last executing test programs: 9m3.23670738s ago: executing program 32 (id=624): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, &(0x7f0000000000)=0x4, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) connect$inet(r2, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) sendmmsg$inet(r2, &(0x7f0000004d00)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x30000}, 0x7000000}], 0x300, 0xf1c) 4m33.949086378s ago: executing program 3 (id=1840): r0 = socket$can_bcm(0x1d, 0x2, 0x2) io_setup(0x9, &(0x7f0000000240)) preadv2(r0, &(0x7f0000001380)=[{&(0x7f0000000040)=""/40, 0x28}, {0x0}, {&(0x7f0000000140)=""/87, 0x57}, {&(0x7f0000000280)=""/171, 0xab}, {&(0x7f0000000340)=""/4096, 0x1000}, {&(0x7f0000001340)=""/58, 0x3a}], 0x6, 0x7, 0x0, 0x5) r1 = semget(0x3, 0x1, 0x670) semctl$IPC_RMID(r1, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="20000000240007012ebd7000fbdbdf25020600000000018008000500", @ANYRES32, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x4048011}, 0x48080) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_NESTED_STATE(r5, 0x4048aecb, &(0x7f00000034c0)=@svm={0x8, 0x1, 0x1080, {0xdddd1000}, {"89c07f0b82fd2a0a3f0c56da8d37c2264453280e4cfe9e72bc9810fbfc2dd0b2361089f20126916d63172c18a657abdfdf00dad36794cff4c7b4b370db93f24c747c4fedc1a7bf97970236376fe95c942a247f0fe0b999047a1f57a98eeafd90e358d7a5edf75548ce38749ea49159c0f7d1589f0cd017cb6ccf9834c2d82fd3bd9765feed31138b995a15597ec09805b5f7b633bfb77df8b2661ec7f97db470177af503c5686a2f9b0bb9a18c5a6e0ebc3f64787b821b64ea52652522bdd076c8499f559df2a355861fd7919911d6ed2202c17e95e410b9a468ae089c969244a635475bfc67837d6ffffe5a72bea6e60bdee9d2c2af935da05dbf4373c103c1750281ff2a254281fe21b313a535045eb98f003f890856f65a5e029b324b6f173ab657049cfcf0d2ee9fc8d28671c7c0cc6c67a80f09076f6dedd4cdc3ccfc3bc1856fc823cffa0dc3f9484b09ffebd1390fa5934a7e93e4c52683ea49e46fee3802be49754f4ca9c94e762c52801acbf6d1f64f4f745da4f01aefec585fcc26a3e7e0593b427a07a516a2b50d3a96e214a76c516a1125fc6343b2b3c43f053bfd90074fb986e6113091e5b183df4900ee6faab00d9cc55705917e6f9d682ad092de2d47146649f840284ac01dd69ba854f20d29ddbdd97b2ab484d86d539c1356170c8028ac5a3f5e8f52ca6f7fec98a7c1348cccaa8626e2714fe90134ab5457e94b444859ee524b756bc94980f9c63355fff3ecd6ec82414badbb62bd6af9c4708fe4de800d1423bd088c9bdf7c6602ad709089d6be409f3fa4e156ee3a9e0a34025ef1e05e2cc4c3d744781d05ca4cd187244fb730b6de2e0c3dd876e67491b81b28917489d3f01c0010220b0bb34161100b4813c10842d949735a223250dc80c3f776e0e1c0bc1c329543033eab277dba48ee0b3642bb58877e49ff860b5f64952ef92aa9bdff9a7a229c21d32f607da0e708528a6130883a739b81702c59c51498a862e4948f7a2f2300f72821a2eb7d3a182b32b6c7d95d0d984daa5940b9f1fb5bf04872d53f0e03990559520a0c4acb38a6a40da57d564b4824f004129cc5faf436da22319b12dc4370436893bc62c6c763bed8a5b09b8d871af6c110d2ab9de58f2c73a118dd47cd38aa8cfc85ee24c9ee39b27dd2c5a4232d23229b49086cf70d542d409e9916a0fcd4457cf406c40e843eff8a83074b057bdf7acccdd1b14a91392fd89241b173dcd49f0492f7a531e76be432f3b7325b922245699865ad0738e6b0a70babd0e421e2febd4328d3007e504fad90eaf661403fff309645de17e819fa3c04a4907e35d0bf1a04f8dfac8d0e6fe38285c4060b0f0c321ec7153654fc53afa7b58df3b64d67fe4f15640c0606d5ae7f678782cd1dcb088244b97c9333d8cc6a8e6a472f30bf00ac0a5b0d80edacb587f2d3429f4157e3125c04521eb7d59f8a2eda2b9125de73bc4dd397ba8de0b3b00aaf446d40d646c004762d105bfe01f071b86323c24ab41dfb885abf0b562726f14a9b6a4c00a4080617d0242d9841cf9c35240fc6cbe4d0d6d5177e34369e8f879b4b4c502c2fc7384f1efcd68a74f54d50cbfe4212d0ccc1bd8837147a7b854da36eddd699109377d5253ffc8ea13b805211d8f824f3da29ef84c57986ef4bec01be1fbfed33bfa119b45faa141385d56214670a8bd1b7bb9495489ff82848417d0764aa6278362d89543661ff8be392a7cf12bf506d432a0f29f85d3f2df91a0faf260729e7c2478b45edc6c3f1e115ab8bc1794448c3cb33c5b3d5ef3153e8d869ce3a8f2496da0486b63eec4630a98ff416cea1d583f96557dc7fe85ddafeca5b9cbe7ea48854f6367c4e1d5ae2d30ba66c8ee3c1c4fa1ca260c622d75efd0a050e7c0304a6185779a331e195352a8a50f5bc560defd33ebd7532d315981be55a1414d968aacbca0bf2a166d1b06bcb0b8eb5e3e8918e00b2dcd57c3a0f82d46bc2c052e57b69a74db4aab59358cd1bdc196ad21ffeb841c45ef1796067dfa38035fa946efc4621fcd8f3b92489628dfe93653be13a84b09df25e35981ad0dbdef3e2d759a3690526ce77778a6afab45adc04aef56fdb5e71bf1a93f34316ee39f25829e8d3f0314710a8054ad9c9ff309224c46d0f96480a953d7453dcd877ebcbc1a9da8ea2e21bdeae11f3d5e4660d398d55941c7587919426216eccf4b09b032301c09c9930b954302f8f1367f280a803bccdbaec61fc3c51fd9dc16a56d8c4389766067d77afd638938d66c8443935cd7caf0f0125d8674fe66888086d29914c9f6869f3255d754ad15e4472477680f38796b67d628499d25416dc60af394c64fba4ec08bc110ddbd66cacc7e6f82e0d756fe104c466590ad1dc84a26985281a0fda25168966f2f73249fd9c03b34601df6544d15e9f300e9148ab24aeda4ebf94031a89a2ac747cd32ae56b9bda2006b2a31b61f13d3a49f3fdd70e6992307515426d45009d6e4ebbce739528c631174b0312c274f6c196975036db881eef7f58840f284aa7b4aa50fa293feddef65793619522372abad6d75a3553ebcbb79c058bc1a6c9bdf293b1050173c4c35b539144eaabc32817935e28a922161888d2ea7f1546314ec30042dfb26cf6185108815b3139422b85c569e7753f311374c5f113891387dc165496171217fc84f833212362ce4b02dd5da8ab5d0ecde334fe9810ebacb3ded2b72d37eae7071cc73026bf9e09ab1cd830b33469b6cdf47431111b88387e68983a9f07070ff35e427f27feae64d4fe98c60dca64e3f718c7206a89300fdd504097e042b4772f3d8f32a826921a3b7f81f0b7e2adbad65e9a72eb2d0dc3aea6e7f0dc4bcaf3eb82fd029514faae0a5f8ee7af22ae17155ec1c586474a33bf4dea7abb21b3c4d91b842b619208bfc63d06e9426aca041de0c1cdb036cb9b4906a232614255eaadc7d0659175661f1889d78687f41bf0adb61b843c65351bf3d4d11cdd38f2a952a93d4d3ffa155d50c78c38531fb72958c1d9fbe30ffd135421d997b93fcbdc4c6ba0c9590e8811a51c0238c3630bc3b3ffa7faf3bebd9288a0330cedbb134f8f76e7f1cc52fd4ca9f02fd054efa141c0cb545f962c3d16b981546bbd1afdaeef03c2f1e0211dad10e5b87ea32710743884aae2e891f2d4c149496a24513dab59770b4fb620079393762395adbda363b07ca28ad6952f4e2c495a585c64aa93b2046b10e2cc31d22907b0b9cd60ee3479139d0cdcba2a8414fc56c130adbfb2cb5c5fa02acb19a8d2f05c7cc36745619e28da182f7b1baa6b3abad91428d666de3de67371cc97bdd8844f952f3950be7ddd3de5a8febb66bd86d79355fa8a44b6dece66874e27aa12b46b696d14137ac8422895d14e235f050471dc327d5ea4074e186c5d7932353e0ff8b1f1ee92b6a70407a6551bb452ce98b0b43dc4d6cf860e53393ede6981bba033923597dd2a681748d270e1982f9b6cf072af065c975911d3d6bac86580413e47be5233592ec164c9b3046a34a58a26394f96b53f0cf831b7cc064a603dd79fa7f11681600b8f8d76a460a2cdba72662e50cc97a4aa8078acc84a759eda6b04790e8dc61a788826367d2b6a05af3bc1414fc1d46fe192bb92c40a8b1ffe82adc3648c9590b7ca937dc92a5bdaf6f913873cbe77de759f2d5a833fc196572aed2b72bbc1e2acc479b0d2a17f8f4663c0752be0fa2c3b417ae0d2f9a2acc6c54c6d86b60312a0a278a454aed181e7f7fd2f268a20d9ed954c6e8a27d90de99d0beeb447fc827b85c81bc9a328147b3be04159f346d93f7e776a981cbb3bccdba61e37a959b48386a1928f9e74fa5c558dbc11ca274030d3a56488cd863fe8f627a444916730b459320db6e5b8dbbaa11bd500fd1d0fa69a622e22c18d7cdac18c5efcb2a179f30ca02bab8ac3dde9de0aab94ac29d1ef81777f42f65dee76aba23682406ed86575d5d743f4888b575bc06f37288a740a7b4a17169e49181595f440e477d149a8653d9e7b56fd5fe148cc17e7b6c940e92fd6e233ea31ee6d6d1ca935f961db8ef141b830186e10c2a0844588d6665594b1308a939fd352b94e1379438cce2ea54fde86bd8d2326c1c31c0e9e3476b5ddfd0118cf1fc87954d85379f28dcf82771670659d064384792457e403dc1d6361b96c3c8d953be6ed008b7671924305561dbc5c1296d822f852b33a7331339d6b6254081addc61f0d11c0f62926dea10873fc3b35d6f0e544ed6803d7c2f00c3702719f6a3017ed1ac999cdc7ef8fd4b6aaa109833d76df4a7271409cc18971000260d96a89f4459889119ce02b8a533907ca49ef248e8c89e39c15e5899c05327749ab920b5908cd96a37ec16a81b9366e44fe1c81d2eea23ccf43d69ab6de41d91d0aa4c6b63b3680f0bd2d6916d4d077a57a43d5b7ec61d39b6d75cd9e0c5b079e0903a5b7487bc61a92d34ef0dedebbe7adb6fda5838e7a90633b17fbafc061e2a39148ac22a96e86819a34c42d7f707acb432bf9be73686090386a6c4521a570f3a45f9c9aae664fc9a0c4beca28da6a3fdd0c24814aad76b6566bbe7f47d0fe8e56b5439ee844c03af17744d33fe307a9b7eb5fae170a40e7814affcb3655e186630fe3d98350db1c4bd3446b92001e3a4393449329fa0bf2c00ec9cf532e1539253e7942bbf190a9eaf5750cf7a295ef77df84519a26452367076cbb27df6c531675647783b187e1a74db9505f658400904ae713a9e96ca47bdf7a2753989c67c0a9fdadb02f9bcbf67814aaebe105c89568a39f19412c846a573a065647f6e870a0c42d98030a1eaee3a6038131dee1fd8b310ea43b3651bb5dc3fa5929d3fe4bff16bb1882bb75db0c61a415feff5df98ea78d6b75866d376475ae5c5653adb5741a672b8f11958a9a45fb36635ea10b136f5f3b32acd8a0061a537c5865fddeb05fddcf5e27b942259964ce2557bb1c7adc056104535f6e672c21d041fcd7c97f65b3866a84337551cd77e1a6ba7f8ca6935dfdda35def96937a525fe3dabcf7e7a3193b4707c8504131fed0f8b28d0fe6171956f2c04da1d92e16f4caaafcd3efe91625b1c6f4945a9752e231aa129075ba864ebb55ea39759f153d004ee30a83801dd43b633930bb331d2f4a11fa53688481f2270388c7fe914ac4bba705289ad3c282add0cb0f5aa740d2191e60cff2c4e103418f0a74ae9d87acbdc71ec5794ffa548baf7bc3c16f9699e27ef7f1eedb9f7e7c5920f92eaa27e3208a423afcade0e5b33b4d74e39452502d096836c617b3bc7fd866228a6a102d46c6247c25beb2655c57f2690e4f80f64051bfb8334ed585fc162d13ed55ac5b1c9e903c99d8574e785ed933395ac924a0c3f02c23ed81be6fbbc9de196ef1d529a5fde294141c34da4d5a3b8335f808f3d1bb8f4ffc4df0a6ac7e744845af0eb9ee1dd149c49b656aa1d7b1ff1d2c476f5629b2cec159ca2429db94910e0ca10aa7eb10de0dff940080032e703ebf2710b4882753b61fbe93677415ddb065fe82ec75e1e79443aafcb5a2d028ce1b6413a324fd6da48626e4e45141db0d2537a75a85c7076b0ff9815bf3d619a483dffcb6dbcd36b3de811ec35d7376469920506e7987dcb9ee893b3bb0b243cd68383fa9d0dc74fe31f3ae09d0b1154908d1cea4137489af97e45e5ab6a092c28d3e1b56aee79d100275ca780ddea8b3e21e362511a113e4c6f14d49c6e32e3ea58c50ec278ab5708fbfa55bd5208e1f202e6f8c1b31c2a6a682c7c8556e2ddcc527cf4a5724e"}}) (fail_nth: 3) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$inet(0xa, 0x801, 0x84) connect$inet(r8, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r8, 0x8) r9 = accept4(r8, 0x0, 0x0, 0x0) sendto$inet(r9, &(0x7f00000002c0)="cc", 0x1, 0x4000, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r9, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x0, 0x6, 0xffffffff}, 0x10) sendto$inet6(r9, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r9, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r9, 0x84, 0x7c, &(0x7f0000000240)={0x0, 0x0, 0xb1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r9, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0xb1}, 0x39) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_inet_SIOCSIFDSTADDR(r11, 0x891b, &(0x7f00000002c0)={'lo\x00', {0x2, 0x4e22, @private=0xac14140a}}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0x0, 0xb}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4004}, 0xc000) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) 4m32.789769487s ago: executing program 3 (id=1841): bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="05000000070020214200000040"], 0x50) socket(0x27, 0x1, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r7, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_clsact={0xb}]}, 0x30}, 0x1, 0xfffc}, 0x4000800) sendmsg$nl_route_sched(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@delchain={0x40, 0x64, 0xf31, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0xfff3, 0xffff}, {0x0, 0x1b}}, [@filter_kind_options=@f_flower={{0xb}, {0x10, 0x2, [@TCA_FLOWER_KEY_ETH_DST={0xa, 0x4, @broadcast}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x10}, 0x4000004) r9 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r9, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000940)=@delchain={0x24, 0x11, 0x1, 0x1f, 0x0, {0x0, 0x0, 0x0, r8}}, 0x24}}, 0x0) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) socket$tipc(0x1e, 0x5, 0x0) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000001180)=ANY=[@ANYBLOB="b800000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES16=0x0, @ANYBLOB="000000c88ba9929cfb1274cab1e2bfc50000000000a900000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a0000000000000000000000804000000000000000000800"/125], 0xb8}}, 0x8001) socket$nl_xfrm(0x10, 0x3, 0x6) 4m30.592469962s ago: executing program 3 (id=1849): bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x12, 0xd, 0x4, 0x2}, 0x50) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f00005f5000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)=ANY=[@ANYBLOB="020306001b0000000000000000000000010003000000000000000000000000000000000000000000000000000000000005000600000000000a0000000000000100000000000000000000000000000000000000000000000004000400000080000000000000000000000000000000000000000000000000000200010000000000000000fd0000000005000500000000000a00000000000000fe8800000000000000000000000000010000000000000000030007000000000002000000ffffffff0000000000000000020013"], 0xd8}}, 0x0) 4m30.248691592s ago: executing program 3 (id=1855): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f00000003c0)={0x2, 0x1, 0x1}) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000240)=@o_path={&(0x7f0000000100)='./file0\x00', 0x0, 0x10, r2}, 0x18) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000800), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r5, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',g']) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000200)) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc058560f, &(0x7f0000000140)=@multiplanar_mmap={0x0, 0x1, 0x4, 0x0, 0x0, {0x0, 0xea60}, {0x0, 0x1, 0x0, 0x0, 0x0, 0x0, "a730b801"}, 0x0, 0x1, {0x0}}) 4m29.233410281s ago: executing program 3 (id=1859): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000400), 0x8080, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000100)=0x3) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000680), 0x101402, 0x0) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000140)=0x1) ioctl$KDFONTOP_SET_DEF(r0, 0x4b72, &(0x7f0000000240)={0x2, 0xfffffeff, 0x3, 0xb, 0x40198, &(0x7f0000000bc0)="849571f3cb6d14306073a2525451fd9e421bcd4bc398215526e659f0a1016053ec1d8d42dd72b816039882d38cb84037deb65ee265eee17d98438273dc1e7728b2c798dbabb09131a2594322b01e07fc18ad8b752f0629280d89dac1efc67120d93ae35d6bd03ecddf3933597676f7cb8dcf9d7b225d3140319b5c4bb0f7bc76e8655baeae0408cab22b88930914e68585bd2a71516156a80862b3df5fe16b5eb1868fbed181f6f80e116a15c692f9b1922e361ca4fef6d521830439a5005ecc2cfada48eccd87a460ede4674c4256cdd871fdd9818bbdf72dd79064c965444f57ed47f5fe573b04563de05ef9d27fc500896d50fac69c42d056403aef8cdaf2af01369eb4e7d81bfe16915ec49583be1fc0c80c5e6a50e0231b1819c77b728995b96d8083b27e69903f0c98e1dfa6e8dd3baa8a9e88a93b692ab81bbf6141764e939b5ae436772438894bcd9a1de0b07818d194e228b532f7451a1315785a11311bd73fad01800000980388b83d8b37906243b93a93dc7cdbcff2f84c7060f922dc5f9d17d9708145c88d926c7677efc6c2638680af4f9f2ffe2e9f27b5e7b11c1b55e325ee1218ee571ccdee7917b7f4b84cb80acd684895df3bd01ce5da45fcb920b933f75302151f62ab72198384e2240ae5b9e9dde0a4fba19546aa65b331e95a5ef2c8bfb86990f9b55dd92e6ad164b2455fff8f43192fc36c7b7f080305cab51719ff381bf984dcdf7b9fc6d6c17b5d1ca77dd884c7b005b95707d97d0f8ac03290e5e8c9ca90e06ae42d43d18cee09463bfa514212d1c0825ed1c3161ac02f8545791e7d72bc36396a705f873c994fc8d787a310a2bdf405b52f146445ea0c9d01f75815a699976f6513179d2cfe679bd8ce5a09f25788a489189178541ea5212bf2aadf155da37eb18ca83eaf80bfc48cf95608c4c73b6ab0e39f2ab65f9e0e3712e0f2f97221dfbd2fb1ff5fa79085ea4e1720a1c8190b946099f1f1d816b888489a4882c839b24713b168159a3443166538859d726b12a32f8f6be93dd3b9eac2b4900b2c8faba92c2feb715c5aacbf4971c71b1c6f5896c838dff1602384c656f89e55834589fe75319b323ce75a1610d45a9ffebd81dfd96bf2d19cc44ae92e213872ab1752fcadd5b2ee0c6442be4edd15a05bf5a9d0297c9abed4e3079e76fea77ff32fb954dd97c49f87112a4be1bceed3b3f625c545630f89723804b0afa3a126341bb99b39ee34250ef66a0752d87b31bfb35fead79cad569a7fea4e5737eb49fef069832f006eb3ffa843a9d42d130acd7863e0f203f6d14bdaa4fa031d8f920f95d6879194174288f48137ed44d838138636581840e21b36e63e8acd5a15b8a450d1491f972a543591504b65c5751774c18522a70dd34574374c1c86e67e4d2b04d7891a1e562e4dc453683962e48f3accb66091de4b"}) writev(r1, &(0x7f0000000000)=[{&(0x7f00000026c0)="9586a26e2862e86c8e4f12d8f826", 0xe}], 0x1) r2 = socket(0x10, 0x803, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x101b00, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'syzkaller0\x00', 0x0}) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x8c000, 0x0) r7 = dup(r6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r7, 0xfffff000) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) migrate_pages(0x0, 0x3, &(0x7f0000000040)=0x100000000000080, &(0x7f0000000300)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r8 = openat$cgroup_procs(0xffffffffffffffff, &(0x7f0000000180)='cgroup.threads\x00', 0x2, 0x0) write$cgroup_pid(r8, &(0x7f00000001c0), 0x12) pread64(r8, &(0x7f00000031c0)=""/212, 0xd4, 0x7fffffff) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newqdisc={0x24, 0x24, 0x10, 0x70bd2b, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x8, 0x7}, {0xe, 0xffff}}}, 0x24}}, 0x40804) socket(0x400000000010, 0x3, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r9 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) read$FUSE(r9, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r9, &(0x7f0000000040)={0x50, 0x0, r10, {0x7, 0x1f, 0x8, 0x7691409, 0x8, 0x6, 0x0, 0x0, 0x0, 0x0, 0x10, 0x100000}}, 0x50) write$FUSE_INIT(r9, &(0x7f0000000b40)={0xfffffffffffffeef, 0xfffffffffffffff5, r10, {0x7, 0x2d, 0x1, 0x110d0026, 0xf, 0x7, 0x4, 0x8000, 0x0, 0x0, 0x20}}, 0x50) socket$unix(0x1, 0x2, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x4c, 0x0}) 4m28.888811669s ago: executing program 3 (id=1861): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0xffffff6a) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@deltclass={0x2c, 0x29, 0x200, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0xa, 0xfff1}, {0x1, 0xe}, {0xffe0, 0xffec}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x9}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8011}, 0x41) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f00000001c0)=@buf) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000200), 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000240)={{0x20, 0xc7}, {0xe, 0x80}, 0xbab, 0x6cc901cdb7bfef81, 0xc4}) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000002c0)={0xa, 0x0, r3}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r4, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r3, {0xcc5, 0x9}}, './file0\x00'}) ioctl$XFS_IOC_GETBMAPX(r3, 0xc0205838, &(0x7f0000000340)={0x7, 0x4, 0x7, 0x10001, 0x7fff, 0x3f, 0x8}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000380)=0xd10, 0x4) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r5) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4, 0x50, r5, 0xd9e37000) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000400)=0x41000) fstat(r3, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000440)=@nbd={'/dev/nbd', 0x0}, r6, &(0x7f0000000500)={0x1, 0x7, 0xfffffffffffffffe, 0x9, 0x2, 0x12000, 0x1, 0x8001, 0x2}) ioctl$BTRFS_IOC_INO_PATHS(r3, 0xc0389423, &(0x7f00000005c0)={0x7091e6b0, 0x28, [0x6, 0x3, 0x9, 0x9], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$LOOP_SET_FD(r5, 0x4c00, r3) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000600)={0x2000, r3}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000640)=@assoc_value, &(0x7f0000000680)=0x8) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f00000006c0)=0x1) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000700)=0x2, 0x4) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r5, 0x3b72, &(0x7f0000000740)={0xe0, 0x6, 0x2, 0x6, "3bf547f896e3b37701e51eafdb5eb11a62b72dbe15a52385f01ce779d5927b9847500bd53980f14cbf5921fa2ccf24429368520ab37309061b868106d431e41ac65136cade62cc05a5503c2bd72e2e844bce7097dbfc8069b0f0932c8db40f0e68447e3c19124876a62931f4f872b577664317171d3f2e61cce5584c20ecb458f19caa728685434ac57058ba72fc943e75cd2af002c7bb40bc11caa4616803bef1665f0c6980fdc8f4761c2d9e8b903c19c9690015a45437c2a330aa1b9454a5f8f8eaaed0c6be69"}) sendmsg$tipc(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000840)="7c6de876731b4a7bd26ecc347784027eada04bf3b5db6dd929e830a1a1f04a5ec9ba1aa55d885b6d95", 0x29}, {&(0x7f0000000880)="e687f0fdcf9cd9725729360f3591c89ab8b63441a9b5d8d7e19025d3df038350290c16e0ef5409d8fb484a", 0x2b}], 0x2, 0x0, 0x0, 0x4004}, 0x4000800) link(&(0x7f0000000940)='./file0\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000009c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r5, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x50, 0x0, 0x31c, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x1, 0x40}}}}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x8014}, 0x20000000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), r4) sendmsg$NL80211_CMD_SET_STATION(r4, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x34, r8, 0x8, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x3e5}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x28}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0xc080) 4m28.622260197s ago: executing program 33 (id=1861): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x40000, 0x0) ioctl$TIOCPKT(r0, 0x5420, &(0x7f0000000040)=0xffffff6a) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000180)={&(0x7f0000000080), 0xc, &(0x7f0000000140)={&(0x7f0000000100)=@deltclass={0x2c, 0x29, 0x200, 0x70bd2b, 0x25dfdbff, {0x0, 0x0, 0x0, r2, {0xa, 0xfff1}, {0x1, 0xe}, {0xffe0, 0xffec}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x9}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8011}, 0x41) ioctl$sock_SIOCGIFCONF(r1, 0x8912, &(0x7f00000001c0)=@buf) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000200), 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r3, 0xc0505350, &(0x7f0000000240)={{0x20, 0xc7}, {0xe, 0x80}, 0xbab, 0x6cc901cdb7bfef81, 0xc4}) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f00000002c0)={0xa, 0x0, r3}) ioctl$AUTOFS_DEV_IOCTL_FAIL(r4, 0xc0189377, &(0x7f0000000300)={{0x1, 0x1, 0x18, r3, {0xcc5, 0x9}}, './file0\x00'}) ioctl$XFS_IOC_GETBMAPX(r3, 0xc0205838, &(0x7f0000000340)={0x7, 0x4, 0x7, 0x10001, 0x7fff, 0x3f, 0x8}) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000000380)=0xd10, 0x4) syz_genetlink_get_family_id$ipvs(&(0x7f00000003c0), r5) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x4, 0x50, r5, 0xd9e37000) ioctl$KVM_SET_IDENTITY_MAP_ADDR(r3, 0x4008ae48, &(0x7f0000000400)=0x41000) fstat(r3, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl$Q_SETQUOTA(0xffffffff80000801, &(0x7f0000000440)=@nbd={'/dev/nbd', 0x0}, r6, &(0x7f0000000500)={0x1, 0x7, 0xfffffffffffffffe, 0x9, 0x2, 0x12000, 0x1, 0x8001, 0x2}) ioctl$BTRFS_IOC_INO_PATHS(r3, 0xc0389423, &(0x7f00000005c0)={0x7091e6b0, 0x28, [0x6, 0x3, 0x9, 0x9], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$LOOP_SET_FD(r5, 0x4c00, r3) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r4, 0x1, &(0x7f0000000600)={0x2000, r3}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f0000000640)=@assoc_value, &(0x7f0000000680)=0x8) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f00000006c0)=0x1) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r1, 0x10e, 0x2, &(0x7f0000000700)=0x2, 0x4) ioctl$IOMMU_VFIO_IOMMU_UNMAP_DMA(r5, 0x3b72, &(0x7f0000000740)={0xe0, 0x6, 0x2, 0x6, "3bf547f896e3b37701e51eafdb5eb11a62b72dbe15a52385f01ce779d5927b9847500bd53980f14cbf5921fa2ccf24429368520ab37309061b868106d431e41ac65136cade62cc05a5503c2bd72e2e844bce7097dbfc8069b0f0932c8db40f0e68447e3c19124876a62931f4f872b577664317171d3f2e61cce5584c20ecb458f19caa728685434ac57058ba72fc943e75cd2af002c7bb40bc11caa4616803bef1665f0c6980fdc8f4761c2d9e8b903c19c9690015a45437c2a330aa1b9454a5f8f8eaaed0c6be69"}) sendmsg$tipc(r5, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)=[{&(0x7f0000000840)="7c6de876731b4a7bd26ecc347784027eada04bf3b5db6dd929e830a1a1f04a5ec9ba1aa55d885b6d95", 0x29}, {&(0x7f0000000880)="e687f0fdcf9cd9725729360f3591c89ab8b63441a9b5d8d7e19025d3df038350290c16e0ef5409d8fb484a", 0x2b}], 0x2, 0x0, 0x0, 0x4004}, 0x4000800) link(&(0x7f0000000940)='./file0\x00', 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000009c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ADD_TX_TS(r5, &(0x7f0000000ac0)={&(0x7f0000000980)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a00)={0x50, 0x0, 0x31c, 0x70bd29, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x1, 0x40}}}}, [@NL80211_ATTR_USER_PRIO={0x5, 0xd3, 0x1}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_TSID={0x5, 0xd2, 0x2}]}, 0x50}, 0x1, 0x0, 0x0, 0x8014}, 0x20000000) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), r4) sendmsg$NL80211_CMD_SET_STATION(r4, &(0x7f0000000c00)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000bc0)={&(0x7f0000000b80)={0x34, r8, 0x8, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_MGMT_SUBTYPE={0x5, 0x29, 0xa}, @NL80211_ATTR_PEER_AID={0x6, 0xb5, 0x3e5}, @NL80211_ATTR_OPMODE_NOTIF={0x5, 0xc2, 0x28}]}, 0x34}, 0x1, 0x0, 0x0, 0x10}, 0xc080) 2m41.310206344s ago: executing program 5 (id=2332): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) write(r0, &(0x7f0000000100)="1800000016005f0214fffffffffffff80700000001000000", 0x18) 2m41.116515942s ago: executing program 5 (id=2334): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg(r2, 0x0, 0x0) ioctl$sock_inet_SIOCDARP(0xffffffffffffffff, 0x8953, &(0x7f0000000040)={{0x2, 0x4e24, @remote}, {0x306, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x2c}}, 0x0, {0x2, 0x4e20, @initdev={0xac, 0x1e, 0x1, 0x0}}}) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), r3) sendmsg$NL80211_CMD_PROBE_MESH_LINK(r3, &(0x7f00000011c0)={0x0, 0x0, &(0x7f0000001180)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x20000180) r4 = add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, 0x0, 0x0) keyctl$KEYCTL_RESTRICT_KEYRING(0x1d, r4, &(0x7f00000000c0)='asymmetric\x00', 0x0) io_uring_setup(0x5eb7, &(0x7f0000000140)={0x0, 0x9cc2, 0x10000, 0x1, 0x28}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000480), 0x22401, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x4) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000200)="ea0d00b0000f229464670fc79c8100800000ba6100ecbaf80c66b8ecb1048566efbafc0c66b8106d7dd166eff0867dc5decb66b9800000c00f326635000100000f30ea0000e50066b8010000000f01d9", 0x50}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0, 0x3f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=@updpolicy={0xb8, 0x19, 0x1, 0x70bd25, 0x0, {{@in=@multicast2, @in=@private=0xa010102, 0x0, 0x0, 0xffff, 0x0, 0xa, 0x0, 0x0, 0x87}, {0x0, 0x0, 0x40000000000004, 0x3, 0x9ac, 0xfe, 0x4000000000000000, 0xfffffffffffffffb}, {0x0, 0x0, 0x200000000000000}, 0x800}}, 0xb8}}, 0x2c004010) r8 = socket(0x1, 0x803, 0x0) setsockopt$IP_VS_SO_SET_ZERO(r8, 0x0, 0x48f, &(0x7f0000000040)={0x67, @empty, 0x4e20, 0x3, 'fo\x00', 0x2b, 0xe, 0x55}, 0x2c) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000005c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x29}, {0x0, 0x0, 0x7, 0x0, 0x0, 0x2, 0xffffffffffffffff}, {0x0, 0x0, 0x0, 0xffffffffffffffff}}}, 0xb8}}, 0x4004) 2m39.523620804s ago: executing program 5 (id=2342): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001380)={0x14, 0x102e, 0x9, 0xfffffffe, 0x25dfdbfd, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x2400c080}, 0x0) 2m39.169509489s ago: executing program 5 (id=2343): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x76a9bba1a690db0f, 0x0, 0x0, {0xa, 0x0, 0x2005}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x3cb140bb}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}]}, @NFTA_CHAIN_POLICY={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r3 = socket(0x11, 0x3, 0x0) setsockopt$packet_int(r3, 0x107, 0xf, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x11}, 0x20040054) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f0000000900)=ANY=[@ANYBLOB="fc000000190001002dbd70000000000000000000000000000000000000000000ac1414aa00000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000000080000000000000000010000000000000044000500ac1414aa000004000000000000000000000000003c00000002000000ac1414aa0000000000000000000000000600000004"], 0xfc}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r5, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="0000000008440000300012800b00010067656e657665000020000280140007000000000000000000000000000000000105000c000100000008000a00", @ANYRES32=r5], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 2m38.872306868s ago: executing program 5 (id=2344): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, 0x0, 0x0) write(r0, &(0x7f0000000100)="1800000016005f0214fffffffffffff80700000001000000", 0x18) 2m38.691008519s ago: executing program 5 (id=2345): r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x802) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r2, 0x541b, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20fff}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) add_key$fscrypt_provisioning(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x0}, &(0x7f00000005c0)={0x1, 0x0, @a}, 0x48, 0xfffffffffffffffb) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2800) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000108117980800000000000109022400010000000009040000020308000009210000010122290a090581"], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x80000001}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0x80}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f00000005c0)='syz_tun\x00', 0x10) sendto$inet(r7, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x42, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa3747e76de3790800450000340000000000069078ac1414bbac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="8c020069cb6a70000000000000af0000e7570000"], 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'ip6gre0\x00', 0x0, 0x2f, 0x40, 0x1, 0x2, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback, 0x700, 0x10, 0x7, 0xfffff801}}) sendmmsg$inet(r4, &(0x7f0000000e40)=[{{&(0x7f00000000c0)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="140000000000000000000000010000002700000000000000140000000000000000000000020000000d000000000000001400000000000000000000000100000006000000000000001400000000000000000000000200000006000000000000001400000000000000000000000200000001000000000000002400000000000000000000000700000044145b43e000000100000002ac1414bb00000008000000001c000000000000000000000008000000", @ANYRES32=r5, @ANYBLOB="ac1e0001ac1e0001000000001c000000000000000000000008000000", @ANYRES32=r8, @ANYBLOB="0a010000000000000000000077ce8c5e0d772cae455320c5ca35b0c5e4bc76bb447e78727d8b6f8783fb21633c354338f704a02026db09cb1097f1e6a082825e22ceb119a99cf4136ae19847fd34b51719"], 0xe0}}, {{&(0x7f00000008c0)={0x2, 0x4, @private=0xa010100}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000900)="c2b044a578a2dbdbb597f46412c09289cd80df34c7f3d8d5b876b4d439730f3e0ef04fc74f7d8ff1cb48dc6819aa22aafd23ac1241ba26adc1b65757f5094a09a6c69ef58e5a909499d4367ee4e02c898d6b1f352456b05dd7e0e775e77ef6f6117e40819b63ea", 0x67}], 0x1, &(0x7f00000009c0)=[@ip_retopts={{0xf8, 0x0, 0x7, {[@cipso={0x86, 0x2a, 0x1, [{0x7, 0xb, "7b40efbf6b7ab3bdb7"}, {0x2, 0x11, "c8f8398713c73b35263412439d13ab"}, {0x0, 0x8, "adf2ecafc64f"}]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x17, 0x97, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @local]}, @end, @timestamp_addr={0x44, 0x44, 0x58, 0x1, 0x1, [{@local, 0xfff}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@multicast2, 0x1800000}, {@local, 0x7ff}, {@multicast1}, {@local, 0x9}, {@loopback, 0x8}]}, @end, @timestamp_prespec={0x44, 0x4c, 0x17, 0x3, 0x4, [{@dev={0xac, 0x14, 0x14, 0x2e}, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x55}, {@rand_addr=0x64010102, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@multicast1, 0xfffffffc}, {@loopback, 0x200}, {@empty, 0xf}, {@rand_addr=0x64010102}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2000}]}, @end, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0xc, 0x5e, 0x3, 0x6, [{@multicast1, 0x4}]}]}}}, @ip_retopts={{0x74, 0x0, 0x7, {[@timestamp_prespec={0x44, 0xc, 0x7a, 0x3, 0xa, [{@dev={0xac, 0x14, 0x14, 0x30}, 0x8}]}, @end, @rr={0x7, 0x23, 0xb4, [@broadcast, @broadcast, @loopback, @private=0xa010101, @local, @multicast1, @multicast1, @broadcast]}, @rr={0x7, 0x1f, 0xfa, [@local, @private=0xa010100, @loopback, @rand_addr=0x64010102, @broadcast, @loopback, @private=0xa010100]}, @cipso={0x86, 0x15, 0x1, [{0x7, 0x4, "c61a"}, {0x5, 0xb, "43faf0d1943dabb702"}]}]}}}], 0x170}}, {{&(0x7f0000000b40)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, &(0x7f0000000d40)=[{&(0x7f0000000b80)="f5f2db72f61ef0077413611326c42d8b786aa88eaa0b8701b66b0b2bcbc9fa21e499b87ba306a812f298d8e611adff639b13f1460a77078e9a1a196da1e4e88b6a197841d8350583a9175f54663ced89803d9ddd851ba463ffa6f3a20fa7a901e63e30618bc257f9773c89c0ae04d2316af23419cb77", 