device number 36 [ 1606.581745][T18897] moto_modem ttyUSB0: moto_modem converter now disconnected from ttyUSB0 [ 1606.628874][T18897] usb_serial_simple 9-1:13.96: device disconnected [ 1606.705864][ T5904] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1606.717062][ T5904] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1606.841193][T24529] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1606.853808][T24529] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1606.866111][T24529] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1606.881858][T24529] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1607.096340][T24529] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1607.145383][T24529] 8021q: adding VLAN 0 to HW filter on device team0 [ 1607.153268][T24609] netlink: 'syz.2.4396': attribute type 4 has an invalid length. [ 1607.162931][T24570] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1607.171919][T24570] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1607.179956][T24609] netlink: 17 bytes leftover after parsing attributes in process `syz.2.4396'. [ 1607.199107][ T5904] smsc95xx 7-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1607.210304][ T5904] smsc95xx 7-1:0.67: probe with driver smsc95xx failed with error -71 [ 1607.221784][ T5904] usb 7-1: USB disconnect, device number 27 [ 1607.270065][T24529] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1607.281896][T24529] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1607.349574][ T1333] bridge0: port 1(bridge_slave_0) entered blocking state [ 1607.356662][ T1333] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1607.397359][T18897] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 1607.420694][ T1333] bridge0: port 2(bridge_slave_1) entered blocking state [ 1607.427831][ T1333] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1607.547227][T18897] usb 9-1: Using ep0 maxpacket: 32 [ 1607.553647][T18897] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1607.565137][T18897] usb 9-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1607.627266][T18897] usb 9-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 1607.636323][T18897] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1607.690228][T18897] usb 9-1: config 0 descriptor?? [ 1607.700247][T24529] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1607.838813][T24529] veth0_vlan: entered promiscuous mode [ 1607.997775][T24628] syz.6.4400 (24628): drop_caches: 2 [ 1608.005275][T24628] syz.6.4400 (24628): drop_caches: 2 [ 1608.085925][T24629] netlink: 'syz.9.4401': attribute type 4 has an invalid length. [ 1608.093738][T24629] netlink: 17 bytes leftover after parsing attributes in process `syz.9.4401'. [ 1608.169680][ T5982] usb 9-1: USB disconnect, device number 37 [ 1608.554499][ T5842] Bluetooth: hci3: command tx timeout [ 1608.600432][T24611] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1608.755309][T24611] afs: Unknown parameter 'dy˙˙' [ 1608.770972][T24529] veth1_vlan: entered promiscuous mode [ 1608.825069][T24529] veth0_macvtap: entered promiscuous mode [ 1608.841101][T24529] veth1_macvtap: entered promiscuous mode [ 1609.888956][T24529] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1609.901112][T24529] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1609.919335][T24529] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1609.929267][T24529] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1609.938294][T24529] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1609.947058][T24529] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1610.015597][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1610.024638][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1610.083655][ T1333] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1610.109501][T24634] lo speed is unknown, defaulting to 1000 [ 1610.115883][T24634] virt_wifi0 speed is unknown, defaulting to 1000 [ 1610.152525][ T1333] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1613.031528][ T30] audit: type=1400 audit(1752498084.572:6341): avc: denied { map } for pid=24667 comm="syz.8.4411" path="/dev/usbmon0" dev="devtmpfs" ino=716 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 1613.226550][ T49] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1613.350114][ T49] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1613.449622][ T49] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1613.545826][ T49] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1613.621868][ T49] bridge_slave_1: left allmulticast mode [ 1613.627768][ T49] bridge_slave_1: left promiscuous mode [ 1613.633420][ T49] bridge0: port 2(bridge_slave_1) entered disabled state [ 1613.642743][ T49] bridge_slave_0: left allmulticast mode [ 1613.648760][ T49] bridge_slave_0: left promiscuous mode [ 1613.654388][ T49] bridge0: port 1(bridge_slave_0) entered disabled state [ 1613.940781][ T49] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1613.950821][ T49] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1613.960491][ T49] bond0 (unregistering): Released all slaves [ 1614.162230][ T49] hsr_slave_0: left promiscuous mode [ 1614.168670][ T49] hsr_slave_1: left promiscuous mode [ 1614.174343][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1614.181796][ T49] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1614.189588][ T49] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1614.196967][ T49] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1614.214927][ T49] veth1_macvtap: left promiscuous mode [ 1614.220707][ T49] veth0_macvtap: left promiscuous mode [ 1614.226234][ T49] veth1_vlan: left promiscuous mode [ 1614.231503][ T49] veth0_vlan: left promiscuous mode [ 1614.551055][ T49] team0 (unregistering): Port device team_slave_1 removed [ 1614.592261][ T49] team0 (unregistering): Port device team_slave_0 removed [ 1615.213980][ T30] audit: type=1400 audit(1752498086.752:6342): avc: denied { module_load } for pid=24674 comm="syz.8.4414" path="/sys/kernel/oops_count" dev="sysfs" ino=57569 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sysfs_t tclass=system permissive=1 [ 1615.278739][T24676] pim6reg1: entered allmulticast mode [ 1616.474807][T24682] netlink: 'syz.6.4413': attribute type 4 has an invalid length. [ 1616.482696][T24682] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4413'. [ 1617.769054][T18662] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1617.821839][T24695] netlink: 'syz.2.4416': attribute type 4 has an invalid length. [ 1617.829692][T24695] netlink: 17 bytes leftover after parsing attributes in process `syz.2.4416'. [ 1617.904810][T18662] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1617.913753][T18662] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1617.926716][T18662] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1617.936770][T18662] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1618.160956][T24687] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4417'. [ 