last executing test programs: 16.59922434s ago: executing program 1 (id=68): r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$kcm(0x29, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x81, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000400)=ANY=[], 0x3c}}, 0x0) sendmsg$IPCTNL_MSG_CT_DELETE(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000280)={0x1c, 0x2, 0x1, 0x301, 0x0, 0x0, {0x2, 0x0, 0x4}, [@CTA_ZONE={0x6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20048001}, 0x4048814) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000140)) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=@acquire={0x128, 0x17, 0x1, 0x0, 0x0, {{@in6=@ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0xfe, 0x0}}, 0x4d4}, @in=@remote, {@in6=@dev={0xfe, 0x80, '\x00', 0x15}, @in6=@local, 0x0, 0x0, 0x0, 0x6}, {{@in=@local, @in6=@ipv4={'\x00', '\xff\xff', @broadcast}, 0x0, 0x0, 0x4e22, 0x0, 0x2, 0x0, 0xa0}, {0x0, 0x0, 0x0, 0x0, 0x1}, {0x3}, 0x4, 0x6e6bbf, 0x1}, 0xfffffffe}}, 0x128}}, 0x20004040) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETRULE(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x40, 0x7, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x6}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}, 0x40}, 0x1, 0x0, 0x0, 0x4040}, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)={0x5c, 0x2, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11, 0x1, 0x0, 0x1}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xffff}]}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x84}, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r8, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$NONE(r1, 0x3b89, &(0x7f0000000180)={0x28, 0x1, r9, r8, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_ALLOC$TEST(r1, 0x3b89, &(0x7f0000000200)={0x28, 0x4, r9, r10, 0x0, 0x0, 0xdead, 0x4, &(0x7f0000000240)}) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0505405, &(0x7f00000001c0)={{0x1, 0x0, 0x0, 0x0, 0xff6e}, 0x0, 0x80}) ioctl$SNDRV_TIMER_IOCTL_START(0xffffffffffffffff, 0x54a0) 15.531893834s ago: executing program 3 (id=70): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000001140)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a14000000180a05000000000000000000030000006c000000160a01040000000000000000020000040900020073797a30000000000900010073797a300000000040000380080001400000000008000240510599282c0003801400010064756d6d79300000000000000000000014000100627269646765300000000000000000002c000000000a010400000000000000000a0000090900010073797a30000000000c000440000000000000000344000000140a010400000000000000000100000225000800f2aa1e09cec8e4655a18e44bdc9c54f849b3a5a5dc7db4d93b57d6c9ea558848a3000000080003400000000aac020000140a0102000000000000000003000005f300080059d080639092d9df94e9736cf9e820987f8ce273e4f355e447d8620a6d82590aa7d15fe43d75f437eca3023b2703b8e4437b221e4bb44e2dbbf2ad3a302581fd44546388ef688054e3e60cfe1ebf807bef54189a7c869426530135ab2908df3d3f17314d8b63d82588db339c3abde4a654f51b45a86cc302343b27b784df364340ce84fe74c7eac852a56d322053e42ef4c4eccf983f8b2b43cf6525f6148c0871a3847da25a4712661efc85266ec308672e76e46893f9a2251c7fc2d8b4c2d1b57de132477cb4427029cf042d5e1e779a1c583978c0240df14dc080655071eb2677714fb93eb42bc03c6ab359713a00eb000800c939c7101a8a6941c67d334d67959f82eb6664b3be9a4c2abe53bda9ed2fae041dab63de74bebec684c13f4bb20aeac218564551edcdf93f678cc9781c8bffbd0fad09e5e761df0a05925a16bf739e499e732b0307ceb25ce1a99807120e01e5acca22fddecbf61d07c959d4ba7eb869bd2e1df3e03d97a6b84e315851aa8775e71a11bace72ccb2012ab84c9e5e2457f952f6738819603298cab4363a41aea34225f6d741e30dc627b9f3ab8709dbfc82458160161263f51a1a0771f1a11f7c54ba8762ef6c2743de48e5dcd6fa300df5960b713e4e1574ed0e2108be3e9a945e8ddaccd39d35000900010073797a31000000009e000800e8dab8d8a17de2cfed9a9edc6d7e431ed77bda89186f400bc85c02631589953dce976f81424bb8f9e45be01734a49bcc35570451d632212d879aa785877d9719dbc359af8d57c56fa404e9d92c4e9c6fc51ce6a4121cc1dc207b10c9d8e5f4e6edffb3055aabee1181ee6529b5ef24d905c5f6d6fc6a7a83baf7e1896752593d18b49caacda7ff43e237fdc11ada6752b379c7bcad6317d5df3100000900010073797a31000000004c010000180a05000000000000000000020000010c000540000000000000000260000380540003801400010073697430000000000000000000000000140001006970766c616e310000000000000000001400010076657468315f746f5f626174616476001400010073797a5f74756e00000000000000000008000140000000000c00054000000000000000050c00054000000000000000032400038008000240000000070800014000000000080002400000000708000140000000000900010073797a310000000078000380400003801400010067656e65766530000000000000000000140001006272696467655f736c6176655f3000001400010065727370616e3000000000000000000008000140000000002c0003801400010064756d6d793000000000000000000000140001006970766c616e310000000000000000000900010073797a30"], 0x510}}, 0x0) (async) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) (async) r2 = accept4(r0, 0x0, 0x0, 0x800) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r2) (async) pread64(r2, &(0x7f00000001c0)=""/223, 0xdf, 0x6) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="50000000020603000000000000000000000000000c002e5921c41400000000000500010006000000050005000100000005000400000000000900020073797a30000000000c000300686173683a697000"], 0x50}}, 0x0) (async, rerun: 64) r4 = signalfd(r2, &(0x7f0000000080)={[0x1]}, 0x8) (rerun: 64) openat$cgroup_subtree(r4, &(0x7f00000000c0), 0x2, 0x0) 14.882774928s ago: executing program 3 (id=71): mkdirat$binderfs(0xffffffffffffff9c, &(0x7f00000001c0)='./binderfs2\x00', 0x1ff) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000000)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) syz_open_dev$video(0x0, 0x1d24, 0x0) r4 = socket$inet(0xa, 0x801, 0x84) connect$inet(r4, &(0x7f0000000340)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r4, 0x8) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000440)=@deltaction={0x40, 0x18, 0x1, 0x70bd2a, 0x25dfdbfe, {0xa}, [@TCA_ACT_TAB={0x2c, 0x1, [{0x10, 0x8f, 0x0, 0x0, @TCA_ACT_KIND={0xa, 0x1, 'pedit\x00'}}, {0xc, 0x9, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x7fffffff}}, {0xc, 0xf, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0xb8a}}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x44000}, 0x20040844) r6 = accept4(r4, 0x0, 0x0, 0x0) sendmmsg$unix(r3, 0x0, 0x0, 0x4000045) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r6, 0x84, 0x22, 0x0, 0x0) sendto$inet(r6, &(0x7f0000000300)="b3", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r6, 0x84, 0x7b, &(0x7f00000003c0)={0x0, 0x4}, 0x8) close(r6) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r7 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r7, 0xc0606610, &(0x7f0000000140)={0x60, 0x0, &(0x7f00001cd000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x9, &(0x7f00000021c0), 0x0, 0xc2ff, 0x0, 0x0, 0x0, 0x76}) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f0000000040)={0x4, 0xfff, 0x4, {0x9, @sliced={0xd, [0x2, 0x9, 0x0, 0x7, 0x2, 0x3, 0xfff9, 0x3, 0x104d, 0x1, 0x4, 0x6a, 0x200, 0x8b, 0x7, 0x4, 0x4, 0x8022, 0x3, 0xd, 0x2, 0x1000, 0x6, 0x5, 0x1, 0x9, 0x1c61, 0x3, 0x9, 0x9, 0x9, 0x7, 0xbaab, 0x7, 0xffd8, 0x3e1f, 0x5, 0x7, 0x0, 0x9f, 0x5, 0xd, 0x4, 0x100, 0x1000, 0x4, 0x7d82, 0x7], 0x9}}, 0xfffffffd}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0) r8 = syz_usb_connect(0x0, 0x2d, &(0x7f00000005c0)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870fd00090582"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000040)=0xd) 13.443795635s ago: executing program 1 (id=73): connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xfe}}, 0xffffffff}, 0x1c) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000007880)=[{{0x0, 0x0, &(0x7f0000000740)=[{&(0x7f0000000040)="af0ac95ab194f93f8e795a9b29420fa62d", 0x11}], 0x1}}], 0x1, 0x24088000) readv(0xffffffffffffffff, &(0x7f0000000040)=[{0x0}], 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x9, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x14, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d960001000000000000000000007efff100004000ffffffc900", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c527d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 12.870352114s ago: executing program 1 (id=76): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8004, 0x0, 0x9, 0xda, 0x2, 0xfa11, 0xffbffffb}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r5) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r6, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0xffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000040)={0x40, 0x17, 0x4, 0x4, 0xecff, 0x5ff2, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/pm_async', 0xa82, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000940)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) unshare(0x20000400) bind$unix(0xffffffffffffffff, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) listen(0xffffffffffffffff, 0x8) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0xc, @empty, 0x7}, 0x2f) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd70000400000005000000080009000200000008000c00a80a0000060001000500000008000b"], 0x48}}, 0x20000084) 10.021923253s ago: executing program 1 (id=82): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) pipe(&(0x7f0000019480)={0xffffffffffffffff, 0xffffffffffffffff}) close(r0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) (async) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000300)=0x1, 0x4) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x1) (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) (async) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x20000, 0x0) (async) move_mount(r3, &(0x7f0000000140)='.\x00', r2, 0x0, 0x41) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) close(r4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a4c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc080003400000001408000c4000000e45400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006000100d103000014000000110001"], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a480000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a31000000001c000380180000800c00018006000100d1070000080003400000000114000000110001"], 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async) close(0x3) (async) open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x0, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000003, 0xfa11, 0xffffffff}, 0x0) (async) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)='\x00', 0x1, 0xfffffffffffffffe) (async) connect$inet(r1, &(0x7f00000006c0)={0x2, 0x0, @empty}, 0x10) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000900)=0xffffffffffffffff, 0x4) (async) sendmmsg$inet(r1, &(0x7f0000002180)=[{{0x0, 0x0, &(0x7f0000000540)=[{0x0}, {&(0x7f0000002280)="0f", 0x1}], 0x2}}], 0x1, 0x4008440) (async) socket$nl_route(0x10, 0x3, 0x0) (async) r6 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r6, &(0x7f0000000380)=""/55, 0x37) (async) inotify_add_watch(0xffffffffffffffff, &(0x7f00000001c0)='.\x00', 0x4000423) 9.59114349s ago: executing program 1 (id=84): socket$inet6_sctp(0xa, 0x5, 0x84) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_io_uring_setup(0x5dee, 0x0, 0x0, &(0x7f00000002c0), &(0x7f0000000000)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$inet(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x5, 0x9, 0x6, 0x0, 0xb49, 0x9, 0x8, 0x2, 0x3}, 0x0) mkdir(0x0, 0x22) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) unshare(0x62040200) r2 = syz_usb_connect(0x6, 0x22, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000180)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_AGP_ALLOC(r3, 0xc0206434, &(0x7f00000001c0)={0x401, 0x0, 0x10001}) syz_usb_control_io(r2, &(0x7f00000006c0)={0x2c, &(0x7f0000000100)={0x20, 0xe, 0x19, {0x19, 0x6, "9c0e6c06c3609b5149c75696a71c8b93c5706d978d3e03"}}, &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x41e}}, &(0x7f0000000440)=ANY=[@ANYBLOB="000fd2010000050fd20106ca1002fb1a56defec196f7ed3e610e13b72b866b1da4a4a25af28da77136ce81a0775f5879c7ee0526c3ea4f052a755df1399bf1c178c567d0c3346b06981343bedfa4365708f8fdfb73be1a59969ede3cf30abbf7d74e755d92ec4386cf6da1287d4c177529a70cdbb46a1c5e38e5daa85ef28a40bcbbc4d808bac5aaed83367542c856a8497c909eda6134d2f7b3e6be31417de2ecc6dc51ad4f3ffd20bd76303feb77361e383aa9952154d543d17d12735ed7330e7fd04d7a67e94107eb69e0f37799b28f09ba255303100bc41003bb45cb7635ea5a77120dbe2fcf4b4b710a087002a25f0984cd31165c53aea2cd735dab2b89de6de9508b8e7dd94e01637615ea5acdec66e049f0d63300479168f8d4f8299fc16c36cc18633b8ba36a9c7576606d49b6bd8eb600a9589725e203310332864331590bdebff285d46334f617cf8c7937b09b70c8062683e2329d54febebe3746a733aec5655ad7c1912df217f0131d994d73f9ba1f8d1fa509a357fbab696d6349d555693d1f3ab5986b82d86b07c0b00309ded28dfbbf42527de854071002325900001410048140f4facf99a3dfee26f7eb15cf8142b821100b46853c821207beef7306f2def7315c2d49a7525c3c87aef9ca274c241ec2"], &(0x7f0000000640)={0x20, 0x29, 0xf, {0xf, 0x29, 0x8, 0x0, 0xc0, 0x1, "55c46140", 'cTO@'}}, &(0x7f0000000680)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x1, 0x81, 0x4, 0x9, 0x0, 0x6, 0x9}}}, &(0x7f0000000b40)={0x84, &(0x7f0000000700)={0x20, 0x14, 