0x76}, {&(0x7f0000000c00)="ee4d06d92acc03ff3d2145ca356575ec7064aed7f57e5393ef72a9862573679607257c49ec26a60b6a75951cbab93c058b1f3b1a9201d87e899c023e5a3c68f7c9cef3df9030a95205a2956a94d7aa0ecfa320dec08a0e", 0x57}, {&(0x7f0000000c80)="93f36ca3ed151966dd39ae6783562903f24eddc81ae67620afa74fed94e608792c553be9069240cae1c106837734cdc41919544a6ea90bf56e64cc80153286ad0236dc169bb44a69ecd41fecbf9a028d6c6fd05c2d56bcfea7bdfbf54dd5123edab0c9948f7e651212740ce3cb0c13a8e1bd89b35c249215ad09b2a5b285650baf59203d69f7923bb3a100e5a2ce9d0439cc1e0f5f2a85f91ac155d6abc5fdcf767814e870f22a8643e63ce66f6ddc", 0xaf}], 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="2800000000000000000000000700000083119c9fd7fdab28a3e158282e94e576b294067f53bd43001400000000000000000000000100000002000000000000001100000000000000000000000100000006000000000000001100000000000000000000000100000068000000000000001100"/123], 0x88}}], 0x3, 0x40000) 2m23.161058606s ago: executing program 34 (id=2345): r0 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x802) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r2, 0x541b, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x9, 0x5, 0x20fff}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r1, 0x100000000) add_key$fscrypt_provisioning(&(0x7f0000000540), &(0x7f0000000580)={'syz', 0x0}, &(0x7f00000005c0)={0x1, 0x0, @a}, 0x48, 0xfffffffffffffffb) linkat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x2800) r3 = socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000000000108117980800000000000109022400010000000009040000020308000009210000010122290a090581"], 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0xc, &(0x7f0000000000)=0x201, 0x4) ioctl$ifreq_SIOCGIFINDEX_team(r3, 0x8933, &(0x7f0000000140)={'team0\x00', 0x0}) syz_genetlink_get_family_id$tipc(0x0, 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000001c6a000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)={{0x14, 0x10, 0x1, 0x0, 0x0, {0xa}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x80000001}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0x80}}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'wlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r7, &(0x7f0000000040)={0x2, 0x4e22, @empty}, 0x67) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f00000005c0)='syz_tun\x00', 0x10) sendto$inet(r7, 0x0, 0x0, 0x24000840, &(0x7f0000000080)={0x2, 0x0, @remote}, 0x10) syz_emit_ethernet(0x42, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa3747e76de3790800450000340000000000069078ac1414bbac1414aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="8c020069cb6a70000000000000af0000e7570000"], 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000280)={'ip6gre0\x00', &(0x7f0000000200)={'ip6gre0\x00', 0x0, 0x2f, 0x40, 0x1, 0x2, 0x6, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, @loopback, 0x700, 0x10, 0x7, 0xfffff801}}) sendmmsg$inet(r4, &(0x7f0000000e40)=[{{&(0x7f00000000c0)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, &(0x7f0000000100), 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="140000000000000000000000010000002700000000000000140000000000000000000000020000000d000000000000001400000000000000000000000100000006000000000000001400000000000000000000000200000006000000000000001400000000000000000000000200000001000000000000002400000000000000000000000700000044145b43e000000100000002ac1414bb00000008000000001c000000000000000000000008000000", @ANYRES32=r5, @ANYBLOB="ac1e0001ac1e0001000000001c000000000000000000000008000000", @ANYRES32=r8, @ANYBLOB="0a010000000000000000000077ce8c5e0d772cae455320c5ca35b0c5e4bc76bb447e78727d8b6f8783fb21633c354338f704a02026db09cb1097f1e6a082825e22ceb119a99cf4136ae19847fd34b51719"], 0xe0}}, {{&(0x7f00000008c0)={0x2, 0x4, @private=0xa010100}, 0x10, &(0x7f0000000980)=[{&(0x7f0000000900)="c2b044a578a2dbdbb597f46412c09289cd80df34c7f3d8d5b876b4d439730f3e0ef04fc74f7d8ff1cb48dc6819aa22aafd23ac1241ba26adc1b65757f5094a09a6c69ef58e5a909499d4367ee4e02c898d6b1f352456b05dd7e0e775e77ef6f6117e40819b63ea", 0x67}], 0x1, &(0x7f00000009c0)=[@ip_retopts={{0xf8, 0x0, 0x7, {[@cipso={0x86, 0x2a, 0x1, [{0x7, 0xb, "7b40efbf6b7ab3bdb7"}, {0x2, 0x11, "c8f8398713c73b35263412439d13ab"}, {0x0, 0x8, "adf2ecafc64f"}]}, @ra={0x94, 0x4, 0x1}, @lsrr={0x83, 0x17, 0x97, [@dev={0xac, 0x14, 0x14, 0x18}, @multicast2, @initdev={0xac, 0x1e, 0x1, 0x0}, @rand_addr=0x64010102, @local]}, @end, @timestamp_addr={0x44, 0x44, 0x58, 0x1, 0x1, [{@local, 0xfff}, {@local}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x9}, {@multicast2, 0x1800000}, {@local, 0x7ff}, {@multicast1}, {@local, 0x9}, {@loopback, 0x8}]}, @end, @timestamp_prespec={0x44, 0x4c, 0x17, 0x3, 0x4, [{@dev={0xac, 0x14, 0x14, 0x2e}, 0x4}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x55}, {@rand_addr=0x64010102, 0x9}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x8}, {@multicast1, 0xfffffffc}, {@loopback, 0x200}, {@empty, 0xf}, {@rand_addr=0x64010102}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2000}]}, @end, @ra={0x94, 0x4}, @timestamp_prespec={0x44, 0xc, 0x5e, 0x3, 0x6, [{@multicast1, 0x4}]}]}}}, @ip_retopts={{0x74, 0x0, 0x7, {[@timestamp_prespec={0x44, 0xc, 0x7a, 0x3, 0xa, [{@dev={0xac, 0x14, 0x14, 0x30}, 0x8}]}, @end, @rr={0x7, 0x23, 0xb4, [@broadcast, @broadcast, @loopback, @private=0xa010101, @local, @multicast1, @multicast1, @broadcast]}, @rr={0x7, 0x1f, 0xfa, [@local, @private=0xa010100, @loopback, @rand_addr=0x64010102, @broadcast, @loopback, @private=0xa010100]}, @cipso={0x86, 0x15, 0x1, [{0x7, 0x4, "c61a"}, {0x5, 0xb, "43faf0d1943dabb702"}]}]}}}], 0x170}}, {{&(0x7f0000000b40)={0x2, 0x4e24, @rand_addr=0x64010100}, 0x10, &(0x7f0000000d40)=[{&(0x7f0000000b80)="f5f2db72f61ef0077413611326c42d8b786aa88eaa0b8701b66b0b2bcbc9fa21e499b87ba306a812f298d8e611adff639b13f1460a77078e9a1a196da1e4e88b6a197841d8350583a9175f54663ced89803d9ddd851ba463ffa6f3a20fa7a901e63e30618bc257f9773c89c0ae04d2316af23419cb77", 0x76}, {&(0x7f0000000c00)="ee4d06d92acc03ff3d2145ca356575ec7064aed7f57e5393ef72a9862573679607257c49ec26a60b6a75951cbab93c058b1f3b1a9201d87e899c023e5a3c68f7c9cef3df9030a95205a2956a94d7aa0ecfa320dec08a0e", 0x57}, {&(0x7f0000000c80)="93f36ca3ed151966dd39ae6783562903f24eddc81ae67620afa74fed94e608792c553be9069240cae1c106837734cdc41919544a6ea90bf56e64cc80153286ad0236dc169bb44a69ecd41fecbf9a028d6c6fd05c2d56bcfea7bdfbf54dd5123edab0c9948f7e651212740ce3cb0c13a8e1bd89b35c249215ad09b2a5b285650baf59203d69f7923bb3a100e5a2ce9d0439cc1e0f5f2a85f91ac155d6abc5fdcf767814e870f22a8643e63ce66f6ddc", 0xaf}], 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="2800000000000000000000000700000083119c9fd7fdab28a3e158282e94e576b294067f53bd43001400000000000000000000000100000002000000000000001100000000000000000000000100000006000000000000001100000000000000000000000100000068000000000000001100"/123], 0x88}}], 0x3, 0x40000) 2m14.913628735s ago: executing program 6 (id=2417): socket$nl_generic(0x10, 0x3, 0x10) openat$vimc2(0xffffffffffffff9c, &(0x7f0000001080), 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_audit(0x10, 0x3, 0x9) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="38000b001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r1, @ANYBLOB="06001500070000000c00168008000100", @ANYRES64=r0], 0x38}}, 0x10) 2m14.586458457s ago: executing program 6 (id=2418): shmdt(0x0) (async) syz_emit_ethernet(0x46, &(0x7f00000000c0)={@link_local={0x3}, @link_local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x66, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x5, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @initdev={0xac, 0x1e, 0x0, 0x0}}, "140022ebe46a252e"}}}}}, 0x0) (async) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x90, 0x0, 0x2, 0x401, 0x0, 0x0, {0xa}, [@CTA_EXPECT_MASTER={0x4}, @CTA_EXPECT_MASK={0x3c, 0x3, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x1}}, @CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @private0}, {0x14, 0x4, @mcast1}}}]}, @CTA_EXPECT_TUPLE={0x3c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x2c, 0x1, 0x0, 0x1, @ipv6={{0x14, 0x3, @mcast2}, {0x14, 0x4, @mcast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x86}}]}]}, 0x90}, 0x1, 0x0, 0x0, 0x20008004}, 0x4) r1 = syz_open_dev$amidi(&(0x7f0000000140), 0x2, 0x181) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x2000) (async) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r1, 0x40045731, &(0x7f0000000300)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000040)='nv', 0x2) (async) socket$inet(0x2, 0x80001, 0x84) (async) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) (async) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x200105d0}], 0x1}, 0x1f00) (async) sendmsg$tipc(r5, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0xfffffdef}], 0x1}, 0x0) (async) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) bind$can_raw(r6, &(0x7f00000001c0)={0x1d, r7}, 0x10) (async) setsockopt$CAN_RAW_RECV_OWN_MSGS(r6, 0x65, 0x4, &(0x7f00000003c0)=0x1, 0x4) ioctl$SIOCGSTAMP(r6, 0x8906, 0x0) (async) sendmsg$can_raw(r6, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=@can={{}, 0x0, 0x3, 0x0, 0x0, "00000010000300"}, 0x10}}, 0x20000000) (async, rerun: 64) r8 = dup2(r4, r5) (rerun: 64) ioctl$SNDCTL_SYNTH_ID(r8, 0xc08c5114, &(0x7f0000000540)={"806ab2bb3727efa9ddfdbc14e42b7e5b4d8b40b05d524bfe6881ec45d687", 0x4, 0x0, 0x1, 0xfffffff8, 0xfffffff3, 0xa, 0x2, 0x4, [0x80, 0x2, 0xffffff06, 0x7, 0x7, 0x40, 0x2, 0x9, 0x9, 0x2, 0x8, 0xe, 0xfffffffc, 0x9, 0x4, 0x8000, 0xf, 0x101]}) (async) read(r6, &(0x7f0000002340)=""/232, 0xe8) setsockopt$sock_int(r3, 0x1, 0xf, &(0x7f0000000180)=0x40, 0x4) bind$inet6(r3, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x3c}}}, 0x1c) (async) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r9, &(0x7f0000000340)={0xa, 0x4e22, 0xc, @loopback, 0x9}, 0x1c) syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d0009050303"], &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) 2m11.393894751s ago: executing program 6 (id=2429): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$dvb_demux(&(0x7f0000000000), 0x0, 0x480) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/6, 0x6}], 0x1, 0x7, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x8, 0x20, 0x0, 0x6, {{0x7, 0x4, 0x1, 0x3b, 0x1c, 0x66, 0x0, 0xd1, 0x29, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, {[@timestamp={0x44, 0x8, 0xd1, 0x0, 0x2, [0x14]}]}}}}}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000340)={r3, 0x1, 0x6, @broadcast}, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x1ff}, 0x0) r4 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) close(r1) r5 = socket(0x1e, 0x4, 0x0) recvmmsg(r5, &(0x7f00000052c0)=[{{&(0x7f0000000180)=@ax25={{0x3, @netrom}, [@netrom, @remote, @netrom, @default, @null, @remote, @netrom, @default]}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000200)=""/189, 0xbd}], 0x1}, 0xef35}, {{&(0x7f0000000780)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000001d80)}, 0x79}], 0x2, 0x2000, 0x0) shmat(r4, &(0x7f0000f62000/0x1000)=nil, 0x7000) mremap(&(0x7f0000f7f000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x5) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x8000}}) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x4, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) 2m9.810211098s ago: executing program 6 (id=2437): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000000)=0xd) set_mempolicy(0x5, &(0x7f0000000000)=0x2, 0x6) openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x187903, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x82) writev(r2, &(0x7f00000000c0)=[{&(0x7f0000000040)="273eebfecb7c0e923301b61c42cb1d11f41d00bdab2a3d983b065a56", 0x1c}, {&(0x7f00000002c0)="10eba9fdb4cbab48929e1af15100"/28, 0x1c}], 0x2) sendfile(r0, r1, 0x0, 0x9) 2m9.521791812s ago: executing program 6 (id=2439): syz_open_dev$dri(0x0, 0x700000000000000, 0x48040) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ff8000/0x2000)=nil, 0x0}, 0x68) socket$unix(0x1, 0x1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x10, 0x4, &(0x7f0000000040)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd}, 0x94) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x4004045) r0 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x399}) bind$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0xa}, 0x1c) io_uring_enter(r0, 0x8ae, 0x6933, 0x17, 0x0, 0xeffd) 2m9.04963242s ago: executing program 6 (id=2442): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000000c0)=0x8000000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x7, 0x0, 0x1, 0x12, 0xd7}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r3, &(0x7f00000007c0)={0x2020}, 0x2020) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000140)={@remote, @loopback, @loopback, 0x2, 0x5, 0x9, 0x400, 0x3, 0x2150084}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) setxattr$incfs_metadata(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040), 0x0, 0x0, 0x2) r4 = syz_open_dev$dri(0x0, 0x1, 0x10800) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x3}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x2, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x400, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000380)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x13ff, 0x0, &(0x7f0000000340)='\x00', 0x1, 0x0, 0x3, 0x2, 0xfffffffc, 0x0, 0x0}) socket$inet6(0xa, 0x1, 0x0) ioctl$USBDEVFS_DISCARDURB(r5, 0x550b, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$UI_SET_KEYBIT(r7, 0x40045565, 0x3b) sendfile(r6, r6, 0x0, 0x200000) 1m53.547142941s ago: executing program 35 (id=2442): r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f00000000c0)=0x8000000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x7, 0x0, 0x1, 0x12, 0xd7}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) mbind(&(0x7f00001e7000/0x2000)=nil, 0x2000, 0x8003, &(0x7f0000000000)=0x9, 0x3, 0x2) r3 = syz_open_procfs(0x0, &(0x7f0000000040)='smaps_rollup\x00') madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) read$FUSE(r3, &(0x7f00000007c0)={0x2020}, 0x2020) bind$inet(0xffffffffffffffff, &(0x7f00000001c0)={0x2, 0x4e20, @rand_addr=0x64010101}, 0x10) ioctl$sock_inet6_SIOCDELRT(r3, 0x890c, &(0x7f0000000140)={@remote, @loopback, @loopback, 0x2, 0x5, 0x9, 0x400, 0x3, 0x2150084}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) setxattr$incfs_metadata(&(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040), 0x0, 0x0, 0x2) r4 = syz_open_dev$dri(0x0, 0x1, 0x10800) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r4, 0xc02064b9, &(0x7f0000000dc0)={&(0x7f0000000280)=[0x0, 0x0, 0x0], 0x0, 0x3}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x2, 0x0, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x400, 0x0, 0x0, 0x41000, 0x42, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = syz_open_dev$usbfs(&(0x7f0000000080), 0x75, 0x109301) ioctl$USBDEVFS_SUBMITURB(r5, 0x8038550a, &(0x7f0000000380)=@urb_type_bulk={0x3, {0x1, 0x1}, 0x13ff, 0x0, &(0x7f0000000340)='\x00', 0x1, 0x0, 0x3, 0x2, 0xfffffffc, 0x0, 0x0}) socket$inet6(0xa, 0x1, 0x0) ioctl$USBDEVFS_DISCARDURB(r5, 0x550b, 0x0) r6 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0x2000, 0x0) r7 = openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$UI_SET_KEYBIT(r7, 0x40045565, 0x3b) sendfile(r6, r6, 0x0, 0x200000) 1m48.18551971s ago: executing program 0 (id=2497): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000080)={0x40209c, 0xb, 0x3, 0xfdffffef}, 0x10) write(r0, &(0x7f0000000100)="1800000016005f0214fffffffffffff807000000010000", 0x17) 1m48.041174759s ago: executing program 0 (id=2498): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) syz_io_uring_setup(0x517, &(0x7f0000000100)={0x0, 0x15d2, 0x1000, 0x1, 0x11f}, 0x0, 0x0, 0x0) r4 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r4, 0x40106f52, &(0x7f0000000000)={0x21, &(0x7f00000000c0)=[{0x11, '\x00', @data=0x6, 0x9}]}) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r2, 0x3ba0, &(0x7f0000000980)={0x48, 0x5, r3, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_ACCESS_RW(r2, 0x3ba0, &(0x7f0000000ac0)={0x81, 0x8, r5, 0x0, 0xfffffffffffffffc, 0xff6c, &(0x7f0000000000)='\x00\x00\x00\x00\x00'}) syz_usb_connect(0x3, 0x0, 0x0, 0x0) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r6 = openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) read$FUSE(r6, &(0x7f0000002d40)={0x2020}, 0xfffffffffffffc88) ioctl$AUTOFS_IOC_READY(r6, 0x9360, 0x7) read$FUSE(r6, &(0x7f0000002b80)={0x2020}, 0x2020) preadv(r0, &(0x7f0000002b40)=[{&(0x7f0000000180)=""/106, 0x6a}, {&(0x7f0000000b40)=""/4096, 0x1000}, {&(0x7f0000001b40)=""/4096, 0x1000}], 0x3, 0x9, 0x5) 1m46.849790063s ago: executing program 0 (id=2503): socket$xdp(0x2c, 0x3, 0x0) syz_open_dev$loop(0x0, 0x1, 0x122c42) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)=@newlink={0x6c, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2b24d, 0x11a20}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x30, 0x16, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, [@IFLA_VF_MAC={0x28, 0x1, {0x7b1}}]}]}, @IFLA_LINKMODE={0x5, 0x11, 0x6}]}, 0x6c}, 0x1, 0x0, 0x0, 0xc1}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0x6}, 0x0) syz_open_dev$video(0x0, 0x101, 0xab02) syz_open_dev$ttys(0xc, 0x2, 0x1) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) r3 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, 0x0) openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r5 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r5, 0xc0184800, &(0x7f0000000100)={0x4, r4}) pselect6(0x40, &(0x7f0000000180)={0x7f, 0x2000, 0x12, 0x2, 0x6, 0x9, 0x40, 0x2}, 0x0, 0x0, 0x0, 0x0) r6 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000bc0)='/proc/diskstats\x00', 0x0, 0x0) r7 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000001080), 0x0, 0x0) io_submit(0x0, 0x1, &(0x7f0000000800)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x5, 0xfffe, r7, 0x0}]) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000005ec0)={'ip6_vti0\x00', &(0x7f0000005e40)={'ip6gre0\x00', 0x0, 0x71, 0x2, 0x3, 0xfffffffd, 0x42, @dev={0xfe, 0x80, '\x00', 0x38}, @mcast1, 0x40, 0x80, 0x1, 0x7f}}) 1m45.560632227s ago: executing program 0 (id=2505): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r1 = openat$cgroup_pressure(0xffffffffffffffff, &(0x7f0000000040)='memory.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000100)={'some', 0x20, 0xffffffff, 0x20, 0x7}, 0x2f) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) syz_usb_connect(0x0, 0x36, &(0x7f00000004c0)=ANY=[@ANYBLOB="12010000693c1e10cd060202043e010203010902240001000000000904230002722f680009057a43ff0346090509050e"], 0x0) sendmsg$NFT_MSG_GETRULE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB="2c0000000738c986124dd20a010300080000000000000a004001090001007379030000000000090002007379fee6095237ac3a3d303f61ac3a6612f8317eca581ffbee41998fc8e58a18c5cf281191986d2ad97f91c0be3dcf7047cf02fa32ffd3614f3f9e95b9dc1aab7b6572c782eb4cbcfc286df66f850ffdbb222cd9682ea6a44ebe6d0d32b55827849651f33cd1ecc7452fb02b93fc84155b381ca66d75d150f38a06092e542d67e755bc747661b3ee6dcb4b304b95e77293bfb664b41e59f55cc7"], 0x2c}, 0x1, 0x0, 0x0, 0x20040850}, 0x44054) 1m42.745366201s ago: executing program 0 (id=2516): socket$inet6(0xa, 0x800000000000002, 0x0) process_vm_writev(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = syz_usb_connect(0x0, 0x24, 0x0, 0x0) r5 = semget(0x1, 0x4, 0x69c) semctl$SETALL(r5, 0x0, 0x11, 0x0) syz_usb_disconnect(r4) readv(0xffffffffffffffff, &(0x7f00000003c0)=[{0x0}], 0x1) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$unix(0x1, 0x5, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) r6 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0x0) setsockopt$RXRPC_UPGRADEABLE_SERVICE(r6, 0x110, 0x5, &(0x7f0000000000)=[0x3, 0x4], 0x2) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) unshare(0x24000400) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000680)=ANY=[], 0x50) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000b40)=@newlink={0x44, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8093, 0x8268}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macvtap={{0xc}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r1}, @IFLA_MASTER={0x8, 0xa, r8}]}, 0x44}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) 1m39.242213052s ago: executing program 0 (id=2530): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000011c0)={'tunl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x6, 0x7, 0xffe, 0x80002e4, {{0x5, 0x4, 0x0, 0xe, 0x14, 0x63, 0x1, 0x10, 0x29, 0x0, @multicast2, @remote}}}}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r4, 0xc08c5335, &(0x7f0000000440)={0x1, 0x2, 0x1, 'queue1\x00', 0x5}) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r4, 0x0) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0xffff, 0x2, 0x2, '\x00', 0x654}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1m24.040646809s ago: executing program 36 (id=2530): r0 = syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x8401) r1 = fcntl$dupfd(r0, 0x406, r0) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000080)={0x2, 0x3, 0x0, 0x0, 0x7995}, 0xfcb5, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r1, 0x89f1, &(0x7f00000011c0)={'tunl0\x00', &(0x7f0000000000)={'gre0\x00', 0x0, 0x6, 0x7, 0xffe, 0x80002e4, {{0x5, 0x4, 0x0, 0xe, 0x14, 0x63, 0x1, 0x10, 0x29, 0x0, @multicast2, @remote}}}}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cpuacct.usage_percpu_user\x00', 0x275a, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_INFO(r4, 0xc08c5335, &(0x7f0000000440)={0x1, 0x2, 0x1, 'queue1\x00', 0x5}) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000003, 0x28011, r4, 0x0) preadv(r4, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x1, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_SET_FPU(r4, 0x41a0ae8d, &(0x7f0000000240)={'\x00', 0x4, 0x9, 0xbd, 0x0, 0xffff, 0x2, 0x2, '\x00', 0x654}) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1m7.057927458s ago: executing program 1 (id=2610): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x0, 0x2, @dev={0xfe, 0x80, '\x00', 0x20}, 0x7}, 0x1c) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r1}, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYRES32=r1, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xff, 0x7, 0x7fc00002}]}) membarrier(0x10, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000300)) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r2, 0xc0502100, &(0x7f0000000440)) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r3, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r2, 0x0}]) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) socket$kcm(0x10, 0x2, 0x4) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x58, 0x2, 0x6, 0x301, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0x11, 0x3, 'hash:net,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x58}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_TEST(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000000c0)=ANY=[@ANYBLOB="640000000906010800000000000000000600000505000100070000003c0007801800148014000240fc0000000000000000000000000000011800018014000240ff01000000000000000000000000000105000300070000000900020073797a31"], 0x64}}, 0x4800) 1m4.869497138s ago: executing program 1 (id=2614): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x0, 0x3000000, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x31}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSETELEM={0x88, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4004}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x5c, 0x3, 0x0, 0x1, [{0x58, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x4c, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x45, 0x1, "c023471681f02c94d5e1fcc9edd3d3f514d42f153f23e012bf3d4e99c95d7e25e5f7c0a6097522b02e8af64bd0bf534e64a809e8cd3420d9d284b9e22ff5715d44"}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x124}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 1m4.800291843s ago: executing program 1 (id=2616): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$dvb_demux(&(0x7f0000000000), 0x0, 0x480) preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000040)=""/6, 0x6}], 0x1, 0x7, 0x0) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x8, 0x20, 0x0, 0x6, {{0x7, 0x4, 0x1, 0x3b, 0x1c, 0x66, 0x0, 0xd1, 0x29, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, {[@timestamp={0x44, 0x8, 0xd1, 0x0, 0x2, [0x14]}]}}}}}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x1ff}, 0x0) r3 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) close(r1) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r4, &(0x7f00000052c0)=[{{&(0x7f0000000180)=@ax25={{0x3, @netrom}, [@netrom, @remote, @netrom, @default, @null, @remote, @netrom, @default]}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000200)=""/189, 0xbd}], 0x1}, 0xef35}, {{&(0x7f0000000780)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000001d80)}, 0x79}], 0x2, 0x2000, 0x0) shmat(r3, &(0x7f0000f62000/0x1000)=nil, 0x7000) mremap(&(0x7f0000f7f000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x5) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x72, 0x4, 0x7fff0000}]}) close_range(r6, 0xffffffffffffffff, 0x0) 1m2.697644305s ago: executing program 1 (id=2619): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) setsockopt$inet_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000340)='nv', 0x2) connect$inet(r3, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000840)="89000000120081ae08060cdc030000fe7f030000014000000001ffca1b1f0000000024c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec00150c00014003080c00bdad446b31007a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947e", 0x75}, {&(0x7f0000000140)="11d6cb557c8496a2fe7a81f38210bfa9b70ee09c", 0x14}], 0x2}, 0x4000000) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x29, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x3b, 0x0, 0x0) r5 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r6 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r6, r5, &(0x7f0000002080)=0x3a, 0x23b) 1m0.464731759s ago: executing program 1 (id=2621): syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYRES32=0x0], 0x0) r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x181703, 0x0) ioctl$SNDCTL_SEQ_OUTOFBAND(r0, 0x40085112, &(0x7f0000000480)=@v={0x93, 0xc, 0x90, 0x13, @MIDI_NOTEON=@special, 0x6, 0x8}) 57.28506526s ago: executing program 1 (id=2625): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r0, &(0x7f00000012c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001280)={&(0x7f0000001480)=ANY=[@ANYBLOB="60100000010500000000000000000000050000095402010003000000000001000c0029070700070073797a310000000000000000000000000000000000000000000000000000000009e9706f4da8f714ff02d54cb78a81a27cf1f42c757ba285d3aa2fe54e65432b2e33c4c6b07b3afb2d68a331942a028e3599a45d2d33cc33e3f62d50750faa506ff40700010000000200000001000400030000000600000000027f0003000000000800000008c4d003000000090000000500000403000000ff0700000200010000000000be00000004000300810094df0100000009000000080002000300000003000000050081000100000005000000ea5f070000000000070000000300070003000000feffffffff03040000000000fcffffff0100040001000000010000000600040000000000000000000000000201000000070000000104070002000000000200000200010000000000090000000100080002000000080000000500030001000000ffffffff0200a6080100000005000000587f0300010000000200000000000300020000000500000069040000020000000600000003000700030000000800000003000700010000000d0000004000c60d0200000000000000260103000000000003000000ff070300010000000d000000020000040300000028cf0000f9ff03000300000005000000020053000000000002000000090000000200000002000000b700010000000000020000000400010403000000b2cf0000ff000100030000004a0500000e0008fd02000000070000000600cc0900000000020000008100010003000000030000001000000002000000ff0700005402010000000000020000000206ffffff010c0073797a3100000000000000000000000000000000000000000000000000000000f1be73d9e6ae4c2d3c112f14f9ba728d56b0980fd05ec46c6f505cd3a5683a56df4ac519f1002108c60a5e26803a5aa8a3ca4283090e67f2463cbd7fbc6a408d08000400000000000400000008000700020000000200000009000a000000000009000000030009000200000008000000100001800300000004000000050001000200000003000000a0000000010000000800000008000200010000000000000000000100030000000300000007000d0000000000e70000000d00080001000000040000000d0001000100000009000000000009000200000001800000100000020300000008000000270e070002000000090000000600ff0000000000000200000700020003000000ffffff7f030047090300000001000000040007000100000000040000090006000100000000000000050000f002000000f9ffffffff0f800000000000f9f9ffff080001000200000000000004f7ff0b000300000003000000000899000100000002000000080002000000000037b80000060009000100000009000000c0ff070002000000100000000700010002000000050000000000010002000000fdffffff080000100200000007000000060000000300000035000000001001000300000006000000ffff0b0000000000020000000100000103000000020000000800030002000000ff7f00000400030000000000010400000700f7ff00000000040000000000080003000000050000000004ff000200000008000000540201000300000000010000040007000000160073797a300000000000000000000000000000000000000000000000000000000026da6849460ccc040c83a7f09d11f1724e4876451b15210e8ce1e1cb5fcafa68a27e1f110b51add750ce3643b79028dae9516c96c941f3af9638e379b795ce04f6f77f0003000000030000000700fcff02000000920b000009000e000100000004000000ff7f110e01000000070000000400070003000000d60d00007ba6548e010000000200000009008400030000000900000004000300030000000400000000000500030000000a000000040007000100000000000000f1000100000000001e0000000000010000000000186d38360500b10003000000070000000b00010101000000090000000001110000000000f7ffffff0100870300000000f8ffffff00020300010000000400000009001600000000000100000003000700010000000300000002000900010000000900000007000700020000000200000009000200c7051d070080000003000600010000000203000002000c00030000000800000042000700030000001d0000000000ffff01000000010000000e0022008e5392c81c09000000040700030000000700000001047f00010000000200000001809bde020000000200000004001611010000000500000089030200010000000f0000000000800002000000090000000100040000000000238e00000900460b020000000500000003000a000000000003000000af00faff00000000090000000300050002000000030000001c050a000300000080ffffff0400000003000000090000005402010003000000000000000d03b6de0002140073797a31000000000000000000000000000000000000000000000000000000006a1c498d2d086b55d99904da041395476aba09faf251189a92fa1b3f4a13ade034b1ced55379c2de27599666ac3ad6ec6d8f58c162222d953c0b512031a2f7690700050002000000f00200000300060000000000e000000001048000020000000001000000009d000200000000000100080002000200000008000000ff0100000100000003000000c459090003000000330000000104070002000000080000000900010100000000090000001200060001000000f9ffffff010009000300000000000000ef00b20002000000000000e80800eb0f02000000030000000200ff0102000000090000002b0080ff02000000070000000500090001000000a43ea2edc993248de3b390973d00000002000000020000000c0000000d0009000000000006000000070002000300000007000000020081000100000002000000ff00fdff0300000007000000feff040003000000010000808700010000000000c00300000700020002000000070000000b0050000100000003000000f0ff030001000000010000000100d3000000000009000000f800340201000000ffffffff0800ff01b3bed92b020000000500f7ff02000000020000000400010000000000800000000e00040003000000e70400004802c04502000000040000000100ed0c00000000dd0000004806008001000000010000007f00020000000000060000007f00ff07020000002c0700000100030003000000100000000500030000000000060000000600ff0f0200000003000000540201000000000004000000071706000200040073797a31000000000000000000000000000000000000000000000000000000009cb960897177b8e3684dda39ef68ccc767eee7395eef4f7fa70e135b61b06a12835e9c2b220513c8fdc950f7b9192314a22ab57a85e193d91e89be2c0fc1bbd44bff0e000300000001000080ff00e50003000000f30000000100578602000000008000008c0a00000000000030d8000008000f0008e8ecf20000000000000100010000001b0000000800ff7f03000000b200000009007f0001000000f50b00000600030001000000090000000900060000000000060000000200c00000000000d7feffff040009000000000001000080090008000100000000100000ffffa900020000000b0000000e00ff000100000008000000050005000100000000000038f1ff000001000000090000000200080002000000020000000100070002000000030000004000000200000000070000004000050000000000a20000000500000001000000ac0b000000000b0003000000010000000200060001000000000100000800c100030000000700000001800400030000000200000089000020010000000700000001003e0b03000000400000000200ff0f0000000000000000010007000200000005000000ff0fda0001000000010400000400090001000000000000000400020000000000090000000001600002000000000000880000100002000000030000000101010002000000ffff0000b3000e0001000000050000000400030001000000008000000900010003000000fa00000001000200010000000700000054020100030000000600000005dc0d090300000073797a3100000000000000000000000000000000000000000000000000000000ae4ce3832b64b998215d697a70681d56e6aa5b4e7fc0b22f8cdac64a6d39c25b9f555d991ab487e25bba2af7a5f3840c38870b46ec716ef96a147f684cd9a6320200d90d03000000e01616000100050001000000040000000700400003000000fa000000080002000100000ca87e3138cfe16649c67600e5af000003004fc102000000ffff0000ff00ff0f01000000070000006f06000000000000ff0f00000200143e03000000000000000658010001000000ffffffff01000900030000000600000010000d00000000005f090000ff0f050003000000090000000500ff010100000009000000a9ff2202000000000c0000000400030000000000fcffffff0400000003000000070000000900b2bf030000000c0000000800080001000000000000000c0004000200000008000000000803000300000000800000080009000200000008000000182f326d0200000002000000030017000300000002000000ea07c50800000000000400000700f8ff030000000200000001000000010000003d0800000200770302000000070000000d000600000000001900000008009b7200000000050000000100040002000000050000000600ff010100000000010000427c98d001000000faffffff09000600030000000100010000000400000000000500000004000600020000000000000004000700010000000300000009003d0003000000030000003100f00001000000ffffff7f0101050002000000ff010000ab1707000300000008000000540201000300000002000000000204000300120073797a30000000000000000000000000000000000000000000000000000000001255fccfe405968c11599361e95c9eb5c6f5bff978231f355f5ab815f41359ad336c8d36168eaf17ae47df3baf92029665bce9eaca7e5a17d82d2cc6ccab98310800001000000000000000000c000000020000000a000000070009000000000000000000000409000200000003000000020005000200000001000080000208000300000002000000dfff9b070300000001000000e1a50400020000000000000001000400020000000400000000800400010000001000000003000700030000000100000001fc10000300000000000000799be00d03000000080000000700000200000000070000000e00c0ff00000000010000000500060001000000030000000000080000000000943c00000100ff0f03000000fa0000000800008002000000050000000700ff0f0000000002000000000005000000000003000000030fff7f0100000006000000000003000300000003000000030001000000000055d00000008006000000000004000000000005000200000005000000051210d602000000080000000c001000020000000700000001000e00000000000700000001008e0003000000020000000100050003000000080000000000060003000000060000004000650001000000ff03000004000300010000000000ffff04000a0002000000840100000700010401000000050000001000060000000000f6fffffffeff7f00020000000100000002000500020000000600000081725a5f04e4ed14c05ea0f5caa862fcf5f151f83b48d955"], 