1618.209789][T24687] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=24687 comm=syz.6.4417 [ 1618.250771][T24691] lo speed is unknown, defaulting to 1000 [ 1618.258093][T24691] virt_wifi0 speed is unknown, defaulting to 1000 [ 1618.988035][T24710] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4423'. [ 1619.093739][T24719] lo speed is unknown, defaulting to 1000 [ 1619.101083][T24719] virt_wifi0 speed is unknown, defaulting to 1000 [ 1619.261539][T24722] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4425'. [ 1620.582427][T18662] Bluetooth: hci3: command tx timeout [ 1620.598330][T24691] chnl_net:caif_netlink_parms(): no params data found [ 1620.857635][ T30] audit: type=1400 audit(1752498092.292:6343): avc: denied { connect } for pid=24725 comm="syz.6.4426" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1621.212582][T24741] netlink: 'syz.2.4428': attribute type 4 has an invalid length. [ 1621.220465][T24741] netlink: 17 bytes leftover after parsing attributes in process `syz.2.4428'. [ 1621.622616][T24691] bridge0: port 1(bridge_slave_0) entered blocking state [ 1621.631070][T24691] bridge0: port 1(bridge_slave_0) entered disabled state [ 1621.650061][T24691] bridge_slave_0: entered allmulticast mode [ 1621.666732][T24691] bridge_slave_0: entered promiscuous mode [ 1621.689943][T24691] bridge0: port 2(bridge_slave_1) entered blocking state [ 1621.697169][T24691] bridge0: port 2(bridge_slave_1) entered disabled state [ 1621.704342][T24691] bridge_slave_1: entered allmulticast mode [ 1621.765989][T24691] bridge_slave_1: entered promiscuous mode [ 1621.838392][T24750] netlink: 'syz.9.4429': attribute type 3 has an invalid length. [ 1621.857179][T24750] netlink: 20 bytes leftover after parsing attributes in process `syz.9.4429'. [ 1621.878729][T24691] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1621.915958][T24691] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1621.942581][T24754] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4432'. [ 1622.093811][T24756] bridge0: port 2(bridge_slave_1) entered disabled state [ 1622.101107][T24756] bridge0: port 1(bridge_slave_0) entered disabled state [ 1622.108480][T24756] bridge0: entered allmulticast mode [ 1622.116862][T24756] bridge_slave_1: left allmulticast mode [ 1622.122508][T24756] bridge_slave_1: left promiscuous mode [ 1622.128140][T24756] bridge0: port 2(bridge_slave_1) entered disabled state [ 1622.141900][T24756] bridge_slave_0: left allmulticast mode [ 1622.147717][T24756] bridge_slave_0: left promiscuous mode [ 1622.153326][T24756] bridge0: port 1(bridge_slave_0) entered disabled state [ 1622.248279][T24691] team0: Port device team_slave_0 added [ 1622.366263][T24691] team0: Port device team_slave_1 added [ 1622.463603][T24691] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1622.472225][T24691] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1622.648979][T24767] netlink: 'syz.9.4434': attribute type 4 has an invalid length. [ 1622.656740][T24767] netlink: 17 bytes leftover after parsing attributes in process `syz.9.4434'. [ 1623.497345][T24691] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1623.623951][ T5831] Bluetooth: hci3: command tx timeout [ 1623.810605][T24691] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1623.819879][T24691] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1623.958935][T24691] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1624.041578][T24691] hsr_slave_0: entered promiscuous mode [ 1624.049247][T24691] hsr_slave_1: entered promiscuous mode [ 1624.248270][T24779] lo speed is unknown, defaulting to 1000 [ 1624.257229][ T10] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1624.268810][T24779] virt_wifi0 speed is unknown, defaulting to 1000 [ 1624.703080][ T10] usb 7-1: Using ep0 maxpacket: 16 [ 1625.770797][ T10] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1625.868315][ T10] usb 7-1: config 13 has an invalid interface number: 96 but max is 0 [ 1625.878350][T24784] netlink: 36 bytes leftover after parsing attributes in process `syz.2.4439'. [ 1625.899805][ T10] usb 7-1: config 13 has no interface number 0 [ 1625.902260][ T5831] Bluetooth: hci3: command tx timeout [ 1625.906006][ T10] usb 7-1: config 13 interface 96 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 1625.906038][ T10] usb 7-1: config 13 interface 96 has no altsetting 0 [ 1625.941035][ T10] usb 7-1: New USB device found, idVendor=22b8, idProduct=2c84, bcdDevice=2f.28 [ 1625.977416][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1625.985470][ T10] usb 7-1: Product: syz [ 1625.999270][ T10] usb 7-1: Manufacturer: syz [ 1626.010150][T24786] lo speed is unknown, defaulting to 1000 [ 1626.016482][T24786] virt_wifi0 speed is unknown, defaulting to 1000 [ 1626.043041][ T10] usb 7-1: SerialNumber: syz [ 1626.080625][T24775] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1627.845366][T24798] netlink: 'syz.8.4441': attribute type 4 has an invalid length. [ 1627.853188][T24798] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4441'. [ 1628.038653][ T5831] Bluetooth: hci3: command tx timeout [ 1628.292774][ T10] usb_serial_simple 7-1:13.96: moto_modem converter detected [ 1628.309492][ T10] usb 7-1: moto_modem converter now attached to ttyUSB0 [ 1628.334010][ T10] usb 7-1: USB disconnect, device number 28 [ 1628.368929][ T10] moto_modem ttyUSB0: moto_modem converter now disconnected from ttyUSB0 [ 1628.502863][T24812] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4445'. [ 1628.513934][ T10] usb_serial_simple 7-1:13.96: device disconnected [ 1628.552742][T24814] SELinux: policydb magic number 0x0 does not match expected magic number 0xf97cff8c [ 1628.562827][T24814] SELinux: failed to load policy [ 1628.677751][T24816] random: crng reseeded on system resumption [ 1628.683649][T24691] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1628.694080][T24691] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1628.705604][T24691] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1628.720372][T24691] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1628.857259][ T5904] usb 10-1: new high-speed USB device number 36 using dummy_hcd [ 1628.930019][T24691] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1628.945332][T24691] 8021q: adding VLAN 0 to HW filter on device team0 [ 1629.011969][T24828] netlink: 'syz.8.4448': attribute type 4 has an invalid length. [ 1629.019835][T24828] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4448'. [ 1629.386205][T24691] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1629.396582][T24691] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1629.425083][ T5904] usb 10-1: device descriptor read/64, error -71 [ 1629.434961][ T969] bridge0: port 1(bridge_slave_0) entered blocking state [ 1629.442094][ T969] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1629.460159][ T969] bridge0: port 2(bridge_slave_1) entered blocking state [ 1629.467250][ T969] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1629.679109][T24835] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4450'. [ 1629.699910][T24835] binder: BINDER_SET_CONTEXT_MGR already set [ 1629.705961][T24835] binder: 24833:24835 ioctl 4018620d 200000000040 returned -16 [ 1629.721408][T24835] binder: 24833:24835 unknown command 0 [ 1629.727246][T24835] binder: 24833:24835 ioctl c0306201 200000000300 returned -22 [ 1629.940694][ T5904] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 1630.124466][T24844] lo speed is unknown, defaulting to 1000 [ 1630.131055][T24844] virt_wifi0 speed is unknown, defaulting to 1000 [ 1630.157607][ T5904] usb 10-1: device descriptor read/64, error -71 [ 1630.268098][ T5904] usb usb10-port1: attempt power cycle [ 1630.310109][T24691] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1630.355626][T24691] veth0_vlan: entered promiscuous mode [ 1630.489015][T24850] 9p: Unknown Cache mode or invalid value fsca#he [ 1630.531756][T24691] veth1_vlan: entered promiscuous mode [ 1630.609319][ T5904] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 1630.680338][ T5904] usb 10-1: device descriptor read/8, error -71 [ 1630.710699][T24691] veth0_macvtap: entered promiscuous mode [ 1630.754283][T24691] veth1_macvtap: entered promiscuous mode [ 1630.876245][T24865] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4459'. [ 1630.912249][T24868] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 1630.965865][T24691] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1631.040596][T24872] netlink: 'syz.8.4457': attribute type 4 has an invalid length. [ 1631.048434][T24872] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4457'. [ 1631.058537][ T5904] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 1631.196264][ T5904] usb 10-1: device descriptor read/8, error -71 [ 1631.325098][T24691] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1631.385941][T24691] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.410368][ T5904] usb usb10-port1: unable to enumerate USB device [ 1631.417951][T24691] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.426729][T24691] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.435513][T24691] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1631.537790][ T3584] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1631.545606][ T3584] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1631.828274][T24883] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4461'. [ 1632.098707][T21387] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1632.120268][T24881] netlink: 36 bytes leftover after parsing attributes in process `syz.9.4463'. [ 1632.130809][T24881] binder: BINDER_SET_CONTEXT_MGR already set [ 1632.136771][T24881] binder: 24880:24881 ioctl 4018620d 200000000040 returned -16 [ 1632.144972][T24881] binder: 24880:24881 unknown command 0 [ 1632.150607][T24881] binder: 24880:24881 ioctl c0306201 200000000300 returned -22 [ 1632.193419][T21387] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1632.539225][T16443] usb 10-1: new high-speed USB device number 40 using dummy_hcd [ 1632.717584][T16443] usb 10-1: Using ep0 maxpacket: 16 [ 1632.729574][T16443] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 1632.746706][T16443] usb 10-1: config 0 has no interface number 0 [ 1632.762097][T16443] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1632.933184][T16443] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1633.088960][T16443] usb 10-1: New USB device found, idVendor=28bd, idProduct=0071, bcdDevice= 0.00 [ 1633.106833][T16443] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1633.133893][T16443] usb 10-1: config 0 descriptor?? [ 1633.766021][T24919] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1634.721281][T24896] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1634.844822][T16443] input: HID 28bd:0071 as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.1/0003:28BD:0071.0031/input/input93 [ 1634.953128][T24929] netlink: 'syz.6.4474': attribute type 4 has an invalid length. [ 1634.981227][T24929] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4474'. [ 1635.073409][T16443] input: HID 28bd:0071 as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.1/0003:28BD:0071.0031/input/input94 [ 1635.101076][T16443] uclogic 0003:28BD:0071.0031: input,hidraw0: USB HID v0.02 Keypad [HID 28bd:0071] on usb-dummy_hcd.9-1/input1 [ 1635.131919][T16443] usb 10-1: USB disconnect, device number 40 [ 1635.251265][T24934] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4476'. [ 1635.276505][T24934] binder: BINDER_SET_CONTEXT_MGR already set [ 1635.282644][T24934] binder: 24932:24934 ioctl 4018620d 200000000040 returned -16 [ 1635.299722][T24934] binder: 24932:24934 unknown command 0 [ 1635.305470][T24934] binder: 24932:24934 ioctl c0306201 200000000300 returned -22 [ 1635.623067][ T13] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1635.825718][T24937] lo speed is unknown, defaulting to 1000 [ 1635.978841][ T13] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1636.050633][T24937] virt_wifi0 speed is unknown, defaulting to 1000 [ 1636.146463][ T13] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1636.250054][ T13] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1636.373785][ T13] bridge_slave_1: left allmulticast mode [ 1636.379672][ T13] bridge_slave_1: left promiscuous mode [ 1636.385401][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 1636.393773][ T13] bridge_slave_0: left allmulticast mode [ 1636.399539][ T13] bridge_slave_0: left promiscuous mode [ 1636.405177][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 1636.664133][ T13] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1636.674445][ T13] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1636.684708][ T13] bond0 (unregistering): Released all slaves [ 1636.880992][ T13] hsr_slave_0: left promiscuous mode [ 1636.886652][ T13] hsr_slave_1: left promiscuous mode [ 1636.892640][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1636.900295][ T13] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1636.908398][ T13] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1636.915773][ T13] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1636.930605][ T13] veth1_macvtap: left promiscuous mode [ 1636.936076][ T13] veth0_macvtap: left promiscuous mode [ 1636.943847][ T13] veth1_vlan: left promiscuous mode [ 1636.949187][ T13] veth0_vlan: left promiscuous mode [ 1637.266460][ T13] team0 (unregistering): Port device team_slave_1 removed [ 1637.303343][ T13] team0 (unregistering): Port device team_slave_0 removed [ 1637.956553][T24946] tmpfs: Bad value for 'mpol' [ 1638.169361][T24952] netlink: 'syz.6.4478': attribute type 4 has an invalid length. [ 1638.177203][T24952] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4478'. [ 1638.607313][T18897] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 1638.695551][ T5831] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1638.709410][ T5831] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1638.720085][ T5831] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1638.727981][ T5831] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1638.735294][ T5831] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1638.803164][T24956] lo speed is unknown, defaulting to 1000 [ 1638.853954][T18897] usb 9-1: Using ep0 maxpacket: 32 [ 1638.869233][T18897] usb 9-1: config 0 has an invalid interface number: 51 but max is 0 [ 1638.873215][T24956] virt_wifi0 speed is unknown, defaulting to 1000 [ 1638.877489][T18897] usb 9-1: config 0 has no interface number 0 [ 1638.902242][T18897] usb 9-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1638.912187][T18897] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1638.920277][T18897] usb 9-1: Product: syz [ 1638.924499][T18897] usb 9-1: Manufacturer: syz [ 1638.929153][T18897] usb 9-1: SerialNumber: syz [ 1638.950141][T18897] usb 9-1: config 0 descriptor?? [ 1638.963009][T18897] quatech2 9-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1639.164309][T18897] usb 9-1: qt2_attach - failed to power on unit: -71 [ 1639.178147][T18897] quatech2 9-1:0.51: probe with driver quatech2 failed with error -71 [ 1639.239592][T18897] usb 9-1: USB disconnect, device number 38 [ 1639.653933][T24956] chnl_net:caif_netlink_parms(): no params data found [ 1639.771099][T24976] netlink: 36 bytes leftover after parsing attributes in process `syz.6.4487'. [ 1639.835905][T24976] binder: BINDER_SET_CONTEXT_MGR already set [ 1639.842123][T24976] binder: 24973:24976 ioctl 4018620d 200000000040 returned -16 [ 1639.866687][T24976] binder: 24973:24976 unknown command 0 [ 1639.872485][T24976] binder: 24973:24976 ioctl c0306201 200000000300 returned -22 [ 1640.282913][T24988] netlink: 'syz.8.4488': attribute type 4 has an invalid length. [ 1640.287482][T24956] bridge0: port 1(bridge_slave_0) entered blocking state [ 1640.297916][T24988] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4488'. [ 1640.415326][T24956] bridge0: port 1(bridge_slave_0) entered disabled state [ 1640.447804][T24956] bridge_slave_0: entered allmulticast mode [ 1640.455063][T24956] bridge_slave_0: entered promiscuous mode [ 1640.476298][T24956] bridge0: port 2(bridge_slave_1) entered blocking state [ 1640.494239][T24956] bridge0: port 2(bridge_slave_1) entered disabled state [ 1640.509201][T24956] bridge_slave_1: entered allmulticast mode [ 1640.669192][T24956] bridge_slave_1: entered promiscuous mode [ 1640.709071][T24956] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1640.738813][T24956] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1640.779159][T24997] netlink: 'syz.9.4493': attribute type 4 has an invalid length. [ 1640.787106][T24997] netlink: 17 bytes leftover after parsing attributes in process `syz.9.4493'. [ 1640.796616][T13180] usb 7-1: new high-speed USB device number 29 using dummy_hcd [ 1640.805496][ T5831] Bluetooth: hci3: command tx timeout [ 1641.002844][T13180] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1641.139400][T13180] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8E has invalid maxpacket 0 [ 1641.168056][T13180] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1641.172439][T24956] team0: Port device team_slave_0 added [ 1641.191137][T24956] team0: Port device team_slave_1 added [ 1641.198845][T13180] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0xA has invalid maxpacket 0 [ 1641.225737][T24956] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1641.227386][T13180] usb 7-1: New USB device found, idVendor=05ab, idProduct=0301, bcdDevice= 1.00 [ 1641.234051][T24956] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1641.261224][T13180] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1641.269940][T24956] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1641.290839][T24956] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1641.291231][T13180] usb 7-1: Product: syz [ 1641.297927][T24956] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1641.297968][T24956] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1641.369743][T13180] usb 7-1: Manufacturer: syz [ 1641.374409][T13180] usb 7-1: SerialNumber: syz [ 1641.374921][T24956] hsr_slave_0: entered promiscuous mode [ 1641.381066][T13180] usb 7-1: config 0 descriptor?? [ 1641.392288][T13180] ums-isd200 7-1:0.0: USB Mass Storage device detected [ 1641.395622][T24956] hsr_slave_1: entered promiscuous mode [ 1641.618760][T13180] scsi host1: usb-storage 7-1:0.0 [ 1641.634167][T13180] usb 7-1: USB disconnect, device number 29 [ 1641.745146][T25013] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4498'. [ 1641.810359][T25017] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=19 sclass=netlink_tcpdiag_socket pid=25017 comm=syz.2.4497 [ 1642.080938][T25020] xt_connbytes: Forcing CT accounting to be enabled [ 1642.097243][T18982] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 1642.105085][T25020] set match dimension is over the limit! [ 1642.112596][T24956] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1642.123339][T24956] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1642.133246][T24956] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 1642.146085][T24956] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 1642.257245][T18982] usb 9-1: Using ep0 maxpacket: 16 [ 1642.259682][T24956] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1642.267429][T18982] usb 9-1: config 0 has 1 interface, different from the descriptor's value: 8 [ 1642.280742][T18982] usb 9-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 4.00 [ 1642.282846][T24956] 8021q: adding VLAN 0 to HW filter on device team0 [ 1642.310613][T17450] bridge0: port 1(bridge_slave_0) entered blocking state [ 1642.317763][T17450] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1642.348650][T17450] bridge0: port 2(bridge_slave_1) entered blocking state [ 1642.355767][T17450] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1642.406305][T24956] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1642.434760][T24956] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1642.482336][T18982] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1642.519689][T18982] usb 9-1: Product: syz [ 1642.525053][T18982] usb 9-1: Manufacturer: syz [ 