0x51, "bcecd04f2d8a1213662374ea22552adbeedfacfd2b6479ae80996e549dbdf9dd9e21ed27746d8fec18980fbc94b6788cda1b6af0ed0ec01c69fbd1c39a6f942733245a93b37d2bef345d6350316e907437"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x1}, &(0x7f00000007c0)={0x0, 0x8, 0x1, 0x9}, &(0x7f0000000800)={0x20, 0x0, 0x4, {0x2, 0x2}}, &(0x7f0000000840)=ANY=[@ANYBLOB='Q]\x00'/14], &(0x7f0000000880)={0x40, 0x7, 0x2, 0xeb2b}, &(0x7f00000008c0)={0x40, 0x9, 0x1, 0x81}, &(0x7f0000000900)={0x40, 0xb, 0x2, "a698"}, &(0x7f0000000940)={0x40, 0xf, 0x2, 0x7}, &(0x7f0000000980)={0x40, 0x13, 0x6, @random="8a3e2319d95c"}, &(0x7f00000009c0)={0x40, 0x17, 0x6, @local}, &(0x7f0000000a00)={0x40, 0x19, 0x2, "f8e1"}, &(0x7f0000000a40)={0x40, 0x1a, 0x2, 0x4}, &(0x7f0000000a80)={0x40, 0x1c, 0x1, 0xfd}, &(0x7f0000000ac0)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000b00)={0x40, 0x21, 0x1, 0x2}}) r4 = socket$inet6(0xa, 0x3, 0x3) connect$inet6(r4, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000340)={{{@in6=@loopback, @in=@loopback, 0x4f23, 0xfffc, 0x4e1f, 0x6, 0xa, 0x2a11bad3d5f03f04, 0x30}, {0x100000000, 0x2, 0xfffffffffffffffe, 0x0, 0xffffffffffffffff, 0x6, 0x8, 0x800000000001}, {0x9, 0xfffffffffffffffe, 0x4, 0x9}, 0xd8, 0x0, 0x1, 0x0, 0x0, 0x3}, {{@in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x210000, 0x33}, 0x0, @in=@remote, 0xffffffff, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffb}}, 0xe8) sendmmsg(r4, &(0x7f0000000480), 0x2e9, 0xffe0) 9.241838222s ago: executing program 1 (id=85): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x208002, 0x0) fsopen(0x0, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000002c80), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000140)={0x7, 0x1, 0x2}) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000000)={0x2, @meta={0x3854454d, 0x4b6a643f, 0x81ee, 0x4301, 0x487a6f19}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x10008001, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000"], 0x64}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007"], 0x138}}, 0x4) setitimer(0x2, 0x0, &(0x7f00000001c0)) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="d4000000000101040000000000000000020000002400018014000180080001007f00000108000200ac1414000c0002800500010000000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000030000080008400000000a0400164008001540000000030400170058000d"], 0xd4}}, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000680)='\x87^\xe9y\x105\xf3\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xea\x9e\xd2iE\xac\xb4\xf1\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9Vs\x8c\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xdd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0', 0x7) ftruncate(r5, 0xffff) 8.42300361s ago: executing program 32 (id=85): openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x208002, 0x0) fsopen(0x0, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000002c80), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000140)={0x7, 0x1, 0x2}) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000000)={0x2, @meta={0x3854454d, 0x4b6a643f, 0x81ee, 0x4301, 0x487a6f19}}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x10008001, 0x0, 0x9, 0xfffffffffffffffd, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000"], 0x64}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001300)=ANY=[@ANYBLOB="38010000000101040000000000000000020000002c0001801400018008000100ac14143208000200ac1414000c00028005000100000000000600034000020000240002801400018008000100e000000108000200e00000010c0002800500010000000000080007"], 0x138}}, 0x4) setitimer(0x2, 0x0, &(0x7f00000001c0)) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB="d4000000000101040000000000000000020000002400018014000180080001007f00000108000200ac1414000c0002800500010000000000240002801400018008000100e000000108000200e00000010c00028005000100000000000800074000030000080008400000000a0400164008001540000000030400170058000d"], 0xd4}}, 0x0) openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000680)='\x87^\xe9y\x105\xf3\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa24\xa9am\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xea\x9e\xd2iE\xac\xb4\xf1\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sW\x1b\xb7\xb3\xa2\xc9&@\xca\xda\xdc\xe2/\x97X\xac\b\xb0\xc2<\x80E\x1a\xbc\xc7W\xda9Vs\x8c\xaf\xc6\x90i\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\xb0\xa8\x9eo\xebF(\x9dL\x01vRk\xaacB\x04\xa7I\v\x86EZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xdd\xec\xcc\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16\x05\x00\x00\x00\x00\x00\x00\x00\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x83fC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03\x05Np\xda\"\xf1\xb6\xbcP\x8fP\x8d\x89%\xf2\x12T\xd0\xc3\x15W\x9c\x87\x1b\x8c\xc9\xd9\xc6\xad\x96-d\xa2wFB\xcaB\xa5\x15\xf8,\x04\x1c*\xd98\x8bG\x90\x81`\x03\xe0\xde\x9c\x9a\x0f\x1b\x8f\xd2%*&$Wc\xb3\xa6\xc4TK1}2\xb3\xab\xf4\xb7\xb7\x85\apa\xaf\x1c\x10i\xb9\x9f\x06\xff4%\"7f \x0e\xf5Bk\r\xac\"\x13tNx\xc0', 0x7) ftruncate(r5, 0xffff) 8.402889866s ago: executing program 3 (id=87): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="480000001000010400000000000000000000000a", @ANYRES32=0x0, @ANYBLOB="7b13000000000000200012800b00010067656e657665000010000280060005004e2000000400060008000a00b5"], 0x48}}, 0x4000) 7.939466769s ago: executing program 4 (id=91): r0 = socket$inet6_sctp(0xa, 0x801, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r0, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x1}, 0x8) sendto$inet6(r0, &(0x7f0000000140)="f4", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e21, 0x0, @rand_addr=' \x01\x00'}, 0x1c) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7c, &(0x7f0000000200)={0x0, 0x9, 0x2ce8}, 0x8) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000100)={0x2, 0x4e24, @multicast2}, 0x10) sendmmsg$inet(r1, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) r2 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transactions\x00', 0x0, 0x0) preadv2(r2, &(0x7f0000000b00)=[{&(0x7f0000000640)=""/106, 0x6a}], 0x1, 0x4, 0x3ff, 0x0) bind$qrtr(r2, &(0x7f00000000c0)={0x2a, 0x3, 0xfffffffe}, 0xc) setsockopt$inet_tcp_TLS_TX(r1, 0x6, 0x17, &(0x7f0000000080)=@gcm_128={{}, "9005451377480361", "bbad434d19477339418b5b79f10c141a", "dc717b03", "72f2ea1a3290afcc"}, 0x28) r3 = landlock_create_ruleset(&(0x7f0000000040)={0x62, 0x2, 0x2}, 0x18, 0x2) landlock_restrict_self(r3, 0x2) 7.737812701s ago: executing program 3 (id=92): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev}, 0x2}}, 0x2e) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8004, 0x0, 0x9, 0xda, 0x2, 0xfa11, 0xffbffffb}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000280), r5) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x1c, r6, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0xffffffff}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4001}, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) ioctl$USBDEVFS_CONTROL(r7, 0xc0185500, &(0x7f0000000040)={0x40, 0x17, 0x4, 0x4, 0xecff, 0x5ff2, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/power/pm_async', 0xa82, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f0000000940)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) unshare(0x20000400) bind$unix(0xffffffffffffffff, 0x0, 0x0) add_key$keyring(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) listen(0xffffffffffffffff, 0x8) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e23, 0xc, @empty, 0x7}, 0x2f) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000580)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002cbd70000400000005000000080009000200000008000c00a80a0000060001000500000008000b"], 0x48}}, 0x20000084) 7.510735469s ago: executing program 4 (id=94): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000500)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet6(0x10, 0x3, 0x5) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r2, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000001c00)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000140)="a75668ff8a5d6b53", 0x8}], 0x1}}], 0x1, 0x20000080) shutdown(r3, 0x1) connect$inet6(r2, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@delqdisc={0x1b4, 0x25, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0xf}, {0x10, 0x4}, {0x10, 0x1}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1ff}, @TCA_STAB={0x80, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0xd, 0x6, 0x0, 0x7, 0x1, 0x9, 0x9e5, 0x4}}, {0xc, 0x2, [0x0, 0x2, 0x81, 0x7800]}}, {{0x1c, 0x1, {0x9, 0x7, 0x9, 0xfffffffd, 0x2, 0x8001, 0x7ff, 0x3}}, {0xa, 0x2, [0x0, 0xc, 0x87a]}}, {{0x1c, 0x1, {0x5, 0x5, 0x101, 0x2, 0x2, 0x0, 0x5, 0x6}}, {0x10, 0x2, [0x7f, 0x8000, 0x0, 0x8, 0xffff, 0x2f]}}]}, @TCA_STAB={0x4}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x5}, @qdisc_kind_options=@q_cake={{0x9}, {0x50, 0x2, [@TCA_CAKE_WASH={0x8}, @TCA_CAKE_ATM={0x8, 0x4, 0x1}, @TCA_CAKE_TARGET={0x8, 0x8, 0x5}, @TCA_CAKE_BASE_RATE64={0xc, 0x2, 0x4}, @TCA_CAKE_MPU={0x8, 0xe, 0x3f}, @TCA_CAKE_RTT={0x8, 0x7, 0x5}, @TCA_CAKE_ATM={0x8}, @TCA_CAKE_NAT={0x8, 0xb, 0x1}, @TCA_CAKE_WASH={0x8}]}}, @TCA_STAB={0xa0, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x28, 0xd, 0x2, 0x7f, 0x0, 0x6, 0x81, 0x2}}, {0x8, 0x2, [0x1, 0xd382]}}, {{0x1c, 0x1, {0x4, 0x6, 0x7, 0x7b2c, 0x1, 0x8, 0x7, 0x2}}, {0x8, 0x2, [0x0, 0x4]}}, {{0x1c, 0x1, {0x8, 0x90, 0xe6eb, 0x4a1, 0x0, 0x5, 0x2, 0x6}}, {0x10, 0x2, [0x3a3, 0x5, 0x80, 0x1, 0x7, 0x7]}}, {{0x1c, 0x1, {0x8, 0x5, 0x4, 0x2, 0x1, 0x80000000, 0x0, 0x3}}, {0xa, 0x2, [0x0, 0xff, 0x3]}}]}]}, 0x1b4}, 0x1, 0x0, 0x0, 0xc801}, 0x8000) setsockopt$inet6_tcp_TCP_ULP(r2, 0x6, 0x1f, &(0x7f00000000c0), 0x4) r5 = openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000004002, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="780000001600010027bd7000ffdbdf250a3888ff", @ANYRES32, @ANYBLOB="080009000600000014000100000000000000000000000000000000013c0002"], 0x78}, 0x1, 0xba01, 0x0, 0x40041}, 0x4048) sendfile(r5, 0xffffffffffffffff, 0x0, 0x201f00) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r7, 0x40a85321, &(0x7f00000004c0)={{0x80}, 'port0\x00', 0x50, 0x180c75, 0x7, 0x104, 0x1ff, 0x0, 0x0, 0x0, 0x6}) r8 = syz_open_dev$vbi(&(0x7f00000002c0), 0x0, 0x2) preadv(r8, &(0x7f0000000680)=[{&(0x7f0000000400)=""/162, 0xa2}, {&(0x7f0000000580)=""/203, 0xcb}], 0x2, 0x80000001, 0x3) 5.095595579s ago: executing program 0 (id=97): r0 = add_key$user(&(0x7f0000002700), 0x0, 0x0, 0x0, 0xffffffffffffffff) r1 = request_key(&(0x7f0000000000)='pkcs7_test\x00', &(0x7f0000002a00)={'syz', 0x0}, 0x0, 0xfffffffffffffffe) keyctl$unlink(0x9, r0, r1) 4.818176672s ago: executing program 3 (id=98): r0 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x40d82, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000002500010125bd7000fdffffff550000000800030047"], 0x1c}, 0x1, 0x0, 0x0, 0x20004840}, 0x28000) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20004840}, 0x28000) close(r0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat(0xffffffffffffffff, &(0x7f00000000c0)='./file1\x00', 0x65f009c9400aa2fa, 0x1d6) r5 = socket$can_bcm(0x1d, 0x2, 0x2) r6 = socket$inet(0xa, 0x801, 0x84) connect$inet(r6, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r6, 0xfffffffd) r7 = accept4(r6, 0x0, 0x0, 0x0) ioctl$sock_inet_sctp_SIOCINQ(r7, 0x541b, &(0x7f0000000040)) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r5, &(0x7f00000000c0)={0x1d, r8}, 0x10) sendmsg$can_bcm(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)=ANY=[@ANYBLOB="01000040000400000000000001000000", @ANYRES64=0x0, @ANYRES64=0x2710, @ANYRES64=0x0, @ANYRES64=0x2710, @ANYBLOB="000000000100000004000040020300007b442856bfec870b"], 0x48}, 0x1, 0x0, 0x0, 0x4004040}, 0x0) sendmsg$can_bcm(r5, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="01000000020200001900000000000000", @ANYRES64=0x77359400, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001000000000000e0040100004c86b8b1f25c15177b42aca2c0aad4f497849aeccf6292df09e61802c800ed020800bd92670a8b4e55fb1e7a38b036969a9934506ea249ae80075b9ee589ccd366e8975cfcd195c885eef61f1b4da3dcfa5e23f9a100007fca389fb617d2a86bea7412"], 0x48}}, 0x40000) r9 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000180)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x38e38e38e38e6d9, [{{0x9, 0x2, 0x8b2433624728cd4b}}]}}, 0x0) r10 = socket$igmp6(0xa, 0x3, 0x2) listen(r10, 0x62b3) syz_usb_ep_write$ath9k_ep1(r9, 0x82, 0x580, &(0x7f0000000c80)=ANY=[@ANYBLOB="9300004e87d648f8cbb83b95fbf862312d5c7a4b5b9e712758ac45fe818c6e15424c62acc8541e8d079aff64ebd64b88cd0c2eedfaf37a28e99b0dae5b599f5da35fb4ac4a2d5c65a6db4fdc094b142117e77bf8809b59a8d7537b14b652f83e33a15a949bfed3c2920b854e75af62a7dab0bcb4ef8327fcdb8c24b2093b88a82e98b972108901b00d7a43071887059c1d7bfc4f8766465de44c004e"]) socket$rds(0x15, 0x5, 0x0) 4.793197695s ago: executing program 0 (id=100): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000800)=ANY=[@ANYBLOB="b8000000190001000000000000000000e00000020000000000000000000000000000000000000000000000000000000000000000000000000a0000008700", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000d9f6000000000000000000000000000000000200000000000000000000000000000000000000000000000500000000000000fbffffffffffffff000000000000000000000000000040000000000000000002000000"], 