0x1060}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x205, 0x2) mmap(&(0x7f000006e000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r1, 0xffb0c000) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r2, &(0x7f0000000200)='m', 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000003c0)=@newqdisc={0x24, 0x24, 0x50b, 0x8, 0x3, {0x60, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xffff, 0xffff}, {0x1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="4801000042000100fffffffffddbdf250200000004003880100001800c00c8000200000000000000200104801c"], 0x148}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/mcfilter6\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001040)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r5}, 0x68) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="fffffffffffffffffeffffff0800450000300000000026ac9777f01a991d0067907800000000ffffffff2100907812000228250000240000000000000000e0000002d7fffffc"], 0x0) r6 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x30bd, 0xc000, 0x8, 0x40000185}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x10000000007, 0x2102) syz_usb_disconnect(r7) close(r8) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000100)) r9 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r9, &(0x7f0000000200)="a3", 0x1) r10 = socket$inet6(0xa, 0x80002, 0x0) getsockopt$inet6_mreq(r10, 0x88, 0x66, 0x0, &(0x7f0000000000)=0xfffffffffffffe09) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r9, 0xc0984124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 42.217929746s ago: executing program 37 (id=2625): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_REMOVE(r0, &(0x7f00000012c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000001280)={&(0x7f0000001480)=ANY=[@ANYBLOB="60100000010500000000000000000000050000095402010003000000000001000c0029070700070073797a310000000000000000000000000000000000000000000000000000000009e9706f4da8f714ff02d54cb78a81a27cf1f42c757ba285d3aa2fe54e65432b2e33c4c6b07b3afb2d68a331942a028e3599a45d2d33cc33e3f62d50750faa506ff40700010000000200000001000400030000000600000000027f0003000000000800000008c4d003000000090000000500000403000000ff0700000200010000000000be00000004000300810094df0100000009000000080002000300000003000000050081000100000005000000ea5f070000000000070000000300070003000000feffffffff03040000000000fcffffff0100040001000000010000000600040000000000000000000000000201000000070000000104070002000000000200000200010000000000090000000100080002000000080000000500030001000000ffffffff0200a6080100000005000000587f0300010000000200000000000300020000000500000069040000020000000600000003000700030000000800000003000700010000000d0000004000c60d0200000000000000260103000000000003000000ff070300010000000d000000020000040300000028cf0000f9ff03000300000005000000020053000000000002000000090000000200000002000000b700010000000000020000000400010403000000b2cf0000ff000100030000004a0500000e0008fd02000000070000000600cc0900000000020000008100010003000000030000001000000002000000ff0700005402010000000000020000000206ffffff010c0073797a3100000000000000000000000000000000000000000000000000000000f1be73d9e6ae4c2d3c112f14f9ba728d56b0980fd05ec46c6f505cd3a5683a56df4ac519f1002108c60a5e26803a5aa8a3ca4283090e67f2463cbd7fbc6a408d08000400000000000400000008000700020000000200000009000a000000000009000000030009000200000008000000100001800300000004000000050001000200000003000000a0000000010000000800000008000200010000000000000000000100030000000300000007000d0000000000e70000000d00080001000000040000000d0001000100000009000000000009000200000001800000100000020300000008000000270e070002000000090000000600ff0000000000000200000700020003000000ffffff7f030047090300000001000000040007000100000000040000090006000100000000000000050000f002000000f9ffffffff0f800000000000f9f9ffff080001000200000000000004f7ff0b000300000003000000000899000100000002000000080002000000000037b80000060009000100000009000000c0ff070002000000100000000700010002000000050000000000010002000000fdffffff080000100200000007000000060000000300000035000000001001000300000006000000ffff0b0000000000020000000100000103000000020000000800030002000000ff7f00000400030000000000010400000700f7ff00000000040000000000080003000000050000000004ff000200000008000000540201000300000000010000040007000000160073797a300000000000000000000000000000000000000000000000000000000026da6849460ccc040c83a7f09d11f1724e4876451b15210e8ce1e1cb5fcafa68a27e1f110b51add750ce3643b79028dae9516c96c941f3af9638e379b795ce04f6f77f0003000000030000000700fcff02000000920b000009000e000100000004000000ff7f110e01000000070000000400070003000000d60d00007ba6548e010000000200000009008400030000000900000004000300030000000400000000000500030000000a000000040007000100000000000000f1000100000000001e0000000000010000000000186d38360500b10003000000070000000b00010101000000090000000001110000000000f7ffffff0100870300000000f8ffffff00020300010000000400000009001600000000000100000003000700010000000300000002000900010000000900000007000700020000000200000009000200c7051d070080000003000600010000000203000002000c00030000000800000042000700030000001d0000000000ffff01000000010000000e0022008e5392c81c09000000040700030000000700000001047f00010000000200000001809bde020000000200000004001611010000000500000089030200010000000f0000000000800002000000090000000100040000000000238e00000900460b020000000500000003000a000000000003000000af00faff00000000090000000300050002000000030000001c050a000300000080ffffff0400000003000000090000005402010003000000000000000d03b6de0002140073797a31000000000000000000000000000000000000000000000000000000006a1c498d2d086b55d99904da041395476aba09faf251189a92fa1b3f4a13ade034b1ced55379c2de27599666ac3ad6ec6d8f58c162222d953c0b512031a2f7690700050002000000f00200000300060000000000e000000001048000020000000001000000009d000200000000000100080002000200000008000000ff0100000100000003000000c459090003000000330000000104070002000000080000000900010100000000090000001200060001000000f9ffffff010009000300000000000000ef00b20002000000000000e80800eb0f02000000030000000200ff0102000000090000002b0080ff02000000070000000500090001000000a43ea2edc993248de3b390973d00000002000000020000000c0000000d0009000000000006000000070002000300000007000000020081000100000002000000ff00fdff0300000007000000feff040003000000010000808700010000000000c00300000700020002000000070000000b0050000100000003000000f0ff030001000000010000000100d3000000000009000000f800340201000000ffffffff0800ff01b3bed92b020000000500f7ff02000000020000000400010000000000800000000e00040003000000e70400004802c04502000000040000000100ed0c00000000dd0000004806008001000000010000007f00020000000000060000007f00ff07020000002c0700000100030003000000100000000500030000000000060000000600ff0f0200000003000000540201000000000004000000071706000200040073797a31000000000000000000000000000000000000000000000000000000009cb960897177b8e3684dda39ef68ccc767eee7395eef4f7fa70e135b61b06a12835e9c2b220513c8fdc950f7b9192314a22ab57a85e193d91e89be2c0fc1bbd44bff0e000300000001000080ff00e50003000000f30000000100578602000000008000008c0a00000000000030d8000008000f0008e8ecf20000000000000100010000001b0000000800ff7f03000000b200000009007f0001000000f50b00000600030001000000090000000900060000000000060000000200c00000000000d7feffff040009000000000001000080090008000100000000100000ffffa900020000000b0000000e00ff000100000008000000050005000100000000000038f1ff000001000000090000000200080002000000020000000100070002000000030000004000000200000000070000004000050000000000a20000000500000001000000ac0b000000000b0003000000010000000200060001000000000100000800c100030000000700000001800400030000000200000089000020010000000700000001003e0b03000000400000000200ff0f0000000000000000010007000200000005000000ff0fda0001000000010400000400090001000000000000000400020000000000090000000001600002000000000000880000100002000000030000000101010002000000ffff0000b3000e0001000000050000000400030001000000008000000900010003000000fa00000001000200010000000700000054020100030000000600000005dc0d090300000073797a3100000000000000000000000000000000000000000000000000000000ae4ce3832b64b998215d697a70681d56e6aa5b4e7fc0b22f8cdac64a6d39c25b9f555d991ab487e25bba2af7a5f3840c38870b46ec716ef96a147f684cd9a6320200d90d03000000e01616000100050001000000040000000700400003000000fa000000080002000100000ca87e3138cfe16649c67600e5af000003004fc102000000ffff0000ff00ff0f01000000070000006f06000000000000ff0f00000200143e03000000000000000658010001000000ffffffff01000900030000000600000010000d00000000005f090000ff0f050003000000090000000500ff010100000009000000a9ff2202000000000c0000000400030000000000fcffffff0400000003000000070000000900b2bf030000000c0000000800080001000000000000000c0004000200000008000000000803000300000000800000080009000200000008000000182f326d0200000002000000030017000300000002000000ea07c50800000000000400000700f8ff030000000200000001000000010000003d0800000200770302000000070000000d000600000000001900000008009b7200000000050000000100040002000000050000000600ff010100000000010000427c98d001000000faffffff09000600030000000100010000000400000000000500000004000600020000000000000004000700010000000300000009003d0003000000030000003100f00001000000ffffff7f0101050002000000ff010000ab1707000300000008000000540201000300000002000000000204000300120073797a30000000000000000000000000000000000000000000000000000000001255fccfe405968c11599361e95c9eb5c6f5bff978231f355f5ab815f41359ad336c8d36168eaf17ae47df3baf92029665bce9eaca7e5a17d82d2cc6ccab98310800001000000000000000000c000000020000000a000000070009000000000000000000000409000200000003000000020005000200000001000080000208000300000002000000dfff9b070300000001000000e1a50400020000000000000001000400020000000400000000800400010000001000000003000700030000000100000001fc10000300000000000000799be00d03000000080000000700000200000000070000000e00c0ff00000000010000000500060001000000030000000000080000000000943c00000100ff0f03000000fa0000000800008002000000050000000700ff0f0000000002000000000005000000000003000000030fff7f0100000006000000000003000300000003000000030001000000000055d00000008006000000000004000000000005000200000005000000051210d602000000080000000c001000020000000700000001000e00000000000700000001008e0003000000020000000100050003000000080000000000060003000000060000004000650001000000ff03000004000300010000000000ffff04000a0002000000840100000700010401000000050000001000060000000000f6fffffffeff7f00020000000100000002000500020000000600000081725a5f04e4ed14c05ea0f5caa862fcf5f151f83b48d955"], 0x1060}, 0x1, 0x0, 0x0, 0x2000000}, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) r1 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x205, 0x2) mmap(&(0x7f000006e000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r1, 0xffb0c000) r2 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r2, &(0x7f0000000200)='m', 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000003c0)=@newqdisc={0x24, 0x24, 0x50b, 0x8, 0x3, {0x60, 0x0, 0x0, 0x0, {0x0, 0x8}, {0xffff, 0xffff}, {0x1, 0xffff}}}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="4801000042000100fffffffffddbdf250200000004003880100001800c00c8000200000000000000200104801c"], 0x148}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) r4 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) r5 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/mcfilter6\x00') prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000001040)={&(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000ff0000/0x10000)=nil, &(0x7f0000ff9000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ff2000/0xe000)=nil, &(0x7f0000ff1000/0x3000)=nil, &(0x7f0000ff3000/0x2000)=nil, &(0x7f0000ff4000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x0, 0x0, r5}, 0x68) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000140)=ANY=[@ANYBLOB="fffffffffffffffffeffffff0800450000300000000026ac9777f01a991d0067907800000000ffffffff2100907812000228250000240000000000000000e0000002d7fffffc"], 0x0) r6 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x30bd, 0xc000, 0x8, 0x40000185}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000d1d7a440041601801f44010203010902120001000000000904"], 0x0) r8 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x10000000007, 0x2102) syz_usb_disconnect(r7) close(r8) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, &(0x7f0000000100)) r9 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r9, &(0x7f0000000200)="a3", 0x1) r10 = socket$inet6(0xa, 0x80002, 0x0) getsockopt$inet6_mreq(r10, 0x88, 0x66, 0x0, &(0x7f0000000000)=0xfffffffffffffe09) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r9, 0xc0984124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 13.817145841s ago: executing program 9 (id=2707): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r0, &(0x7f0000000200)='m', 0x1) r1 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r2 = io_uring_setup(0x7, &(0x7f0000000040)={0x0, 0x30bd, 0xc000, 0x8, 0x40000185}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x12, 0x3, 0x0, &(0x7f0000000240)='syzkaller\x00', 0x80000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock_addr=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) io_uring_enter(r2, 0x2219, 0x7721, 0x16, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000100)) r3 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r3, &(0x7f0000000200)="a3", 0x1) ioctl$SNDRV_PCM_IOCTL_STATUS_EXT64(r3, 0xc0984124, &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}) 13.616636286s ago: executing program 9 (id=2708): syz_emit_ethernet(0x7a, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="030300400000fedbdf250c00000008000300", @ANYRES32=r1, @ANYBLOB="f9918521ae521dc09c78e735b920ac5bb38d69160ca75a1e1ac573a53b3fbde330120afa79a6e5c2035824b1273469b17af1a596a0cd1e22fa91395e7d254d648201577b43df1de2374acbb60e00377fe9e1121e2163ae61cbba5e0492a53666fbe137"], 0x1c}, 0x1, 0x0, 0x0, 0x8050}, 0x4000) 13.21725852s ago: executing program 9 (id=2711): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000000), 0x0, 0x480) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x8, 0x20, 0x0, 0x6, {{0x7, 0x4, 0x1, 0x3b, 0x1c, 0x66, 0x0, 0xd1, 0x29, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, {[@timestamp={0x44, 0x8, 0xd1, 0x0, 0x2, [0x14]}]}}}}}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000340)={r2, 0x1, 0x6, @broadcast}, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x1ff}, 0x0) r3 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) close(r1) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r4, &(0x7f00000052c0)=[{{&(0x7f0000000180)=@ax25={{0x3, @netrom}, [@netrom, @remote, @netrom, @default, @null, @remote, @netrom, @default]}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000200)=""/189, 0xbd}], 0x1}, 0xef35}, {{&(0x7f0000000780)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000001d80)}, 0x79}], 0x2, 0x2000, 0x0) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) shmat(r3, &(0x7f0000f62000/0x1000)=nil, 0x7000) mremap(&(0x7f0000f7f000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x5) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}}) r6 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) fstat(r6, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsopen(&(0x7f0000000100)='cifs\x00', 0x0) 12.286033041s ago: executing program 2 (id=2714): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8924, &(0x7f0000000000)={'vlan0\x00', @random="010000201000"}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x185842, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r5 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x2c, &(0x7f0000000300)={0x0, 0x1, 0x6}) mq_timedsend(r5, 0x0, 0x0, 0x5f8, 0x0) mq_timedsend(r5, 0x0, 0x0, 0xa, 0x0) 11.357155516s ago: executing program 7 (id=2715): fsopen(&(0x7f0000000580)='overlay\x00', 0x0) openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) modify_ldt$write2(0x11, &(0x7f0000000200)={0xd8a, 0x20000800, 0x2000, 0x0, 0x3, 0x1, 0x1, 0x1}, 0x10) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r2, 0x3ba0, &(0x7f0000000200)={0x48}) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000640)=@filter={'filter\x00', 0x42, 0x4, 0x2f0, 0xffffffff, 0x1b8, 0x0, 0x1b8, 0xffffffff, 0xffffffff, 0x2b0, 0x2b0, 0x2b0, 0xffffffff, 0x4, 0x0, {[{{@ip={@empty, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {}, {}, 0x11}, 0x0, 0xa0, 0xc8, 0x0, {0x100000000000000}, [@common=@unspec=@connmark={{0x30}, {0x5}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x98, 0xc0, 0x0, {}, [@common=@unspec=@state={{0x28}, {0x7}}]}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@ip={@multicast2, @private=0xa010102, 0x0, 0x0, 'veth1_virt_wifi\x00', '\x00', {}, {}, 0x0, 0x1}, 0x0, 0x90, 0xd0, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x350) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x80800) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$inet_int(r6, 0x0, 0x6, &(0x7f0000000040)=0xfffd, 0x4) setsockopt$sock_int(r5, 0x1, 0x7, &(0x7f00000014c0)=0x10000b, 0x4) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000640)=""/88, 0x58}, {&(0x7f0000000740)=""/105, 0xfffffe0b}], 0x2}, 0x0) 10.624817406s ago: executing program 2 (id=2716): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) io_setup(0x2, &(0x7f0000000000)=0x0) r1 = eventfd(0x0) io_submit(r0, 0x2, &(0x7f00000012c0)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0xc2, r1, &(0x7f0000000180)="0000fd6000000000", 0x8, 0x36}, &(0x7f0000001280)={0x2000000, 0x0, 0x0, 0x5, 0x3ae, r1, &(0x7f0000000280), 0x0, 0x7, 0x0, 0x2, r1}]) syz_clone(0x80, 0x0, 0xc0f86530fbfd412a, 0x0, 0x0, 0x0) 10.122496819s ago: executing program 7 (id=2719): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8f4d0086d0492082a6d0000000109021b0001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000000)={0x2c, &(0x7f00000000c0)=ANY=[], 0x0, 0x0, 0x0, 0x0}) sendmsg$TIPC_NL_LINK_SET(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYRESHEX=r0, @ANYRES16, @ANYBLOB="20002abd7000fedbdf2509000000840004801300010062726f6164636173742d6c696e6b00004c00078008000400070000000800020082b00000080001000200000008000400d538004008000300010001000800040007000000080002"], 0x98}, 0x1, 0x0, 0x0, 0x4850}, 0x80) socket(0x400000000010, 0x3, 0x0) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) r2 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0xfffffffd}}, 0x10) r3 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f0000000500)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0x10, 0x3, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x2, 0x89, 0x8, 0xb319, 0x3}, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r7, 0x6, 0x3, &(0x7f0000000180)=0x3ff, 0x4) bind$inet(r7, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r7, &(0x7f0000001c00)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000280)='S', 0x1}], 0x1}}], 0x1, 0x20008000) shutdown(r7, 0x1) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000000c0), 0x4) openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) socket$nl_route(0x10, 0x3, 0x0) 9.900172386s ago: executing program 8 (id=2720): add_key(&(0x7f0000000300)='user\x00', 0x0, &(0x7f0000000380)="010001000000000000001000015b", 0xe, 0xfffffffffffffffd) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$kcm(0x29, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x1002, 0x89, 0x8, 0xb319, 0x3}, 0x0) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x8) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000080)=0x80000003) dup2(r4, r4) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000200)=0x5) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) fcntl$setpipe(r1, 0x407, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x3c0d, 0x0, 0x80000, 0x1ea}, &(0x7f0000000340), 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={0x0}) r7 = fanotify_init(0x200, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) fanotify_mark(r7, 0x101, 0x48001051, r8, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) file_setattr(0xffffffffffffff9c, 0x0, &(0x7f00000004c0)={0x80004000, 0x2, 0x80000001, 0xa1ef, 0x3}, 0x18, 0x1000) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r9}) 9.898804203s ago: executing program 4 (id=2721): syz_emit_ethernet(0x7a, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r2, @ANYBLOB="030300400000fedbdf250c00000008000300", @ANYRES32=r1, @ANYBLOB="f9918521ae521dc09c78e735b920ac5bb38d69160ca75a1e1ac573a53b3fbde330120afa79a6e5c2035824b1273469b17af1a596a0cd1e22fa91395e7d254d648201577b43df1de2374acbb60e00377fe9e1121e2163ae61cbba5e0492a53666fbe137"], 0x1c}, 0x1, 0x0, 0x0, 0x8050}, 0x4000) 9.817544361s ago: executing program 9 (id=2722): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000900), 0x10, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) recvmmsg$unix(r1, &(0x7f0000003fc0)=[{{&(0x7f0000000140), 0x6e, &(0x7f0000001ac0)=[{&(0x7f0000000200)=""/41, 0x29}, {&(0x7f0000000940)=""/4096, 0x1000}, {&(0x7f0000001940)=""/41, 0x29}, {&(0x7f0000001980)=""/24, 0x18}, {&(0x7f00000019c0)=""/197, 0xc5}], 0x5, &(0x7f0000001b40)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x78}}, {{&(0x7f0000001bc0)=@abs, 0x6e, &(0x7f0000002fc0)=[{&(0x7f0000001c40)=""/6, 0x6}, {&(0x7f0000001c80)=""/81, 0x51}, {&(0x7f0000001d00)=""/100, 0x64}, {&(0x7f0000001d80)=""/162, 0xa2}, {&(0x7f0000001e40)=""/122, 0x7a}, {&(0x7f0000001ec0)=""/62, 0x3e}, {&(0x7f0000001f00)=""/189, 0xbd}, {&(0x7f0000001fc0)=""/4096, 0x1000}], 0x8, &(0x7f0000003040)=[@rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xd8}}, {{&(0x7f0000003400), 0x6e, &(0x7f0000003900)=[{&(0x7f0000003480)=""/207, 0xcf}, {&(0x7f0000003580)=""/241, 0xf1}, {&(0x7f0000003680)=""/160, 0xa0}, {&(0x7f0000003740)=""/216, 0xd8}, {&(0x7f0000003840)=""/145, 0x91}], 0x5, &(0x7f0000003980)=[@cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x38}}, {{0x0, 0x0, 0x0}}], 0x4, 0x40012163, &(0x7f0000004100)={0x0, 0x3938700}) r3 = memfd_secret(0x0) mmap(&(0x7f00002b7000/0x3000)=nil, 0x3000, 0x1000007, 0x11, r1, 0x0) ftruncate(r3, 0x51a9497) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'veth0_to_bond\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0xec37}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipvlan={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r5}, @IFLA_MTU={0x8, 0x4, 0x1ff}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0xc000802) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) modify_ldt$write(0x1, &(0x7f0000000040)={0x3, 0x0, 0x4000, 0x1, 0x1, 0x0, 0x0, 0x1}, 0x10) r7 = syz_usb_connect(0x0, 0x24, &(0x7f0000000440)=ANY=[@ANYBLOB="120100002eab5a40401c3405cc6d010203010902120001000000000904"], 0x0) ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(r2, 0x80184153, &(0x7f0000005180)={0x0, &(0x7f0000005140)=[&(0x7f00000002c0)="d23c2101180a3eae7971971bf6b723505872683f09d7ea151b3470bc4fbf697a81118122c03499d7e4245acee9e06ac5b67396e3cb905d50565b1bccdc2f9bc04522cd3a6f3e7eaaf6b9af33b654fa045b5537ecdd7d9dcd25a552a03cda8ca30e67f3", &(0x7f0000000340)="3f66d2e2bf52b71017b03c1808b4272832d6726136a143a510d0282d603264ebfe28e773546bae9f70c2564730e2df770e39def6eb234a83f06ff8a71b1358dc862ac7b9f9a53237917ab5fd2fe9c76bf3923fd32773f38e8665bda6a6783dba4af1ea0d9238edf4c42e76ea6e97ed2a695e5b726730d9eaf5fdf4a879e3f10b71b1e7b31834b3f34a11aa2619082347c5d0e15bbb9dd77c52fefb91f0e5f2a0ca4de54b0dfe0c459383bdcec58cfe805eb30b865060eb", &(0x7f0000000480)="c436399f9f0d1d74cecb3f90db611c1c5d03293f8eeffdda2230c13e5e605b8df6b980904461b24cf84401a8c611e681e1cae1a65ddd9ab4390dbcce444479a3da7f0d61839009a83f4ee52ab9ca27521daa3ac88e92e718a1d869ab4e93416db242e5f8057805974ba503eecabea1480ee65f1eddcbdd41126b9b5e158aa1d56ff1e7c385ceaeb9dee1ab2bd1fbda658127865914256e935e8ce5c9e235296066569bb6c1aa2d845585adc6fc9b9749efec064e165e92af42ef0e0d379a865cf7dbdd73a0efa85e76342ce2c4fd1f2bb336a99a5214c7e5", &(0x7f0000000580), &(0x7f0000004140)="5bcf85efdde08f2abaea97d69670d8ff465ae5a31b66643e8d0c7850110470786e0bc05d865c770773a710881d46c5f45d0c7dd14063aa7162b1f0b1c9e9722d7d04bdcf15b6008dc30d56b3896ace3b1e2cc280b60da78e10e4ae50bedba5bc74b9be03ccf9b09c8b1425d028b3856894d11543bf16396ea525ddb00b34e92345a8639ecdfbfd2869cb3dfba7528cb859f8e14826b18863c95bf26671e01d667ee66adb21cf5d5b76d3fbc29e52b30f8efc2aa7ddc441229cd35e3082e8055e9fe8cd75da2d10538b41751edf9dd9fae565786e0ac2def4819fe58c26f16c0c6bbf77501e6b3915867923975bbcaca85cdca328bdbdebae28865462587765b56d18d2ce4a0177d93f8e9f8112730af82111cdb5d9a44c83bcfabdbe4a89ff5f6503008b1c5821af3077190b89fef935a7e4f52ef47387e166ce1a78b9f631baf151b4f6b4326e1b22496409e67dddbd3e282ad7d838fdc55da469125061e7203919beb365a9ad71dcf630bc4eca2038403287848fcb790e50979a7631142bdc4158074fe25e2357e274f11d40e6960640a3ac8ddd5beafa028bfbfe3a05b2e8454fb161d96a123aafc1a0f40f37f104e75fb14b827facf710afe1b890e3962cb3697c380861544acbdb22435b3bb32db0bc93083d68bff76c2c19dfc92d311b6898a85e66103be48bcc45e97af0af0e5479a6d66ffb37175698e4bff570474d7dcbce8aec428b99680768008d2a72401aef3f59275f26e66c9d1b844bf4a933588768686b9b4f7907127f6a85462596a854f007da32b6b35f72672718c19880919fc0d3a295632f40dc03465a7df451e6a5875d9106473501aab6a6db4d24398cc41807b86863b8b0f57aff8329602e7b1ebcd91ac9e73b7d544742c0bf438f43018f0de007d2edb6601fb8bdf60889e8be2948b28dcf8608d326ba07b314130afd73c143dde8ad08593f85690840d11408cf686f80f9231f5d115fd0b4f466bda5637e44321b380c3680096b164b2bfdc8ac3b4e42cffa6fa98c2d78455ff8d6145b60033a9029c3aa28c03155e58a1349e1ce0fef7304407e33b6c998562ef4bf55c7a5cc57adeb525b8311a880d54aa873ac4e2d65276dc637eae893881129e864198638b3b227e2bbfa2125ef8f98d1f6722b4a8fd019ed9ea55cf15390551fa50e7214473d2c8209c2e3c569f45c35c77d908d438cb6953e5cbec0326269b874d25f09e086c4a02cc81ae546454b597af2ac04eb1fb26db4c5898288c5327baad9313b7817b29760d141baf5ea73392f848167e938bcd0d9d9aeefb1fada9db5de7a21a9f2cf6ddd0d37e470533c35d54cfa41a34652716c90e750297aead3bc35111cf1d51950195f2af1ed35984529f249be416bcfa6acb11d97f28d8405188f997299b26f60c6cd140e4b9f9c82a139bced3593b5bfa862c6e43e2bd9c5abba39212922c5e07243eebb9c3e8ea60ad74651c4675ccc0aeb66a8d5333fc6e07c0da3783003900a93269bc038cebcf0a182462f20de41c1852752405728402f5d83662e1b9d5ed718960cffa809fbf61409a92b9dd61141ff332a13e6c02bc0b4c01c27ab931e95cc8631004d51a9129b3186ef4d23df2577bcc3189fcdb3c1e68dfb7ef33131d8390bae18311a2283850be8eed78a19be7992d93a8689330cd219e5962915c0173456a340979f62fa46e5c157aa9d8513b95b5b1efc18553d8db45df9543bcc70f0ba487ea498a7acd6fef9586f2a6092da1f6d80303627530afa1cacf7ccef5e6aa72620db4cad4ecb1d69f8a186961bcd802922569d1044e417a59a3dedf445126b07b55234a92e1a3a32454980d64042f7e2215ae3f1244f0a628ad09dddd67601b2d3d2fbeb012ebedd9ee7da8fbe82d88594964c291df3dc136ff2ca0602f3db0ddd54a1090f3e4cf66a6e99d115a1b1ed3af4675fc39be1605717f0319452a8b3005e8e33d70ee226449572cb097d5f0f422935b5c299d3e538172fded9479cac53b170c426ec311dcb98e1cfd7342a5f3e6e51c030f69952261b5a93dca23ffbce97bc51b19d605d724cbe531cd5f48906aa5013345a4fc5471b4ac94d2d9ea1a169569347e9929f7dabc1ef91f972420eb0204380de1177110a078a31d4941457f36a66acd571e35468c8a5c90d595821fb78018bc8ecc65cc80e64a353b2f17c5f8c725c3f26bbebecae5a852c629481a026f0de40372c075e9a9a366a33e418b99f0de46e0d4bcd59774a8ef40df44057d8147b9ba057900d48a05cd39124253119ee62d9e111a625b27369c8d71938b7194cc3486076192f4f0c14035c4d2bc99b723609eda5c8b4e3fa1dfafb7de640246eb0e5b25a5747257c5e2f19204711e6265745df03051659f164009add047bf19f21a9525f3969f6b8e86e412a08486a47d43a9fc5f0fc2c9b930fcd52e28fc27c0572b98709066b5320a306f5d6575362af66e03f126bfb6f410af1b7416f1c1779d4e51093aedd9a289da78b7428d3a3c88cc7004f9b24c604c4aece9be1277638c5bb080d6a28dfd91fb19aefc15d7348708a4470f94d221dfeaed0ed95b4c900109d1f0f27b91e4a3f74e1391948d2c7dd398f9c31bf2c7456d7b3154ee1f317de8aba439a49d6b5351a2ed08c0526df980499f917a3646edcfcb47ac2415dd37a7f7c4e941af786d4d08d6c6d604866fe7aa5c099068f4e0be67da70fbabfc1406b77756591b9701fadcf50e22c269d6ec3504231d6e4ff37b5adb6943a031a34584ff6d01d5be43f0d7731a58400de6e9fbdced23a0c59995b7b1e6fa72de2b69bf7dce02dc0ee3bc2ceb071c39a8be798fd1c7bd174d17fb2491f0c0d16fb834c1856424ad4b6deb74468b2334204aaf2b1a9747eb4cf53fde6fac5e8039961dfed1ba92e016943c07c655732d91398222d54cbbe45b5cea9b74540d492cd9836d160bbc39b4fbca050394328fbb392b01acbd1174b18bd8283925a5dc9b1d9554a9aa3bcf101096a2fa77fb48dc888c2df220b4012e30f8d3c29488e91efcc5e6161087b47b720cd791307359d9df9356b69fdee9f23e869512d925e3f889e2b81045a333df982f0fe36471c9e2ecf8c39d1ecb01fad7e13ed2729f6a7c13ec6535e8bd233b7915bdadecf829dddfb45ff74a8448624bc58462e4bf148493ee5b8ed1edf4e10b5e78644b9e2de36cf5b63abbfdb4bbbe9b8a80fd5e0737f3d42ef4442f830a4ea9ffa5a0533655cdb86512faf33aed551bbbbc05a5255eb560a2b1a9f2c6722107d052e640dbd3e3926d0e94845c1103796a20c28d4384bcd202b33c01fdee8bcc3800f99a384f8aed7493c5b2b05a64073e1bf555ba2d098a343c9a86b40e9bf48f7ab65fe255578daa5e5bf6ac0b5afd70611cef6ed528390d0494beb193295a97dfd87bcd7027910cf5aaf2a984565f0bb0fc7d035ae3a194492221b39df98caa26b7564251dc12dc7b3c387a793d136064d173a337db889d0d41bc26554c8ade47a2c50d540c6d7c06a02ef4010b345d69d202d55185c7794948e9fca5bf449c4b48e935846c3e4a551f4ae2d5af7328f95ff79a41fa247d1c93c794b6a69b8098a3bfb7de2428e84211b26f7675998568e95094d99b42a7d224d0b18ede3c8ec60445b30c48b14d9fe54ac86017e8c9c75d691ef73d93102b0170933fdd3054613d0c25f20e4ca3ca70534f15e9b06e38c1db09e0845c62e8b8630e2e35e85dc93f3985f4cc24a4cb7485d3b93e6a542bd946998873465f64e14c0d304762c3d5d44a70a8575b0e59b0791a1e8db4defbed2198a6f394b708b1e4b7954e5b62aff37c384c85e55e416aa6e33f6621b5dfcc83e15ff720bc86b6fb588b0fd01dd8501a503bc4097acdb142da674e204d72c08be3fa19f2738c8e649a660dd2d58ddd2bdcb4f4dc7e091822ec3b3c445765612ce1bf67145e8ff8531a7b04bf569d6b29ea773acdc18bd795c27ca7e56df3280e3bdbca896ec0ff34edd88c23477261133e648dfb49f2566d330d4452af637528ca46fa94301f7dda3bc3be805d15557b5c7bfcf3cdcc28c62c51db67b151cf343419c62d40f7f9f35d9dbfd9561e8c0820c7a8f97f6debf3405339e194537e54984b657ee64ece4af804b11ecd4a7ca52a8d1ad054f3e94d6d00a9a183865317cf3d7a5a1e4a5bbe57a5dac5b5d8861561238478288ccb623f1bac8c776805ad9941d6ba11e8d81ea58f33f59c7c3fbee948ed917f187d5306b37880312ac7ceef7864d10e0f8c72d603c1e60015ee9dfc1b9b26f82e8f37f8f0c51993c20ad086b0568925a03adbc0d5c7e67b1ecbb38ebdd2439f8ac872dc479e651438111e61c60fd7cb03380dfb0f07862d10c82562384936801eefe335e91ce99d19754674b42c073482dc5312e241d09de85cbaad368534f95f5a50afdb36e779bd0cffbd46a06a006193cd8cc2ed5bf0650187126842be6f52ba5969d32735423f6f20d1cc0a40cb943ead821e9fb8b7a8a92160d0fca30ecb9986ab0fed7ad61aa38b9c68103b0b66747c8d3a310e12c0928919cd7a2e248e9daac4315638fe87a38ff5f57fe760e0efc99075040a45a6918ba265767b85966ebbc7d3e9982165c2d9375c9f4cf660547a834e163c661565486746d3732ace88a68163c890e1ed477734ffa0423faa1336dd374c27c9974e432d0ca5b4da80472e1b27077db64792ad0385ee9eda468610fdec27bc3d7452614a25cf7aa58c461275493f54f8fd9cbc2f8c2abcc31e738a5943cbf2676a4551fb69909a005cb5b88e4f36a945ff153e6a145ad3c4f1b274dbb48a9d74e4d6f776f80461f5d807564a24a85b5f18733d52dce1b17f6e87a831f6067eb7a352ad856fb74433220171aad6713f2c3cc173785b653cc28c95d54a69804a903b85f007995bedf7342c90ce5891f25fd204d692effabb261e81eb38841aac478a8fd457aeeeef554ce4302cda66985dc40b29d707d45cca43e166c088f2a6d29e0aed56523ce430efadc18b3cff99c2c93d3475e1a0f1bd867cd04c6c297e7977f2a8aab977d8defb1c525279c3c38fcf44d794f3c6c79da2aeecad4f1c93f9e5f67be5e1176da747a98cc4667c68e6f53341e9bef6cd8a31ff2c16372f3f7ae78b98c7cab322eb42466c7b1e6d6fb4724acc1251f2c63a4b38769e4625a1b801a2a3fc4c67ea6e8d648ebc7a19aec5860338bd76dfdf753de5f26541bad56c274de5759c1371d06f51bd815edf93982ce9c761b166fbd71f752463ecb70f2778e77ea9fd906e9c2ced45a0715109f79d3b4346a8035c4f9b01a963bbb492676169273ee59e6a1dd077fbbe6fb95cebb6ab519051efaa8383ea665ebc832e3106e56bfac3bad32863ca9c66be03c8c18619a745668d484aa55c3afbcc3b126a55424701f01fc5704b214111929528061cf7f89e1aa0d8b9ceb4acc75674196a215ae73d0b7f4c5e0c6e76c096e73e09bcbf2dc8853e1dce0bc23cdaeaa2d27e5c3daa88bd22219c02d8808fded8112cb25eb098781ce2ccfe8913a3c74626f6f2c567d8b806cd56716943ad95c3ebe95abeb629eadb4230e4ae526ad426471317f74d5e7ce1755bbb405b3b94a6a3c308d37d61a058e69053f9ab015d4146fddd8ed521024b77588cd7f3639a95fd0e3cb75192f4d165504e91c8fa3b1ec5eece94a23b5b1a093446e14bde0c0713aada9ebbf420a71dc89578b9e1b4de70f03e6430b157a622cc8505853ccffbbf5af27a6dc760008d6fce3914f5f6f8940447861140a144847c67462a839dbe9af46f2be"]}) syz_usb_control_io$hid(r7, 