1642.537195][T18982] usb 9-1: SerialNumber: syz [ 1642.557388][T18982] usb 9-1: config 0 descriptor?? [ 1642.571810][T18982] ftdi_sio 9-1:0.0: FTDI USB Serial Device converter detected [ 1642.598021][T18982] usb 9-1: Detected FT232B [ 1642.740876][T25038] 9pnet_fd: Insufficient options for proto=fd [ 1642.758882][T25038] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1642.767793][ T10] usb 7-1: new high-speed USB device number 30 using dummy_hcd [ 1642.774599][T24956] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1642.778451][T18982] ftdi_sio ttyUSB0: Unable to read latency timer: -71 [ 1642.794494][T18982] ftdi_sio ttyUSB0: Unable to write latency timer: -71 [ 1642.846513][T24956] veth0_vlan: entered promiscuous mode [ 1642.858078][ T5831] Bluetooth: hci3: command tx timeout [ 1642.875129][T24956] veth1_vlan: entered promiscuous mode [ 1642.911222][T24956] veth0_macvtap: entered promiscuous mode [ 1642.922146][T24956] veth1_macvtap: entered promiscuous mode [ 1642.933985][T18982] usb 9-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1642.945099][T18982] usb 9-1: USB disconnect, device number 39 [ 1642.946514][T24956] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1642.957792][T18982] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1642.964897][T24956] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1642.975430][T18982] ftdi_sio 9-1:0.0: device disconnected [ 1643.021891][ T10] usb 7-1: Using ep0 maxpacket: 32 [ 1643.031481][ T10] usb 7-1: config 0 has an invalid interface number: 51 but max is 0 [ 1643.050433][T25042] vimc link validate: Sensor B:src:640x480 (0x33424752, 8, 0, 0, 0) Raw Capture 1:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 1643.407499][ T10] usb 7-1: config 0 has no interface number 0 [ 1643.422965][T24956] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1643.433077][T24956] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1643.442489][T24956] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1643.451508][T24956] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1643.451986][ T10] usb 7-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1643.469524][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1643.477796][ T10] usb 7-1: Product: syz [ 1643.482003][ T10] usb 7-1: Manufacturer: syz [ 1643.499499][ T10] usb 7-1: SerialNumber: syz [ 1643.512922][ T10] usb 7-1: config 0 descriptor?? [ 1643.521780][ T10] quatech2 7-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1643.542112][ T1333] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1643.550115][ T1333] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1643.574869][ T969] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1643.582934][ T969] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1643.723222][ T10] usb 7-1: qt2_attach - failed to power on unit: -71 [ 1643.731320][ T10] quatech2 7-1:0.51: probe with driver quatech2 failed with error -71 [ 1643.744508][ T10] usb 7-1: USB disconnect, device number 30 [ 1643.821308][T25048] netlink: 212376 bytes leftover after parsing attributes in process `syz.2.4505'. [ 1644.237091][T25055] netlink: 'syz.8.4506': attribute type 4 has an invalid length. [ 1644.245397][T25055] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4506'. [ 1646.513460][T25074] FAULT_INJECTION: forcing a failure. [ 1646.513460][T25074] name failslab, interval 1, probability 0, space 0, times 0 [ 1646.526349][T25074] CPU: 1 UID: 0 PID: 25074 Comm: syz.9.4510 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 1646.526376][T25074] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1646.526387][T25074] Call Trace: [ 1646.526393][T25074] [ 1646.526400][T25074] dump_stack_lvl+0x16c/0x1f0 [ 1646.526430][T25074] should_fail_ex+0x512/0x640 [ 1646.526453][T25074] ? fs_reclaim_acquire+0xae/0x150 [ 1646.526473][T25074] ? tomoyo_encode2+0x100/0x3e0 [ 1646.526498][T25074] should_failslab+0xc2/0x120 [ 1646.526524][T25074] __kmalloc_noprof+0xd2/0x510 [ 1646.526547][T25074] ? d_absolute_path+0x136/0x1a0 [ 1646.526571][T25074] tomoyo_encode2+0x100/0x3e0 [ 1646.526600][T25074] tomoyo_encode+0x29/0x50 [ 1646.526622][T25074] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1646.526655][T25074] tomoyo_path_number_perm+0x245/0x580 [ 1646.526674][T25074] ? tomoyo_path_number_perm+0x237/0x580 [ 1646.526704][T25074] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1646.526727][T25074] ? find_held_lock+0x2b/0x80 [ 1646.526775][T25074] ? find_held_lock+0x2b/0x80 [ 1646.526796][T25074] ? hook_file_ioctl_common+0x145/0x410 [ 1646.526820][T25074] ? __fget_files+0x20e/0x3c0 [ 1646.526849][T25074] security_file_ioctl+0x9b/0x240 [ 1646.526875][T25074] __x64_sys_ioctl+0xb7/0x210 [ 1646.526898][T25074] do_syscall_64+0xcd/0x4c0 [ 1646.526924][T25074] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.526942][T25074] RIP: 0033:0x7f359238e929 [ 1646.526957][T25074] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1646.526974][T25074] RSP: 002b:00007f3593226038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1646.526991][T25074] RAX: ffffffffffffffda RBX: 00007f35925b6160 RCX: 00007f359238e929 [ 1646.527003][T25074] RDX: 0000200000000500 RSI: 00000000c05064a7 RDI: 0000000000000005 [ 1646.527014][T25074] RBP: 00007f3593226090 R08: 0000000000000000 R09: 0000000000000000 [ 1646.527024][T25074] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1646.527034][T25074] R13: 0000000000000000 R14: 00007f35925b6160 R15: 00007ffdab211e88 [ 1646.527060][T25074] [ 1646.527074][T25074] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1646.761809][ T30] audit: type=1400 audit(1752498118.302:6344): avc: denied { mounton } for pid=25076 comm="syz.6.4512" path="/bus" dev="proc" ino=4026531855 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=dir permissive=1 [ 1646.761886][T25077] overlay: filesystem on ./bus is read-only [ 1646.795450][T25077] overlay: filesystem on ./bus is read-only [ 1647.037212][ T10] usb 7-1: new high-speed USB device number 31 using dummy_hcd [ 1647.045168][T25080] FAULT_INJECTION: forcing a failure. [ 1647.045168][T25080] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1647.059067][T25080] CPU: 0 UID: 0 PID: 25080 Comm: syz.8.4513 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 1647.059091][T25080] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1647.059102][T25080] Call Trace: [ 1647.059108][T25080] [ 1647.059118][T25080] dump_stack_lvl+0x16c/0x1f0 [ 1647.059148][T25080] should_fail_ex+0x512/0x640 [ 1647.059176][T25080] should_fail_alloc_page+0xe7/0x130 [ 1647.059204][T25080] prepare_alloc_pages+0x3c2/0x610 [ 1647.059228][T25080] __alloc_frozen_pages_noprof+0x18b/0x23f0 [ 1647.059254][T25080] ? __pfx_stack_trace_save+0x10/0x10 [ 1647.059278][T25080] ? stack_depot_save_flags+0x28/0xa40 [ 1647.059304][T25080] ? __alloc_frozen_pages_noprof+0x294/0x23f0 [ 1647.059330][T25080] ? kasan_save_stack+0x42/0x60 [ 1647.059351][T25080] ? kasan_save_stack+0x33/0x60 [ 1647.059373][T25080] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1647.059395][T25080] ? __pmd_alloc+0xbf/0x930 [ 1647.059411][T25080] ? handle_mm_fault+0x589/0xd10 [ 1647.059437][T25080] ? get_user_pages_remote+0x258/0xb20 [ 1647.059454][T25080] ? get_arg_page+0xf4/0x310 [ 1647.059473][T25080] ? copy_string_kernel+0x180/0x510 [ 1647.059493][T25080] ? do_execveat_common.isra.0+0x2ed/0x610 [ 1647.059516][T25080] ? __x64_sys_execve+0x8e/0xb0 [ 1647.059536][T25080] ? do_syscall_64+0xcd/0x4c0 [ 1647.059559][T25080] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1647.059589][T25080] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1647.059611][T25080] ? policy_nodemask+0xea/0x4e0 [ 1647.059643][T25080] alloc_pages_mpol+0x1fb/0x550 [ 1647.059670][T25080] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1647.059693][T25080] ? css_rstat_updated+0x9d/0xd30 [ 1647.059725][T25080] alloc_pages_noprof+0x131/0x390 [ 1647.059750][T25080] pte_alloc_one+0x1c/0x3a0 [ 1647.059769][T25080] __pte_alloc+0x6d/0x3c0 [ 1647.059794][T25080] ? __pfx___pte_alloc+0x10/0x10 [ 1647.059820][T25080] ? _raw_spin_unlock+0x28/0x50 [ 1647.059841][T25080] ? __pmd_alloc+0x3fb/0x930 [ 1647.059861][T25080] __handle_mm_fault+0x4358/0x5490 [ 1647.059889][T25080] ? __pfx___handle_mm_fault+0x10/0x10 [ 1647.059933][T25080] handle_mm_fault+0x589/0xd10 [ 1647.059959][T25080] __get_user_pages+0x589/0x3b80 [ 1647.059989][T25080] ? __pfx___get_user_pages+0x10/0x10 [ 1647.060017][T25080] get_user_pages_remote+0x258/0xb20 [ 1647.060041][T25080] ? __pfx_get_user_pages_remote+0x10/0x10 [ 1647.060058][T25080] ? __pfx_vma_link+0x10/0x10 [ 1647.060080][T25080] ? selinux_vm_enough_memory+0x12a/0x190 [ 1647.060117][T25080] get_arg_page+0xf4/0x310 [ 1647.060137][T25080] ? __pfx_get_arg_page+0x10/0x10 [ 1647.060158][T25080] ? up_write+0x1b2/0x520 [ 1647.060183][T25080] copy_string_kernel+0x180/0x510 [ 1647.060211][T25080] do_execveat_common.isra.0+0x2ed/0x610 [ 1647.060240][T25080] __x64_sys_execve+0x8e/0xb0 [ 1647.060264][T25080] do_syscall_64+0xcd/0x4c0 [ 1647.060290][T25080] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1647.060308][T25080] RIP: 0033:0x7f451fb8e929 [ 1647.060322][T25080] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1647.060339][T25080] RSP: 002b:00007f4520aa7038 EFLAGS: 00000246 ORIG_RAX: 000000000000003b [ 1647.060356][T25080] RAX: ffffffffffffffda RBX: 00007f451fdb5fa0 RCX: 00007f451fb8e929 [ 1647.060368][T25080] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000200000000180 [ 1647.060379][T25080] RBP: 00007f4520aa7090 R08: 0000000000000000 R09: 0000000000000000 [ 1647.060389][T25080] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 1647.060400][T25080] R13: 0000000000000000 R14: 00007f451fdb5fa0 R15: 00007fffc382df78 [ 1647.060430][T25080] [ 1647.558908][ T10] usb 7-1: Using ep0 maxpacket: 8 [ 1647.575953][ T10] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 1647.587901][ T10] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1647.607934][ T10] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1647.628896][ T10] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1647.725420][ T10] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1647.875190][ T10] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1647.923444][ T10] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1648.159094][ T10] usb 7-1: usb_control_msg returned -32 [ 1648.164665][ T10] usbtmc 7-1:16.0: can't read capabilities [ 1648.940761][ T1333] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1649.766393][T16443] usb 7-1: USB disconnect, device number 31 [ 1650.203306][ T1333] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1650.272774][ T1333] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1650.355710][ T1333] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1650.464707][ T1333] bridge_slave_1: left allmulticast mode [ 1650.470484][ T1333] bridge_slave_1: left promiscuous mode [ 1650.476107][ T1333] bridge0: port 2(bridge_slave_1) entered disabled state [ 1650.485298][ T1333] bridge_slave_0: left allmulticast mode [ 1650.491110][ T1333] bridge_slave_0: left promiscuous mode [ 1650.496721][ T1333] bridge0: port 1(bridge_slave_0) entered disabled state [ 1650.764213][ T1333] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1650.774330][ T1333] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1650.786545][ T1333] bond0 (unregistering): Released all slaves [ 1651.068201][ T1333] hsr_slave_0: left promiscuous mode [ 1651.082246][ T1333] hsr_slave_1: left promiscuous mode [ 1651.178711][ T1333] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1651.429967][ T1333] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1651.475197][ T1333] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1651.512413][ T1333] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1651.575335][ T1333] veth1_macvtap: left promiscuous mode [ 1651.596948][ T1333] veth0_macvtap: left promiscuous mode [ 1651.610839][ T1333] veth1_vlan: left promiscuous mode [ 1651.623463][ T1333] veth0_vlan: left promiscuous mode [ 1651.840486][T18662] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1651.854590][T18662] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1651.869958][T18662] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1651.881416][T18662] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1651.890359][T18662] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1652.274789][ T1333] team0 (unregistering): Port device team_slave_1 removed [ 1652.684714][ T1333] team0 (unregistering): Port device team_slave_0 removed [ 1653.226052][T25134] lo speed is unknown, defaulting to 1000 [ 1653.232545][T25134] virt_wifi0 speed is unknown, defaulting to 1000 [ 1653.267638][T25149] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1653.736050][T25131] lo speed is unknown, defaulting to 1000 [ 1653.762086][T25131] virt_wifi0 speed is unknown, defaulting to 1000 [ 1653.979711][T18662] Bluetooth: hci3: command tx timeout [ 1654.160065][ T30] audit: type=1400 audit(1752498125.692:6345): avc: denied { read write } for pid=25153 comm="syz.9.4533" name="btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1654.268668][T25170] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4539'. [ 1654.281349][T25170] smc: net device bond0 erased user defined pnetid SYZ2 [ 1654.295571][T25170] delete_channel: no stack [ 1654.486711][ T10] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 1654.536021][ T30] audit: type=1400 audit(1752498125.692:6346): avc: denied { open } for pid=25153 comm="syz.9.4533" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1654.603481][ T30] audit: type=1400 