0xb8}, 0x1, 0x0, 0x0, 0x4000015}, 0x2c000010) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="c4000000190001000000000000004000e00000020000000000000000000000000000000000000000000000000200000000000000000000000a00000087000000", @ANYRES32=0x0, @ANYRES8], 0xc4}, 0x1, 0x0, 0x0, 0x40101}, 0x28048890) 4.700742198s ago: executing program 4 (id=101): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[@ANYBLOB="4800000010000104000000000000000000000011", @ANYRES32=0x0, @ANYBLOB="7b13000000000000200012800b00010067656e657665000010000280060005004e2000000400060008000a00b5"], 0x48}}, 0x4000) 4.578074679s ago: executing program 0 (id=102): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000940)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x2}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x400}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x8c}}, 0x0) syz_emit_ethernet(0x6a, &(0x7f0000000100)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x39}, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x3d, 0x5c, 0x64, 0x0, 0x4, 0x11, 0x0, @private=0xa010101, @multicast1}, {0x4e23, 0x4e22, 0x48, 0x0, @wg=@cookie={0x3, 0x0, "ad9d19e2d6cc6c40e5a7effb50d9cd03ae950ea24d34e3c7", "93f472fe42b31a88da3b514de88e68a15e012825d7c81fbb31c9e0049318d963"}}}}}}, 0x0) 4.565584934s ago: executing program 2 (id=103): socket$inet_smc(0x2b, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xc, 0x8041, 0x0, 0x5441, 0x0, 0xfffffe0000000001, 0x9, 0xf7ffffff}, 0x0) r2 = fsopen(&(0x7f0000000100)='cgroup\x00', 0x0) dup(r2) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f0000000580)={0x48, 0x2, r4, 0x0, 0x0, 0x0}) ioctl$IOMMU_HWPT_GET_DIRTY_BITMAP(r3, 0x3b8c, &(0x7f0000000780)={0x30, r5, 0x0, 0x0, 0x0, 0x84, 0xa9, 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x10) socket$alg(0x26, 0x5, 0x0) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000180)='status\x00') r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000300)=ANY=[@ANYBLOB], 0xb4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40000040) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) r9 = socket$inet6_udp(0xa, 0x2, 0x0) r10 = socket$netlink(0x10, 0x3, 0x4) bind$unix(0xffffffffffffffff, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) write(r10, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb00000000000000", 0x24) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000040)={'lo\x00'}) sendmsg$nl_route_sched(r6, 0x0, 0x884) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000400)=@filter={'filter\x00', 0x8000000, 0x4, 0x370, 0xffffffff, 0x1d0, 0x0, 0x1d0, 0xfeffffff, 0xffffffff, 0x2a0, 0x2a0, 0x2a0, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev={0xfe, 0x80, '\x00', 0x29}, @private2, [0xffffff00, 0xff000000, 0xff, 0xffffff00], [0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff], 'macvlan0\x00', 'sit0\x00', {}, {}, 0x87, 0x3, 0x4, 0x15}, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x6, {0x1}}}}, {{@uncond, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x3, 0x5, {0x2000010}}}}, {{@ipv6={@private2, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xffffff00, 0xff], [0x0, 0xffffff00, 0xf97f1f27bc0fd003, 0xff000000], 'bridge_slave_0\x00', 'ip6tnl0\x00', {}, {0xff}, 0x11, 0x80, 0x2, 0x6a}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28, 'NFQUEUE\x00', 0x0, {0xff}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x419) r11 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000140)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) close_range(r11, 0xffffffffffffffff, 0x0) 4.402370095s ago: executing program 0 (id=104): fcntl$lock(0xffffffffffffffff, 0x22, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x2}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket(0x2, 0x3, 0xf8) sendto$unix(r2, 0x0, 0xffffffffffffff84, 0x48850, &(0x7f0000000340)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r3, 0x29, 0x2e, &(0x7f0000000200)={0x6, {{0xa, 0x3, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0xfffd, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000400)=ANY=[], 0xb8}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$NFT_MSG_GETSETELEM(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002f40)=ANY=[@ANYBLOB="40000000210a010900000000000000000a0000010900020073797a31000000000900010073797a31"], 0x40}}, 0x8000) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff000000001d040000f0ff00007f040000000000005504000001ed0aff2400000017ffffffcc40000000000000730a00fe0000000077040000000000f1c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800d900000000caa964e4b7000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee633000000000000e5129722a6e1593a52ae80d4d800000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325a904514d8e90131bfc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f49e4dcc1b7af0b51b9cafeda067b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb860600911480a876fbba690200937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b30e55ac1275e938706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2053c3c280acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff0492df6b53002514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9f0284405e3127dde7e41285fbe0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd6d6ab7e0e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa250bc93b233a2291b5b10eebc49b6882f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119dcf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f018720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455bc3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000010000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e37a1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc8de9bac0006b98a8283eee5665f3aede28228e0468db"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x1e}, 0x48) r5 = syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x48042) writev(r5, 0x0, 0x0) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_tcp_buf(r7, 0x6, 0x8, &(0x7f0000000040)=""/4096, &(0x7f0000001040)=0x1000) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(0xffffffffffffffff, 0x84, 0x7, &(0x7f0000000040), &(0x7f0000000080)=0x4) write$vga_arbiter(r6, &(0x7f00000000c0), 0xf) setsockopt$IP6T_SO_SET_ADD_COUNTERS(0xffffffffffffffff, 0x29, 0x41, &(0x7f0000000380)={'raw\x00', 0x3, [{}, {}, {}]}, 0x58) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040), 0x0) 3.792845068s ago: executing program 4 (id=105): syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000080)={0x8, 0x6, &(0x7f0000000200)=ANY=[@ANYBLOB="1800008080b63428e900"/20, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x41000, 0xf72cb191e650caa, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_open_dev$loop(&(0x7f0000000280), 0xffff, 0x14f600) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) ioctl$VIDIOC_QBUF(0xffffffffffffffff, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x1, 0x0, {}, {0x0, 0xb846941ed94b4582, 0x0, 0x0, 0x0, 0xfe, "8200"}, 0x2000000, 0x2, {}, 0x20800}) write$binfmt_misc(r1, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x20, 0x80000000700, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000000001000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x0, 0x31]}}) 3.224732344s ago: executing program 4 (id=106): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000001140), 0x101000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) prctl$PR_MCE_KILL(0x21, 0x1, 0x2000000) prctl$PR_MCE_KILL_GET(0x22) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f0000000080)="d8df0f23b3b9ce000000b807000000ba000000000f301b8154fea900c1210680320000c4e28ddc8dcd00000066ba2100b81c540000efb950020000c74424009b000000c744240202000000c7442406000000000f011c24b9a60800000f00510066b87a000f02d86161300f300fc79d53bf0000c4b961edc30101220f01c3", 0x7e}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_SET_LAPIC(r3, 0x4400ae8f, &(0x7f00000001c0)={"04dfc86351907bcbc9293982262069af775bedfb0a63cb8031ecdc5351097e022d45a9640a4a4b506dc328f61ac030dacac442d82b9e81e6847961e65610b8f6e25f9eaf1a9f48ac011b67d68f871246c6424cd7837f6bfc47209662ba0d0f44149fcefbbf6fa5b40644bce6cf7210107f57b850d0c9af06c766af1c637aa057167a6910e2e185b8d972e49eeda481d9a58394ef43958ce7407e73d6460653fc672aa4ab6a26bd1a631fa3a0f2b025ba137b8e3f933af28e1ea9984bc0438ea00b5f5b16893a22bb83ff1c92407a946d4dc7d347d526db0e71bb38f873937ca7343fb7248867adf5decd52e74f05c768c3b1c8282b9b1b1bc0f7ae08917b2abe3d3305e32b8db562d19dd7c83fde6dbe03ef72aa7ddc00144895b2a1981105046a28ca0852521afbcd2b6cdb0bbed4670d746c45fb5589f279cfd594911cb11f2a7336af10b2332e731f2eec8287c735f2346449f1629fde95d6c78bed90645bb280e222976d5721ee6dd6068c1d6274d2382e524672a2656eed5cf34eff27c2974deebf2aa6226e3fa2f15ea8db5891a062d422607a450a32cfdfaaeadfb2498e79fe9e47089b2a8bbdbdcbb076ebbd9c8fdc6246c00a34176a1c46a924ab4c3877215e5666c7b384e9238b3ad6ac559d90e22170d6915c7150a1858eb3f20a1847642018840b49c335074496991fb3193914f5213846ff8bf5b389298d797dfdd4a1d116caec17f13152c9699caab72a96d364134266030e67ada0de8d2bb05091f7d855fe1c435574856b0f8de9dc6af14ce179e3c0b6b563ccb8e02900fa9412784b0e5fa71a6e4499fecd1343d289daeb929d0cbd96f9f4501bc9d6d9d0b4f462aaf2556ce92ae6438bb307aa258c8c4ba6646f99f5a3d4e14f677353722cc81a8ef1f68d41ad1bef785b248faee830613461239487bee1b53724eb28301420ced16a8110a8680c91c665f8eff65e2d48f95db7ad4f30d079a39a2286fb3df3472d330f6f11fc7d1939a923c50263b3e03140f7cec279df5785fa2124d1650563799defc378cb9506ee7142eb108b3f4125ade3d9a73646bddac795c753895b2ad51d358eff496d1c1a885c30b85b50eca89bf15ae50ae3301805f1691b3a391d7575c9a0a514710ad3e590491c60bdab122222c66cbb155452a01cb9750da7450900000000000000bf38c8185c769c1409eb0b1c613eac8101d6784c9510790dd1df8fa6f2b4dbdbde3bdcbf6bfc456f68b680f2595853178e89a32e9c56d66fd2210fb0fc0e3cda61e6980e16e47ae8071182af80950c43ba221fe072e6945107a6edcd38bfeb201a657969bf340960a67e30987e56c953a177404fdf67b5d99bbc06d705a0fc9659336b458ea0d575ddfe59706738d1e65c505272000000000000004000"}) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x80000) syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000680)=ANY=[@ANYRES8], 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_GET_HW_INFO(r4, 0x3b8a, &(0x7f0000000380)={0x28, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r0, 0x404c534a, &(0x7f0000001180)={0x4, 0x4dfe, 0xfffffffc}) 1.875632258s ago: executing program 2 (id=107): r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000880)=ANY=[@ANYBLOB="e4010000100001000000000000000000fc420000000000000000000000000000000000000000000000000020000000000000ecdf000000000a00000000000000", @ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="ffffffff0000000000000000000000000000000032000000fc01000000000000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000fcffffffffffffff0000000000000000ffffffffffffffffc73b0000000000000000000000000000000000800000000000000000000000000000000000000000ffffffff2dbd700000000000020004004c000000000000001c001700000000002abd700000000000000000000000000000000000480002006362632873657270656e742900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008d001400686d61632873686132353629000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000802000080000000aef356316f6f7d6ab0f8637b42ff0300008aa309bdd3f9dcffb669556b74c61e032441fd13571c4c64597441f3cf2a548c89a004673b82b4618529a52c676f7c94000000"], 0x1e4}}, 0x44840) 1.59257001s ago: executing program 0 (id=108): sendmsg$IPCTNL_MSG_TIMEOUT_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="3400000000080102000000000004000000000000000001008d"], 0x34}, 0x1, 0x0, 0x0, 0x4000011}, 0x4c000) (async) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000040)="89000000120081ae08060cdc030ec0007f03e3f700000001", 0x18}], 0x1}, 0x0) (async) syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000040201, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc3400000000001090224"], 0x0) syz_usb_disconnect(r1) syz_emit_ethernet(0x0, 0x0, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) (async) rt_sigprocmask(0x2, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x3, 0x36, 0x0, 0x0) r2 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) (async, rerun: 64) syz_open_procfs(0x0, 0x0) (rerun: 64) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000500)={0x0, 0xfffffffffffffd83, 0xfa00, {0x0, 0x0}}, 0xfdbc) (async) syz_emit_ethernet(0x3a, 0x0, 0x0) (async) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r2, 0xc0884123, &(0x7f0000000240)={0x2, "a0aa7bd2dba0443bbf6b32eba76abf26745358a4700e66a4cf216d8af69b684bfa988d9101a3380f944322cf2c601a94e9c289a2bfebbdccf43f84c91330c6e9", {0x40, 0x6}}) (async, rerun: 32) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f00000008c0)={0x6, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000100000000a500000000000018490000fe"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x19, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xa7e3}, 0x94) (rerun: 32) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x2e0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x60000000, 0x12, 