0x0, 0x0) syz_usb_control_io(r7, 0x0, &(0x7f0000000680)={0x84, &(0x7f00000001c0)={0x40, 0x17, 0x4, "739e2a16"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 9.709312356s ago: executing program 2 (id=2723): r0 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_G_STD(r0, 0x80085617, &(0x7f0000000040)) io_setup(0x800, &(0x7f0000000080)=0x0) r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x62, 0x2000) ioctl$HIDIOCSUSAGE(r2, 0x4018480c, &(0x7f0000000100)={0x3, 0x200, 0x8, 0x1, 0x1000, 0xfffffffa}) ioctl$VIDIOC_QUERYMENU(r2, 0xc02c5625, &(0x7f0000000140)={0x4, 0x7fffffff, @value=0xfffffffffffffffb}) r3 = socket$inet6(0xa, 0x4, 0x2) recvmmsg(r3, &(0x7f0000001a40)=[{{&(0x7f0000000180)=@nl, 0x80, &(0x7f0000001580)=[{&(0x7f0000000200)=""/193, 0xc1}, {&(0x7f0000000300)=""/4096, 0x1000}, {&(0x7f0000001300)=""/90, 0x5a}, {&(0x7f0000001380)=""/51, 0x33}, {&(0x7f00000013c0)=""/124, 0x7c}, {&(0x7f0000001440)=""/41, 0x29}, {&(0x7f0000001480)=""/228, 0xe4}], 0x7, &(0x7f0000001600)=""/164, 0xa4}, 0x401}, {{&(0x7f00000016c0)=@l2tp={0x2, 0x0, @remote}, 0x80, &(0x7f0000001900)=[{&(0x7f0000001740)=""/192, 0xc0}, {&(0x7f0000001800)=""/133, 0x85}, {&(0x7f00000018c0)=""/21, 0x15}], 0x3, &(0x7f0000001940)=""/243, 0xf3}, 0x6}], 0x2, 0x103, &(0x7f0000001ac0)) r4 = syz_io_uring_setup(0x4943, &(0x7f0000001b00)={0x0, 0x1ec1, 0x8, 0x3, 0xf4}, &(0x7f0000001b80), &(0x7f0000001bc0), &(0x7f0000001c00)) syz_io_uring_setup(0x7a4c, &(0x7f0000001c40)={0x0, 0x4fb9, 0x0, 0x3, 0x3bf, 0x0, r4}, &(0x7f0000001cc0), &(0x7f0000001d00), &(0x7f0000001d40)) r5 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f0000001d80), 0x1, 0x0) r6 = syz_open_dev$vcsa(&(0x7f0000001dc0), 0x6, 0x10900) ioctl$FAT_IOCTL_GET_ATTRIBUTES(r6, 0x80047210, &(0x7f0000001e00)) setrlimit(0x2, &(0x7f0000001e40)={0x8, 0x100000001}) ioctl$UFFDIO_MOVE(r6, 0xc028aa05, &(0x7f0000001e80)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x4}) ioctl$VIDIOC_DECODER_CMD(r6, 0xc0485660, &(0x7f0000001ec0)={0x1, 0x1, @stop_pts=0x6}) ioctl$AUTOFS_DEV_IOCTL_PROTOSUBVER(r6, 0xc0189373, &(0x7f0000001f40)={{0x1, 0x1, 0x18, r6, {0x3}}, './file0\x00'}) ioctl$VIDIOC_ENUMOUTPUT(r6, 0xc0485630, &(0x7f0000001f80)={0x3, "33abf030e03b912963fd79268349468d83df7f9dc7737ae1a8ce77626aa35520", 0x3, 0x9, 0x6, 0x1700, 0x2}) ioctl$VIDIOC_G_JPEGCOMP(r7, 0x808c563d, &(0x7f0000002000)) r8 = openat$cuse(0xffffffffffffff9c, &(0x7f00000020c0), 0x2, 0x0) io_getevents(r1, 0x7f, 0x5, &(0x7f0000002100)=[{}, {}, {}, {}, {}], 0x0) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r6, 0x6) fstatfs(r3, &(0x7f00000021c0)=""/159) ioctl$VIDIOC_TRY_FMT(r0, 0xc0d05640, &(0x7f0000002280)={0xd, @raw_data="e24ee180f77bcdf532b519e4fc4d4fc394d38b361dbb60ad6c8ab43f5283cccf9cd9d13407c3d3f77e470bc6d1ce4f8026dfa61254ebf41798af6b4e099a03cc5a30edbf7b44e4d4aba03a7335cfb67a5304bd5c1b57bb09d3da1fc7b5fb154ea9e344b933fa7176baddb019c7108d13feedfcd2b0a1d4f38087ab792d985bec9ff03ff4c52dc0a70765231c435076eb3828b3a46abe5eb46f10447d22b4d0e8d737c7c9eee32b2970b54c1b5dcfdc565a1ef2e4257bfc5b939fe9a91fbc5a3cddb899aff4811501"}) ioctl$VIDIOC_S_CROP(r0, 0x4014563c, &(0x7f0000002380)={0xd, {0x9, 0x8, 0x3, 0xfffff801}}) ioctl$XFS_IOC_FSCOUNTS(r8, 0x80205871, &(0x7f00000023c0)) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r3, 0x84, 0x6, &(0x7f0000002400)={0x0, @in={{0x2, 0x4e21, @multicast2}}}, &(0x7f00000024c0)=0x84) getsockopt$inet_sctp6_SCTP_CONTEXT(r3, 0x84, 0x11, &(0x7f0000002500)={0x0, 0x3}, &(0x7f0000002540)=0x8) getsockopt$inet_sctp_SCTP_STATUS(r5, 0x84, 0xe, &(0x7f0000002580)={r9, 0x4, 0x3ff, 0xffff, 0x2, 0x7f, 0xf2a6, 0x1, {r10, @in6={{0xa, 0x4e21, 0x2, @rand_addr=' \x01\x00', 0x237}}, 0x7, 0x3, 0x4, 0x8, 0x1}}, &(0x7f0000002640)=0xb0) accept4(r6, &(0x7f0000002680)=@xdp, &(0x7f0000002700)=0x80, 0x180000) 9.435760202s ago: executing program 4 (id=2724): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r2, 0xc004500a, &(0x7f0000000180)=0xffff0018) ioctl$SOUND_PCM_READ_CHANNELS(r2, 0x80045006, 0x0) r3 = socket(0x840000000002, 0x0, 0xfa) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r5 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000001180)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1, 0x11, &(0x7f0000019200)=ANY=[@ANYBLOB="180800000500000000000000fbffffff18110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b702000014000000b7030000030000008500000005000000bf090000000000005509010000000000950000000000000018190000", @ANYRES32=r5, @ANYBLOB="0000000000000000bf9a00000000000056080000000000008500000007000000b70000000000000095"], &(0x7f00000002c0)='GPL\x00', 0xb, 0x0, 0x0, 0x40f00, 0x46, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) getsockname$inet(r3, 0x0, &(0x7f0000002280)) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000008c0)=@delqdisc={0x1a8, 0x25, 0x202, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, {0x4, 0xb}, {0xffff, 0x10}, {0x1, 0xfff2}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x8, 0xe85, 0x10001}}}}, @TCA_RATE={0x6, 0x5, {0x2, 0x6}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x200}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x401}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x2}, @qdisc_kind_options=@q_blackhole={0xe}, @TCA_EGRESS_BLOCK={0x8, 0xe, 0x6e}, @TCA_RATE={0x6, 0x5, {0x4, 0xa7}}, @TCA_STAB={0x11c, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x2, 0x5, 0x5, 0x5, 0x2, 0x7, 0xd84d, 0x3}}, {0xa, 0x2, [0x10, 0x0, 0x4]}}, {{0x1c, 0x1, {0x2, 0x4, 0x2137, 0x8000, 0x1, 0x3, 0x0, 0x1}}, {0x6, 0x2, [0x6]}}, {{0x1c, 0x1, {0x0, 0xfe, 0x9, 0xffff, 0x0, 0x9, 0xc, 0x1}}, {0x6, 0x2, [0x9]}}, {{0x1c, 0x1, {0x5, 0x5, 0x2, 0x460, 0x2, 0x2, 0x401, 0x2}}, {0x8, 0x2, [0x7, 0x6]}}, {{0x1c, 0x1, {0x9, 0x4, 0x8001, 0x4, 0x0, 0x9, 0x8, 0x7}}, {0x12, 0x2, [0x4, 0x2, 0x8c85, 0x2, 0x8, 0x7, 0x121]}}, {{0x1c, 0x1, {0x7f, 0x8, 0x9, 0x80000000, 0x0, 0x0, 0x2, 0x7}}, {0x12, 0x2, [0x4, 0x2, 0x3, 0x3, 0x84a, 0xf, 0xd6e]}}, {{0x1c, 0x1, {0x8f, 0xa0, 0x8, 0xd, 0x0, 0x5, 0x9, 0x2}}, {0x8, 0x2, [0x5, 0x5]}}]}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x6}]}, 0x1a8}, 0x1, 0x0, 0x0, 0x20000800}, 0x4000) mkdir(&(0x7f00000000c0)='./file0\x00', 0x22) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES8=r0], 0x50) unshare(0x62040200) syz_create_resource$binfmt(&(0x7f0000000140)='./file0\x00') socket$inet6(0xa, 0x800000000000002, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x1100c0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f00000001c0)={0x10, 0x0, 0x25dfdbfb, 0x200000}, 0xc) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000600)=ANY=[@ANYBLOB="300000001000010028bd7000f9dbdf2500000000", @ANYRES32=0x0, @ANYBLOB="15888804000700000008000dfb1048770008001b0008b500"], 0x30}, 0x1, 0x0, 0x0, 0x40801}, 0x4000000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=ANY=[@ANYBLOB="300000001000000125bd7000f6dbdf2500000000", @ANYRES32=0x0], 0x30}, 0x1, 0x0, 0x0, 0x46801}, 0x4000000) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r6, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) r8 = socket(0x28, 0x801, 0x0) connect$vsock_stream(r8, &(0x7f0000000880)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r8, 0x1) 8.024155876s ago: executing program 8 (id=2725): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYBLOB="4800000010000504000000400300000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000280012800b00010065727370616e000018000280080010000000000005001600fe000000040012"], 0x48}}, 0x0) 7.649322446s ago: executing program 2 (id=2726): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xb0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f0000000180)={{@my=0x0}, 0x0, 0x1}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)) ioctl$IOCTL_VMCI_NOTIFY_RESOURCE(r2, 0x7a5, &(0x7f00000000c0)={{@my=0x0}, 0x1, 0x1, 0x19e000}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x185842, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(0xffffffffffffffff, 0x4068aea3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[], 0x48) socket$nl_generic(0x10, 0x3, 0x10) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r4 = mq_open(&(0x7f0000000000)='!selinu\xff\x7f\x00\x00inux\x00T\x8b\xb5\xf3\xcb\xdd\xe3\xbf2\x86\x01\x84\xdd\x8a\x8f_l\xa1L\xb1\xef\xb2\xc9\xf7+C\xb2\x8e9\xb8\xec\x1a\xe5\xaeq\x8fZ\xff\xbcY+\xaf0<\xa3\xb8\"Zm\x1c\x18\x11\x93\xb5z \xc2\x8b\xa9\xc5\x9es\t\xfe\x002\xa0-\xaf\xcdP\x9f\xe5Iv\xce*\xa8\xa3\x14i\x05\x8f\x9b\x1eB\x9f\x9d#E\x19\xdc\xfe\xc7\xeb\xb5\xcd\xc8\xe2U\xce\x00\x00', 0x6e93ebbbcc0884f2, 0x2c, &(0x7f0000000300)={0x0, 0x1, 0x6}) mq_timedsend(r4, 0x0, 0x0, 0x5f8, 0x0) mq_timedsend(r4, 0x0, 0x0, 0xa, 0x0) 7.297377096s ago: executing program 8 (id=2727): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r2, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) setsockopt$packet_rx_ring(r2, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x1, 0xf83, 0x4682}, 0x1c) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'team_slave_1\x00', 0x0}) r5 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r5, &(0x7f00000000c0)='\t', 0x1, 0x100400c1, &(0x7f0000000140)={0x11, 0x8100, r4, 0x1, 0x87}, 0x14) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1000003, 0x13, 0xffffffffffffffff, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) write$FUSE_INIT(r8, &(0x7f0000000140)={0x50, 0x0, 0x0, {0x7, 0x29, 0x0, 0x10082c0c, 0x1, 0x80, 0x5, 0x7, 0x0, 0x0, 0x10, 0x8000002}}, 0x50) sendfile(r7, r8, &(0x7f0000000040), 0x1) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x8, @empty}], 0x1c) syz_emit_ethernet(0x36, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f00000000c0)={[0x8, 0x1000005, 0x7fffffff, 0x0, 0x1, 0x0, 0x7fffffffff7fffff, 0xffffffffffffff70, 0xa, 0x7f, 0x0, 0x80, 0x3, 0x4, 0x1, 0x1], 0xeeee0000, 0x300}) sendmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)=ANY=[@ANYBLOB='0'], 0x30, 0x40851}, 0x80) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r9 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r9, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r9, 0x7a0, &(0x7f00000000c0)={@hyper}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r9, 0x7ab, &(0x7f0000000040)={&(0x7f0000000780)={{@host, 0xfed2}, {@hyper}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c51a69bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8babfc02975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f303000000a640f1b04efb38a36e0ed0e2abcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411da80e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e6579c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b97e3f72535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c9"}, 0x418}) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a64000000060a030400000000000000000200000038000480340001800c0001007061796c6f616400240002800800034000ff07f50800024000000000080001400000001508000440000000020900010073797a30000000000900020073797a32"], 0x8c}}, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x2800491, &(0x7f0000000a40)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x4, 0x0, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) 6.103895011s ago: executing program 7 (id=2728): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) openat$zero(0xffffffffffffff9c, &(0x7f0000000040), 0x1140, 0x0) socket(0x80000000000000a, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000480)) epoll_create1(0x80000) socket$nl_audit(0x10, 0x3, 0x9) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff7000/0x4000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0, 0xfffffffffffffee6}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24040045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xce}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}, {&(0x7f0000000100)}], 0x2) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, 0x0, 0x50) pipe2(&(0x7f0000000000), 0x80000) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) socket$netlink(0x10, 0x3, 0x0) fsopen(&(0x7f0000000980)='iso9660\x00', 0x1) add_key$user(&(0x7f0000000180), 0x0, 0x0, 0x0, 0xfffffffffffffffe) 5.890646346s ago: executing program 4 (id=2729): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'ip6gre0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000001240)=@newqdisc={0x45c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x4000000, {0x0, 0x0, 0x0, r1, {0x0, 0x1}, {0xffff, 0xffff}, {0x6}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x430, 0x2, [@TCA_TBF_RTAB={0x404, 0x2, [0x7, 0x0, 0x1fc, 0x0, 0xfffffc80, 0x0, 0x6, 0x8, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x21, 0x7000000, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x8, 0x0, 0x8, 0x1, 0xffffffff, 0x0, 0x0, 0x2, 0xffffffff, 0x2, 0xc00, 0x0, 0x0, 0x0, 0x1ff, 0x0, 0x0, 0x80002, 0x0, 0x1000, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x4000, 0x0, 0x0, 0xfffffffe, 0x6, 0x0, 0x0, 0x9, 0xb, 0x9, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xe, 0x0, 0x2, 0xfffffffd, 0x0, 0x80007, 0x4, 0x0, 0x0, 0x0, 0x2, 0xfffffffd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0xb97, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x5e, 0x6, 0x8, 0x0, 0x0, 0x1, 0x3, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4, 0x0, 0x0, 0xffffffff, 0xffff8000, 0x0, 0xffffffff, 0x1, 0x0, 0x800009, 0x0, 0x0, 0x8, 0x6, 0x9, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x5, 0x0, 0x2000000, 0x100, 0x0, 0x0, 0x0, 0x2000000, 0x0, 0x0, 0xb6, 0x0, 0x1, 0x0, 0x7, 0x8, 0x0, 0xffffffff, 0xffff, 0x0, 0x0, 0xb3c, 0x0, 0x0, 0x4000, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x800000, 0x0, 0xffffffff, 0x0, 0x9, 0x1, 0x7, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0xffffffff, 0x0, 0x0, 0x1, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x0, 0x2, 0x13, 0x0, 0x0, 0xd79, 0x0, 0x0, 0x0, 0xaa, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x26c, 0x4, 0x7, 0x102, 0x0, 0xb, 0xfffffffd, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x6, 0x8, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3]}, @TCA_TBF_PARMS={0x28, 0x1, {{0x1, 0x0, 0x0, 0x0, 0x0, 0x6}, {0xff, 0x2, 0x3, 0x0, 0x19, 0x40000000}, 0x0, 0x500007f, 0x2}}]}}]}, 0x45c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 5.725564183s ago: executing program 8 (id=2730): add_key(&(0x7f0000000300)='user\x00', 0x0, &(0x7f0000000380)="010001000000000000001000015b", 0xe, 0xfffffffffffffffd) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$kcm(0x29, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x1002, 0x89, 0x8, 0xb319, 0x3}, 0x0) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x8) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000080)=0x80000003) dup2(r4, r4) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000200)=0x5) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) fcntl$setpipe(r1, 0x407, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x3c0d, 0x0, 0x80000, 0x1ea}, &(0x7f0000000340), 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, 0x0) r7 = fanotify_init(0x200, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) fanotify_mark(r7, 0x101, 0x48001051, r8, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) file_setattr(0xffffffffffffff9c, 0x0, &(0x7f00000004c0)={0x80004000, 0x2, 0x80000001, 0xa1ef, 0x3}, 0x18, 0x1000) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r9}) 5.270873189s ago: executing program 4 (id=2731): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents64(r0, &(0x7f0000002f40)=""/4098, 0x1002) syz_emit_ethernet(0x66, &(0x7f00000011c0)={@multicast, @remote, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x7, 0x58, 0x65, 0x0, 0xec, 0x2f, 0x0, @private=0xa010100, @multicast1}, {{0x0, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x1, 0x880b, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {}, {0x8, 0x88be, 0x0, {{0x3, 0x1, 0x7, 0x1, 0x0, 0x2, 0x6}, 0x1, {0x4ded43c0}}}, {0x8, 0x22eb, 0x0, {{0x2, 0x2, 0x6, 0x2, 0x1, 0x2, 0x7}, 0x2, {0x7, 0x1, 0x2, 0x3, 0x1, 0x1, 0x3}}}, {0x8, 0x6558, 0x1}}}}}}, 0x0) 5.015250029s ago: executing program 4 (id=2732): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000200)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000000), 0x0, 0x480) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000300)={'syztnl2\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x8, 0x20, 0x0, 0x6, {{0x7, 0x4, 0x1, 0x3b, 0x1c, 0x66, 0x0, 0xd1, 0x29, 0x0, @multicast2, @dev={0xac, 0x14, 0x14, 0xc}, {[@timestamp={0x44, 0x8, 0xd1, 0x0, 0x2, [0x14]}]}}}}}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000340)={r2, 0x1, 0x6, @broadcast}, 0x10) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x1ff}, 0x0) r3 = shmget$private(0x0, 0x400000, 0x184, &(0x7f0000c00000/0x400000)=nil) close(r1) r4 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r4, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) recvmmsg(r4, &(0x7f00000052c0)=[{{&(0x7f0000000180)=@ax25={{0x3, @netrom}, [@netrom, @remote, @netrom, @default, @null, @remote, @netrom, @default]}, 0x80, &(0x7f0000000600)=[{&(0x7f0000000200)=""/189, 0xbd}], 0x1}, 0xef35}, {{&(0x7f0000000780)=@sco={0x1f, @fixed}, 0x80, &(0x7f0000001d80)}, 0x79}], 0x2, 0x2000, 0x0) sendmmsg(r4, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) shmat(r3, &(0x7f0000f62000/0x1000)=nil, 0x7000) mremap(&(0x7f0000f7f000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000ffc000/0x4000)=nil) ioctl$NBD_SET_BLKSIZE(0xffffffffffffffff, 0xab01, 0x5) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r5 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000600), 0x2, 0x0) mount$fuse(0x0, &(0x7f0000002080)='./file0\x00', &(0x7f0000000000), 0x1000000, &(0x7f0000000380)={{'fd', 0x3d, r5}, 0x2c, {'rootmode', 0x3d, 0x8000}}) r6 = open_tree(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) fstat(r6, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fsopen(&(0x7f0000000100)='cifs\x00', 0x0) 4.498784177s ago: executing program 9 (id=2733): r0 = syz_open_procfs(0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(r0, 0xc0189372, &(0x7f0000000040)={{0x1, 0x1, 0x18, r0, {0x8}}, './file0\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}, 0x1, 0x0, 0x0, 0x48815}, 0xc0a0) r3 = creat(&(0x7f0000000040)='./file0\x00', 0x4b) close(r3) r4 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000140)={0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r4, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r5, 0x0}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f0000000680)={r6, 0x1ff, 0x0, 0x1, 0x3, [0x0, 0x0, 0x0, 0x0], [0x7fdfffff, 0x0, 0x0, 0x4], [0x0, 0xea25, 0x1], [0xfffffffffffffffc, 0x0, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_ADDFB2(r3, 0xc06864b8, &(0x7f00000001c0)={0x0, 0xae, 0x3ff, 0x34325241, 0x0, [r7, r8, 0x0, r8], [0x2b8], [0x0, 0x1]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f0000000280)={&(0x7f0000002000)=[0x0], 0x0, 0x0, 0x0, 0x1}) keyctl$dh_compute(0x17, &(0x7f0000000140), 0x0, 0x0, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'aead\x00', 0x0, 0x0, 'authencesn(sha224-ni,xchacha12-arm)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r9, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beefff5d564c90c200", 0x18) r10 = accept4(r9, 0x0, 0x0, 0x800) sendmsg$inet(r10, &(0x7f0000000e00)={0x0, 0x0, &(0x7f0000000d80)}, 0x2094) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r11, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="040100001a0001000000000000000000ac141400"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ac1e0001000000000000000000000000000000003c000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000100200000000000000014000e00200100"/188], 0x104}}, 0x0) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x48, 0x10, 0x439, 0x2, 0x0, {0x0, 0x0, 0x0, 0x0, 0x1040, 0x44100}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @gre={{0x8}, {0x1c, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @local}, @IFLA_GRE_OFLAGS={0x6, 0x3, 0x81}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x1}]}}}]}, 0x48}}, 0x4040000) 3.861544858s ago: executing program 2 (id=2734): syz_emit_ethernet(0x7a, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) socket$alg(0x26, 0x5, 0x0) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r1, @ANYBLOB="030300400000fedbdf250c00000008000300", @ANYRES32, @ANYBLOB="f9918521ae521dc09c78e735b920ac5bb38d69160ca75a1e1ac573a53b3fbde330120afa79a6e5c2035824b1273469b17af1a596a0cd1e22fa91395e7d254d648201577b43df1de2374acbb60e00377fe9e1121e2163ae61cbba5e0492a53666fbe137"], 0x1c}, 0x1, 0x0, 0x0, 0x8050}, 0x4000) 3.162579005s ago: executing program 2 (id=2735): add_key(&(0x7f0000000300)='user\x00', 0x0, &(0x7f0000000380)="010001000000000000001000015b", 0xe, 0xfffffffffffffffd) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000280)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$kcm(0x29, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x0, 0x800010, 0x0, 0x1002, 0x89, 0x8, 0xb319, 0x3}, 0x0) r4 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000000), 0x20080, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r4, 0xc0045006, &(0x7f0000000180)=0x8) ioctl$SNDCTL_DSP_SETFRAGMENT(r4, 0xc004500a, &(0x7f0000000080)=0x80000003) dup2(r4, r4) ioctl$SNDCTL_DSP_SPEED(r4, 0xc0045002, &(0x7f0000000200)=0x5) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x10000000013, &(0x7f0000000180)=0x1, 0x4) fcntl$setpipe(r1, 0x407, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0x3c0d, 0x0, 0x80000, 0x1ea}, &(0x7f0000000340), 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x400) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r6, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r6, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000040)}) r7 = fanotify_init(0x200, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='net_prio.prioidx\x00', 0x275a, 0x0) fanotify_mark(r7, 0x101, 0x48001051, r8, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) file_setattr(0xffffffffffffff9c, 0x0, &(0x7f00000004c0)={0x80004000, 0x2, 0x80000001, 0xa1ef, 0x3}, 0x18, 0x1000) ioctl$DRM_IOCTL_MODE_GETPLANE(r6, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$UI_DEV_DESTROY(r0, 0x5502) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r6, 0xc02064b9, &(0x7f00000002c0)={&(0x7f0000000240)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, r9}) 2.687774981s ago: executing program 8 (id=2736): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0x14, &(0x7f0000001140), &(0x7f0000001180)=0x4) move_pages(0x0, 0x0, 0x0, &(0x7f0000000080), 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REKEY_OFFLOAD(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=ANY=[@ANYBLOB="fd180000", @ANYRES16=0x0, @ANYBLOB="20002cbd7000fbdbdf254f00000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900020000003100000058007a801c000200579bcf398bbbd75d32aa6077a886a74df3d0fcf02f399c3a1c00020024cf4713299967bd15bf44cad1f4d266b29e2a4135a412b21c0002007282cdb224050171ea757aea781d4160e9223cc0312d38d668007a801c0002005f3b5d542091777612684837dbc0ec47ea67acb692453dd20c0003005bd58c80a1143827140002009811fc13340000000000005ab959470014000100204183f74d05c885801d03a2488d3fd41400020032c5877eef25cfd5a4dd14ad077490051c007a800c000300b27375be034408920c00030000e2000000000000"], 0x104}}, 0x4) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000001200)=ANY=[@ANYBLOB="4801000042000100fffffffffddbdf250200000004003880100001800c00c800020000000000000020010480"], 0x148}, 0x1, 0x0, 0x0, 0x8800}, 0x4040) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd29, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xc, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_RSC={0x10, 0x1, {0x0, 0xfffffffe, 0x4}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x8001}, 0x20008850) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x30}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)=@newtfilter={0x790, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r5, {0x4, 0x10}, {}, {0x7, 0x6}}, [@filter_kind_options=@f_basic={{0xa}, {0x4}}, @filter_kind_options=@f_fw={{0x7}, {0x754, 0x2, [@TCA_FW_ACT={0x670, 0x4, [@m_police={0x638, 0x8, 0x0, 0x0, {{0xb}, {0x4}, {0x60b, 0x6, "35f4bad1ede1bdfdb3de3746838ea0b860af2c20e88dfb5f263eabf1c14277d51632d86e2099c79f6a05330349b30701a1d12e7d24526f381034171812eca252dd858c8af7f397cc655dd77c5e1b0905f9937e59bbb3d85bdd3a137f4aa7ec1a62172a79a5b3193f18771da526081dd9026dbf43498cdc82b486e192e93cf3279e5ab42fa836ee5ac5cbb53513809bcd5680a3d1d1799b99c36f53de8611a6b894f097619dea002caa7181fcf9b31b7edff1f99c8a1272e8ee3ea8ca5cd8e747563361e5b337c6acf536f898dcff96d78b6a3e0b368105938e2efb62692f191cb0508634e2982955c55ebeb1c5b36e21a2e8605929d6457d4a75969469e4d4a294c66ea5bd66c2f5334f904f7b91af511659d16693ed7f026e9fec785b10106459817a95dc4f36cd56d3da4ba8bfdd39c195ddf1b0a009a255962135c7d9075257983923ad00145f8c4275be27c53dbe6be805525c630bb5a2fb2b1ec8e162f0c9f78750c0ff295f600719817f870f50233847937d717443604a3344f314e95d6fd0858abec943d9ee974b820313c76c2fb2109c4dca108cfb5dacf0622b99efd7a617f0ea466580c0cf2d37623c6152cf09b6c66d856cf1ef6f0e0d0606a7c3b4b9af8f02dfed58e769344d521094201a29218f430c7aa6cdc44afc075a61d8c037fa195aaef186a5122222d8a2c983b19a43ecb20394bee0d9faec47028612e2b5322981c31795d5498464d4184c9866c788227fc6f2f928667fa78e99a139d05dc2dcda4a3d8b036d72dbe6e03b095db1b3f513feb997014725e9617ded7d27b80fcd6fc2167db65156af78d2f6be02fe2891afcd5270438c22971d12a672b326baf3331961bf94da42afac6999c39ff51870ddbc5f4f9e0cf8dac3f75d2683fca7672c4510df49944e7cf7fa168b2f9d4da9dd2d01540e06af5e6fa665a5f1bb3c0790e49675ead2d90b0c6b30938356ffd2a3c2a143bbd44f78de4e57c46afa835c7a87c485680c14351523dfaa3174fdf81bdf62a1dec8fc1d8a4637327acf58c9c63166407283fa5d7da328b8586308cb93f647b4f6f8f0a9337e5a5e7348fce1d7b2303f2f61d5f3a063806603dc52bd3bf3ac05d47e14e03cbc5fa2ccc7ac3c594673e82f20fe5ca724702da40f68f85ddfddcbbaffcfdb0a00fdeb5ae3e5958e3c547ff5c0f8eb9ccf9e8f66881138a3b43f60f24ce6c0934c758a8470a4e6f771c386bfd3db9e29cc64bdcb848c4de0b21bcf5f80529dbfbdcdf3441a8af5c0148ab6237857a199a0311ebc60ed570836e765766aca1555fe4c6d2368c1fbaaf18d8e9683c5d723ac65d18df70d996b9b99397115f1a2ec6e5cfa8b0ba6c0d2cd22024bd455cfffee9f7bfcb18d00cdefca25cf9b50074aff814e7ab7febbc15eb951382a4bff3052b267e48b6ba593d6be619d1f745d891692005e7053f212f9770884243052e695d12a68290f696743a31fae3e6edcfa48263520b26b549d294c936e08cb66f1d1dc79ccee57ef49d4ed41ad791d05b709fc30649f28c3a74f6682dedd21a77dd483ae859ed0989822fa3458efad40ed23e1814598b193fcbb4a15aa77b1bbd9dfe5db520d9224ade96aebec3f7b6a37cb05341a8e6167971d3e1f3dd15c397efac72ba5f70f9ef479ac8bfe4961b81f871e58d6cb2d5c1a1eb39eb7cd1942e74cbc4e6c4cf970c9fc61d01bb81ae2e9ca1e18f847ea41b2cc5b2e13b3c59e0c8631fbf0a37b847c321dc10e44af18c65c142277a418ba46dece13b91d184802608bb0ecc861dbe9c3b3c757e888baa696f7a3222193fc8a2a4ca833772a80c8baa915565e43f7b5b33c32dcd39c0ea13d593b24eb868af02bc80b2cc3748400daf258a91dab8734ffca2b5b6a2556ac2903574924b71d21af1460c4a7d79aa8dfc155946c6bbbb9ef045c7bce865526d832f7f7817fa74ac8622a952ee34ea36e89e55d9756ec86a8c01e94be57ee773882b2a3fe4aec6b20d29a0cea9c238ea8f8aa438386be4675e9f91f0cac66397be6220f8b8c9ddb49f9a14cf735fd88bd1684e0e804d1115a7fa6eb9d8dad8e5dd741bf1133f1e28d8321a3f65643ae4e87ea9c8495cbf4ce9cbaae6651845bd97976157b993b9806e9403966e648b9f77bd08265fc21f02e44447d84336e464eceae19adc30bcc7752"}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}, @m_ife={0x34, 0x0, 0x0, 0x0, {{0x8}, {0x4}, {0xb, 0x6, "093d4b88e14ab5"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}, @TCA_FW_MASK={0x8, 0x5, 0x8d37}, @TCA_FW_ACT={0xc0, 0x4, [@m_connmark={0x64, 0x1d, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x7, 0xffff0000, 0xc24ba5996f978a81, 0x10000, 0x3}, 0x5}}]}, {0x17, 0x6, "bda5d5437d3d49903c5fe5229718e0677fa6fb"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_connmark={0x58, 0x8, 0x0, 0x0, {{0xd}, {0x4}, {0x26, 0x6, "82fdc54105578b90de160f075541cbf91b45474a4bf836c9297311734d725b2d77c7"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_FW_CLASSID={0x8, 0x1, {0xf, 0xffe0}}, @TCA_FW_MASK={0x8, 0x5, 0x100}, @TCA_FW_MASK={0x8, 0x5, 0x6}]}}]}, 0x790}, 0x1, 0x4000000}, 0x0) r7 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRES8=r7], 0x48}}, 0x0) sendmmsg$alg(r7, &(0x7f00000000c0), 0x492492492492627, 0x0) 2.519010713s ago: executing program 7 (id=2737): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000014c0)=ANY=[@ANYBLOB="14000000100001000000fff5000000000000000a6c000000060a0b04000000000000000002000000400004803c0001800b00010065787468647200002c000280080004400000004408000740000000050800064000000001050002000000000008000340000000040900010073797a30000000000900020073797a32"], 0x94}}, 0x0) 2.390766124s ago: executing program 9 (id=2738): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) ioctl$USBDEVFS_DROP_PRIVILEGES(0xffffffffffffffff, 0x4004551e, 0x0) ioctl$USBDEVFS_BULK(0xffffffffffffffff, 0xc0185502, &(0x7f00000000c0)={{{0x1, 0x1}}, 0x0, 0x180000, 0x0}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r3 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r3, &(0x7f0000000000)={0x18, 0x2, {0x0, @local}}, 0x1e) connect$pptp(r3, &(0x7f0000000140)={0x18, 0x2, {0x0, @rand_addr=0x64010102}}, 0x1e) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000140), 0xffffffffffffffff) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$L2TP_CMD_TUNNEL_CREATE(r4, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYRESDEC=0x0], 0x3c}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r6, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) socket$unix(0x1, 0x1, 0x0) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000940)={0x2, 0xa, 0xe, 0x2, 0x2, 0x0, 0x70bd28, 0x25dfdbfd}, 0x10}}, 0x4000000) socket(0x400000000010, 0x3, 0x0) 1.685611432s ago: executing program 7 (id=2739): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x54, 0x9, 0xa, 0x401, 0x2000000, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x8}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x8}, @NFTA_SET_DATA_LEN={0x8, 0x7, 0x1, 0x0, 0x31}, @NFTA_SET_DATA_TYPE={0x8}]}, @NFT_MSG_NEWSETELEM={0x78, 0xc, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x4004}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x4c, 0x3, 0x0, 0x1, [{0x48, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_DATA={0x3c, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x35, 0x1, "c023471681f02c94d5e1fcc9edd3d3f514d42f153f23e012bf3d4e99c95d7e25e5f7c0a6097522b02e8af64bd0bf534e64"}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x114}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 1.003431397s ago: executing program 4 (id=2740): syz_open_dev$video4linux(0x0, 0x9, 