audit(1752498125.702:6347): avc: denied { ioctl } for pid=25153 comm="syz.9.4533" path="/dev/btrfs-control" dev="devtmpfs" ino=1316 ioctlcmd=0xaa06 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 1654.641775][T25131] chnl_net:caif_netlink_parms(): no params data found [ 1654.650554][ T10] usb 9-1: Using ep0 maxpacket: 16 [ 1654.669949][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1654.685221][ T10] usb 9-1: config 13 has an invalid interface number: 96 but max is 0 [ 1654.700895][ T10] usb 9-1: config 13 has no interface number 0 [ 1654.719066][ T10] usb 9-1: config 13 interface 96 altsetting 167 bulk endpoint 0x8 has invalid maxpacket 16 [ 1654.749452][ T10] usb 9-1: config 13 interface 96 has no altsetting 0 [ 1654.750322][T25131] bridge0: port 1(bridge_slave_0) entered blocking state [ 1654.765414][ T10] usb 9-1: New USB device found, idVendor=22b8, idProduct=2c84, bcdDevice=2f.28 [ 1654.775210][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1654.787600][ T10] usb 9-1: Product: syz [ 1654.791766][ T10] usb 9-1: Manufacturer: syz [ 1654.796459][ T10] usb 9-1: SerialNumber: syz [ 1654.803900][T25167] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1654.907249][T25131] bridge0: port 1(bridge_slave_0) entered disabled state [ 1654.914563][T25131] bridge_slave_0: entered allmulticast mode [ 1654.922498][T25131] bridge_slave_0: entered promiscuous mode [ 1655.521724][T25131] bridge0: port 2(bridge_slave_1) entered blocking state [ 1655.530250][T25131] bridge0: port 2(bridge_slave_1) entered disabled state [ 1655.538428][T25131] bridge_slave_1: entered allmulticast mode [ 1655.558169][T25131] bridge_slave_1: entered promiscuous mode [ 1656.342370][T18662] Bluetooth: hci3: command tx timeout [ 1656.793125][T25131] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1656.931703][T25131] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1658.407392][T18662] Bluetooth: hci3: command tx timeout [ 1658.490440][T25131] team0: Port device team_slave_0 added [ 1658.500475][T25131] team0: Port device team_slave_1 added [ 1658.500502][ T10] usb_serial_simple 9-1:13.96: moto_modem converter detected [ 1658.541897][ T10] usb 9-1: moto_modem converter now attached to ttyUSB0 [ 1658.552223][T25131] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1658.552236][T25131] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1658.552268][T25131] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1658.553493][T25131] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1658.587368][ T30] audit: type=1400 audit(1752498130.102:6348): avc: denied { bind } for pid=25200 comm="syz.9.4545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1658.633517][T25131] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1658.634201][ T10] usb 9-1: USB disconnect, device number 40 [ 1658.795234][T25212] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1658.882569][T25131] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1659.340623][ T30] audit: type=1400 audit(1752498130.102:6349): avc: denied { connect } for pid=25200 comm="syz.9.4545" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 1659.363677][ T10] moto_modem ttyUSB0: moto_modem converter now disconnected from ttyUSB0 [ 1659.377396][ T10] usb_serial_simple 9-1:13.96: device disconnected [ 1659.394514][T25215] program syz.6.4551 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1659.764723][T25131] hsr_slave_0: entered promiscuous mode [ 1659.804116][T25131] hsr_slave_1: entered promiscuous mode [ 1660.021577][T25228] netlink: 'syz.6.4553': attribute type 4 has an invalid length. [ 1660.029399][T25228] netlink: 17 bytes leftover after parsing attributes in process `syz.6.4553'. [ 1660.457295][ T5831] Bluetooth: hci3: command tx timeout [ 1660.495241][T25231] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4554'. [ 1661.083396][T25219] netlink: 36 bytes leftover after parsing attributes in process `syz.8.4550'. [ 1661.124828][T25219] binder: 25217:25219 ioctl c0306201 200000000300 returned -22 [ 1661.842636][T25250] netlink: 'syz.6.4558': attribute type 10 has an invalid length. [ 1662.096958][T25250] lo: entered promiscuous mode [ 1662.145374][T25250] bond0: (slave lo): enslaved VLAN challenged slave. Adding VLANs will be blocked as long as it is part of bond. [ 1662.271603][ T30] audit: type=1400 audit(1752498133.812:6350): avc: denied { create } for pid=25261 comm="syz.2.4562" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 1662.280959][T25262] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4562'. [ 1662.371166][ T30] audit: type=1400 audit(1752498133.912:6351): avc: denied { write } for pid=25261 comm="syz.2.4562" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_scsitransport_socket permissive=1 [ 1662.395708][T25131] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 1662.403637][T25266] ------------[ cut here ]------------ [ 1662.405414][T25131] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 1662.409501][T25266] WARNING: CPU: 1 PID: 25266 at mm/page_alloc.c:4935 __alloc_frozen_pages_noprof+0x30b/0x23f0 [ 1662.426933][T25266] Modules linked in: [ 1662.431496][T25266] CPU: 1 UID: 0 PID: 25266 Comm: syz.8.4564 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 1662.443692][T25266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1662.454161][T25266] RIP: 0010:__alloc_frozen_pages_noprof+0x30b/0x23f0 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1662.461083][T25266] Code: f0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 fe 0a 0f 86 0a fe ff ff 80 3d da fb 7b 0e 00 75 0b c6 05 d1 fb 7b 0e 01 90 <0f> 0b 90 45 31 f6 eb 81 4d 85 f6 74 22 44 89 fa 89 ee 4c 89 f7 e8 [ 1662.481416][T25266] RSP: 0018:ffffc9000474f908 EFLAGS: 00010246 [ 1662.481610][ T30] audit: type=1400 audit(1752498134.022:6352): avc: denied { write } for pid=5816 comm="syz-executor" path="pipe:[3604]" dev="pipefs" ino=3604 scontext=root:sysadm_r:sysadm_t tcontext=system_u:system_r:sshd_t tclass=fifo_file permissive=1 [ 1662.487989][T25266] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 1662.519438][T25266] RDX: 0000000000000000 RSI: 0000000000000019 RDI: 0000000000040dc0 [ 1662.527659][T25266] RBP: 0000001000002cf0 R08: 0000000000000007 R09: 0000000000000000 [ 1662.535635][T25266] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000019 [ 1662.543974][T25266] R13: 1ffff920008e9f36 R14: 0000001000002cf0 R15: 0000000000000019 [ 1662.552228][T25266] FS: 00007f4520aa76c0(0000) GS:ffff888124813000(0000) knlGS:0000000000000000 [ 1662.561446][T25266] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1662.568129][T25266] CR2: 00002000001859c0 CR3: 000000006a8a7000 CR4: 00000000003526f0 [ 1662.576106][T25266] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000004144 [ 1662.586312][T25266] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1662.594347][T25266] Call