0x0, &(0x7f0000000040)="ded6e0966ec1cf6ba4b897a54e4e062b3114", 0x0, 0x0, 0x3}, 0x50) (async) write$cgroup_subtree(r3, &(0x7f0000000040)=ANY=[@ANYBLOB="93430000520033d087277b9b108b4ab51c"], 0xfe33) (async) r4 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000040)=ANY=[@ANYBLOB="33fe000018"], 0xfe33) (async) r5 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="120100003a982a08cd0ca310a223010203010902120001000000000904"], 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000880)={0x44, &(0x7f00000004c0)={0x40, 0x8, 0x6, "a61623bea283"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_emit_ethernet(0x5a, &(0x7f0000000180)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "4dd318", 0x24, 0x6, 0xff, @private1={0xfc, 0x1, '\x00', 0x2}, @private1, {[@fragment={0x3c, 0x0, 0x1, 0x0, 0x0, 0x3, 0x65}], {{0x0, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x1, 0x4, 0x0, 0x0, {[@eol, @generic={0x22, 0x6, "963b4794"}]}}}}}}}}, 0x0) (async, rerun: 64) syz_usb_control_io$cdc_ncm(r5, 0x0, 0x0) (async, rerun: 64) r6 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x50, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f0000000440)={0x0, @meta={0x4131434d, 0x5f5ff597, 0x4a8a, 0x7187, 0x5400cba6}}) syz_usb_connect$cdc_ncm(0x4, 0xb6, &(0x7f0000000500)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x10, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xa4, 0x2, 0x1, 0x9, 0xd0, 0x9, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x8, 0x24, 0x6, 0x0, 0x1, "3edda4"}, {0x5, 0x24, 0x0, 0x80}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0x3, 0x4, 0x4}, {0x6, 0x24, 0x1a, 0x1, 0xd}, [@mdlm={0x15, 0x24, 0x12, 0xc}, @mdlm={0x15, 0x24, 0x12, 0xc}, @mbim_extended={0x8, 0x24, 0x1c, 0x8, 0xe5, 0x5}, @call_mgmt={0x5, 0x24, 0x1, 0x3, 0x6}, @dmm={0x7, 0x24, 0x14, 0xc2b5, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0xff, 0x6, 0xf, 0x2}]}, {{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0xa, 0x2}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x200, 0x0, 0x9, 0x6}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x4, 0xf8, 0x9}}}}}}}]}}, &(0x7f0000000d80)={0xa, &(0x7f00000005c0)={0xa, 0x6, 0x201, 0xa4, 0x7, 0xa, 0x20, 0x7}, 0x175, &(0x7f0000000600)={0x5, 0xf, 0x175, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x7f, 0x22, 0x8}, @generic={0x6e, 0x10, 0x3, "1e0b32856faab1f4df07cb1734eba1a546e29aaf9d8258796bca15437326dbd2f6ef5f62802b36b513499a3d98dd78a11aed55cf04a1702012834d6e702850c34a8b2acf5bb4cfd31fba0a504b99b211d184cbf194749829f2abe6cc811a76d0d165560b6ad1a787848654"}, @wireless={0xb, 0x10, 0x1, 0x6b55bc2d4e2395a9, 0x6c, 0xc0, 0x4, 0x404b, 0x4}, @generic={0xd9, 0x10, 0x3, "2db70ec576c402ae94d74b809fd38bd0bdf2f5dc091a7c94ebdda51bf3d65bb108b19353476092ed5141741fba84c0723efb23dd8e4adec9768005ca2cf1f32cdec54ff2242ea263a2b4e022342325cac0b959735be77d03fff806819431bea0a21fca9e1109ce49482b0094d5bda66b2711891deab1e389d3b3a9a8bafe44052646025cedbead3605506810066a86398d22d6eb05d793c8a492eec34974b8235c2589635975f63524ca95cd42a25ec1f85725898a0d98a91d397f9fdc40a72ba5518ea07ed051fb47690578260494917ba6eab2776f"}, @ss_container_id={0x14, 0x10, 0x4, 0x7, "54f7b0a033057fd5a46903ad9e950cb3"}]}, 0x6, [{0x99, &(0x7f0000000780)=@string={0x99, 0x3, "90ad9cf3cdb286f19df0e15ba290da85574ae656085532b2506393e42605ec458819a6ba871bae8fec1fb1acbecb1be27c9781847430e0a54d5be5e9b50354fbc059bf6cba4507a19fe4c39d428654221493aac85d51d88a26c7d8f6387838f899f4aedb02b36f0ccf276b394a3b749fbef3cc2b69c469bdf3b85b05254e2b280fec55aa6d7852b7629facd82b7cc0ffa19c4c92f64224"}}, {0xe4, &(0x7f0000000a00)=@string={0xe4, 0x3, "64b71aaba04028780baeda83b03c5f55a9a1cc77104ff57a805c2bcca9a7e8fa4267570ed30326ea152c95ac012e430408daf1d5260d661114e74fc213021b7a2195b0f020aa07070f91034211047d36ab69fbb9b719e0d4eef3177273fa0718413cca026133a47888beb8eee1a5658638be6b493a0545c5e678985273b766b12c07e7e5f029f16eda8eaa3b027d5b44f0b422433af4a4154d16fc9c836cd39d71f6b863866ba8a209a5c681534484c588e7b718b91cd53fe56ce243098581fe1e6264c1d62eb0e0d4153c6a82840b05ad473daebc9ba342b24e330fdf5af7282c3f"}}, {0xfa, &(0x7f0000000b00)=@string={0xfa, 0x3, "b7080fe05c934f6a63b6b9a17388a1d9a6ebe2970c3c2312ebd34f594e498066c212fc0d51248a1ff23cb4a93ed943a3ca2decd00ea7d5071f0f0315285e8d52f57286debffd68478a1a0c066918a14c6e1615c06b6aa7996a1591f7db860a9639c5be8f0ac1570841c124f19eaecde00d5777a209ad973e0a58815401914ae18567dcb661e62c1d643dcaa023775769c9421d8bfa903f675ddd5e48f556d3ae62ff651875921be30b02bba765b6412439d8e007d040970fd7ebdb669ab2efd013df501ace53d763833da4fc38392bd5ac50a83bd234c8abbe64df8d48c55510a3f16c5e7f33eae0238ff9e7bc0bbd84b83507c78cce1569"}}, {0x4, &(0x7f0000000c00)=@lang_id={0x4, 0x3, 0x460}}, {0x4, &(0x7f0000000c40)=@lang_id={0x4, 0x3, 0xc07}}, {0xdb, &(0x7f0000000c80)=@string={0xdb, 0x3, "e9b52db778381f660ab462cc470d94ecf38437f100c0547228716ee2f448c314eb873418fc80586a74ad4233871ea67e9cf89f36130f515b84a3d31c2ab9bcb9db43d178586d6cd8453415566d4bbae668cd230b167fc5e7d6919877d29d8d7ce9f026fdd5ce6df8dbcf92ded646ecbb31fb52460dede8ab25f9645086c461e292a86008cf265fcc95d973279d427ef5d8ca8c29d4446f38ce336f02bce5c34a4e282b78ae9505a1b3abc80fbd4833cadb2218d5bdcdbb40e7951eb393c4bf06f7c38ec85befa5c008a75d6bdda35d6a08961c789a4ee37cd0"}}]}) (async) syz_usb_control_io$uac1(r5, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$uac2(r5, &(0x7f00000003c0)={0x14, &(0x7f0000000e00)={0x0, 0x30, 0x94, {0x94, 0x30, "e72dddc8bb6b79a2415afc618c012e78acadaba8ffbddec9a2ae6b08723c3dc0061e236e7fa286f300ce368dbc72fedfb6d6e9489c92d41dd8505509b924012ea0a8226aded6c9d0f4b2acd8f92d3c3b9173025d0ea4e2c2cb9938d620e2bc23267ab8bcb63014379c7d7509461d0152144124db18dd95af8a893b15b11cc70a21a21aa9d581a173d88b40a2284e2dfdebc0"}}, &(0x7f0000000ec0)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2801}}}, &(0x7f0000001200)={0x44, &(0x7f0000001280)={0x20, 0x3, 0xbb, "3e590030a9ba7999f6aa81da58e98380f0572992515a96f0caa0ab6ce5d0b014c8263d95e9266895192b9cbc59aabae6bf2d70602b1eb5d5a7e67bf502275cdff82b41c4c57f9bfc6e1b5c34fe52ed1aa59ec8d3dc95190a35043f4eb083611a0146364ec890b78b7e59f35c285039f0856c1ca9e5e4d3d46a2e71dd81a0d01dfaa29f9466e9c48f45775f5f4e69789c968ed89d93f405204b0a25a0dd241f22560cc92d6eeace34012731d2d2da6a00e43083b3071798cda1c9ac"}, &(0x7f0000001040)={0x0, 0xa, 0x1, 0xf0}, &(0x7f0000001080)={0x0, 0x8, 0x1, 0x7}, &(0x7f00000010c0)={0x20, 0x81, 0x1, "05"}, &(0x7f0000001100)={0x20, 0x82, 0xffffffffffffff4d, '\x00'}, &(0x7f0000001140)={0x20, 0x83, 0x2, "61a1"}, &(0x7f0000000300)=ANY=[@ANYBLOB="208403000000531122be51ede832f9253031dcdd85d2a7bf2cdd9efc744c37fa39ad2df7fbbe451c6179e1458bc349d452bcf8539dbe46822cfba04e30f97533c83b80bfb86984607600831f4652739beb52623e00e0626686402ed5422dcb6c7b247c4b8550b6eaf0ab29964574c40651c27732d43608faf93a1f017772c85cb4f4df866201"], &(0x7f00000011c0)={0x20, 0x85, 0x3, "e54d30"}}) (async, rerun: 32) syz_usb_control_io$printer(r5, 0x0, 0x0) 1.426718029s ago: executing program 2 (id=109): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="680000001000010029bd7000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="4db20200201a0100140003006e657464657673696d3000000000000034001680300001802c000c8028000100ff03005fcc60ce44271455ffa24700fb0600"], 0x68}, 0x1, 0x0, 0x0, 0xc1}, 0x0) 1.244319185s ago: executing program 3 (id=110): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000580)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r3 = openat$qat_adf_ctl(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) ioctl$IOCTL_STATUS_ACCEL_DEV(r3, 0x40046103, &(0x7f0000000300)={0x0, 0x6, 0xfffffff9, 0x9, 0x5, 0x1, 0xf7, 0x7f, 0x3, 0x1, 0x5, "f7d9d17d2756a832754d2db7a81004bd6b122e1a46766bc2f771d8be1f6c41e1"}) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x19) r4 = syz_open_procfs(0x0, &(0x7f00000007c0)='clear_refs\x00') r5 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r5, 0x0, &(0x7f00000010c0)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io$uac2(r5, 0x0, &(0x7f0000000640)={0x44, &(0x7f0000000380)={0x20, 0x14, 0x49, "85ae18e1405feb2ba94153b76a25b8133680a521391e102cc7c4a49128c0e8eb4b0721395effbc7d086c37a6e0a102b8e7a88a0262c532cb9420fcce15bb513b5fc7d4d69a78e86edd"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) writev(r4, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f000068b000/0x4000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000068c000/0xc000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r6 = io_uring_setup(0x185d, &(0x7f0000000040)={0x0, 0xc8a1, 0xc450, 0x1, 0x3cc}) openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) mprotect(&(0x7f0000158000/0x4000)=nil, 0x4000, 0x5) r7 = syz_open_dev$dri(&(0x7f0000000040), 0x0, 0x0) ioctl$DRM_IOCTL_DROP_MASTER(r7, 0x4610) syz_open_dev$video4linux(&(0x7f0000000000), 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="16"], 0x50) r8 = syz_usb_connect_ath9k(0x3, 0x5a, &(0x7f0000000200)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0xcf3, 0x9271, 0x108, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x48}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r8, 0x82, 0x1d0, &(0x7f0000000280)=ANY=[@ANYBLOB="2400004e6be8f0b6ee2420bf926f6af7edbb052ef8dd8f9221b900585564babc748c4fbea31865b89200004e"]) io_uring_enter(r6, 0x2219, 0x7721, 0x16, 0x0, 0x900) 1.083768663s ago: executing program 2 (id=111): r0 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/raw6\x00') read$sequencer(r0, &(0x7f0000000180)=""/186, 0xba) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) (async) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r3, 0x0, 0x6, 0x0) ioctl$AUTOFS_IOC_CATATONIC(r1, 0x9362, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) ioctl$BTRFS_IOC_SET_RECEIVED_SUBVOL(0xffffffffffffffff, 0xc0c89425, &(0x7f00000002c0)={"6b2f3b6a399bc2f1af59106a2a1667f8", 0x0, 0x0, {0x9, 0x9d5f}, {0x85, 0x40}, 0x8000000000ffff, [0xffffffffffffffff, 0x8e9, 0xc, 0x1d, 0x43, 0xfffffffffffffffb, 0x28, 0x1, 0x34e0000, 0x7fffffffffffffff, 0xa, 0x5, 0x6, 0x8, 0x7, 0x4]}) (async) write$cgroup_subtree(r4, &(0x7f0000000280)=ANY=[], 0x10448) (async) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r4, 0x0) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) (async) prctl$PR_SET_IO_FLUSHER(0x4c, 0x2) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'virt_wifi0\x00'}) connect$unix(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) setsockopt$sock_linger(0xffffffffffffffff, 0x1, 0xd, &(0x7f0000000040)={0x1, 0x1}, 0x8) (async) unshare(0x22020600) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) (async) open(&(0x7f0000000280)='./file0\x00', 0x2a002, 0x32) (async) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) (async) r6 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$ARPT_SO_SET_ADD_COUNTERS(r6, 0x0, 0x60, 0x0, 0x0) r7 = syz_clone(0x94071000, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r7) (async) ptrace$setregs(0xf, r7, 0x41007, 0xfffffffffffffffe) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) (async) bind$inet6(0xffffffffffffffff, 0x0, 0x0) (async) r8 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r8, 0x0, 0x0) 718.421893ms ago: executing program 2 (id=112): syz_emit_ethernet(0xd6, &(0x7f0000000680)={@local, @broadcast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xc8, 0x0, 0x0, 0x0, 0x1, 0x0, @remote, @local}, @time_exceeded={0xb, 0x0, 0x0, 0x3, 0x2c, 0x0, {0x2b, 0x4, 0x0, 0x0, 0x0, 0x64, 0x0, 0x0, 0x89, 0x0, @private=0x2, @dev={0xac, 0x14, 0x14, 0x3d}, {[@cipso={0x86, 0x2a, 0x0, [{0x0, 0xd, "5e000000ff000000000000"}, {0x5, 0x5, "4eb8a6"}, {0x0, 0x12, "9606053d0006ff00800000b61af93a93"}]}, @lsrr={0x83, 0xf, 0xfc, [@dev={0xac, 0x14, 0x14, 0x20}, @broadcast, @rand_addr=0x64010100]}, @cipso={0x86, 0x48, 0x3, [{0x7, 0x7, "4b6cefc500"}, {0x0, 0xc, "df61168c24ac88ad078c"}, {0x7, 0xa, "2189ea43a2149b84"}, {0x6, 0xb, "f7d11634eea26b75af"}, {0x0, 0x9, "02a20948fd7406"}, {0x0, 0x11, "ccf0294e2a3bdb4aa40b249e8e0c1a"}]}, @timestamp={0x44, 0x14, 0x56, 0x0, 0x0, [0x20, 0x0, 0x8, 0x0]}]}}}}}}}, 0x0) 621.469186ms ago: executing program 2 (id=113): socket$packet(0x11, 0x2, 0x300) r0 = syz_open_dev$usbmon(&(0x7f0000000040), 0x9, 0x800) read(r0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) r1 = syz_open_dev$dvb_demux(&(0x7f00000002c0), 0x1, 0x0) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000000200)={0x7, {"9db867d09ed91aa9c5c29f2f1e4be6bf", "cc6c2d12e0353c0e42899a29fdefe3bc", "9defe9f49655f386b84e6bb715dac54f"}, 0x445, 0x7}) socket$packet(0x11, 0x2, 0x300) (async) syz_open_dev$usbmon(&(0x7f0000000040), 0x9, 0x800) (async) read(r0, 0x0, 0x0) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) syz_usb_connect(0x3, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000cc1ef420890b070064ef000000010902120001000000000904"], 0x0) (async) syz_open_dev$dvb_demux(&(0x7f00000002c0), 0x1, 0x0) (async) ioctl$DVB_DEMUX_DMX_SET_FILTER(r1, 0x403c6f2b, &(0x7f0000000200)={0x7, {"9db867d09ed91aa9c5c29f2f1e4be6bf", "cc6c2d12e0353c0e42899a29fdefe3bc", "9defe9f49655f386b84e6bb715dac54f"}, 0x445, 0x7}) (async) 236.737981ms ago: executing program 0 (id=114): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CURSOR(r0, 0xc01c64a3, &(0x7f0000000040)={0x3, 0x0, 0x1, 0x80000001, 0xb, 0x1fd, 