0x34f081) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x50) sendmsg$NL80211_CMD_NEW_INTERFACE(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="090d0000000000f0ff000700000008000300", @ANYRES32=r2, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc000800050006000000140004"], 0x58}}, 0x0) r3 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0) syz_usb_control_io$uac2(r3, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000580)={0x18, &(0x7f0000000640)={0x40, 0xb, 0x1, "e2"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r3, 0x0, &(0x7f00000003c0)={0x24, &(0x7f0000000180)={0x20, 0x11, 0x1, "1a"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 823.095642ms ago: executing program 7 (id=2741): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000000040260933334000000000010902240001000000000904000001030100000921000000012201000905810308"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000380)={0x0, 0x22, 0x1, {[@global=@item_012={0x0, 0x1, 0x5}]}}, 0x0}, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) listen(r3, 0x4) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r3, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x4}, 0x8) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xca}, 0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) r6 = dup3(0xffffffffffffffff, r5, 0x80000) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0xfffffffffffffffe, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(r6, 0xc018937c, &(0x7f0000000000)={{0x1, 0x1, 0x18, r4, {0x4}}, './file0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) r7 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000300)={'bridge0\x00'}) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) fsopen(&(0x7f0000000180)='ntfs3\x00', 0x0) close(r7) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000a8afb5086d04b3082a6d0000000409021200"], 0x0) close_range(r8, r9, 0x0) 0s ago: executing program 8 (id=2742): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x80800, 0x0) close(r4) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r5, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000100)=@ethtool_ringparam={0x8, 0x0, 0x1}}) r6 = socket$unix(0x1, 0x1, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000002c0)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x80, {0x0, 0x0, 0x0, r8, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x5823, 0x200, 0x6362, 0x5, 0xfffffffd, 0xffffffff}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc04c001}, 0x20000804) sendmsg$nl_route_sched(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80000, {0x0, 0x0, 0x0, r8, {0x0, 0xffe0}, {0x2, 0xb}, {0xd, 0xd}}, [@qdisc_kind_options=@q_pfifo_fast={0xf}]}, 0x34}, 0x1, 0x0, 0x0, 0x24000050}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) kernel console output (not intermixed with test programs): 631.373048][ T5907] usb 5-1: New USB device found, idVendor=1770, idProduct=ff00, bcdDevice= 0.40 [ 631.391361][ T5907] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 631.426044][T14596] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 632.244689][ T5907] usbhid 5-1:1.0: can't add hid device: -32 [ 632.257289][ T5907] usbhid 5-1:1.0: probe with driver usbhid failed with error -32 [ 632.619854][ T5964] net_ratelimit: 6 callbacks suppressed [ 632.619873][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.634602][T14610] fuse: Unknown parameter 'gf«' [ 632.641421][T14592] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 632.654949][T14592] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 632.664000][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 632.690459][T14610] ipip0: entered promiscuous mode [ 632.695536][T14610] ipip0: entered allmulticast mode [ 633.077409][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 633.697323][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 633.841717][ T5907] usb 5-1: USB disconnect, device number 92 [ 634.302160][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 634.756894][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.697892][ T5907] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.710203][ T9978] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 635.777411][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.828152][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 635.887354][ T9978] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 635.900893][ T9978] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 635.929251][ T9978] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.972952][ T9978] usb 2-1: config 0 descriptor?? [ 636.204681][ T9978] usbhid 2-1:0.0: can't add hid device: -71 [ 636.252409][ T9978] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 636.493208][ T9978] usb 2-1: USB disconnect, device number 72 [ 636.662603][T12702] Bluetooth: hci3: command 0x0406 tx timeout [ 636.817358][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.117337][ T9978] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 637.322476][ T9978] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 637.347211][ T9978] usb 2-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 637.370648][ T9978] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 637.389193][ T9978] usb 2-1: config 0 descriptor?? [ 637.787113][ T9979] net_ratelimit: 1 callbacks suppressed [ 637.787132][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.819977][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.844279][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.854169][ T5907] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.862325][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 637.865015][ T9978] plantronics 0003:047F:3333.0024: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.1-1/input0 [ 638.309953][T14654] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 638.319310][T14654] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 638.327305][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.737238][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 638.830443][T12702] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 638.847264][T12702] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 638.868284][T12702] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 638.876415][T12702] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 638.887787][T12702] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 638.897390][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.118711][T14665] netlink: 'syz.4.2402': attribute type 1 has an invalid length. [ 639.582879][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 639.946691][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 640.181480][T14663] chnl_net:caif_netlink_parms(): no params data found [ 640.424197][T14663] bridge0: port 1(bridge_slave_0) entered blocking state [ 640.436584][ T5907] usb 2-1: USB disconnect, device number 73 [ 640.483337][T14663] bridge0: port 1(bridge_slave_0) entered disabled state [ 640.528257][T14663] bridge_slave_0: entered allmulticast mode [ 640.541790][T14663] bridge_slave_0: entered promiscuous mode [ 640.570955][T14663] bridge0: port 2(bridge_slave_1) entered blocking state [ 640.593083][T14663] bridge0: port 2(bridge_slave_1) entered disabled state [ 640.600455][T14663] bridge_slave_1: entered allmulticast mode [ 640.618782][T14663] bridge_slave_1: entered promiscuous mode [ 640.652457][ T30] kauditd_printk_skb: 32 callbacks suppressed [ 640.652474][ T30] audit: type=1326 audit(1775573836.476:1365): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 640.744450][T14663] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 640.813214][T14663] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 640.890174][T14663] team0: Port device team_slave_0 added [ 640.907160][T14663] team0: Port device team_slave_1 added [ 640.957672][T14663] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 640.978428][T12702] Bluetooth: hci5: command tx timeout [ 640.992628][T14663] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 641.081228][T14663] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 641.092573][ T30] audit: type=1326 audit(1775573836.476:1366): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.159851][T14663] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 641.199375][T14663] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 641.245856][T14663] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 641.284322][ T30] audit: type=1326 audit(1775573836.476:1367): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.431128][ T30] audit: type=1326 audit(1775573836.476:1368): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.500161][T14663] hsr_slave_0: entered promiscuous mode [ 641.515951][ T30] audit: type=1326 audit(1775573836.476:1369): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=6 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.539271][T14663] hsr_slave_1: entered promiscuous mode [ 641.555649][T14663] debugfs: 'hsr0' already exists in 'hsr' [ 641.575741][T14663] Cannot create hsr debugfs directory [ 641.604401][ T30] audit: type=1326 audit(1775573836.476:1370): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.680311][ T30] audit: type=1326 audit(1775573836.476:1371): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=1 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.707254][ T30] audit: type=1326 audit(1775573836.966:1372): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 641.717107][T12702] Bluetooth: hci2: command 0x0406 tx timeout [ 641.806258][T14690] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2408'. [ 641.863213][ T30] audit: type=1326 audit(1775573836.966:1373): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14684 comm="syz.1.2405" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f20c479c819 code=0x7ffc0000 [ 642.977209][ T9978] usb 1-1: new high-speed USB device number 87 using dummy_hcd [ 643.057805][ T5830] Bluetooth: hci5: command tx timeout [ 643.058205][ T5964] net_ratelimit: 6 callbacks suppressed [ 643.058219][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.144291][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.153835][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.162584][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.177996][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 643.431458][ T9978] usb 1-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 643.471723][ T9978] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 643.489609][T14663] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 643.544048][ T9978] usb 1-1: Product: syz [ 643.562147][ T9978] usb 1-1: Manufacturer: syz [ 643.566858][ T9978] usb 1-1: SerialNumber: syz [ 643.658027][ T9978] usb 1-1: config 0 descriptor?? [ 643.683165][ T9978] i2c-tiny-usb 1-1:0.0: version 6d.cc found at bus 001 address 087 [ 643.690540][T14663] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 643.804393][T14663] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 644.036591][T14663] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 644.097310][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.434545][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.708761][T14663] 8021q: adding VLAN 0 to HW filter on device bond0 [ 644.806640][T14663] 8021q: adding VLAN 0 to HW filter on device team0 [ 644.830212][ T5907] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 644.895228][ T3544] bridge0: port 1(bridge_slave_0) entered blocking state [ 644.895355][ T3544] bridge0: port 1(bridge_slave_0) entered forwarding state [ 644.924043][ T1166] bridge0: port 2(bridge_slave_1) entered blocking state [ 644.924146][ T1166] bridge0: port 2(bridge_slave_1) entered forwarding state [ 645.080224][T14663] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 645.137311][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.137603][ T5830] Bluetooth: hci5: command tx timeout [ 645.192431][T14663] veth0_vlan: entered promiscuous mode [ 645.218731][T14663] veth1_vlan: entered promiscuous mode [ 645.254530][T14663] veth0_macvtap: entered promiscuous mode [ 645.313868][T14663] veth1_macvtap: entered promiscuous mode [ 645.344184][T14663] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 645.374964][T14663] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 645.419716][ T3544] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.436512][ T3544] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.437878][ T5915] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 645.481386][ T3544] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.514780][ T3544] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 645.597574][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 645.629794][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 645.658726][ T5915] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 645.677277][ T1139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.710585][ T1139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 645.726006][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 645.766505][ T5915] usb 2-1: config 0 descriptor?? [ 645.831211][ T1139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 645.876225][ T1139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 646.023169][ T5915] usbhid 2-1:0.0: can't add hid device: -71 [ 646.052037][ T5915] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 646.103037][ T5915] usb 2-1: USB disconnect, device number 74 [ 646.177763][ T9978] i2c i2c-1: failure reading functionality [ 646.204604][ T9978] i2c i2c-1: connected i2c-tiny-usb device [ 646.300203][T14735] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 646.307064][ T9978] usb 1-1: USB disconnect, device number 87 [ 646.537685][ T5915] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 646.746590][T14748] fuse: Unknown parameter 'group_id00000000000000000000' [ 646.769723][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 646.786584][ T5915] usb 2-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 646.933846][ T5915] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 647.014725][ T5915] usb 2-1: config 0 descriptor?? [ 647.234505][ T5830] Bluetooth: hci5: command tx timeout [ 647.528215][ T5915] plantronics 0003:047F:3333.0025: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.1-1/input0 [ 647.947577][T14762] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 648.187602][T14762] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 648.257216][ T5885] net_ratelimit: 5 callbacks suppressed [ 648.257233][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.155152][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.297752][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.730602][ T9978] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 649.862101][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 649.870729][ T5907] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 650.009211][ T9978] usb 8-1: unable to get BOS descriptor or descriptor too short [ 650.019651][ T9978] usb 8-1: config 0 has no interfaces? [ 650.026631][ T9978] usb 8-1: language id specifier not provided by device, defaulting to English [ 650.048407][ T5907] usb 5-1: Using ep0 maxpacket: 8 [ 650.053854][T14779] openvswitch: netlink: IPv4 tun info is not correct [ 650.062043][ T5907] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 650.072072][ T5907] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 650.089528][ T9978] usb 8-1: New USB device found, idVendor=2040, idProduct=b990, bcdDevice=f6.75 [ 650.117109][ T5907] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 650.127474][ T9978] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 650.135488][ T9978] usb 8-1: Product: syz [ 650.141284][ T5907] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 650.164307][ T9978] usb 8-1: SerialNumber: syz [ 650.207359][ T9978] usb 8-1: config 0 descriptor?? [ 650.217104][ T5907] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 650.246774][ T5907] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 650.289628][ T5964] usb 2-1: USB disconnect, device number 75 [ 650.344118][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.476567][T14785] netlink: 44 bytes leftover after parsing attributes in process `syz.1.2434'. [ 650.555357][ T5907] usb 5-1: GET_CAPABILITIES returned 0 [ 650.569604][T14769] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 650.588828][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 650.596866][ T5907] usbtmc 5-1:16.0: can't read capabilities [ 650.614910][T14769] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 650.666247][ T5964] usb 8-1: USB disconnect, device number 2 [ 650.708931][T14789] fuse: Unknown parameter 'group_id00000000000000000000' [ 650.739481][ T5907] usb 5-1: USB disconnect, device number 93 [ 650.900161][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.047997][T14798] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.056917][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 651.337749][ T9978] usb 2-1: new full-speed USB device number 76 using dummy_hcd [ 651.363544][T14802] ref_tracker: memory allocation failure, unreliable refcount tracker. [ 651.498800][ T9978] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 65535, setting to 64 [ 651.511657][ T9978] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 1024, setting to 64 [ 651.530074][T14805] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2441'. [ 651.562701][ T9978] usb 2-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 651.595732][ T9978] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 651.644639][ T9978] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 651.664856][ T9978] usb 2-1: Product: syz [ 651.669780][ T9978] usb 2-1: Manufacturer: syz [ 651.675744][ T9978] usb 2-1: SerialNumber: syz [ 651.711090][ T9978] cdc_mbim 2-1:1.0: skipping garbage [ 651.938833][T14798] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 652.032457][T14798] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 652.727666][ T5907] usb 8-1: new high-speed USB device number 3 using dummy_hcd [ 652.785409][T14798] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 652.802948][T14798] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 652.838723][ T9978] cdc_mbim 2-1:1.0: dwNtbInMaxSize=3 is too small. Using 2048 [ 652.861894][ T9978] cdc_mbim 2-1:1.0: setting rx_max = 2048 [ 652.889132][ T5907] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 652.900219][ T5907] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 652.923693][ T5907] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 652.959795][ T5907] usb 8-1: config 0 descriptor?? [ 653.052210][ T9978] cdc_mbim 2-1:1.0: setting tx_max = 184 [ 653.103516][ T9978] cdc_ncm 2-1:1.1: probe with driver cdc_ncm failed with error -71 [ 653.112590][ T9978] cdc_mbim 2-1:1.1: probe with driver cdc_mbim failed with error -71 [ 653.124686][ T9978] usbtest 2-1:1.1: probe with driver usbtest failed with error -71 [ 653.157647][ T9978] usb 2-1: USB disconnect, device number 76 [ 653.204355][ T5907] usbhid 8-1:0.0: can't add hid device: -71 [ 653.220308][ T5907] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 653.238682][ T5907] usb 8-1: USB disconnect, device number 3 [ 653.261821][ T30] audit: type=1326 audit(1775573849.086:1374): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14820 comm="syz.0.2447" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f8f10d9c819 code=0x0 [ 653.310336][ T1149] net_ratelimit: 4 callbacks suppressed [ 653.310354][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 653.457264][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 653.497260][ T30] audit: type=1326 audit(1775573849.316:1375): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14820 comm="syz.0.2447" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f8f10d9c819 code=0x7ffe0000 [ 653.637673][T14826] fuse: Bad value for 'user_id' [ 653.643611][T14826] fuse: Bad value for 'user_id' [ 653.745559][ T5907] usb 8-1: new high-speed USB device number 4 using dummy_hcd [ 653.937310][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 653.947921][ T5907] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 653.961755][ T5907] usb 8-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 654.061310][ T5907] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 654.120544][ T5907] usb 8-1: config 0 descriptor?? [ 654.498434][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.558651][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 654.611114][ T5907] plantronics 0003:047F:3333.0026: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.7-1/input0 [ 654.889123][T14838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 654.903477][T14836] netdevsim netdevsim1 netdevsim0: entered allmulticast mode [ 654.920773][T14836] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 655.140183][T14838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 655.538628][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.697725][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 655.731153][T14844] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 655.829755][T14850] x_tables: duplicate underflow at hook 3 [ 656.058866][ T5964] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 656.226316][ T5964] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 656.238226][ T5964] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 656.278398][ T5964] usb 2-1: New USB device found, idVendor=1e7d, idProduct=2ced, bcdDevice= 0.00 [ 656.316595][ T5964] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 656.361934][ T5964] usb 2-1: config 0 descriptor?? [ 656.577374][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 656.833228][ T5964] kone 0003:1E7D:2CED.0027: unexpected long global item [ 656.871396][ T5964] kone 0003:1E7D:2CED.0027: parse failed [ 656.897343][ T5964] kone 0003:1E7D:2CED.0027: probe with driver kone failed with error -22 [ 657.107479][T14847] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 657.163819][T14847] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 657.329335][ T9978] usb 8-1: USB disconnect, device number 4 [ 658.657255][ T5885] net_ratelimit: 1272 callbacks suppressed [ 658.657270][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 658.908681][ T9979] usb 2-1: USB disconnect, device number 77 [ 659.015949][T14873] fuse: Bad value for 'user_id' [ 659.102666][T14874] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2458'. [ 659.117184][T14873] fuse: Bad value for 'user_id' [ 659.197052][T14876] No such timeout policy "syz1" [ 659.461557][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.488481][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 659.716692][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.027711][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.762049][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 660.902207][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.777527][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 661.829789][ T9978] usb 8-1: new high-speed USB device number 5 using dummy_hcd [ 662.001029][ T9978] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 662.014498][ T9978] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 662.025539][ T9978] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 662.037592][T14905] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2469'. [ 662.059857][ T9978] usb 8-1: config 0 descriptor?? [ 662.297844][ T9978] usbhid 8-1:0.0: can't add hid device: -71 [ 662.303900][ T9978] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 662.341359][ T9978] usb 8-1: USB disconnect, device number 5 [ 662.769477][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 662.817227][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 663.158262][ T9978] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 663.348730][ T9978] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 663.369928][ T9978] usb 8-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 663.517845][ T9978] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.644337][ T9978] usb 8-1: config 0 descriptor?? [ 663.857381][ T5964] net_ratelimit: 1 callbacks suppressed [ 663.857399][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.079984][ T9978] plantronics 0003:047F:3333.0028: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.7-1/input0 [ 664.098778][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 664.390614][T14929] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 664.467950][T14929] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 664.897507][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.493785][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 665.637196][ T9978] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 665.937224][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.059429][ T9978] usb 5-1: Using ep0 maxpacket: 32 [ 666.160847][ T9978] usb 5-1: unable to get BOS descriptor or descriptor too short [ 666.179192][T14946] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.187781][T14946] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.221980][ T9978] usb 5-1: config 244 has an invalid interface number: 68 but max is 0 [ 666.260560][ T9978] usb 5-1: config 244 has no interface number 0 [ 666.287257][T14947] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2482'. [ 666.288238][ T9978] usb 5-1: config 244 interface 68 altsetting 3 has an endpoint descriptor with address 0xF8, changing to 0x88 [ 666.369493][ T9978] usb 5-1: config 244 interface 68 altsetting 3 endpoint 0x4 has invalid maxpacket 1023, setting to 64 [ 666.418989][ T9978] usb 5-1: config 244 interface 68 altsetting 3 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 666.462352][ T9982] usb 8-1: USB disconnect, device number 6 [ 666.491834][ T9978] usb 5-1: config 244 interface 68 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 666.561245][ T9978] usb 5-1: config 244 interface 68 has no altsetting 0 [ 666.587487][ T9978] usb 5-1: New USB device found, idVendor=0867, idProduct=9812, bcdDevice=24.0f [ 666.604671][ T9978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 666.618500][ T9978] usb 5-1: Product: syz [ 666.622705][ T9978] usb 5-1: Manufacturer: syz [ 666.636223][ T9978] usb 5-1: SerialNumber: syz [ 666.737607][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 666.932284][T14942] block device autoloading is deprecated and will be removed. [ 667.020791][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.039339][T14942] netlink: 'syz.4.2480': attribute type 4 has an invalid length. [ 667.077123][ T9990] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 667.096350][T14955] netlink: 'syz.4.2480': attribute type 4 has an invalid length. [ 667.392787][T14967] xt_CT: You must specify a L4 protocol and not use inversions on it [ 667.527997][ T9990] usb 8-1: config index 0 descriptor too short (expected 8192, got 18) [ 667.542514][ T9990] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 667.566630][T12702] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 667.577976][T12702] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 667.588556][T12702] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 667.611387][T12702] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 667.620491][T12702] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 667.692437][ T9990] usb 8-1: config 0 has no interfaces? [ 667.767329][ T5915] usb 2-1: new full-speed USB device number 78 using dummy_hcd [ 667.787818][ T9990] usb 8-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 667.844213][ T9990] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 667.897220][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 667.956383][ T9990] usb 8-1: Product: syz [ 667.978053][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 668.007262][ T9990] usb 8-1: Manufacturer: syz [ 668.063910][ T9990] usb 8-1: SerialNumber: syz [ 668.069086][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 668.119810][ T9990] usb 8-1: config 0 descriptor?? [ 668.172652][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 668.210149][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 668.408828][ T9990] usb 8-1: USB disconnect, device number 7 [ 668.431945][T14970] chnl_net:caif_netlink_parms(): no params data found [ 668.530810][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xD has invalid wMaxPacketSize 0 [ 668.616595][ T5915] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 668.682366][ T5915] usb 2-1: New USB device found, idVendor=0451, idProduct=5152, bcdDevice=c0.b9 [ 668.704705][ T5915] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 668.742143][ T5915] usb 2-1: Product: syz [ 668.758100][ T5915] usb 2-1: Manufacturer: syz [ 668.784641][ T5915] usb 2-1: SerialNumber: syz [ 668.822223][ T5915] usb 2-1: config 0 descriptor?? [ 668.844543][ T5915] ti_usb_3410_5052 2-1:0.0: TI USB 5052 2 port adapter converter detected [ 668.855457][ T5915] ti_usb_3410_5052 2-1:0.0: missing endpoints [ 669.054454][T14970] bridge0: port 1(bridge_slave_0) entered blocking state [ 669.062580][ T9979] net_ratelimit: 1 callbacks suppressed [ 669.062593][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.080396][T14970] bridge0: port 1(bridge_slave_0) entered disabled state [ 669.107448][T14970] bridge_slave_0: entered allmulticast mode [ 669.116175][T14970] bridge_slave_0: entered promiscuous mode [ 669.138435][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.154281][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.252013][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 669.390685][T14970] bridge0: port 2(bridge_slave_1) entered blocking state [ 669.398037][T14983] netlink: 'syz.7.2490': attribute type 23 has an invalid length. [ 669.406628][T14970] bridge0: port 2(bridge_slave_1) entered disabled state [ 669.473557][T14970] bridge_slave_1: entered allmulticast mode [ 669.529217][T14970] bridge_slave_1: entered promiscuous mode [ 669.636395][ T9978] comedi comedi5: Wrong number of endpoints [ 669.655125][ T9978] dt9812 5-1:244.68: driver 'dt9812' failed to auto-configure device. [ 669.709974][ T5830] Bluetooth: hci6: command tx timeout [ 669.724869][ T9978] usb 5-1: USB disconnect, device number 94 [ 669.878587][T14970] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 669.931696][T14970] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 670.188838][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.327650][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 670.550902][T14970] team0: Port device team_slave_0 added [ 670.568693][T14970] team0: Port device team_slave_1 added [ 670.834227][ T5885] usb 2-1: USB disconnect, device number 78 [ 670.849437][T14970] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 670.856812][T14970] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 670.883804][ T9981] usb 1-1: new high-speed USB device number 88 using dummy_hcd [ 671.059006][T14970] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 671.100285][ T9981] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 671.176861][ T9981] usb 1-1: config 1 interface 1 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 671.209423][T14970] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 671.226744][T14970] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 671.273149][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.273644][ T9981] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 671.281880][ T5885] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 671.344671][T14970] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 671.355674][ T9981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 671.415358][ T9981] usb 1-1: Product: syz [ 671.443594][ T9981] usb 1-1: Manufacturer: syz [ 671.465311][ T9981] usb 1-1: SerialNumber: syz [ 671.508279][ T9981] cdc_ncm 1-1:1.0: skipping garbage [ 671.508777][ T5885] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 671.544224][ T5885] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 671.584534][ T5885] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 671.594623][ T9981] cdc_ncm 1-1:1.0: CDC Union missing and no IAD found [ 671.602888][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 671.637078][ T9981] cdc_ncm 1-1:1.0: bind() failure [ 