Trace: [ 1662.597853][T25266] [ 1662.600782][T25266] ? __pfx_stack_trace_save+0x10/0x10 [ 1662.606167][T25266] ? stack_depot_save_flags+0x28/0xa40 [ 1662.611670][T25266] ? __lock_acquire+0xb8a/0x1c90 [ 1662.616616][T25266] ? __lock_acquire+0xb8a/0x1c90 [ 1662.621600][T25266] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1662.627989][T25266] ? __mutex_trylock_common+0xe9/0x250 [ 1662.633461][T25266] ? __lock_acquire+0xb8a/0x1c90 [ 1662.638428][T25266] ? comedi_unlocked_ioctl+0x1757/0x2e90 [ 1662.644064][T25266] __alloc_pages_noprof+0xb/0x1b0 [ 1662.649141][T25266] ___kmalloc_large_node+0x84/0x1e0 [ 1662.649197][ T5831] Bluetooth: hci3: command 0x0405 tx timeout [ 1662.654330][T25266] ? comedi_unlocked_ioctl+0x1757/0x2e90 [ 1662.666016][T25266] __kmalloc_large_node_noprof+0x1c/0x70 [ 1662.671689][T25266] __kmalloc_noprof.cold+0xc/0x61 [ 1662.676729][T25266] comedi_unlocked_ioctl+0x1757/0x2e90 [ 1662.682240][T25266] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1662.688224][T25266] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1662.694043][T25266] ? do_vfs_ioctl+0x523/0x1a60 [ 1662.702567][T25266] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1662.708235][T25266] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 1662.714762][T25266] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 1662.721381][T25266] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1662.728305][T25266] ? hook_file_ioctl_common+0x145/0x410 [ 1662.733862][T25266] ? selinux_file_ioctl+0x180/0x270 [ 1662.739106][T25266] ? selinux_file_ioctl+0xb4/0x270 [ 1662.744200][T25266] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1662.750041][T25266] __x64_sys_ioctl+0x18e/0x210 [ 1662.754784][T25266] do_syscall_64+0xcd/0x4c0 [ 1662.759286][T25266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1662.765154][T25266] RIP: 0033:0x7f451fb8e929 [ 1662.769558][T25266] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1662.789172][T25266] RSP: 002b:00007f4520aa7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1662.797578][T25266] RAX: ffffffffffffffda RBX: 00007f451fdb5fa0 RCX: 00007f451fb8e929 [ 1662.805646][T25266] RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000004 [ 1662.813609][T25266] RBP: 00007f451fc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1662.821576][T25266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1662.829544][T25266] R13: 0000000000000000 R14: 00007f451fdb5fa0 R15: 00007fffc382df78 [ 1662.837518][T25266] [ 1662.840524][T25266] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1662.847783][T25266] CPU: 1 UID: 0 PID: 25266 Comm: syz.8.4564 Not tainted 6.16.0-rc5-syzkaller-00276-g5d5d62298b8b #0 PREEMPT(full) [ 1662.859823][T25266] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1662.869859][T25266] Call Trace: [ 1662.873113][T25266] [ 1662.876020][T25266] dump_stack_lvl+0x3d/0x1f0 [ 1662.880593][T25266] panic+0x71c/0x800 [ 1662.884470][T25266] ? __pfx_panic+0x10/0x10 [ 1662.888867][T25266] ? show_trace_log_lvl+0x29b/0x3e0 [ 1662.894052][T25266] ? __alloc_frozen_pages_noprof+0x30b/0x23f0 [ 1662.900110][T25266] check_panic_on_warn+0xab/0xb0 [ 1662.905033][T25266] __warn+0xf6/0x3c0 [ 1662.908901][T25266] ? __alloc_frozen_pages_noprof+0x30b/0x23f0 [ 1662.914946][T25266] report_bug+0x3c3/0x580 [ 1662.919262][T25266] ? __alloc_frozen_pages_noprof+0x30b/0x23f0 [ 1662.925307][T25266] handle_bug+0x184/0x210 [ 1662.929617][T25266] exc_invalid_op+0x17/0x50 [ 1662.934093][T25266] asm_exc_invalid_op+0x1a/0x20 [ 1662.938915][T25266] RIP: 0010:__alloc_frozen_pages_noprof+0x30b/0x23f0 [ 1662.945568][T25266] Code: f0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc 83 fe 0a 0f 86 0a fe ff ff 80 3d da fb 7b 0e 00 75 0b c6 05 d1 fb 7b 0e 01 90 <0f> 0b 90 45 31 f6 eb 81 4d 85 f6 74 22 44 89 fa 89 ee 4c 89 f7 e8 [ 1662.965150][T25266] RSP: 0018:ffffc9000474f908 EFLAGS: 00010246 [ 1662.971192][T25266] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 1662.979136][T25266] RDX: 0000000000000000 RSI: 0000000000000019 RDI: 0000000000040dc0 [ 1662.987078][T25266] RBP: 0000001000002cf0 R08: 0000000000000007 R09: 0000000000000000 [ 1662.995022][T25266] R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000019 [ 1663.002968][T25266] R13: 1ffff920008e9f36 R14: 0000001000002cf0 R15: 0000000000000019 [ 1663.010921][T25266] ? __pfx_stack_trace_save+0x10/0x10 [ 1663.016269][T25266] ? stack_depot_save_flags+0x28/0xa40 [ 1663.021706][T25266] ? __lock_acquire+0xb8a/0x1c90 [ 1663.026618][T25266] ? __lock_acquire+0xb8a/0x1c90 [ 1663.031527][T25266] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1663.037834][T25266] ? __mutex_trylock_common+0xe9/0x250 [ 1663.043285][T25266] ? __lock_acquire+0xb8a/0x1c90 [ 1663.048211][T25266] ? comedi_unlocked_ioctl+0x1757/0x2e90 [ 1663.053828][T25266] __alloc_pages_noprof+0xb/0x1b0 [ 1663.058850][T25266] ___kmalloc_large_node+0x84/0x1e0 [ 1663.064040][T25266] ? comedi_unlocked_ioctl+0x1757/0x2e90 [ 1663.069650][T25266] __kmalloc_large_node_noprof+0x1c/0x70 [ 1663.075260][T25266] __kmalloc_noprof.cold+0xc/0x61 [ 1663.080271][T25266] comedi_unlocked_ioctl+0x1757/0x2e90 [ 1663.085720][T25266] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1663.091591][T25266] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1663.097392][T25266] ? do_vfs_ioctl+0x523/0x1a60 [ 1663.102140][T25266] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1663.107150][T25266] ? ioctl_has_perm.constprop.0.isra.0+0x379/0x540 [ 1663.113634][T25266] ? ioctl_has_perm.constprop.0.isra.0+0x383/0x540 [ 1663.120129][T25266] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1663.126969][T25266] ? hook_file_ioctl_common+0x145/0x410 [ 1663.132495][T25266] ? selinux_file_ioctl+0x180/0x270 [ 1663.137689][T25266] ? selinux_file_ioctl+0xb4/0x270 [ 1663.142784][T25266] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1663.148569][T25266] __x64_sys_ioctl+0x18e/0x210 [ 1663.153313][T25266] do_syscall_64+0xcd/0x4c0 [ 1663.157802][T25266] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1663.163672][T25266] RIP: 0033:0x7f451fb8e929 [ 1663.168063][T25266] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1663.187658][T25266] RSP: 002b:00007f4520aa7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1663.196046][T25266] RAX: ffffffffffffffda RBX: 00007f451fdb5fa0 RCX: 00007f451fb8e929 [ 1663.203994][T25266] RDX: 00002000001859c0 RSI: 000000008010640b RDI: 0000000000000004 [ 1663.211940][T25266] RBP: 00007f451fc10b39 R08: 0000000000000000 R09: 0000000000000000 [ 1663.219886][T25266] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1663.227832][T25266] R13: 0000000000000000 R14: 00007f451fdb5fa0 R15: 00007fffc382df78 [ 1663.235784][T25266] [ 1663.238970][T25266] Kernel Offset: disabled [ 1663.243271][T25266] Rebooting in 86400 seconds..