0x1}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000003e0007012bbd700000000000027c00000400fc800f0001806d14314965356ee88bd2"], 0x30}, 0x1, 0x0, 0x0, 0xc000}, 0xc040) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'bridge_slave_1\x00', 0x0}) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f7", 0x1}], 0x1}], 0x1, 0x40800) socket$packet(0x11, 0x3, 0x300) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, 0x0) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) readv(r4, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4c0000001000010025bd7000fddbdf2500000000", @ANYRES32=r3, @ANYBLOB="10080400895504002c001280110001006272696467655f736c6176650000000014000580050028"], 0x4c}, 0x1, 0x0, 0x0, 0x200404c1}, 0x4040010) r6 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./cgroup.cpu/cgroup.procs\x00', 0x2, 0x0) read$watch_queue(r6, &(0x7f0000000540)=""/4096, 0x1000) read$FUSE(r6, &(0x7f0000000240)={0x2020}, 0x2020) 0s ago: executing program 4 (id=115): r0 = openat$kvm(0xffffff9c, &(0x7f0000000140), 0x800, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000080), 0x2001, 0x0) pwritev(r3, &(0x7f00000002c0)=[{0x0}, {&(0x7f0000000000)='0', 0x1}], 0x2, 0x300, 0x20009) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) openat$kvm(0xffffff9c, 0x0, 0x800, 0x0) r4 = userfaultfd(0x80001) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f0000000140)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19) r5 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r5, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/59, 0x392000, 0x800, 0x0, 0x5}, 0x1c) ioctl$UFFDIO_COPY(r4, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000, 0x0, 0x40000000}) r6 = socket$netlink(0x10, 0x3, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) sendmmsg(r7, &(0x7f0000001c00), 0x400000000000159, 0x40840) write(r6, &(0x7f00000000c0)="29000000140005b7ff000051915f95eb01010003a606a40e07fff024bb000000000000000040000d00", 0x29) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@textreal={0x8, &(0x7f0000000000)="0f79ab8c00ba200066b80000000066ef0f09660f38de16004026f0f650d1f3abcfdeef0f01c467670f01cb", 0x2b}], 0x1, 0x68, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.128' (ED25519) to the list of known hosts. [ 80.862171][ T5811] cgroup: Unknown subsys name 'net' [ 81.009633][ T5811] cgroup: Unknown subsys name 'cpuset' [ 81.019044][ T5811] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.579504][ T5811] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 84.789883][ T5832] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 84.799203][ T5832] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 84.811250][ T5832] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 84.818570][ T5833] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 84.827013][ T5833] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 84.827076][ T5832] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 84.838587][ T5833] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 84.847615][ T5832] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 84.850511][ T5833] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 84.859255][ T5832] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 84.866469][ T5833] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 84.876060][ T5832] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 84.881838][ T5833] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 84.887915][ T5832] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 84.892119][ T5833] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 84.904885][ T5833] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 84.912803][ T5833] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 84.921053][ T5833] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 84.928981][ T5836] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 84.933514][ T5833] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 84.954809][ T5836] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 84.955039][ T5833] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 84.969793][ T5836] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 84.992681][ T5836] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.001208][ T5836] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.563393][ T5839] chnl_net:caif_netlink_parms(): no params data found [ 85.688470][ T5843] chnl_net:caif_netlink_parms(): no params data found [ 85.800367][ T5839] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.808394][ T5839] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.816040][ T5839] bridge_slave_0: entered allmulticast mode [ 85.823526][ T5839] bridge_slave_0: entered promiscuous mode [ 85.876866][ T5839] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.884198][ T5839] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.892916][ T5839] bridge_slave_1: entered allmulticast mode [ 85.900905][ T5839] bridge_slave_1: entered promiscuous mode [ 85.917861][ T5845] chnl_net:caif_netlink_parms(): no params data found [ 85.999949][ T5839] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.018545][ T5839] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.072964][ T5846] chnl_net:caif_netlink_parms(): no params data found [ 86.140129][ T5847] chnl_net:caif_netlink_parms(): no params data found [ 86.152459][ T5843] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.160692][ T5843] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.168190][ T5843] bridge_slave_0: entered allmulticast mode [ 86.176108][ T5843] bridge_slave_0: entered promiscuous mode [ 86.192479][ T5839] team0: Port device team_slave_0 added [ 86.229407][ T5843] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.236652][ T5843] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.243909][ T5843] bridge_slave_1: entered allmulticast mode [ 86.251552][ T5843] bridge_slave_1: entered promiscuous mode [ 86.267499][ T5839] team0: Port device team_slave_1 added [ 86.386205][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.393223][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.420002][ T5839] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.448980][ T5843] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.458532][ T5845] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.466336][ T5845] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.474989][ T5845] bridge_slave_0: entered allmulticast mode [ 86.482401][ T5845] bridge_slave_0: entered promiscuous mode [ 86.490587][ T5839] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.497849][ T5839] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.524189][ T5839] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.556138][ T5843] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.565559][ T5845] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.572992][ T5845] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.580688][ T5845] bridge_slave_1: entered allmulticast mode [ 86.588317][ T5845] bridge_slave_1: entered promiscuous mode [ 86.669751][ T5843] team0: Port device team_slave_0 added [ 86.676791][ T5846] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.683948][ T5846] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.691377][ T5846] bridge_slave_0: entered allmulticast mode [ 86.699040][ T5846] bridge_slave_0: entered promiscuous mode [ 86.732449][ T5843] team0: Port device team_slave_1 added [ 86.749965][ T5846] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.757313][ T5846] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.764514][ T5846] bridge_slave_1: entered allmulticast mode [ 86.772420][ T5846] bridge_slave_1: entered promiscuous mode [ 86.780228][ T5847] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.787898][ T5847] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.795109][ T5847] bridge_slave_0: entered allmulticast mode [ 86.802930][ T5847] bridge_slave_0: entered promiscuous mode [ 86.814026][ T5845] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.883542][ T5847] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.891693][ T5847] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.900937][ T5847] bridge_slave_1: entered allmulticast mode [ 86.909530][ T5847] bridge_slave_1: entered promiscuous mode [ 86.936157][ T5845] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.961180][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 86.969378][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 86.995985][ T5843] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.017700][ T5839] hsr_slave_0: entered promiscuous mode [ 87.024861][ T5839] hsr_slave_1: entered promiscuous mode [ 87.057888][ T5836] Bluetooth: hci0: command tx timeout [ 87.058351][ T5833] Bluetooth: hci3: command tx timeout [ 87.064077][ T5836] Bluetooth: hci2: command tx timeout [ 87.072615][ T51] Bluetooth: hci1: command tx timeout [ 87.096276][ T5847] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.106606][ T5843] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.113597][ T5843] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.141442][ T51] Bluetooth: hci4: command tx timeout [ 87.147875][ T5843] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.162949][ T5846] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.201340][ T5847] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.228528][ T5846] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.295868][ T5845] team0: Port device team_slave_0 added [ 87.319832][ T5846] team0: Port device team_slave_0 added [ 87.329516][ T5846] team0: Port device team_slave_1 added [ 87.348458][ T5847] team0: Port device team_slave_0 added [ 87.356950][ T5845] team0: Port device team_slave_1 added [ 87.364558][ T5847] team0: Port device team_slave_1 added [ 87.458502][ T5843] hsr_slave_0: entered promiscuous mode [ 87.465153][ T5843] hsr_slave_1: entered promiscuous mode [ 87.472495][ T5843] debugfs: 'hsr0' already exists in 'hsr' [ 87.478874][ T5843] Cannot create hsr debugfs directory [ 87.507642][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.514667][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.541160][ T5846] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.567713][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.574757][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.601792][ T5845] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.614233][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.621481][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.647816][ T5847] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.659833][ T5846] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.666980][ T5846] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.693158][ T5846] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.730667][ T5845] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.738055][ T5845] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.764213][ T5845] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.790852][ T5847] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.797981][ T5847] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 87.824261][ T5847] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.004162][ T5846] hsr_slave_0: entered promiscuous mode [ 88.011315][ T5846] hsr_slave_1: entered promiscuous mode [ 88.018264][ T5846] debugfs: 'hsr0' already exists in 'hsr' [ 88.024017][ T5846] Cannot create hsr debugfs directory [ 88.055362][ T5847] hsr_slave_0: entered promiscuous mode [ 88.064100][ T5847] hsr_slave_1: entered promiscuous mode [ 88.070804][ T5847] debugfs: 'hsr0' already exists in 'hsr' [ 88.076892][ T5847] Cannot create hsr debugfs directory [ 88.092287][ T5845] hsr_slave_0: entered promiscuous mode [ 88.100456][ T5845] hsr_slave_1: entered promiscuous mode [ 88.106916][ T5845] debugfs: 'hsr0' already exists in 'hsr' [ 88.112860][ T5845] Cannot create hsr debugfs directory [ 88.472855][ T5839] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 88.532586][ T5839] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 88.575526][ T5839] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 88.606451][ T5839] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 88.686787][ T5843] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 88.703134][ T5843] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 88.721520][ T5843] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 88.734256][ T5843] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 88.837650][ T5846] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 88.852509][ T5846] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 88.869145][ T5846] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 88.882579][ T5846] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.016319][ T5845] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.028512][ T5845] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.047188][ T5839] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.060172][ T5845] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.089512][ T5845] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.129076][ T5839] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.135908][ T51] Bluetooth: hci2: command tx timeout [ 89.141482][ T5827] Bluetooth: hci3: command tx timeout [ 89.141493][ T5833] Bluetooth: hci0: command tx timeout [ 89.150917][ T5836] Bluetooth: hci1: command tx timeout [ 89.164922][ T1151] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.172415][ T1151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.206122][ T1151] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.213332][ T1151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.220980][ T5836] Bluetooth: hci4: command tx timeout [ 89.260152][ T5847] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.300995][ T5847] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.322907][ T5843] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.332109][ T5847] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.343624][ T5847] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.408594][ T5846] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.439416][ T5839] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 89.463718][ T5843] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.494974][ T5846] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.524554][ T1151] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.531759][ T1151] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.560292][ T1151] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.567533][ T1151] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.585085][ T58] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.592251][ T58] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.619599][ T58] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.626905][ T58] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.675212][ T5845] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.720853][ T5839] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 89.760631][ T5845] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.786607][ T5847] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.805871][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.813080][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.852476][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.859723][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.876158][ T5847] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.912929][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.920167][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.932916][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.940108][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.991696][ T5839] veth0_vlan: entered promiscuous mode [ 90.011812][ T5846] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.031634][ T5839] veth1_vlan: entered promiscuous mode [ 90.046763][ T5843] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.153890][ T5845] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.194804][ T5846] veth0_vlan: entered promiscuous mode [ 90.218665][ T5839] veth0_macvtap: entered promiscuous mode [ 90.240645][ T5843] veth0_vlan: entered promiscuous mode [ 90.247726][ T5839] veth1_macvtap: entered promiscuous mode [ 90.265125][ T5846] veth1_vlan: entered promiscuous mode [ 90.294334][ T5843] veth1_vlan: entered promiscuous mode [ 90.307671][ T5847] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.338120][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.369500][ T5845] veth0_vlan: entered promiscuous mode [ 90.381140][ T5839] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.423796][ T58] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.434023][ T58] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.457023][ T58] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.466416][ T58] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.477076][ T5845] veth1_vlan: entered promiscuous mode [ 90.493112][ T5846] veth0_macvtap: entered promiscuous mode [ 90.507851][ T5846] veth1_macvtap: entered promiscuous mode [ 90.525839][ T5843] veth0_macvtap: entered promiscuous mode [ 90.562065][ T5847] veth0_vlan: entered promiscuous mode [ 90.568842][ T5843] veth1_macvtap: entered promiscuous mode [ 90.613882][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.624546][ T5847] veth1_vlan: entered promiscuous mode [ 90.639599][ T5846] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.693683][ T1151] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.706628][ T1151] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.724156][ T5845] veth0_macvtap: entered promiscuous mode [ 90.733770][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 90.748319][ T58] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.758032][ T58] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.783502][ T5843] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 90.791417][ T58] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.800724][ T58] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.832657][ T5845] veth1_macvtap: entered promiscuous mode [ 90.861493][ T58] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.871523][ T58] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.890134][ T5847] veth0_macvtap: entered promiscuous mode [ 90.903927][ T58] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.922951][ T1151] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 90.935177][ T1151] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 90.945337][ T5847] veth1_macvtap: entered promiscuous mode [ 90.955054][ T58] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.022317][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.037829][ T5845] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.093588][ T5839] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.121941][ T1111] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.135355][ T1111] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.157528][ T58] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.168110][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.181732][ T1151] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.190879][ T58] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.195032][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.208797][ T1151] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.222590][ T51] Bluetooth: hci2: command tx timeout [ 91.222603][ T5833] Bluetooth: hci3: command tx timeout [ 91.231382][ T5833] Bluetooth: hci0: command tx timeout [ 91.234895][ T5836] Bluetooth: hci1: command tx timeout [ 91.244730][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.293106][ T5847] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.296135][ T5836] Bluetooth: hci4: command tx timeout [ 91.373346][ T1151] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.387665][ T1151] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.405764][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.426634][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.440611][ T1151] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.452751][ T1151] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.474209][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.496986][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.543464][ T1111] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.566212][ T1111] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.580780][ T5906] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 91.722579][ T1111] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.742947][ T1111] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.770865][ T5906] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 91.790284][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.809093][ T5906] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 91.839955][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.849480][ T5906] usb 1-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 91.865720][ T5906] usb 1-1: New USB device strings: Mfr=2, Product=0, SerialNumber=0 [ 91.874051][ T5906] usb 1-1: Manufacturer: syz [ 91.918163][ T5906] usb 1-1: config 0 descriptor?? [ 91.956600][ T797] cfg80211: failed to load regulatory.db [ 91.969181][ T58] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.006698][ T5923] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 92.025695][ T58] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.167123][ T5928] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2'. [ 92.369938][ T5919] xt_hashlimit: size too large, truncated to 1048576 [ 92.733775][ T5937] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.766360][ T5938] FAULT_INJECTION: forcing a failure. [ 92.766360][ T5938] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 92.827329][ T5938] CPU: 1 UID: 0 PID: 5938 Comm: syz.2.7 Not tainted syzkaller #0 PREEMPT(full) [ 92.827359][ T5938] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 92.827381][ T5938] Call Trace: [ 92.827390][ T5938] [ 92.827409][ T5938] dump_stack_lvl+0xe8/0x150 [ 92.827457][ T5938] should_fail_ex+0x412/0x560 [ 92.827498][ T5938] _copy_from_user+0x2d/0xb0 [ 92.827527][ T5938] do_tcp_setsockopt+0x4f3/0x2060 [ 92.827552][ T5938] ? get_pid_task+0x20/0x1f0 [ 92.827578][ T5938] ? __pfx_do_tcp_setsockopt+0x10/0x10 [ 92.827600][ T5938] ? release_sock+0x2f/0x1f0 [ 92.827631][ T5938] ? mptcp_setsockopt+0x2db0/0x36a0 [ 92.827656][ T5938] ? mptcp_setsockopt+0x2db0/0x36a0 [ 92.827678][ T5938] ? __local_bh_enable_ip+0xd0/0x130 [ 92.827706][ T5938] ? tcp_setsockopt+0x3d/0xe0 [ 92.827725][ T5938] ? mptcp_setsockopt+0x2dba/0x36a0 [ 92.827749][ T5938] mptcp_setsockopt+0x2dd8/0x36a0 [ 92.827781][ T5938] ? __pfx_mptcp_setsockopt+0x10/0x10 [ 92.827807][ T5938] ? __pfx_aa_sk_perm+0x10/0x10 [ 92.827841][ T5938] ? __fget_files+0x2a/0x420 [ 92.827861][ T5938] ? aa_sock_opt_perm+0xff/0x1a0 [ 92.827883][ T5938] ? sock_common_setsockopt+0x36/0xc0 [ 92.827906][ T5938] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 92.827930][ T5938] do_sock_setsockopt+0x17c/0x1b0 [ 92.827963][ T5938] __x64_sys_setsockopt+0x13d/0x1b0 [ 92.827995][ T5938] do_syscall_64+0x14d/0xf80 [ 92.828023][ T5938] ? trace_irq_disable+0x3b/0x150 [ 92.828042][ T5938] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.828065][ T5938] ? clear_bhb_loop+0x40/0x90 [ 92.828092][ T5938] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 92.828115][ T5938] RIP: 0033:0x7fd32d59c819 [ 92.828140][ T5938] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 92.828157][ T5938] RSP: 002b:00007fd32e486028 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 92.828179][ T5938] RAX: ffffffffffffffda RBX: 00007fd32d815fa0 RCX: 00007fd32d59c819 [ 92.828195][ T5938] RDX: 0000000000000017 RSI: 0000000000000006 RDI: 0000000000000003 [ 92.828207][ T5938] RBP: 00007fd32e486090 R08: 0000000000000028 R09: 0000000000000000 [ 92.828220][ T5938] R10: 0000200000000080 R11: 0000000000000246 R12: 0000000000000001 [ 92.828233][ T5938] R13: 00007fd32d816038 R14: 00007fd32d815fa0 R15: 00007fd32d93fa48 [ 92.828266][ T5938] [ 93.377921][ T5836] Bluetooth: hci1: command tx timeout [ 93.383498][ T5836] Bluetooth: hci2: command tx timeout [ 93.389359][ T5836] Bluetooth: hci0: command tx timeout [ 93.395197][ T5836] Bluetooth: hci3: command tx timeout [ 93.397965][ T5833] Bluetooth: hci4: command tx timeout [ 94.121069][ T5881] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 94.338971][ T5906] usbhid 1-1:0.0: can't add hid device: -71 [ 94.350875][ T5906] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 94.362670][ T5881] usb 4-1: Using ep0 maxpacket: 32 [ 94.387547][ T5881] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 94.416190][ T5906] usb 1-1: USB disconnect, device number 2 [ 94.441518][ T5881] usb 4-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 50128, setting to 1024 [ 94.508287][ T5881] usb 4-1: New USB device found, idVendor=2b73, idProduct=000a, bcdDevice= 0.40 [ 94.553289][ T5881] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 94.577322][ T5881] usb 4-1: Product: syz [ 94.589414][ T5881] usb 4-1: Manufacturer: syz [ 94.594078][ T5881] usb 4-1: SerialNumber: syz [ 95.534028][ T5955] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 95.601397][ T5955] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 95.647920][ T5881] usb 4-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 95.671227][ T5881] usb 4-1: 2:1 : UAC_AS_GENERAL descriptor not found [ 95.914924][ T5881] snd-usb-audio 4-1:1.0: probe with driver snd-usb-audio failed with error -71 [ 95.952391][ T5881] usb 4-1: USB disconnect, device number 2 [ 95.995719][ T5975] syz.4.13 uses obsolete (PF_INET,SOCK_PACKET) [ 96.425134][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 96.931466][ T5983] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 97.922621][ T5917] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 98.250689][ T5917] usb 4-1: too many configurations: 217, using maximum allowed: 8 [ 98.295852][ T24] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 98.415607][ T5917] usb 4-1: config index 0 descriptor too short (expected 