671.648844][ T5885] usb 2-1: config 0 descriptor?? [ 671.666229][T14970] hsr_slave_0: entered promiscuous mode [ 671.697873][ T9981] cdc_ncm 1-1:1.1: CDC Union missing and no IAD found [ 671.705853][T14970] hsr_slave_1: entered promiscuous mode [ 671.736518][ T9981] cdc_ncm 1-1:1.1: bind() failure [ 671.768425][T14970] debugfs: 'hsr0' already exists in 'hsr' [ 671.774190][T14970] Cannot create hsr debugfs directory [ 671.780203][ T5830] Bluetooth: hci6: command tx timeout [ 671.795358][ T9981] usb 1-1: USB disconnect, device number 88 [ 671.943499][ T5885] usbhid 2-1:0.0: can't add hid device: -71 [ 671.963457][ T5885] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 671.967573][T15002] netlink: 12 bytes leftover after parsing attributes in process `syz.4.2495'. [ 672.015267][ T5885] usb 2-1: USB disconnect, device number 79 [ 672.259673][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.347351][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 672.457304][ T5885] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 672.619184][ T5885] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 672.656638][ T5885] usb 2-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 672.663711][T14970] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 672.684696][ T5885] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.696472][T15008] i2c i2c-0: DVB: adapter 0 frontend 0 frequency 0 out of range (51000..2150000) [ 672.712148][T14970] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 672.738267][ T5885] usb 2-1: config 0 descriptor?? [ 672.872615][T14970] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 672.888636][T14970] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 673.153376][ T5885] plantronics 0003:047F:3333.0029: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.1-1/input0 [ 673.259823][T14970] 8021q: adding VLAN 0 to HW filter on device bond0 [ 673.340801][T14970] 8021q: adding VLAN 0 to HW filter on device team0 [ 673.385617][ T77] bridge0: port 1(bridge_slave_0) entered blocking state [ 673.392829][ T77] bridge0: port 1(bridge_slave_0) entered forwarding state [ 673.474653][T15030] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 673.486084][T15030] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 673.510917][T15031] netlink: 'syz.7.2502': attribute type 23 has an invalid length. [ 673.713502][ T77] bridge0: port 2(bridge_slave_1) entered blocking state [ 673.720731][ T77] bridge0: port 2(bridge_slave_1) entered forwarding state [ 673.950814][ T5830] Bluetooth: hci6: command tx timeout [ 674.248201][T14970] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 674.443921][ T5885] net_ratelimit: 4 callbacks suppressed [ 674.443940][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 674.472014][T14970] veth0_vlan: entered promiscuous mode [ 674.535507][T14970] veth1_vlan: entered promiscuous mode [ 674.703073][T14970] veth0_macvtap: entered promiscuous mode [ 674.756551][T14970] veth1_macvtap: entered promiscuous mode [ 675.110141][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.134180][T15042] syzkaller0: entered promiscuous mode [ 675.142050][T15042] syzkaller0: entered allmulticast mode [ 675.154496][T15042] [U] VÔ3žÂFÙŸ"SÇÁ/ÉÊ4:ÃXTZ“W¡T‘’LWµ«= [ 675.186276][T14970] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 675.194158][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.269917][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.304866][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.317522][T15047] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.348714][T14970] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 675.357663][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.366730][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.377608][ T3544] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.407430][T15047] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.418807][ T5964] usb 2-1: USB disconnect, device number 80 [ 675.420268][ T5907] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 675.453360][ T3544] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.492556][ T1149] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.507187][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 675.534030][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.578853][ T1149] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 675.588706][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.608743][ T9978] usb 1-1: new high-speed USB device number 89 using dummy_hcd [ 675.620869][ T5907] usb 8-1: Using ep0 maxpacket: 8 [ 675.643603][ T5907] usb 8-1: config index 0 descriptor too short (expected 301, got 45) [ 675.676870][T15045] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2506'. [ 675.694568][ T5907] usb 8-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 675.738231][ T5907] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 675.787750][ T9978] usb 1-1: Using ep0 maxpacket: 16 [ 675.793193][ T5907] usb 8-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 675.815939][ T9978] usb 1-1: config 0 has an invalid interface number: 35 but max is 0 [ 675.828654][ T1149] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 675.853505][ T9978] usb 1-1: config 0 has no interface number 0 [ 675.853852][ T1149] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 675.899957][ T5907] usb 8-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 675.929276][ T9978] usb 1-1: config 0 interface 35 altsetting 0 has an endpoint descriptor with address 0x7A, changing to 0xA [ 675.959297][ T5907] usb 8-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 676.003509][ T9978] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0xA has an invalid bInterval 70, changing to 10 [ 676.017435][ T5830] Bluetooth: hci6: command tx timeout [ 676.024717][ T5907] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.024777][ T1139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 676.079350][ T9978] usb 1-1: config 0 interface 35 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 676.084197][ T1139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 676.139447][ T9978] usb 1-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=3e.04 [ 676.194642][ T9978] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.211382][T15055] syzkaller0: entered promiscuous mode [ 676.216953][T15055] syzkaller0: entered allmulticast mode [ 676.228720][ T9978] usb 1-1: Product: syz [ 676.228744][ T9978] usb 1-1: Manufacturer: syz [ 676.228758][ T9978] usb 1-1: SerialNumber: syz [ 676.315781][ T9978] usb 1-1: config 0 descriptor?? [ 676.329570][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.585936][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 676.789835][ T9978] usb 1-1: USB disconnect, device number 89 [ 677.684593][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.748034][T15076] iommufd_mock iommufd_mock1: Adding to iommu group 0 [ 677.768796][T15077] iommufd_mock iommufd_mock0: Adding to iommu group 1 [ 677.787612][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 677.820289][T15081] x_tables: ip6_tables: mh match: only valid for protocol 135 [ 678.368495][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.565070][ T5907] usb 8-1: usb_control_msg returned -71 [ 678.599696][T15040] [U] J"—E:ÀÆ" [ 678.617092][ T5907] usbtmc 8-1:16.0: can't read capabilities [ 678.656280][T15085] batman_adv: batadv0: Adding interface: macvtap1 [ 678.663997][T15085] batman_adv: batadv0: The MTU of interface macvtap1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 678.699882][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 678.768519][ T5907] usb 8-1: USB disconnect, device number 8 [ 678.841529][T15085] batman_adv: batadv0: Not using interface macvtap1 (retrying later): interface not active [ 679.435114][T15102] tipc: Started in network mode [ 679.450989][T15102] tipc: Node identity 46ce9d8c476a, cluster identity 4711 [ 679.485339][T15102] tipc: Enabled bearer , priority 0 [ 679.495065][T15103] __nla_validate_parse: 58 callbacks suppressed [ 679.495083][T15103] netlink: 20 bytes leftover after parsing attributes in process `syz.1.2522'. [ 679.512759][T15105] syzkaller0: entered promiscuous mode [ 679.532756][T15105] syzkaller0: entered allmulticast mode [ 679.604027][T15101] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2523'. [ 679.614508][T15101] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2523'. [ 679.640280][T15101] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2523'. [ 679.668675][T15101] netlink: 32 bytes leftover after parsing attributes in process `syz.4.2523'. [ 679.698838][T15106] netlink: 44 bytes leftover after parsing attributes in process `syz.4.2523'. [ 679.748575][T15096] tipc: Resetting bearer [ 679.778016][ T5964] net_ratelimit: 2 callbacks suppressed [ 679.778036][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 679.796509][T15095] tipc: Resetting bearer [ 679.933539][T15095] tipc: Disabling bearer [ 680.289284][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 680.303719][T15114] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 680.328576][T15114] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 680.338453][ T9978] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 680.497878][ T9978] usb 5-1: Using ep0 maxpacket: 8 [ 680.510710][ T9978] usb 5-1: config 149 has an invalid interface number: 79 but max is 0 [ 680.520968][ T9978] usb 5-1: config 149 has an invalid descriptor of length 0, skipping remainder of the config [ 680.532534][ T9978] usb 5-1: config 149 has no interface number 0 [ 680.543526][ T9978] usb 5-1: config 149 interface 79 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 7 [ 680.615578][T15122] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 680.693591][ T9978] usb 5-1: config 149 interface 79 has no altsetting 0 [ 680.740124][ T9978] usb 5-1: New USB device found, idVendor=05ac, idProduct=6940, bcdDevice=ff.a3 [ 680.751828][ T9978] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 680.771373][ T9978] usb 5-1: Product: syz [ 680.785936][ T9978] usb 5-1: Manufacturer: syz [ 680.809370][ T9978] usb 5-1: SerialNumber: syz [ 680.819104][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.175969][T15128] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 681.377491][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.448250][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.757083][ T9990] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 681.864021][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 681.947121][ T9990] usb 9-1: Using ep0 maxpacket: 32 [ 681.955247][ T9990] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 681.966780][ T9990] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 682.028400][T15143] netlink: 'syz.1.2533': attribute type 1 has an invalid length. [ 682.090520][ T9990] usb 9-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 682.097364][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.128437][ T9990] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 682.163351][ T9990] usb 9-1: config 0 descriptor?? [ 682.184310][ T9990] hub 9-1:0.0: USB hub found [ 682.326651][ T36] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.339817][ T36] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.355236][ T36] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.389632][ T36] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 682.393978][ T9990] hub 9-1:0.0: config failed, hub doesn't have any ports! (err -19) [ 682.521784][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.546813][ T9978] usb 5-1: USB disconnect, device number 95 [ 682.823367][ T9990] hid-generic 0003:046D:C31C.002A: unknown main item tag 0x0 [ 682.847489][ T9990] hid-generic 0003:046D:C31C.002A: hidraw0: USB HID v8.00 Device [HID 046d:c31c] on usb-dummy_hcd.8-1/input0 [ 682.904376][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 682.940987][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 683.472256][T15152] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2534'. [ 683.476677][T15136] usb 9-1: reset high-speed USB device number 2 using dummy_hcd [ 684.064089][T15136] usbhid 9-1:0.0: reset_resume error -1 [ 684.182600][ T5885] usb 9-1: USB disconnect, device number 2 [ 684.989968][ T5885] net_ratelimit: 3 callbacks suppressed [ 684.989982][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.432528][ T5907] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 685.526607][T15177] fuse: Invalid rootmode [ 685.549706][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 685.597168][ T5907] usb 9-1: device descriptor read/64, error -71 [ 685.833397][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 685.840537][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.967206][ T5907] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 686.017329][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 686.097148][ T5907] usb 9-1: device descriptor read/64, error -71 [ 686.207449][ T5907] usb usb9-port1: attempt power cycle [ 686.667155][ T5907] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 686.727759][ T5907] usb 9-1: device descriptor read/8, error -71 [ 686.898123][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.000979][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.040273][T15194] syzkaller0: entered promiscuous mode [ 687.063363][ T5907] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 687.081153][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 687.081261][T15194] syzkaller0: entered allmulticast mode [ 687.116016][ T5907] usb 9-1: device descriptor read/8, error -71 [ 687.239274][ T5907] usb usb9-port1: unable to enumerate USB device [ 687.462297][ T5907] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.097682][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.158890][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 688.277687][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 689.609682][T15215] syz_tun: entered promiscuous mode [ 689.615087][T15215] macvtap1: entered promiscuous mode [ 689.662045][T15215] syz_tun: left promiscuous mode [ 690.202758][ T5885] net_ratelimit: 2 callbacks suppressed [ 690.202778][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.497336][ T5964] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 690.497378][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.558270][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 690.818828][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.494636][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.624211][ T9978] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 691.698747][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 691.904588][ T9978] usb 9-1: config 0 has no interfaces? [ 691.934244][ T9978] usb 9-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 691.974000][ T9978] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 692.035405][ T9978] usb 9-1: Manufacturer: syz [ 692.118113][ T9978] usb 9-1: config 0 descriptor?? [ 692.586444][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.407254][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.563504][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.617418][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 693.948421][ T5964] usb 5-1: unable to get BOS descriptor or descriptor too short [ 693.984175][ T5964] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 694.021260][ T5964] usb 5-1: can't read configurations, error -71 [ 694.704236][T15252] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2562'. [ 694.869811][T15252] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2562'. [ 694.946706][ T5907] usb 9-1: USB disconnect, device number 7 [ 695.514282][T15260] netdevsim netdevsim8 netdevsim0: entered allmulticast mode [ 695.552787][T15260] net_ratelimit: 2 callbacks suppressed [ 695.552799][T15260] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 695.699405][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.808039][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 695.938217][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.587581][ T5907] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 696.767194][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.013098][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.548838][T15276] fuse: Bad value for 'fd' [ 697.777953][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 697.858078][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.304789][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 698.388770][T12702] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 698.409817][T12702] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 698.443160][T12702] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 698.451600][T12702] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 698.459923][T12702] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 698.873272][ T9982] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 699.482542][T15294] chnl_net:caif_netlink_parms(): no params data found [ 699.524346][T15303] binder: 15302:15303 ioctl c0306201 2000000004c0 returned -22 [ 699.583230][ T9982] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 699.616212][ T9982] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 699.656534][ T9982] usb 5-1: Product: syz [ 699.669859][ T9982] usb 5-1: Manufacturer: syz [ 699.694580][ T9982] usb 5-1: SerialNumber: syz [ 699.719886][ T9982] usb 5-1: config 0 descriptor?? [ 699.798538][ T9982] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 098 [ 699.849860][T15305] AppArmor: change_hat: Invalid input '9' [ 700.294058][T15294] bridge0: port 1(bridge_slave_0) entered blocking state [ 700.336555][T15294] bridge0: port 1(bridge_slave_0) entered disabled state [ 700.355541][T15294] bridge_slave_0: entered allmulticast mode [ 700.487214][T15294] bridge_slave_0: entered promiscuous mode [ 700.504970][T15294] bridge0: port 2(bridge_slave_1) entered blocking state [ 700.524123][T15294] bridge0: port 2(bridge_slave_1) entered disabled state [ 700.549774][T15294] bridge_slave_1: entered allmulticast mode [ 700.567249][T15294] bridge_slave_1: entered promiscuous mode [ 700.584668][T12702] Bluetooth: hci7: command tx timeout [ 700.648364][ T1139] net_ratelimit: 4 callbacks suppressed [ 700.648383][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 700.751754][T15294] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 700.791559][T15294] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 700.897590][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.018478][ T9981] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 701.250635][ T9981] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 701.299440][ T9981] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 701.370620][ T9981] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 701.387565][T15294] team0: Port device team_slave_0 added [ 701.406601][ T9981] usb 2-1: config 0 descriptor?? [ 701.440208][T15294] team0: Port device team_slave_1 added [ 701.652656][ T9981] usbhid 2-1:0.0: can't add hid device: -71 [ 701.758998][ T9981] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 701.793355][ T9981] usb 2-1: USB disconnect, device number 82 [ 701.799714][T15294] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 701.806685][T15294] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 701.937989][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 701.950156][T15294] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 702.069835][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.290254][ T9981] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 702.477652][ T9981] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 702.497083][ T9981] usb 2-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 702.529856][ T9981] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.542070][T15294] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 702.585505][ T9982] i2c i2c-1: failure reading functionality [ 702.592418][ T9981] usb 2-1: config 0 descriptor?? [ 702.601118][T15294] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 702.642994][ T9982] i2c i2c-1: connected i2c-tiny-usb device [ 702.667418][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 702.682971][T15294] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 702.683205][T12702] Bluetooth: hci7: command tx timeout [ 702.943842][ T5885] usb 5-1: USB disconnect, device number 98 [ 702.997497][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 703.061297][ T9981] plantronics 0003:047F:3333.002B: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.1-1/input0 [ 703.114663][T15294] hsr_slave_0: entered promiscuous mode [ 703.176156][T15294] hsr_slave_1: entered promiscuous mode [ 703.185104][T15331] FAULT_INJECTION: forcing a failure. [ 703.185104][T15331] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 703.220203][T15294] debugfs: 'hsr0' already exists in 'hsr' [ 703.247034][T15294] Cannot create hsr debugfs directory [ 703.252710][T15331] CPU: 0 UID: 0 PID: 15331 Comm: syz.8.2582 Tainted: G L syzkaller #0 PREEMPT(full) [ 703.252736][T15331] Tainted: [L]=SOFTLOCKUP [ 703.252742][T15331] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 703.252753][T15331] Call Trace: [ 703.252760][T15331] [ 703.252767][T15331] dump_stack_lvl+0xe8/0x150 [ 703.252794][T15331] should_fail_ex+0x412/0x560 [ 703.252823][T15331] _copy_to_user+0x31/0xb0 [ 703.252845][T15331] simple_read_from_buffer+0xe1/0x170 [ 703.252872][T15331] proc_fail_nth_read+0x1bb/0x230 [ 703.252908][T15331] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 703.252933][T15331] ? rw_verify_area+0x2a6/0x4d0 [ 703.252950][T15331] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 703.252972][T15331] vfs_read+0x20c/0xa70 [ 703.252989][T15331] ? fdget_pos+0x246/0x320 [ 703.253002][T15331] ? ksys_write+0x1e6/0x270 [ 703.253023][T15331] ? __pfx___mutex_lock+0x10/0x10 [ 703.253045][T15331] ? __pfx_vfs_read+0x10/0x10 [ 703.253063][T15331] ? __fget_files+0x2a/0x420 [ 703.253079][T15331] ? __fget_files+0x3a0/0x420 [ 703.253093][T15331] ? __fget_files+0x2a/0x420 [ 703.253111][T15331] ksys_read+0x150/0x270 [ 703.253129][T15331] ? __pfx_ksys_read+0x10/0x10 [ 703.253153][T15331] do_syscall_64+0x14d/0xf80 [ 703.253172][T15331] ? trace_irq_disable+0x3b/0x150 [ 703.253188][T15331] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.253206][T15331] ? clear_bhb_loop+0x40/0x90 [ 703.253227][T15331] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 703.253245][T15331] RIP: 0033:0x7f7b5155d04e [ 703.253261][T15331] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 703.253275][T15331] RSP: 002b:00007f7b52527fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 703.253294][T15331] RAX: ffffffffffffffda RBX: 00007f7b525286c0 RCX: 00007f7b5155d04e [ 703.253307][T15331] RDX: 000000000000000f RSI: 00007f7b525280a0 RDI: 0000000000000004 [ 703.253317][T15331] RBP: 00007f7b52528090 R08: 0000000000000000 R09: 0000000000000000 [ 703.253328][T15331] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 703.253339][T15331] R13: 00007f7b51816038 R14: 00007f7b51815fa0 R15: 00007f7b5193fa48 [ 703.253367][T15331] [ 703.525684][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.019203][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 704.093009][T15346] FAULT_INJECTION: forcing a failure. [ 704.093009][T15346] name failslab, interval 1, probability 0, space 0, times 0 [ 704.331661][T15346] CPU: 0 UID: 0 PID: 15346 Comm: syz.7.2585 Tainted: G L syzkaller #0 PREEMPT(full) [ 704.331690][T15346] Tainted: [L]=SOFTLOCKUP [ 704.331696][T15346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 704.331704][T15346] Call Trace: [ 704.331711][T15346] [ 704.331719][T15346] dump_stack_lvl+0xe8/0x150 [ 704.331747][T15346] should_fail_ex+0x412/0x560 [ 704.331776][T15346] should_failslab+0xa8/0x100 [ 704.331801][T15346] kmem_cache_alloc_node_noprof+0x8f/0x690 [ 704.331821][T15346] ? __alloc_skb+0x186/0x7d0 [ 704.331841][T15346] ? __alloc_skb+0x1d0/0x7d0 [ 704.331858][T15346] ? __local_bh_enable_ip+0xd0/0x130 [ 704.331888][T15346] __alloc_skb+0x1d0/0x7d0 [ 704.331909][T15346] netlink_sendmsg+0x5d4/0xb40 [ 704.331935][T15346] ? __pfx_netlink_sendmsg+0x10/0x10 [ 704.331956][T15346] ? aa_sock_msg_perm+0xf1/0x1b0 [ 704.331983][T15346] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 704.332004][T15346] ? __pfx_netlink_sendmsg+0x10/0x10 [ 704.332021][T15346] sock_write_iter+0x49b/0x4f0 [ 704.332049][T15346] ? __pfx_sock_write_iter+0x10/0x10 [ 704.332082][T15346] ? bpf_lsm_file_permission+0x9/0x20 [ 704.332103][T15346] ? security_file_permission+0x75/0x260 [ 704.332132][T15346] vfs_write+0x61d/0xb90 [ 704.332184][T15346] ? __pfx_vfs_write+0x10/0x10 [ 704.332213][T15346] ? __fget_files+0x2a/0x420 [ 704.332236][T15346] ksys_write+0x150/0x270 [ 704.332258][T15346] ? __pfx_ksys_write+0x10/0x10 [ 704.332286][T15346] do_syscall_64+0x14d/0xf80 [ 704.332307][T15346] ? trace_irq_disable+0x3b/0x150 [ 704.332323][T15346] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.332339][T15346] ? clear_bhb_loop+0x40/0x90 [ 704.332360][T15346] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 704.332378][T15346] RIP: 0033:0x7f3f9659c819 [ 704.332395][T15346] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 704.332417][T15346] RSP: 002b:00007f3f947f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 704.332436][T15346] RAX: ffffffffffffffda RBX: 00007f3f96815fa0 RCX: 00007f3f9659c819 [ 704.332449][T15346] RDX: 0000000000000018 RSI: 0000200000000100 RDI: 0000000000000003 [ 704.332460][T15346] RBP: 00007f3f947f6090 R08: 0000000000000000 R09: 0000000000000000 [ 704.332471][T15346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 704.332481][T15346] R13: 00007f3f96816038 R14: 00007f3f96815fa0 R15: 00007f3f9693fa48 [ 704.332508][T15346] [ 704.775080][ T5964] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 704.784787][T12702] Bluetooth: hci7: command tx timeout [ 705.043225][ T9981] usb 2-1: USB disconnect, device number 83 [ 705.057293][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.072419][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.229479][ T5964] usb 9-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 705.244215][ T5964] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 705.284441][ T5964] usb 9-1: Product: syz [ 705.302162][ T5964] usb 9-1: Manufacturer: syz [ 705.319937][ T5964] usb 9-1: SerialNumber: syz [ 705.413161][ T5964] usb 9-1: config 0 descriptor?? [ 705.479813][ T5964] i2c-tiny-usb 9-1:0.0: version 6d.cc found at bus 009 address 008 [ 705.615765][T15294] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 705.689765][T15294] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 705.699844][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 705.748212][T15294] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 705.780039][T15294] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 706.097253][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.164261][T15372] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2589'. [ 706.309503][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 706.587177][T15294] 8021q: adding VLAN 0 to HW filter on device bond0 [ 706.818553][T12702] Bluetooth: hci7: command tx timeout [ 706.850608][T15374] netlink: 'syz.7.2590': attribute type 1 has an invalid length. [ 707.080393][T15374] bond1: entered promiscuous mode [ 707.105074][T15374] 8021q: adding VLAN 0 to HW filter on device bond1 [ 707.133484][T15294] 8021q: adding VLAN 0 to HW filter on device team0 [ 707.147357][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.164743][T15379] nvme_fabrics: unknown parameter or missing value 'syz0' in ctrl creation request [ 707.232276][T15376] vlan2: entered allmulticast mode [ 707.263108][T15376] bond1: entered allmulticast mode [ 707.291487][ T3544] bridge0: port 1(bridge_slave_0) entered blocking state [ 707.298782][ T3544] bridge0: port 1(bridge_slave_0) entered forwarding state [ 707.381354][T15378] bond1: (slave bridge1): making interface the new active one [ 707.427588][T15378] bridge1: entered promiscuous mode [ 707.434099][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.451194][T15378] bridge1: entered allmulticast mode [ 707.458880][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 707.471566][T15378] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 707.515892][ T1139] bridge0: port 2(bridge_slave_1) entered blocking state [ 707.523125][ T1139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 707.957357][ T5964] i2c i2c-1: failure reading functionality [ 707.985286][ T5964] i2c i2c-1: connected i2c-tiny-usb device [ 708.057121][ T5964] usb 9-1: USB disconnect, device number 8 [ 708.177503][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.454519][T15401] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2596'. [ 708.515738][T15402] No such timeout policy "syz1" [ 708.741526][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 708.763620][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.039562][ T1149] bond2 (unregistering): (slave geneve3): Releasing active interface [ 709.058309][ T9990] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 709.120063][ T1149] bond1 (unregistering): (slave bridge1): Releasing backup interface [ 709.148316][ T1149] bridge1 (unregistering): left promiscuous mode [ 709.283672][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 709.357200][ T9990] usb 9-1: Using ep0 maxpacket: 16 [ 709.397456][ T9990] usb 9-1: config 0 has an invalid interface number: 21 but max is 0 [ 709.406002][ T9990] usb 9-1: config 0 has no interface number 0 [ 709.423414][ T9990] usb 9-1: too many endpoints for config 0 interface 21 altsetting 22: 80, using maximum allowed: 30 [ 709.458144][ T9990] usb 9-1: config 0 interface 21 altsetting 22 has 0 endpoint descriptors, different from the interface descriptor's value: 80 [ 709.511532][ T9990] usb 9-1: config 0 interface 21 has no altsetting 0 [ 709.536840][ T9990] usb 9-1: New USB device found, idVendor=061d, idProduct=c020, bcdDevice=9c.15 [ 709.546362][ T9990] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 709.566563][ T9990] usb 9-1: Product: syz [ 709.576875][ T9990] usb 9-1: Manufacturer: syz [ 709.629799][ T1149] bond0 (unregistering): Released all slaves [ 709.638950][ T9990] usb 9-1: SerialNumber: syz [ 709.684694][ T1149] bond1 (unregistering): Released all slaves [ 709.714488][ T9990] usb 9-1: config 0 descriptor?? [ 709.761695][ T1149] bond2 (unregistering): Released all slaves [ 709.816895][ T1149] bond3 (unregistering): Released all slaves [ 710.345086][ T1149] tipc: Left network mode [ 710.377812][ T1149] IPVS: stopping master sync thread 9370 ... [ 710.934191][ T9990] ssu100 9-1:0.21: Quatech SSU-100 USB to Serial Driver converter detected [ 711.074748][ T9990] ssu100 9-1:0.21: probe with driver ssu100 failed with error -71 [ 711.135904][T15294] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 711.214193][ T9990] usb 9-1: USB disconnect, device number 9 [ 711.221306][ T1139] net_ratelimit: 2 callbacks suppressed [ 711.221324][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.547691][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 711.569565][T15431] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2602'. [ 711.730314][T15436] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2602'. [ 711.777735][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.319192][ T1149] mac80211_hwsim hwsim2 wlan0 (unregistering): left allmulticast mode [ 712.328058][ T1149] mac80211_hwsim hwsim2 wlan0 (unregistering): left promiscuous mode [ 712.559452][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.587596][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.597910][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.743059][T15452] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 712.751968][ C0] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.643788][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.833344][ T1149] hsr_slave_0: left promiscuous mode [ 713.873766][T15467] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 713.909135][ T1149] hsr_slave_1: left promiscuous mode [ 716.077129][ T9990] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 716.256504][ T9990] usb 9-1: Using ep0 maxpacket: 32 [ 716.286338][ T9990] usb 9-1: config 0 has an invalid interface number: 196 but max is 0 [ 716.297858][ T9990] usb 9-1: config 0 has no interface number 0 [ 716.307311][ T9990] usb 9-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 716.344579][ T9990] usb 9-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 716.369888][T15294] veth0_vlan: entered promiscuous mode [ 716.385713][ T9990] usb 9-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 716.443280][ T9990] usb 9-1: config 0 interface 196 has no altsetting 0 [ 716.469663][ T9990] usb 9-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 716.478966][ T9990] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 716.504831][ T9990] usb 9-1: Product: syz [ 716.518682][ T9990] usb 9-1: Manufacturer: syz [ 716.537036][ T9990] usb 9-1: SerialNumber: syz [ 716.591693][ T9990] usb 9-1: config 0 descriptor?? [ 716.597771][T15485] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 716.701503][T15475] bridge_slave_0: left allmulticast mode [ 716.737434][ T5915] net_ratelimit: 6 callbacks suppressed [ 716.737449][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.779109][T15475] bridge_slave_0: left promiscuous mode [ 716.785058][T15475] bridge0: port 1(bridge_slave_0) entered disabled state [ 716.799684][T15475] bridge_slave_1: left allmulticast mode [ 716.805555][T15475] bridge_slave_1: left promiscuous mode [ 716.831602][ T5885] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 716.882409][T15475] bridge0: port 2(bridge_slave_1) entered disabled state [ 716.905394][T15475] bond0: (slave bond_slave_0): Releasing backup interface [ 716.918706][ T9990] ipheth 9-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 716.937716][T15475] bond0: (slave bond_slave_1): Releasing backup interface [ 716.949393][ T9990] ipheth 9-1:0.196: probe with driver ipheth failed with error -71 [ 716.993626][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 716.997210][ T9990] usb 9-1: USB disconnect, device number 10 [ 717.032759][ T5885] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 717.069379][ T5885] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 717.076097][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.137933][T15475] team0: Port device team_slave_0 removed [ 717.149348][ T5885] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=94.75 [ 717.184395][ T5885] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 717.203898][T15475] team0: Port device team_slave_1 removed [ 717.212151][T15475] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 717.237111][ T5885] usb 5-1: config 0 descriptor?? [ 717.237617][T15475] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 717.298499][T15475] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 717.316003][T15475] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 717.344241][T15475] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 717.554015][T15493] netlink: 'syz.4.2617': attribute type 10 has an invalid length. [ 717.777696][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 717.857279][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.280262][T15504] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.288729][T15504] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.297337][T15504] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 718.439540][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 720.076739][T15504] syz.1.2619 (15504): drop_caches: 1 [ 720.527052][ T9990] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 720.707924][ T9990] usb 2-1: device descriptor read/64, error -71 [ 720.967223][ T9990] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 721.149670][ T9990] usb 2-1: device descriptor read/64, error -71 [ 721.264288][ T9990] usb usb2-port1: attempt power cycle [ 721.637148][ T9990] usb 2-1: new high-speed USB device number 86 using dummy_hcd [ 721.697670][ T9990] usb 2-1: device descriptor read/8, error -71 [ 721.937482][ T9990] usb 2-1: new high-speed USB device number 87 using dummy_hcd [ 721.964251][ T9990] usb 2-1: device descriptor read/8, error -71 [ 721.989579][T15521] netlink: 'syz.8.2623': attribute type 23 has an invalid length. [ 722.017734][ T5915] net_ratelimit: 8 callbacks suppressed [ 722.017751][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 722.127372][ T9990] usb usb2-port1: unable to enumerate USB device [ 722.412935][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.077546][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.513080][T15526] netlink: 'syz.1.2625': attribute type 1 has an invalid length. [ 723.539097][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 723.817255][ T5915] usb 2-1: new high-speed USB device number 88 using dummy_hcd [ 723.942734][ T9982] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.027126][ T9978] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 724.105295][ T5915] usb 2-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 724.137260][ T5915] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.156683][ T5915] usb 2-1: Product: syz [ 724.161059][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.177112][ T5915] usb 2-1: Manufacturer: syz [ 724.181758][ T5915] usb 2-1: SerialNumber: syz [ 724.188307][ T9978] usb 9-1: Using ep0 maxpacket: 16 [ 724.196371][ T9978] usb 9-1: config 0 has an invalid interface number: 2 but max is 0 [ 724.206144][ T9978] usb 9-1: config 0 has no interface number 0 [ 724.227744][ T5915] usb 2-1: config 0 descriptor?? [ 724.232970][ T9978] usb 9-1: config 0 interface 2 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 724.245786][ T9978] usb 9-1: New USB device found, idVendor=04d8, idProduct=00dd, bcdDevice= 0.00 [ 724.255405][ T9978] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.323438][ T9978] usb 9-1: config 0 descriptor?? [ 724.424850][T15294] veth1_vlan: entered promiscuous mode [ 724.463458][T15496] warning: `syz.4.2617' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 724.503379][ T5915] usb 2-1: USB disconnect, device number 88 [ 724.611655][T15294] veth0_macvtap: entered promiscuous mode [ 724.652481][ T9990] usb 5-1: USB disconnect, device number 99 [ 724.679961][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 724.711020][T15294] veth1_macvtap: entered promiscuous mode [ 724.808853][ T9978] mcp2221 0003:04D8:00DD.002C: USB HID v0.05 Device [HID 04d8:00dd] on usb-dummy_hcd.8-1/input2 [ 724.830094][T15294] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 724.938423][T15294] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 724.980913][ T1166] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.006057][ T1166] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.075648][ T1166] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.123968][ T1166] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 725.221174][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.289185][T15545] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2627'. [ 725.740640][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.774568][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 725.817257][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 725.898107][ T5885] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 725.979615][ T1139] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 725.997702][ T1139] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 726.101081][ T5885] usb 8-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 726.108482][T15557] netlink: 'syz.4.2632': attribute type 1 has an invalid length. [ 726.126422][ T5885] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 726.175166][ T5885] usb 8-1: Product: syz [ 726.202630][ T5885] usb 8-1: Manufacturer: syz [ 726.210700][T15557] bond12: entered promiscuous mode [ 726.235558][T15557] 8021q: adding VLAN 0 to HW filter on device bond12 [ 726.247345][ T5885] usb 8-1: SerialNumber: syz [ 726.257427][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 726.306541][ T5885] usb 8-1: config 0 descriptor?? [ 726.360691][ T5885] i2c-tiny-usb 8-1:0.0: version 6d.cc found at bus 008 address 009 [ 726.473408][T15560] vlan3: entered allmulticast mode [ 726.490361][T15560] bond12: entered allmulticast mode [ 726.524683][T15563] bond12: (slave bridge2): making interface the new active one [ 726.587127][T15563] bridge2: entered promiscuous mode [ 726.594868][T15563] bridge2: entered allmulticast mode [ 726.606276][T15563] bond12: (slave bridge2): Enslaving as an active interface with an up link [ 726.726202][T15567] netlink: 76 bytes leftover after parsing attributes in process `syz.9.2566'. [ 727.098220][T15575] FAULT_INJECTION: forcing a failure. [ 727.098220][T15575] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 727.163206][T15575] CPU: 0 UID: 0 PID: 15575 Comm: syz.9.2634 Tainted: G L syzkaller #0 PREEMPT(full) [ 727.163236][T15575] Tainted: [L]=SOFTLOCKUP [ 727.163242][T15575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 727.163254][T15575] Call Trace: [ 727.163264][T15575] [ 727.163273][T15575] dump_stack_lvl+0xe8/0x150 [ 727.163304][T15575] should_fail_ex+0x412/0x560 [ 727.163336][T15575] prepare_alloc_pages+0x22a/0x650 [ 727.163366][T15575] __alloc_frozen_pages_noprof+0x12f/0x380 [ 727.163392][T15575] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 727.163418][T15575] ? __pfx_policy_nodemask+0x10/0x10 [ 727.163445][T15575] ? __lock_acquire+0x6b5/0x2cf0 [ 727.163470][T15575] alloc_pages_mpol+0x232/0x4a0 [ 727.163498][T15575] vma_alloc_folio_noprof+0xea/0x210 [ 727.163523][T15575] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 727.163557][T15575] do_pte_missing+0x1656/0x3490 [ 727.163595][T15575] handle_mm_fault+0x1bec/0x3310 [ 727.163634][T15575] ? handle_mm_fault+0xee/0x3310 [ 727.163664][T15575] ? __pfx_handle_mm_fault+0x10/0x10 [ 727.163706][T15575] ? lock_mm_and_find_vma+0xa7/0x340 [ 727.163729][T15575] do_user_addr_fault+0x75b/0x1340 [ 727.163773][T15575] exc_page_fault+0x6a/0xc0 [ 727.163798][T15575] asm_exc_page_fault+0x26/0x30 [ 727.163815][T15575] RIP: 0010:rep_movs_alternative+0x4a/0x90 [ 727.163834][T15575] Code: cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 8b 06 48 89 07 48 83 c6 08 48 83 c7 08 83 e9 08 74 db 83 f9 08 73 e8 eb c5 a4 c3 cc cc cc cc 48 8b 06 48 89 07 48 8d 47 08 48 83 e0 f8 48 [ 727.163847][T15575] RSP: 0018:ffffc9000bf07898 EFLAGS: 00050202 [ 727.163864][T15575] RAX: ffffffff84ad1c01 RBX: ffff888030c78000 RCX: 0000000000000047 [ 727.163877][T15575] RDX: 0000000000000000 RSI: ffff888030c78000 RDI: 0000200000001200 [ 727.163887][T15575] RBP: ffffc9000bf07a10 R08: ffff888030c78046 R09: 1ffff1100618f008 [ 727.163898][T15575] R10: dffffc0000000000 R11: ffffed100618f009 R12: dffffc0000000000 [ 727.163911][T15575] R13: 0000000000000000 R14: 00007ffffffff000 R15: 0000000000000047 [ 727.163929][T15575] ? _copy_to_iter+0x441/0x17d0 [ 727.163954][T15575] _copy_to_iter+0x493/0x17d0 [ 727.163984][T15575] ? __pfx__copy_to_iter+0x10/0x10 [ 727.164017][T15575] seq_read_iter+0xbf5/0xe10 [ 727.164056][T15575] seq_read+0x367/0x480 [ 727.164087][T15575] ? __pfx_seq_read+0x10/0x10 [ 727.164115][T15575] ? apparmor_file_permission+0x1f4/0x300 [ 727.164135][T15575] ? __pfx_seq_read+0x10/0x10 [ 727.164146][T15575] proc_reg_read+0x1e9/0x2e0 [ 727.164157][T15575] ? __pfx_proc_reg_read+0x10/0x10 [ 727.164168][T15575] vfs_read+0x20c/0xa70 [ 727.164180][T15575] ? fdget_pos+0x246/0x320 [ 727.164193][T15575] ? ksys_write+0x1e6/0x270 [ 727.164215][T15575] ? __pfx___mutex_lock+0x10/0x10 [ 727.164239][T15575] ? __pfx_vfs_read+0x10/0x10 [ 727.164260][T15575] ? __fget_files+0x2a/0x420 [ 727.164277][T15575] ? __fget_files+0x3a0/0x420 [ 727.164286][T15575] ? __fget_files+0x2a/0x420 [ 727.164299][T15575] ksys_read+0x150/0x270 [ 727.164311][T15575] ? __pfx_ksys_read+0x10/0x10 [ 727.164328][T15575] do_syscall_64+0x14d/0xf80 [ 727.164346][T15575] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.164364][T15575] ? clear_bhb_loop+0x40/0x90 [ 727.164386][T15575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 727.164402][T15575] RIP: 0033:0x7f903259c819 [ 727.164418][T15575] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 727.164427][T15575] RSP: 002b:00007f90334a5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 727.164437][T15575] RAX: ffffffffffffffda RBX: 00007f9032815fa0 RCX: 00007f903259c819 [ 727.164444][T15575] RDX: 0000000000002020 RSI: 0000200000001200 RDI: 0000000000000003 [ 727.164450][T15575] RBP: 00007f90334a5090 R08: 0000000000000000 R09: 0000000000000000 [ 727.164456][T15575] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 727.164462][T15575] R13: 00007f9032816038 R14: 00007f9032815fa0 R15: 00007f903293fa48 [ 727.164477][T15575] [ 727.864148][ T9979] usb 9-1: USB disconnect, device number 11 [ 728.167442][T15578] netlink: 'syz.4.2633': attribute type 23 has an invalid length. [ 728.221645][ T5915] net_ratelimit: 3 callbacks suppressed [ 728.221664][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 728.273909][T15584] fuse: Unknown parameter 'gf«' [ 728.307834][T15584] ipip0: entered promiscuous mode [ 728.405878][T15584] ipip0: entered allmulticast mode [ 728.577754][ T5885] i2c i2c-2: failure reading functionality [ 728.595718][ T5885] i2c i2c-2: connected i2c-tiny-usb device [ 728.637764][ T5885] usb 8-1: USB disconnect, device number 9 [ 728.816414][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 729.297481][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.021011][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.153277][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.247891][T15602] netdevsim netdevsim7: loading /lib/firmware/. failed with error -22 [ 730.307251][T15602] netdevsim netdevsim7: Direct firmware load for . failed with error -22 [ 730.315945][T15602] netdevsim netdevsim7: Falling back to sysfs fallback for: . [ 730.347636][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 730.803673][T15616] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2642'. [ 730.815495][T15616] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2642'. [ 730.853720][T15616] netlink: 16 bytes leftover after parsing attributes in process `syz.8.2642'. [ 730.927245][T15616] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2642'. [ 730.972657][T15616] netlink: 44 bytes leftover after parsing attributes in process `syz.8.2642'. [ 731.186334][T15626] syzkaller0: entered promiscuous mode [ 731.191988][T15626] syzkaller0: entered allmulticast mode [ 731.377607][ T9981] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 731.396980][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.542568][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 731.677255][ T9981] usb 10-1: Using ep0 maxpacket: 16 [ 731.691919][ T9981] usb 10-1: config 1 has an invalid interface number: 105 but max is 0 [ 731.705610][ T9981] usb 10-1: config 1 has no interface number 0 [ 731.712487][ T9981] usb 10-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 731.724500][ T9981] usb 10-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 731.749235][ T9981] usb 10-1: config 1 interface 105 has no altsetting 0 [ 731.897104][ T9981] usb 10-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 731.920871][ T9981] usb 10-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 731.954682][ T9981] usb 10-1: Product: syz [ 731.966851][ T9981] usb 10-1: Manufacturer: syz [ 731.993263][ T9981] usb 10-1: SerialNumber: syz [ 732.119871][T15627] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 732.168392][T15627] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 732.418260][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 732.599210][T15627] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 732.720774][T15627] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 732.847566][ T49] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 733.457219][ T5885] net_ratelimit: 1 callbacks suppressed [ 733.457240][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.018000][ T9979] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 734.049421][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.315174][ T9978] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 734.507402][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 734.517435][ T9978] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 734.529664][ T9978] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 734.539853][ T9978] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 734.568039][ T9978] usb 9-1: config 0 descriptor?? [ 734.825588][ T9978] usbhid 9-1:0.0: can't add hid device: -71 [ 734.859392][ T9978] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 734.915959][ T9978] usb 9-1: USB disconnect, device number 12 [ 735.168578][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.417084][ T9978] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 735.538099][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 735.696171][ T9978] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 735.801912][ T9978] usb 9-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 735.823518][ T9978] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 735.846636][ T9978] usb 9-1: config 0 descriptor?? [ 736.097426][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.259721][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.278409][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.334762][ T9978] plantronics 0003:047F:3333.002D: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.8-1/input0 [ 736.577387][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 736.631484][T15665] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 736.640356][T15665] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 737.477670][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 737.937282][ T9981] aqc111 10-1:1.105 (unnamed net_device) (uninitialized): Failed to read(0x20) reg index 0x0000: -110 [ 737.952541][ T9981] aqc111 10-1:1.105: probe with driver aqc111 failed with error -110 [ 738.113083][ T9981] usb 9-1: USB disconnect, device number 13 [ 738.286903][ T9979] usb 8-1: unable to get BOS descriptor or descriptor too short [ 738.311261][ T9979] usb 8-1: unable to read config index 0 descriptor/start: -71 [ 738.337383][ T9979] usb 8-1: can't read configurations, error -71 [ 738.601703][ T3544] net_ratelimit: 1 callbacks suppressed [ 738.601729][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.657763][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 738.872492][ T5830] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 738.885098][ T5830] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 738.893536][ T5830] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 738.912536][ T5830] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 738.924866][ T5830] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 739.149720][ T5907] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.697322][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 739.767487][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.739823][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.904787][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 740.977140][T12702] Bluetooth: hci8: command tx timeout [ 741.777400][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.029689][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.178868][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 742.958568][T15627] netlink: 8 bytes leftover after parsing attributes in process `syz.9.2644'. [ 743.068173][T12702] Bluetooth: hci8: command tx timeout [ 743.180267][ T5885] usb 10-1: USB disconnect, device number 2 [ 743.337272][T15673] netlink: 76 bytes leftover after parsing attributes in process `syz.8.2654'. [ 743.871390][ T5885] net_ratelimit: 2 callbacks suppressed [ 743.871406][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.044788][T15680] chnl_net:caif_netlink_parms(): no params data found [ 744.127299][ T5907] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 744.299811][ T5907] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 744.312297][ T5907] usb 10-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 744.337927][ T5907] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 744.348452][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.475192][T15680] bridge0: port 1(bridge_slave_0) entered blocking state [ 744.504910][ T9991] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 744.512649][T15680] bridge0: port 1(bridge_slave_0) entered disabled state [ 744.534780][T15680] bridge_slave_0: entered allmulticast mode [ 744.561191][T15680] bridge_slave_0: entered promiscuous mode [ 744.587590][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.608589][T15680] bridge0: port 2(bridge_slave_1) entered blocking state [ 744.615810][T15680] bridge0: port 2(bridge_slave_1) entered disabled state [ 744.664691][T15680] bridge_slave_1: entered allmulticast mode [ 744.667751][ T5907] usb 10-1: config 0 descriptor?? [ 744.700080][T15707] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2660'. [ 744.709425][ T5885] usb 8-1: new full-speed USB device number 12 using dummy_hcd [ 744.790816][T15680] bridge_slave_1: entered promiscuous mode [ 744.897469][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 744.924669][ T5885] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 744.962475][ T5907] usbhid 10-1:0.0: can't add hid device: -71 [ 744.969785][ T5885] usb 8-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 744.969816][ T5885] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.024877][ T5907] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 745.033978][ T5885] usb 8-1: config 0 descriptor?? [ 745.101152][ T5885] dvb-usb: found a 'TeVii S662' in warm state. [ 745.110167][ T5907] usb 10-1: USB disconnect, device number 3 [ 745.137097][T12702] Bluetooth: hci8: command tx timeout [ 745.145289][ T5885] dw2102: su3000_power_ctrl: 1, initialized 0 [ 745.199074][T15680] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 745.218149][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.223249][ T5885] dvb-usb: bulk message failed: -22 (2/0) [ 745.278929][T15680] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 745.299477][ T5885] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 745.399269][ T5885] dvb-usb: TeVii S662 error while loading driver (-19) [ 745.447887][ T5885] usb 8-1: USB disconnect, device number 12 [ 745.478137][T15680] team0: Port device team_slave_0 added [ 745.507128][ T5907] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 745.531811][T15680] team0: Port device team_slave_1 added [ 745.667381][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.678927][ T5907] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 745.690695][ T5907] usb 10-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 745.734937][ T5907] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 745.747530][T15680] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 745.784565][T15680] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 745.812106][ T5907] usb 10-1: config 0 descriptor?? [ 745.857726][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 745.936308][T15680] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 745.947693][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 746.004307][T15680] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 746.011677][T15680] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 746.146150][T15680] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 746.335619][ T5907] plantronics 0003:047F:3333.002E: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.9-1/input0 [ 746.475149][T15680] hsr_slave_0: entered promiscuous mode [ 746.496655][T15680] hsr_slave_1: entered promiscuous mode [ 746.502531][ T9980] usb 8-1: new high-speed USB device number 13 using dummy_hcd [ 746.668481][T15737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 746.791009][T15737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 747.224180][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.241214][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.253280][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.257126][T12702] Bluetooth: hci8: command tx timeout [ 747.409957][ T9980] usb 8-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 747.501620][ T9980] usb 8-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 747.542042][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 747.610091][ T9980] usb 8-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 747.690428][ T9980] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 747.800573][ T9980] usb 8-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 748.066531][ T9980] usb 8-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 748.127383][ T9980] usb 8-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 748.136512][ T9980] usb 8-1: Product: syz [ 748.158769][ T9980] usb 8-1: Manufacturer: syz [ 748.237520][ T9980] cdc_wdm 8-1:1.0: skipping garbage [ 748.302956][ T9980] cdc_wdm 8-1:1.0: skipping garbage [ 748.367220][ T9980] cdc_wdm 8-1:1.0: cdc-wdm1: USB WDM device [ 748.437061][ T9980] cdc_wdm 8-1:1.0: Unknown control protocol [ 748.572503][ T9991] usb 9-1: unable to get BOS descriptor or descriptor too short [ 748.612918][ T9991] usb 9-1: unable to read config index 0 descriptor/start: -71 [ 748.651588][ T9991] usb 9-1: can't read configurations, error -71 [ 748.749613][ T9990] usb 10-1: USB disconnect, device number 4 [ 748.816285][T15746] fuse: Bad value for 'rootmode' [ 749.307737][ T9990] net_ratelimit: 3 callbacks suppressed [ 749.307765][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 749.328951][ T9991] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 749.517870][ T9991] usb 9-1: unable to get BOS descriptor or descriptor too short [ 749.552954][ T9991] usb 9-1: New USB device found, idVendor=200c, idProduct=100b, bcdDevice= 0.40 [ 749.572157][ T9991] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 749.614580][ T9991] usb 9-1: Product: syz [ 749.630737][ T9991] usb 9-1: Manufacturer: syz [ 749.648552][ T9991] usb 9-1: SerialNumber: syz [ 749.807393][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.122955][T15762] tipc: Started in network mode [ 750.149088][T15762] tipc: Node identity f2b6450086d3, cluster identity 4711 [ 750.158445][T15762] tipc: Enabled bearer , priority 0 [ 750.166531][T15757] syzkaller0: entered promiscuous mode [ 750.173158][T15757] syzkaller0: entered allmulticast mode [ 750.302840][T15757] tipc: Resetting bearer [ 750.324907][ T9980] usb 8-1: USB disconnect, device number 13 [ 750.348320][T15680] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 750.351908][ T9991] usb 9-1: 1:1: cannot set freq 48000 to ep 0x1 [ 750.367678][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 750.401137][T15756] tipc: Resetting bearer [ 750.522111][T15756] tipc: Disabling bearer [ 750.617895][T15680] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 750.633046][ T9991] usb 9-1: USB disconnect, device number 15 [ 750.744733][T15680] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 750.809179][T15680] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 750.941250][T15787] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 750.956140][T15786] udevd[15786]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 750.988330][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.298823][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.358511][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.372296][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.386896][ T9979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.395107][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.547043][ T9980] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 751.557666][ T1166] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 751.632973][T15680] 8021q: adding VLAN 0 to HW filter on device bond0 [ 751.725460][ T9980] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 751.771861][T15680] 8021q: adding VLAN 0 to HW filter on device team0 [ 751.781142][ T9980] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 751.817757][ T9980] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.880107][ T1149] bridge0: port 1(bridge_slave_0) entered blocking state [ 751.887316][ T1149] bridge0: port 1(bridge_slave_0) entered forwarding state [ 751.914778][ T9980] usb 9-1: config 0 descriptor?? [ 751.955244][ T1139] bridge0: port 2(bridge_slave_1) entered blocking state [ 751.962456][ T1139] bridge0: port 2(bridge_slave_1) entered forwarding state [ 752.195885][ T9980] usbhid 9-1:0.0: can't add hid device: -71 [ 752.237734][ T9980] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 752.237899][T15809] FAULT_INJECTION: forcing a failure. [ 752.237899][T15809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 752.308911][T15680] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 752.340975][ T9980] usb 9-1: USB disconnect, device number 16 [ 752.391982][T15809] CPU: 1 UID: 0 PID: 15809 Comm: syz.7.2678 Tainted: G L syzkaller #0 PREEMPT(full) [ 752.392010][T15809] Tainted: [L]=SOFTLOCKUP [ 752.392016][T15809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 752.392025][T15809] Call Trace: [ 752.392032][T15809] [ 752.392039][T15809] dump_stack_lvl+0xe8/0x150 [ 752.392069][T15809] should_fail_ex+0x412/0x560 [ 752.392100][T15809] _copy_to_user+0x31/0xb0 [ 752.392122][T15809] simple_read_from_buffer+0xe1/0x170 [ 752.392152][T15809] proc_fail_nth_read+0x1bb/0x230 [ 752.392177][T15809] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 752.392201][T15809] ? rw_verify_area+0x2a6/0x4d0 [ 752.392217][T15809] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 752.392239][T15809] vfs_read+0x20c/0xa70 [ 752.392254][T15809] ? fdget_pos+0x246/0x320 [ 752.392267][T15809] ? ksys_read+0x1e6/0x270 [ 752.392287][T15809] ? __pfx___mutex_lock+0x10/0x10 [ 752.392310][T15809] ? __pfx_vfs_read+0x10/0x10 [ 752.392327][T15809] ? __fget_files+0x2a/0x420 [ 752.392343][T15809] ? __fget_files+0x3a0/0x420 [ 752.392357][T15809] ? __fget_files+0x2a/0x420 [ 752.392379][T15809] ksys_read+0x150/0x270 [ 752.392407][T15809] ? __pfx_ksys_read+0x10/0x10 [ 752.392431][T15809] do_syscall_64+0x14d/0xf80 [ 752.392452][T15809] ? trace_irq_disable+0x3b/0x150 [ 752.392467][T15809] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.392482][T15809] ? clear_bhb_loop+0x40/0x90 [ 752.392504][T15809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 752.392520][T15809] RIP: 0033:0x7f3f9655d04e [ 752.392536][T15809] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 752.392549][T15809] RSP: 002b:00007f3f947f5fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 752.392565][T15809] RAX: ffffffffffffffda RBX: 00007f3f947f66c0 RCX: 00007f3f9655d04e [ 752.392576][T15809] RDX: 000000000000000f RSI: 00007f3f947f60a0 RDI: 0000000000000004 [ 752.392585][T15809] RBP: 00007f3f947f6090 R08: 0000000000000000 R09: 0000000000000000 [ 752.392594][T15809] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 752.392602][T15809] R13: 00007f3f96816038 R14: 00007f3f96815fa0 R15: 00007f3f9693fa48 [ 752.392628][T15809] [ 753.004295][T15680] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 753.127481][ T9980] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 753.294926][ T9980] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 753.309025][ T9980] usb 9-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 753.341196][ T9980] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.388437][ T9980] usb 9-1: config 0 descriptor?? [ 753.728710][T15680] veth0_vlan: entered promiscuous mode [ 753.840585][T15680] veth1_vlan: entered promiscuous mode [ 753.853652][ T9980] plantronics 0003:047F:3333.002F: hiddev0,hidraw0: USB HID v0.00 Device [HID 047f:3333] on usb-dummy_hcd.8-1/input0 [ 754.130483][T15838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 754.162178][T15838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 754.686648][ T9980] net_ratelimit: 6 callbacks suppressed [ 754.686666][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.709020][T15680] veth0_macvtap: entered promiscuous mode [ 754.739498][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 754.838634][T15680] veth1_macvtap: entered promiscuous mode [ 754.957489][T15680] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 