52555, got 72) [ 98.519794][ T24] usb 2-1: New USB device found, idVendor=0bda, idProduct=8153, bcdDevice=e2.3d [ 98.554537][ T24] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 98.624669][ T5917] usb 4-1: config index 1 descriptor too short (expected 52555, got 72) [ 98.684372][ T24] usb 2-1: Product: syz [ 98.693403][ T24] usb 2-1: Manufacturer: syz [ 98.713943][ T24] usb 2-1: SerialNumber: syz [ 98.775572][ T24] r8152-cfgselector 2-1: Unknown version 0x0000 [ 98.782098][ T24] r8152-cfgselector 2-1: config 0 descriptor?? [ 98.843356][ T5917] usb 4-1: config index 2 descriptor too short (expected 52555, got 72) [ 98.909180][ T5917] usb 4-1: config index 3 descriptor too short (expected 52555, got 72) [ 98.975413][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 99.079761][ T5917] usb 4-1: config index 4 descriptor too short (expected 52555, got 72) [ 99.102161][ T5917] usb 4-1: config index 5 descriptor too short (expected 52555, got 72) [ 99.122488][ T5917] usb 4-1: config index 6 descriptor too short (expected 52555, got 72) [ 99.226362][ T5917] usb 4-1: config index 7 descriptor too short (expected 52555, got 72) [ 99.279935][ T5917] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 99.292123][ T5992] random: crng reseeded on system resumption [ 99.301215][ T5917] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 99.321017][ T5917] usb 4-1: Product: syz [ 99.329942][ T5992] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 99.338535][ T5917] usb 4-1: Manufacturer: syz [ 99.343148][ T5917] usb 4-1: SerialNumber: syz [ 99.417287][ T5992] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 99.546799][ T5992] Unrecognized hibernate image header format! [ 99.585000][ T5992] PM: hibernation: Image mismatch: architecture specific data [ 99.588894][ T5917] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 99.618929][ T5992] netlink: 'syz.1.18': attribute type 46 has an invalid length. [ 99.882126][ T24] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 100.155962][ T5917] usb 4-1: USB disconnect, device number 3 [ 100.541147][ T6015] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 101.004219][ T24] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 101.027362][ T24] ath9k_htc: Failed to initialize the device [ 101.055256][ T5917] usb 4-1: ath9k_htc: USB layer deinitialized [ 101.362463][ T6007] IPVS: sh: FWM 3 0x00000003 - no destination available [ 101.378658][ T5909] r8152-cfgselector 2-1: USB disconnect, device number 2 [ 101.405306][ T796] IPVS: starting estimator thread 0... [ 101.550145][ T6022] IPVS: using max 38 ests per chain, 91200 per kthread [ 101.631590][ T6026] loop5: detected capacity change from 0 to 7 [ 101.650112][ T6030] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 101.881900][ T6032] IPVS: sh: FWM 3 0x00000003 - no destination available [ 101.889462][ C1] IPVS: sh: FWM 3 0x00000003 - no destination available [ 101.902518][ T6026] Dev loop5: unable to read RDB block 7 [ 101.907222][ T5909] IPVS: starting estimator thread 0... [ 101.927677][ T6026] loop5: unable to read partition table [ 101.948620][ T6026] loop5: partition table beyond EOD, truncated [ 102.009414][ T6026] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 102.184394][ T6034] IPVS: using max 28 ests per chain, 67200 per kthread [ 103.401405][ T115] IPVS: stop unused estimator thread 0... [ 103.487722][ T6047] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 103.835522][ T9] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 104.115482][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 104.122652][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 104.155750][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 104.192944][ T6055] trusted_key: encrypted_key: keylen parameter is missing [ 104.210710][ T9] usb 2-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 104.227878][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 104.248531][ T9] usb 2-1: Product: syz [ 104.253440][ T6056] trusted_key: encrypted_key: keylen parameter is missing [ 104.263142][ T9] usb 2-1: Manufacturer: syz [ 104.274016][ T9] usb 2-1: SerialNumber: syz [ 104.313626][ T9] usb 2-1: config 0 descriptor?? [ 104.383284][ T6057] trusted_key: encrypted_key: keylen parameter is missing [ 104.416002][ T6056] trusted_key: encrypted_key: keylen parameter is missing [ 104.554667][ C0] imon 2-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 104.578555][ T9] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input5 [ 104.860077][ T9] imon:send_packet: packet tx failed (-71) [ 104.876891][ T5909] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 104.895600][ T9] imon 2-1:0.0: panel buttons/knobs setup failed [ 105.036171][ T5909] usb 3-1: Using ep0 maxpacket: 8 [ 105.069830][ T9] rc_core: IR keymap rc-imon-pad not found [ 105.088167][ T9] Registered IR keymap rc-empty [ 105.100080][ T5909] usb 3-1: config 0 has an invalid interface number: 1 but max is 0 [ 105.110732][ T5909] usb 3-1: config 0 has no interface number 0 [ 105.119708][ T9] imon 2-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 105.133281][ T9] imon 2-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 105.139448][ T5909] usb 3-1: config 0 interface 1 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 105.168518][ T9] imon:send_packet: packet tx failed (-71) [ 105.178578][ T5909] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 105.196509][ T9] imon 2-1:0.0: remote input dev register failed [ 105.204461][ T9] imon 2-1:0.0: imon_init_intf0: rc device setup failed [ 105.232802][ T5909] usb 3-1: config 0 interface 1 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 105.274744][ T5909] usb 3-1: New USB device found, idVendor=0af0, idProduct=6751, bcdDevice=75.cb [ 105.426006][ T5909] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 105.433281][ T9] imon 2-1:0.0: unable to initialize intf0, err 0 [ 105.441311][ T5909] usb 3-1: config 0 descriptor?? [ 105.462325][ T9] imon:imon_probe: failed to initialize context! [ 105.505555][ T9] imon 2-1:0.0: unable to register, err -19 [ 105.527785][ T9] usb 2-1: USB disconnect, device number 3 [ 105.533268][ T5909] hso 3-1:0.1: Failed to find BULK IN ep [ 105.567489][ T6075] netlink: 28 bytes leftover after parsing attributes in process `syz.3.39'. [ 105.730200][ T6065] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 105.740518][ T6065] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 105.757956][ T5909] usb 3-1: USB disconnect, device number 2 [ 105.935620][ T9] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 106.086073][ T9] usb 2-1: Using ep0 maxpacket: 16 [ 106.104070][ T9] usb 2-1: config 0 interface 0 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 106.136537][ T9] usb 2-1: config 0 interface 0 has no altsetting 0 [ 106.156189][ T9] usb 2-1: New USB device found, idVendor=15c2, idProduct=0041, bcdDevice=1f.20 [ 106.183835][ T9] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.202638][ T9] usb 2-1: Product: syz [ 106.220505][ T9] usb 2-1: Manufacturer: syz [ 106.254711][ T9] usb 2-1: SerialNumber: syz [ 106.284776][ T9] usb 2-1: config 0 descriptor?? [ 106.484130][ C0] imon 2-1:0.0: imon usb_rx_callback_intf0: status(-71) [ 106.537439][ T9] input: iMON Panel, Knob and Mouse(15c2:0041) as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input7 [ 106.560233][ T5909] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 106.625314][ T9] imon:send_packet: packet tx failed (-71) [ 106.671227][ T9] imon 2-1:0.0: panel buttons/knobs setup failed [ 106.737784][ T5909] usb 5-1: unable to get BOS descriptor or descriptor too short [ 106.767575][ T5909] usb 5-1: New USB device found, idVendor=041e, idProduct=3000, bcdDevice= 0.40 [ 106.805458][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 106.813527][ T5909] usb 5-1: Product: syz [ 106.953544][ T5909] usb 5-1: Manufacturer: syz [ 106.973187][ T5909] usb 5-1: SerialNumber: syz [ 106.995504][ T9] rc_core: IR keymap rc-imon-pad not found [ 107.002478][ T9] Registered IR keymap rc-empty [ 107.040097][ T9] imon 2-1:0.0: Looks like you're trying to use an IR protocol this device does not support [ 107.060493][ T6099] bridge0: port 3(erspan0) entered blocking state [ 107.075736][ T6099] bridge0: port 3(erspan0) entered disabled state [ 107.092431][ T9] imon 2-1:0.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 107.108864][ T6099] erspan0: entered allmulticast mode [ 107.131703][ T9] imon:send_packet: packet tx failed (-71) [ 107.131705][ T6099] erspan0: entered promiscuous mode [ 107.162504][ T6099] bridge0: port 3(erspan0) entered blocking state [ 107.169304][ T6099] bridge0: port 3(erspan0) entered forwarding state [ 107.206355][ T6100] erspan0: left allmulticast mode [ 107.221906][ T9] imon 2-1:0.0: remote input dev register failed [ 107.228882][ T5909] usb 5-1: 1:1 : UAC_AS_GENERAL descriptor not found [ 107.243066][ T6100] erspan0: left promiscuous mode [ 107.252042][ T5909] usb 5-1: unit 13 not found! [ 107.266928][ T9] imon 2-1:0.0: imon_init_intf0: rc device setup failed [ 107.279463][ T6100] bridge0: port 3(erspan0) entered disabled state [ 107.331522][ T6099] syz_tun: entered allmulticast mode [ 107.343772][ T9] imon 2-1:0.0: unable to initialize intf0, err 0 [ 107.399355][ T9] imon:imon_probe: failed to initialize context! [ 107.420158][ T6098] syz_tun: left allmulticast mode [ 107.429863][ T9] imon 2-1:0.0: unable to register, err -19 [ 107.451015][ T9] usb 2-1: USB disconnect, device number 4 [ 107.496781][ T5909] usb 5-1: USB disconnect, device number 2 [ 107.758708][ T6031] udevd[6031]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 108.046307][ T9] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 108.096372][ T6111] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 108.415506][ T9] usb 4-1: Using ep0 maxpacket: 32 [ 108.422682][ T9] usb 4-1: config 5 has an invalid interface number: 132 but max is 0 [ 108.593338][ T9] usb 4-1: config 5 has no interface number 0 [ 108.747175][ T9] usb 4-1: config 5 interface 132 has no altsetting 0 [ 108.787550][ T9] usb 4-1: New USB device found, idVendor=19ab, idProduct=1000, bcdDevice= 0.5e [ 108.836166][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 108.858614][ T9] usb 4-1: Product: syz [ 108.864171][ T9] usb 4-1: Manufacturer: syz [ 108.870319][ T9] usb 4-1: SerialNumber: syz [ 109.025512][ T796] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 109.205989][ T5909] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 109.217407][ T796] usb 2-1: too many configurations: 217, using maximum allowed: 8 [ 109.234180][ T796] usb 2-1: config index 0 descriptor too short (expected 52555, got 72) [ 109.244973][ T796] usb 2-1: config index 1 descriptor too short (expected 52555, got 72) [ 109.265550][ T796] usb 2-1: config index 2 descriptor too short (expected 52555, got 72) [ 109.275671][ T796] usb 2-1: config index 3 descriptor too short (expected 52555, got 72) [ 109.286052][ T796] usb 2-1: config index 4 descriptor too short (expected 52555, got 72) [ 109.309260][ T796] usb 2-1: config index 5 descriptor too short (expected 52555, got 72) [ 109.325237][ T6105] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 109.348068][ T796] usb 2-1: config index 6 descriptor too short (expected 52555, got 72) [ 109.360130][ T796] usb 2-1: config index 7 descriptor too short (expected 52555, got 72) [ 109.380745][ T796] usb 2-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 109.398727][ T796] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 109.412706][ T6128] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 109.425960][ T6105] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 109.452559][ T796] usb 2-1: Product: syz [ 109.458286][ T796] usb 2-1: Manufacturer: syz [ 109.475042][ T9] uvcvideo 4-1:5.132: Found UVC 0.00 device syz (19ab:1000) [ 109.484907][ T796] usb 2-1: SerialNumber: syz [ 109.493308][ T9] uvcvideo 4-1:5.132: No valid video chain found. [ 109.503963][ T5909] usb 1-1: too many configurations: 217, using maximum allowed: 8 [ 109.556339][ T5909] usb 1-1: config index 0 descriptor too short (expected 52555, got 72) [ 109.583951][ T5909] usb 1-1: config index 1 descriptor too short (expected 52555, got 72) [ 109.605829][ T796] usb 2-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 109.649862][ T6130] netlink: 14 bytes leftover after parsing attributes in process `syz.2.56'. [ 109.664681][ T9] usb 4-1: USB disconnect, device number 4 [ 109.672002][ T5909] usb 1-1: config index 2 descriptor too short (expected 52555, got 72) [ 109.703178][ T5909] usb 1-1: config index 3 descriptor too short (expected 52555, got 72) [ 109.727525][ T5909] usb 1-1: config index 4 descriptor too short (expected 52555, got 72) [ 109.748055][ T5909] usb 1-1: config index 5 descriptor too short (expected 52555, got 72) [ 109.784855][ T5901] usb 2-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 109.938514][ T5909] usb 1-1: config index 6 descriptor too short (expected 52555, got 72) [ 110.001380][ T6130] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 