754.987394][ T5964] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 755.004274][T15680] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 755.021051][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.067127][ T49] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.076140][ T9980] usb 8-1: new high-speed USB device number 14 using dummy_hcd [ 755.276395][ T49] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.295907][ T5964] usb 5-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 755.327719][ T5964] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.356164][ T5964] usb 5-1: Product: syz [ 755.361452][ T49] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.376211][ T5964] usb 5-1: Manufacturer: syz [ 755.391127][ T9980] usb 8-1: config 220 has an invalid interface number: 76 but max is 2 [ 755.404935][ T9980] usb 8-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 755.412045][ T5964] usb 5-1: SerialNumber: syz [ 755.461842][ T49] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.472981][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.499165][ T9980] usb 8-1: config 220 has no interface number 2 [ 755.512454][ T5964] usb 5-1: config 0 descriptor?? [ 755.581366][ T9980] usb 8-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 755.628826][ T5964] i2c-tiny-usb 5-1:0.0: version 6d.cc found at bus 005 address 100 [ 755.699882][ T9980] usb 8-1: config 220 interface 0 has no altsetting 0 [ 755.735903][ T9980] usb 8-1: config 220 interface 76 has no altsetting 0 [ 755.745603][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 755.770357][ T9980] usb 8-1: config 220 interface 1 has no altsetting 0 [ 755.787612][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 755.794384][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 755.810182][ T9980] usb 8-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 755.836082][ T9980] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 755.854072][ T9981] usb 9-1: USB disconnect, device number 17 [ 755.927097][ T9980] usb 8-1: Product: syz [ 755.962701][ T9980] usb 8-1: Manufacturer: syz [ 756.075971][ T49] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 756.082151][ T9980] usb 8-1: SerialNumber: syz [ 756.121381][ T49] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 756.622233][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.737902][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.746058][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.754260][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 756.763732][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 757.108989][ T9980] usb 8-1: can't set config #220, error -71 [ 757.212721][ T9980] usb 8-1: USB disconnect, device number 14 [ 758.220255][ T5964] i2c i2c-1: failure reading functionality [ 758.349554][ T5964] i2c i2c-1: connected i2c-tiny-usb device [ 758.378215][ T5964] usb 5-1: USB disconnect, device number 100 [ 758.618625][T15886] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 759.780133][ T9980] net_ratelimit: 5 callbacks suppressed [ 759.780148][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.867385][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 759.887236][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 760.898096][ T9990] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.050533][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.293810][ T9990] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 761.457816][ T9990] usb 3-1: Using ep0 maxpacket: 32 [ 761.465036][ T9990] usb 3-1: config 0 has an invalid interface number: 196 but max is 0 [ 761.485712][ T9990] usb 3-1: config 0 has no interface number 0 [ 761.528025][ T9990] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x2 has invalid maxpacket 528 [ 761.644306][ T9991] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 761.662238][ T9990] usb 3-1: config 0 interface 196 altsetting 1 endpoint 0x82 has invalid wMaxPacketSize 0 [ 761.709599][ T9990] usb 3-1: config 0 interface 196 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 0 [ 761.758012][ T9990] usb 3-1: config 0 interface 196 has no altsetting 0 [ 761.796014][ T9990] usb 3-1: New USB device found, idVendor=05ac, idProduct=7700, bcdDevice=eb.3a [ 761.806681][ T9991] usb 10-1: Using ep0 maxpacket: 8 [ 761.819952][ T9991] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 761.833952][ T9990] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 761.853470][ T9991] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 761.864763][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.874912][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.885237][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 761.899551][ T9990] usb 3-1: Product: syz [ 761.921412][ T9991] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 761.934766][ T9990] usb 3-1: Manufacturer: syz [ 761.958487][ T9990] usb 3-1: SerialNumber: syz [ 761.980400][ T9991] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 762.022358][ T9990] usb 3-1: config 0 descriptor?? [ 762.042368][ T9991] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 762.068414][T15910] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 762.167375][ T9991] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 762.215409][ T9991] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 762.267416][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.417277][ T9990] ipheth 3-1:0.196: ipheth_get_macaddr: usb_control_msg: -71 [ 762.464213][ T9990] ipheth 3-1:0.196: probe with driver ipheth failed with error -71 [ 762.508196][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 762.523921][ T9991] usb 10-1: usb_control_msg returned -32 [ 762.547061][ T9991] usbtmc 10-1:16.0: can't read capabilities [ 762.628240][ T9990] usb 3-1: USB disconnect, device number 22 [ 762.727828][T15917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 762.736528][T15917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 762.853543][T15917] usbtmc 10-1:16.0: usb_control_msg returned -71 [ 762.864567][ T9990] usb 10-1: USB disconnect, device number 5 [ 763.207391][T15950] fuse: Unknown parameter 'æd' [ 764.197140][ T9990] usb 3-1: new full-speed USB device number 23 using dummy_hcd [ 764.465081][ T9990] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 764.540953][ T9990] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 764.587070][ T5830] Bluetooth: hci5: command 0x0406 tx timeout [ 764.587292][ T9990] usb 3-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 764.617685][T15962] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 764.727859][ T9991] usb 8-1: new high-speed USB device number 15 using dummy_hcd [ 764.786304][ T9990] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 764.878252][ T9990] usb 3-1: config 0 descriptor?? [ 764.910028][ T9990] hub 3-1:0.0: USB hub found [ 765.058468][ T5915] net_ratelimit: 5 callbacks suppressed [ 765.058487][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.107138][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.130183][ T9991] usb 8-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 765.145631][ T9990] hub 3-1:0.0: 1 port detected [ 765.153450][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.167559][ T9991] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 765.197242][ T9991] usb 8-1: Product: syz [ 765.468162][ T9991] usb 8-1: Manufacturer: syz [ 765.472835][ T9991] usb 8-1: SerialNumber: syz [ 765.489276][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.507471][T15974] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 765.545275][T15975] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2704'. [ 765.585632][ T9991] usb 8-1: config 0 descriptor?? [ 765.643467][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.651661][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.664103][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 765.724070][ T9991] i2c-tiny-usb 8-1:0.0: version 6d.cc found at bus 008 address 015 [ 765.852774][T15975] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2704'. [ 766.032830][ T5915] hub 3-1:0.0: activate --> -90 [ 766.097579][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 766.455211][T15979] usb 3-1: USB disconnect, device number 23 [ 766.672497][T15989] IPv4: Oversized IP packet from 127.202.26.0 [ 767.070860][ T36] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 767.357077][T15979] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 767.547427][T15979] usb 3-1: Using ep0 maxpacket: 8 [ 767.569306][T15979] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 8 [ 767.591838][T15979] usb 3-1: config 1 interface 1 altsetting 1 bulk endpoint 0x3 has invalid maxpacket 16 [ 767.646494][T15979] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 767.667749][T15979] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 767.690103][ T9991] i2c i2c-1: failure reading functionality [ 767.706838][ T9991] i2c i2c-1: connected i2c-tiny-usb device [ 767.753841][T15979] usb 3-1: Product: syz [ 767.803874][T15979] usb 3-1: Manufacturer: syz [ 767.818995][ T9991] usb 8-1: USB disconnect, device number 15 [ 767.847694][T15979] usb 3-1: SerialNumber: syz [ 768.053358][T16018] netlink: 76 bytes leftover after parsing attributes in process `syz.7.2712'. [ 768.138875][T16020] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 768.152762][T16020] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 768.216082][T15979] cdc_ncm 3-1:1.0: bind() failure [ 768.332709][T15979] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 768.368917][T15979] cdc_ncm 3-1:1.1: bind() failure [ 769.647374][T15979] usb 3-1: USB disconnect, device number 24 [ 769.702368][T16036] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 770.158110][ T77] net_ratelimit: 7 callbacks suppressed [ 770.158128][ T77] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.267389][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 770.887126][ T5915] usb 8-1: new high-speed USB device number 16 using dummy_hcd [ 771.167060][ T5915] usb 8-1: Using ep0 maxpacket: 8 [ 771.192078][ T5915] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 771.297666][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.309685][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.351687][ T5915] usb 8-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 771.402451][ T5915] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 771.511431][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 771.562047][ T5915] usb 8-1: config 0 descriptor?? [ 771.580837][ T5915] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 771.740592][T16081] netlink: 16 bytes leftover after parsing attributes in process `syz.4.2724'. [ 771.997071][ T9978] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 772.168949][ T9978] usb 10-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 772.180224][ T9978] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 772.190543][ T9978] usb 10-1: Product: syz [ 772.247564][ T9978] usb 10-1: Manufacturer: syz [ 772.309308][ T5915] gspca_vc032x: reg_w err -110 [ 772.314160][ T5915] vc032x 8-1:0.0: probe with driver vc032x failed with error -110 [ 772.337657][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 772.659490][ T9978] usb 10-1: SerialNumber: syz [ 772.666322][T16091] netlink: 'syz.8.2725': attribute type 16 has an invalid length. [ 772.688163][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.192695][ T9978] usb 10-1: config 0 descriptor?? [ 773.280993][ T9978] i2c-tiny-usb 10-1:0.0: version 6d.cc found at bus 010 address 006 [ 773.378602][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 773.978107][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.419607][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 774.474489][ T5964] usb 8-1: USB disconnect, device number 16 [ 775.092893][T16114] sch_tbf: burst 25 is lower than device ip6gre0 mtu (1448) ! [ 775.359380][ T1139] net_ratelimit: 2 callbacks suppressed [ 775.359400][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.457713][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 775.788366][ T9978] i2c i2c-1: failure reading functionality [ 775.846857][ T9978] i2c i2c-1: connected i2c-tiny-usb device [ 776.108760][ T9978] usb 10-1: USB disconnect, device number 6 [ 776.555787][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.767371][T12760] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 776.813047][T16141] netlink: 20 bytes leftover after parsing attributes in process `syz.9.2733'. [ 776.934369][T16136] fuse: Bad value for 'fd' [ 777.457362][ T9980] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 777.627198][T15979] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.146535][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 778.369595][T16159] netlink: 'syz.8.2736': attribute type 1 has an invalid length. [ 778.657478][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.697303][ T5964] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.787487][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 779.826591][T16185] netlink: 'syz.4.2740': attribute type 11 has an invalid length. [ 780.137110][T15979] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 780.167032][ T5964] usb 8-1: new high-speed USB device number 17 using dummy_hcd [ 780.507245][ T9981] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.587461][ T5964] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 780.598692][T15979] usb 5-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 780.607884][T15979] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 780.617053][ T5964] usb 8-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 780.633050][T15979] usb 5-1: Product: syz [ 780.648295][T15979] usb 5-1: Manufacturer: syz [ 780.658319][ T5964] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 780.669249][T15979] usb 5-1: SerialNumber: syz [ 780.690949][ T5964] usb 8-1: config 0 descriptor?? [ 780.703195][T15979] usb 5-1: config 0 descriptor?? [ 780.748301][ T5915] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 780.930446][ T5964] usbhid 8-1:0.0: can't add hid device: -71 [ 780.936911][ T5964] usbhid 8-1:0.0: probe with driver usbhid failed with error -71 [ 780.985155][ T5964] usb 8-1: USB disconnect, device number 17 [ 781.002679][T16192] tipc: Started in network mode [ 781.028372][T16192] tipc: Node identity 2aed2edcb583, cluster identity 4711 [ 781.070342][T16192] tipc: Enabled bearer , priority 0 [ 781.107490][T16193] syzkaller0: entered promiscuous mode [ 781.113000][T16193] syzkaller0: entered allmulticast mode [ 781.128419][ T1139] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.231851][T16192] tipc: Resetting bearer [ 781.282800][T16191] tipc: Resetting bearer [ 781.391872][T16191] tipc: Disabling bearer [ 781.487337][ T5964] usb 8-1: new high-speed USB device number 18 using dummy_hcd [ 781.540731][T15979] usb 5-1: Firmware version (0.0) predates our first public release. [ 781.548983][T15979] usb 5-1: Please update to version 0.2 or newer [ 781.649357][ T5964] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 781.660766][ T5964] usb 8-1: New USB device found, idVendor=047f, idProduct=3333, bcdDevice= 0.40 [ 781.689226][ T5964] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 781.698922][ T31] INFO: task syz.5.2345:14469 blocked for more than 143 seconds. [ 781.717427][ T31] Tainted: G L syzkaller #0 [ 781.764903][T15979] usb 5-1: USB disconnect, device number 101 [ 781.787396][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 781.822016][ T5964] usb 8-1: config 0 descriptor?? [ 781.839414][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 781.851769][ T31] task:syz.5.2345 state:D stack:24960 pid:14469 tgid:14469 ppid:8237 task_flags:0x400040 flags:0x00080002 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 781.993504][ T31] Call Trace: [ 781.996860][ T31] [ 782.047112][ T31] __schedule+0x15dd/0x52d0 [ 782.052596][ T31] ? stack_trace_save+0xa9/0x100 [ 782.078567][ T31] ? __pfx___schedule+0x10/0x10 [ 782.083508][ T31] ? schedule+0x90/0x360 [ 782.178145][ T31] schedule+0x164/0x360 [ 782.182374][ T31] schedule_preempt_disabled+0x13/0x30 [ 782.241954][ T31] __mutex_lock+0x7fe/0x1300 [ 782.246623][ T31] ? __mutex_lock+0x5ac/0x1300 [ 782.287240][ T3544] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.306515][ T31] ? usbdev_release+0x7e/0x760 [ 782.322984][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 782.380279][ T31] ? __fsnotify_parent+0x267/0x620 [ 782.386346][ T31] ? __pfx___fsnotify_parent+0x10/0x10 [ 782.427012][ T31] ? __pfx_usbdev_release+0x10/0x10 [ 782.432564][ T31] usbdev_release+0x7e/0x760 [ 782.467143][ T31] ? __pfx_usbdev_release+0x10/0x10 [ 782.497181][ T31] __fput+0x44f/0xa70 [ 782.501261][ T31] task_work_run+0x1d9/0x270 [ 782.506151][ T31] ? __pfx_task_work_run+0x10/0x10 [ 782.567086][ T31] exit_to_user_mode_loop+0xed/0x480 [ 782.572482][ T31] ? rcu_is_watching+0x15/0xb0 [ 782.624759][ T31] do_syscall_64+0x32d/0xf80 [ 782.666984][ T31] ? trace_irq_disable+0x3b/0x150 [ 782.672101][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.727124][ T31] ? clear_bhb_loop+0x40/0x90 [ 782.731908][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 782.789511][ T31] RIP: 0033:0x7fef2959c819 [ 782.795966][ T31] RSP: 002b:00007fef2993fba8 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 [ 782.856983][ T31] RAX: 0000000000000000 RBX: 00007fef2993fc90 RCX: 00007fef2959c819 [ 782.865210][ T31] RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 [ 782.907116][ T9991] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 782.937041][ T31] RBP: 0000000000097d6f R08: 0000000000000001 R09: 0000000000000000 [ 782.945075][ T31] R10: 0000001b2d520000 R11: 0000000000000246 R12: 00007fef2993fcd0 [ 782.987100][ T31] R13: 00007fef29815fac R14: 0000000000098398 R15: 00007fef29815fa0 [ 782.996228][ T31] [ 783.027214][ T31] [ 783.027214][ T31] Showing all locks held in the system: [ 783.035054][ T31] 1 lock held by khungtaskd/31: [ 783.087009][ T31] #0: ffffffff8e75e5a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 783.117075][ T31] 3 locks held by kworker/u8:3/49: [ 783.122230][ T31] #0: ffff88813fe54148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.176675][ T31] #1: ffffc90000b97c40 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.202717][ T31] #2: ffffffff8fbd0888 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 783.212209][ T31] 3 locks held by kworker/u8:10/3544: [ 783.222257][ T31] #0: ffff888032ba0948 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.234309][ T31] #1: ffffc9000ce3fc40 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.250340][ T31] #2: ffffffff8fbd0888 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 783.266667][ T31] 1 lock held by dhcpcd/5490: [ 783.271777][ T31] #0: ffffffff8fbd0888 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x404/0x1ad0 [ 783.282429][ T31] 2 locks held by getty/5586: [ 783.307005][ T31] #0: ffff888037c180a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 783.316820][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x45c/0x13c0 [ 783.347057][ T31] 3 locks held by kworker/1:6/5915: [ 783.352383][ T31] #0: ffff88813fe0f148 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.380071][ T31] #1: ffffc9000464fc40 ((work_completion)(&rdev->destroy_work)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.408398][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.417060][ T31] #2: ffffffff8e764780 (rcu_state.barrier_mutex){+.+.}-{4:4}, at: rcu_barrier+0x4c/0x580 [ 783.436425][ T31] 5 locks held by kworker/1:7/5964: [ 783.441830][ T31] #0: ffff888021ada548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.454916][ T31] #1: ffffc9000467fc40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.468390][ T31] #2: ffff88802a0281e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 783.477594][ T31] #3: ffff8880584c71e0 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 783.486874][ T31] #4: ffff8880278191a8 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x450 [ 783.498457][ T31] 6 locks held by kworker/1:13/9989: [ 783.503763][ T31] 3 locks held by kworker/1:15/9991: [ 783.511904][ T31] #0: ffff88813fe0f148 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.523987][ T31] #1: ffffc90004c7fc40 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.535940][ T31] #2: ffffffff8fbd0888 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 783.546694][ T9978] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.556281][ T31] 1 lock held by syz.5.2345/14469: [ 783.563263][ T31] #0: ffff888029f901e0 (&dev->mutex){....}-{4:4}, at: usbdev_release+0x7e/0x760 [ 783.572804][ T31] 1 lock held by syz.6.2442/14812: [ 783.579239][ T31] #0: ffff888029f901e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x182/0x770 [ 783.588561][ T31] 1 lock held by syz.0.2530/15131: [ 783.593689][ T31] #0: ffff888029f901e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x182/0x770 [ 783.604020][ T31] 1 lock held by syz-executor/15294: [ 783.611562][ T31] #0: ffffffff8e7648b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 783.623763][ T31] 1 lock held by syz.1.2625/15525: [ 783.629581][ T31] #0: ffff888029f901e0 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x182/0x770 [ 783.639012][ T31] 4 locks held by udevd/15690: [ 783.643792][ T31] #0: ffff888073e950a0 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe10 [ 783.654256][ T31] #1: ffff888035149488 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 [ 783.664927][ T31] #2: ffff88813fe32968 (kn->active#29){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 783.676160][ T31] #3: ffff8880587d21e0 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 783.688628][ T31] 7 locks held by kworker/1:0/15979: [ 783.693935][ T31] #0: ffff888021ada548 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0xa52/0x18c0 [ 783.707794][ T31] #1: ffffc900040c7c40 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0xa8d/0x18c0 [ 783.723377][ T31] #2: ffff888029f491e0 (&dev->mutex){....}-{4:4}, at: hub_event+0x17f/0x4f30 [ 783.736778][ T31] #3: ffff8880587d21e0 (&dev->mutex){....}-{4:4}, at: usb_disconnect+0xf8/0x990 [ 783.747813][ T31] #4: ffff8880367a91a8 (&dev->mutex){....}-{4:4}, at: device_release_driver_internal+0xb6/0x870 [ 783.759063][ T31] #5: ffffffff8fbd0888 (rtnl_mutex){+.+.}-{4:4}, at: ieee802154_unregister_hw+0x5a/0xe0 [ 783.771514][ T31] #6: ffff88803b51a7c8 (&local->iflist_mtx#2){+.+.}-{4:4}, at: ieee802154_remove_interfaces+0x33/0x1d0 [ 783.786826][ T31] 1 lock held by syz.8.2743/16204: [ 783.793530][ T31] #0: ffffffff8e7648b8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x38d/0x770 [ 783.931007][ T31] [ 783.933384][ T31] ============================================= [ 783.933384][ T31] [ 783.947184][ T5885] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 783.947450][ T31] NMI backtrace for cpu 0 [ 783.947466][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 783.947487][ T31] Tainted: [L]=SOFTLOCKUP [ 783.947493][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 783.947511][ T31] Call Trace: [ 783.947519][ T31] [ 783.947526][ T31] dump_stack_lvl+0xe8/0x150 [ 783.947553][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 783.947571][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 783.947595][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 783.947615][ T31] sys_info+0x135/0x170 [ 783.947638][ T31] watchdog+0xfd9/0x1030 [ 783.947659][ T31] ? watchdog+0x21a/0x1030 [ 783.947680][ T31] kthread+0x388/0x470 [ 783.947697][ T31] ? __pfx_watchdog+0x10/0x10 [ 783.947711][ T31] ? __pfx_kthread+0x10/0x10 [ 783.947728][ T31] ret_from_fork+0x51e/0xb90 [ 783.947752][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 783.947772][ T31] ? __switch_to+0xc7d/0x1450 [ 783.947793][ T31] ? __pfx_kthread+0x10/0x10 [ 783.947811][ T31] ret_from_fork_asm+0x1a/0x30 [ 783.947846][ T31] [ 783.947853][ T31] Sending NMI from CPU 0 to CPUs 1: [ 784.073965][ C1] NMI backtrace for cpu 1 [ 784.073984][ C1] CPU: 1 UID: 0 PID: 9989 Comm: kworker/1:13 Tainted: G L syzkaller #0 PREEMPT(full) [ 784.074009][ C1] Tainted: [L]=SOFTLOCKUP [ 784.074014][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 784.074025][ C1] Workqueue: usb_hub_wq hub_event [ 784.074050][ C1] RIP: 0010:check_preemption_disabled+0x22/0xe0 [ 784.074073][ C1] Code: 90 90 90 90 90 90 90 90 55 41 57 41 56 53 65 8b 05 57 f3 6c 07 65 8b 0d 4c f3 6c 07 f7 c1 ff ff ff 7f 74 0c 5b 41 5e 41 5f 5d cc cc cc cc cc 9c 59 f7 c1 00 02 00 00 74 ea 65 4c 8b 3d fe f2 [ 784.074085][ C1] RSP: 0018:ffffc900045ee5b8 EFLAGS: 00000046 [ 784.074097][ C1] RAX: 0000000000000001 RBX: 0000000000000246 RCX: 0000000000000046 [ 784.074107][ C1] RDX: 00000000a9a9717c RSI: ffffffff8e16c434 RDI: ffffffff8c27d500 [ 784.074118][ C1] RBP: 0000000000000000 R08: ffffffff81768a55 R09: ffffffff8e75e5a0 [ 784.074128][ C1] R10: ffffc900045ee758 R11: ffffffff81b0dbf0 R12: 0000000000000002 [ 784.074138][ C1] R13: ffffffff8e75e5a0 R14: 0000000000000000 R15: 0000000000000000 [ 784.074148][ C1] FS: 0000000000000000(0000) GS:ffff888125554000(0000) knlGS:0000000000000000 [ 784.074159][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 784.074170][ C1] CR2: 0000200000395030 CR3: 000000000e54c000 CR4: 00000000003526f0 [ 784.074183][ C1] DR0: 0000000000000008 DR1: 0000000000000002 DR2: 0000000000000404 [ 784.074192][ C1] DR3: ffffffffefffff14 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 784.074202][ C1] Call Trace: [ 784.074208][ C1] [ 784.074213][ C1] lock_acquire+0x100/0x2e0 [ 784.074233][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 784.074253][ C1] ? driver_probe_device+0x4f/0x240 [ 784.074275][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 784.074294][ C1] unwind_next_frame+0xc2/0x23c0 [ 784.074312][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 784.074333][ C1] ? unwind_next_frame+0xa5/0x23c0 [ 784.074352][ C1] ? __driver_probe_device+0x18c/0x320 [ 784.074372][ C1] ? driver_probe_device+0x4f/0x240 [ 784.074392][ C1] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 784.074407][ C1] arch_stack_walk+0x11b/0x150 [ 784.074429][ C1] ? driver_probe_device+0x4f/0x240 [ 784.074450][ C1] stack_trace_save+0xa9/0x100 [ 784.074464][ C1] ? __pfx_stack_trace_save+0x10/0x10 [ 784.074479][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 784.074494][ C1] ? __kmalloc_node_track_caller_noprof+0x4db/0x7b0 [ 784.074511][ C1] ? __alloc_skb+0x2c1/0x7d0 [ 784.074525][ C1] ? __netdev_alloc_skb+0xc1/0x810 [ 784.074541][ C1] ? ath6kl_usb_post_recv_transfers+0x207/0x6f0 [ 784.074561][ C1] ? ath6kl_usb_power_on+0x6a/0x280 [ 784.074578][ C1] ? ath6kl_core_init+0x1e1/0x10b0 [ 784.074595][ C1] ? ath6kl_usb_probe+0x14df/0x15d0 [ 784.074613][ C1] kasan_save_track+0x3e/0x80 [ 784.074628][ C1] ? kasan_save_track+0x3e/0x80 [ 784.074642][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 784.074657][ C1] ? __kmalloc_noprof+0x35c/0x760 [ 784.074671][ C1] ? usb_alloc_urb+0x46/0x150 [ 784.074685][ C1] ? ath6kl_usb_post_recv_transfers+0x24f/0x6f0 [ 784.074704][ C1] ? ath6kl_usb_power_on+0x6a/0x280 [ 784.074722][ C1] ? ath6kl_core_init+0x1e1/0x10b0 [ 784.074737][ C1] ? ath6kl_usb_probe+0x14df/0x15d0 [ 784.074754][ C1] ? usb_probe_interface+0x668/0xc90 [ 784.074773][ C1] ? really_probe+0x267/0xaf0 [ 784.074792][ C1] ? __driver_probe_device+0x18c/0x320 [ 784.074810][ C1] ? driver_probe_device+0x4f/0x240 [ 784.074850][ C1] __kasan_kmalloc+0x93/0xb0 [ 784.074866][ C1] __kmalloc_noprof+0x35c/0x760 [ 784.074881][ C1] ? usb_alloc_urb+0x46/0x150 [ 784.074895][ C1] ? __kmalloc_noprof+0x1b8/0x760 [ 784.074911][ C1] usb_alloc_urb+0x46/0x150 [ 784.074926][ C1] ath6kl_usb_post_recv_transfers+0x24f/0x6f0 [ 784.074950][ C1] ath6kl_usb_power_on+0x6a/0x280 [ 784.074968][ C1] ath6kl_core_init+0x1e1/0x10b0 [ 784.074986][ C1] ? __kasan_kmalloc+0x93/0xb0 [ 784.075004][ C1] ? __pfx_ath6kl_core_init+0x10/0x10 [ 784.075021][ C1] ? __asan_memcpy+0x40/0x70 [ 784.075034][ C1] ? ath6kl_core_create+0x7fb/0x9a0 [ 784.075052][ C1] ath6kl_usb_probe+0x14df/0x15d0 [ 784.075075][ C1] usb_probe_interface+0x668/0xc90 [ 784.075097][ C1] ? __pfx_usb_probe_interface+0x10/0x10 [ 784.075116][ C1] really_probe+0x267/0xaf0 [ 784.075137][ C1] __driver_probe_device+0x18c/0x320 [ 784.075157][ C1] driver_probe_device+0x4f/0x240 [ 784.075178][ C1] __device_attach_driver+0x279/0x430 [ 784.075199][ C1] bus_for_each_drv+0x258/0x2f0 [ 784.075215][ C1] ? __pfx___device_attach_driver+0x10/0x10 [ 784.075235][ C1] ? __pfx_bus_for_each_drv+0x10/0x10 [ 784.075251][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 784.075268][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 784.075286][ C1] __device_attach+0x2c5/0x450 [ 784.075306][ C1] ? __pfx___device_attach+0x10/0x10 [ 784.075326][ C1] ? _raw_spin_unlock+0x28/0x50 [ 784.075342][ C1] device_initial_probe+0xa1/0xd0 [ 784.075362][ C1] bus_probe_device+0x12a/0x220 [ 784.075376][ C1] ? device_add+0x726/0xb70 [ 784.075395][ C1] device_add+0x7b6/0xb70 [ 784.075420][ C1] usb_set_configuration+0x1a87/0x2110 [ 784.075453][ C1] usb_generic_driver_probe+0x8d/0x150 [ 784.075472][ C1] usb_probe_device+0x1c4/0x3b0 [ 784.075492][ C1] ? __pfx_usb_probe_device+0x10/0x10 [ 784.075517][ C1] really_probe+0x267/0xaf0 [ 784.075538][ C1] __driver_probe_device+0x18c/0x320 [ 784.075558][ C1] driver_probe_device+0x4f/0x240 [ 784.075579][ C1] __device_attach_driver+0x279/0x430 [ 784.075601][ C1] bus_for_each_drv+0x258/0x2f0 [ 784.075616][ C1] ? __pfx___device_attach_driver+0x10/0x10 [ 784.075642][ C1] ? __pfx_bus_for_each_drv+0x10/0x10 [ 784.075658][ C1] ? lockdep_hardirqs_on+0x7a/0x110 [ 784.075675][ C1] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 784.075692][ C1] __device_attach+0x2c5/0x450 [ 784.075712][ C1] ? __pfx___device_attach+0x10/0x10 [ 784.075732][ C1] ? _raw_spin_unlock+0x28/0x50 [ 784.075748][ C1] device_initial_probe+0xa1/0xd0 [ 784.075767][ C1] bus_probe_device+0x12a/0x220 [ 784.075782][ C1] ? device_add+0x726/0xb70 [ 784.075800][ C1] device_add+0x7b6/0xb70 [ 784.075822][ C1] usb_new_device+0xa08/0x16f0 [ 784.075842][ C1] ? __pfx_usb_new_device+0x10/0x10 [ 784.075858][ C1] ? _raw_spin_unlock_irq+0x23/0x50 [ 784.075875][ C1] hub_event+0x2a1c/0x4f30 [ 784.075907][ C1] ? __pfx_hub_event+0x10/0x10 [ 784.075927][ C1] ? process_scheduled_works+0xa8d/0x18c0 [ 784.075945][ C1] ? process_scheduled_works+0xa8d/0x18c0 [ 784.075963][ C1] process_scheduled_works+0xb6e/0x18c0 [ 784.075989][ C1] ? __pfx_process_scheduled_works+0x10/0x10 [ 784.076009][ C1] ? assign_work+0x3d5/0x5e0 [ 784.076027][ C1] worker_thread+0xa53/0xfc0 [ 784.076053][ C1] kthread+0x388/0x470 [ 784.076066][ C1] ? __pfx_worker_thread+0x10/0x10 [ 784.076083][ C1] ? __pfx_kthread+0x10/0x10 [ 784.076096][ C1] ret_from_fork+0x51e/0xb90 [ 784.076115][ C1] ? __pfx_ret_from_fork+0x10/0x10 [ 784.076131][ C1] ? __switch_to+0xc7d/0x1450 [ 784.076148][ C1] ? __pfx_kthread+0x10/0x10 [ 784.076162][ C1] ret_from_fork_asm+0x1a/0x30 [ 784.076186][ C1] [ 784.618208][ T1149] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 785.440442][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 785.447352][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 785.458022][ T31] Tainted: [L]=SOFTLOCKUP [ 785.462353][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 785.472426][ T31] Call Trace: [ 785.475723][ T31] [ 785.478841][ T31] vpanic+0x56c/0xa60 [ 785.482873][ T31] ? __pfx___schedule+0x10/0x10 [ 785.487743][ T31] ? __pfx_vpanic+0x10/0x10 [ 785.492280][ T31] ? __pfx_console_unlock+0x10/0x10 [ 785.497501][ T31] panic+0xc5/0xd0 [ 785.501242][ T31] ? __pfx_panic+0x10/0x10 [ 785.505664][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 785.511065][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 785.517247][ T31] watchdog+0x1023/0x1030 [ 785.521589][ T31] ? watchdog+0x21a/0x1030 [ 785.526006][ T31] kthread+0x388/0x470 [ 785.530163][ T31] ? __pfx_watchdog+0x10/0x10 [ 785.534899][ T31] ? __pfx_kthread+0x10/0x10 [ 785.539512][ T31] ret_from_fork+0x51e/0xb90 [ 785.544133][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 785.549325][ T31] ? __switch_to+0xc7d/0x1450 [ 785.554014][ T31] ? __pfx_kthread+0x10/0x10 [ 785.558599][ T31] ret_from_fork_asm+0x1a/0x30 [ 785.563376][ T31] [ 785.566776][ T31] Kernel Offset: disabled [ 785.571089][ T31] Rebooting in 86400 seconds..