110.224259][ T5909] usb 1-1: config index 7 descriptor too short (expected 52555, got 72) [ 110.298324][ T5909] usb 1-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 110.451580][ T6130] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 110.490924][ T5909] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 110.517278][ T6130] bond0 (unregistering): Released all slaves [ 110.544440][ T5909] usb 1-1: Product: syz [ 110.567430][ T5909] usb 1-1: Manufacturer: syz [ 110.572133][ T5909] usb 1-1: SerialNumber: syz [ 110.614424][ T5909] usb 1-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 110.804017][ T24] usb 1-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 110.907466][ T5901] ath9k_htc 2-1:1.0: ath9k_htc: Target is unresponsive [ 110.928262][ T5901] ath9k_htc: Failed to initialize the device [ 110.935262][ T6133] autofs4:pid:6133:check_dev_ioctl_version: ioctl control interface version mismatch: kernel(1.1), user(1.100), cmd(0xc018937e) [ 111.065709][ T6133] autofs4:pid:6133:validate_dev_ioctl: invalid device control module version supplied for cmd(0xc018937e) [ 111.076734][ T5901] usb 2-1: ath9k_htc: USB layer deinitialized [ 111.345652][ T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 111.577423][ T9] usb 5-1: config 1 has an invalid descriptor of length 188, skipping remainder of the config [ 111.609736][ T9] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 111.780040][ T9] usb 5-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 111.789493][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 111.804673][ T9] usb 5-1: SerialNumber: syz [ 111.855962][ T24] ath9k_htc 1-1:1.0: ath9k_htc: Target is unresponsive [ 111.891782][ T24] ath9k_htc: Failed to initialize the device [ 111.949767][ T24] usb 1-1: ath9k_htc: USB layer deinitialized [ 112.207510][ T9] usb 5-1: 0:2 : does not exist [ 112.219795][ T9] usb 5-1: unit 5 not found! [ 112.266945][ T5906] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 112.416819][ T5906] usb 4-1: device descriptor read/64, error -71 [ 112.430565][ T9] usb 5-1: USB disconnect, device number 3 [ 112.603812][ T5834] udevd[5834]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 112.695777][ T5906] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 112.888309][ T5906] usb 4-1: device descriptor read/64, error -71 [ 113.026239][ T5906] usb usb4-port1: attempt power cycle [ 113.400003][ T5909] usb 1-1: USB disconnect, device number 3 [ 113.515530][ T5906] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 113.557279][ T5906] usb 4-1: device descriptor read/8, error -71 [ 113.705502][ T5881] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 113.905816][ T5881] usb 3-1: Using ep0 maxpacket: 16 [ 113.916120][ T5906] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 113.935000][ T5881] usb 3-1: config index 0 descriptor too short (expected 14385, got 56) [ 113.968587][ T5906] usb 4-1: device descriptor read/8, error -71 [ 113.985517][ T5881] usb 3-1: config 52 has too many interfaces: 52, using maximum allowed: 32 [ 114.001882][ T5881] usb 3-1: config 52 has an invalid descriptor of length 52, skipping remainder of the config [ 114.107315][ T5906] usb usb4-port1: unable to enumerate USB device [ 114.117193][ T5901] usb 2-1: USB disconnect, device number 5 [ 114.148965][ T5881] usb 3-1: config 52 has 0 interfaces, different from the descriptor's value: 52 [ 114.213117][ T5881] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 114.227690][ T24] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 114.244642][ T5881] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 114.315253][ T5881] usb 3-1: Manufacturer: syz [ 114.385900][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 114.394284][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 114.420255][ T24] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 114.464693][ T24] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 114.493195][ T24] usb 1-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 114.518215][ T24] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 114.629086][ T6147] netlink: 16 bytes leftover after parsing attributes in process `syz.2.62'. [ 114.655758][ T24] usb 1-1: config 0 descriptor?? [ 114.793228][ T6166] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 114.893738][ T6169] netlink: 204 bytes leftover after parsing attributes in process `syz.4.67'. [ 114.903357][ T6169] syz.4.67 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 115.243150][ T6171] netdevsim netdevsim3 netdevsim0: entered allmulticast mode [ 115.272934][ T24] input: HID 0458:5011 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5011.0001/input/input9 [ 115.545210][ T24] input: HID 0458:5011 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:0458:5011.0001/input/input10 [ 115.724391][ T24] kye 0003:0458:5011.0001: input,hiddev0,hidraw0: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.0-1/input0 [ 116.438330][ C0] kye 0003:0458:5011.0001: usb_submit_urb(ctrl) failed: -1 [ 116.577512][ T24] usb 1-1: reset high-speed USB device number 4 using dummy_hcd [ 116.755518][ T24] usb 1-1: device descriptor read/64, error -32 [ 116.835809][ T6184] netlink: 'syz.3.71': attribute type 15 has an invalid length. [ 117.015577][ T24] usb 1-1: reset high-speed USB device number 4 using dummy_hcd [ 117.092411][ T5881] usb 3-1: USB disconnect, device number 3 [ 117.165503][ T24] usb 1-1: device descriptor read/64, error -32 [ 117.205703][ T5901] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 117.365572][ T5901] usb 4-1: device descriptor read/64, error -71 [ 117.435570][ T24] usb 1-1: reset high-speed USB device number 4 using dummy_hcd [ 117.495906][ T24] usb 1-1: device descriptor read/8, error -32 [ 117.618331][ T5881] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 117.646225][ T5901] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 117.744022][ T6193] loop2: detected capacity change from 0 to 7 [ 117.772800][ T6193] loop2: [ 117.784386][ T6193] loop2: partition table partially beyond EOD, truncated [ 117.795513][ T5881] usb 3-1: Using ep0 maxpacket: 8 [ 117.811145][ T5881] usb 3-1: New USB device found, idVendor=0ccd, idProduct=0038, bcdDevice=99.03 [ 117.854689][ T5881] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 117.863895][ T5901] usb 4-1: device descriptor read/64, error -71 [ 117.933071][ T5881] usb 3-1: Product: syz [ 117.947847][ T5881] usb 3-1: Manufacturer: syz [ 117.952691][ T5881] usb 3-1: SerialNumber: syz [ 117.973220][ T5881] usb 3-1: config 0 descriptor?? [ 117.992650][ T5881] dvb-usb: found a 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' in warm state. [ 118.006925][ T5901] usb usb4-port1: attempt power cycle [ 118.034383][ T6200] netlink: 'syz.0.74': attribute type 1 has an invalid length. [ 118.142760][ T5881] dvb-usb: bulk message failed: -22 (2/0) [ 118.174893][ T5881] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 118.190970][ T5881] dvbdev: DVB: registering new adapter (TerraTec/qanu USB2.0 Highspeed DVB-T Receiver) [ 118.288282][ T5881] usb 3-1: media controller created [ 118.341064][ T5881] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 118.390460][ T5881] dvb-usb: bulk message failed: -22 (1/0) [ 118.409084][ T5881] dvb-usb: no frontend was attached by 'TerraTec/qanu USB2.0 Highspeed DVB-T Receiver' [ 118.459291][ T5901] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 118.474024][ T5881] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.2/usb3/3-1/input/input11 [ 118.486653][ T5901] usb 4-1: device descriptor read/8, error -71 [ 118.494244][ T5916] usb 1-1: USB disconnect, device number 4 [ 118.539436][ T5881] dvb-usb: schedule remote query interval to 50 msecs. [ 118.683172][ T5881] dvb-usb: bulk message failed: -22 (2/0) [ 118.741667][ T5881] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Receiver successfully initialized and connected. [ 118.752525][ T5901] usb 4-1: new high-speed USB device number 12 using dummy_hcd [ 118.760286][ T5959] dvb-usb: bulk message failed: -22 (1/0) [ 118.768270][ T5959] dvb-usb: error while querying for an remote control event. [ 118.860964][ T24] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 118.922806][ T5901] usb 4-1: device descriptor read/8, error -71 [ 119.140552][ T5901] usb usb4-port1: unable to enumerate USB device [ 119.154974][ T5881] usb 3-1: USB disconnect, device number 4 [ 119.349873][ T24] usb 5-1: too many configurations: 217, using maximum allowed: 8 [ 119.400576][ T24] usb 5-1: config index 0 descriptor too short (expected 52555, got 72) [ 119.432009][ T24] usb 5-1: config index 1 descriptor too short (expected 52555, got 72) [ 119.446443][ T24] usb 5-1: config index 2 descriptor too short (expected 52555, got 72) [ 119.463282][ T24] usb 5-1: config index 3 descriptor too short (expected 52555, got 72) [ 119.477242][ T24] usb 5-1: config index 4 descriptor too short (expected 52555, got 72) [ 119.483800][ T5881] dvb-usb: TerraTec/qanu USB2.0 Highspeed DVB-T Re successfully deinitialized and disconnected. [ 119.506948][ T24] usb 5-1: config index 5 descriptor too short (expected 52555, got 72) [ 119.518216][ T24] usb 5-1: config index 6 descriptor too short (expected 52555, got 72) [ 119.537265][ T24] usb 5-1: config index 7 descriptor too short (expected 52555, got 72) [ 119.562142][ T24] usb 5-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 119.613227][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 119.664094][ T24] usb 5-1: Product: syz [ 119.714742][ T24] usb 5-1: Manufacturer: syz [ 119.737402][ T24] usb 5-1: SerialNumber: syz [ 119.817747][ T24] usb 5-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 119.845852][ T5909] usb 5-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 119.962104][ T6214] netlink: 12 bytes leftover after parsing attributes in process `syz.2.79'. [ 120.345429][ T0] NOHZ tick-stop error: local softirq work is pending, handler #02!!! [ 120.665708][ T6219] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 120.886172][ T6221] netdevsim netdevsim2 netdevsim0: entered allmulticast mode [ 120.976604][ T5909] ath9k_htc 5-1:1.0: ath9k_htc: Target is unresponsive [ 121.003792][ T5909] ath9k_htc: Failed to initialize the device [ 121.297614][ T6230] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 121.368549][ T5909] usb 5-1: ath9k_htc: USB layer deinitialized [ 122.100695][ T5881] usb 5-1: USB disconnect, device number 4 [ 122.236500][ T36] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.467230][ T36] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.643887][ T36] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 122.840466][ T6236] geneve2: entered promiscuous mode [ 122.882027][ T6236] geneve2: entered allmulticast mode [ 123.021922][ T6240] netlink: 12 bytes leftover after parsing attributes in process `syz.4.90'. [ 123.032025][ T36] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 123.149413][ T51] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 123.158177][ T51] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 123.195696][ T51] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 123.225656][ T51] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 123.246162][ T51] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 123.408907][ T36] bridge_slave_1: left allmulticast mode [ 123.414889][ T36] bridge_slave_1: left promiscuous mode [ 123.468661][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 123.557790][ T36] bridge_slave_0: left allmulticast mode [ 123.585530][ T36] bridge_slave_0: left promiscuous mode [ 123.721688][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 124.062910][ T6265] netlink: 8 bytes leftover after parsing attributes in process `syz.4.94'. [ 125.395457][ T5836] Bluetooth: hci0: command tx timeout [ 125.858312][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 125.926152][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 126.017336][ T36] bond0 (unregistering): Released all slaves [ 126.091503][ T6250] netlink: 44 bytes leftover after parsing attributes in process `syz.2.93'. [ 126.360935][ T6285] netlink: 12 bytes leftover after parsing attributes in process `syz.0.100'. [ 126.677153][ T6295] geneve2: entered promiscuous mode [ 126.683571][ T6295] geneve2: entered allmulticast mode [ 127.113980][ T6306] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 127.157027][ T5916] usb 4-1: new high-speed USB device number 13 using dummy_hcd [ 127.405888][ T6309] loop5: detected capacity change from 0 to 6 [ 127.419162][ T5916] usb 4-1: too many configurations: 217, using maximum allowed: 8 [ 127.448413][ T36] hsr_slave_0: left promiscuous mode [ 127.454036][ T6309] loop5: [POWERTEC] p1 p2 [ 127.487916][ T5836] Bluetooth: hci0: command tx timeout [ 127.499325][ T36] hsr_slave_1: left promiscuous mode [ 127.511149][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 127.519957][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 127.536677][ T6309] loop5: p1 start 6 is beyond EOD, truncated [ 127.542799][ T6309] loop5: p2 size 16 extends beyond EOD, truncated [ 127.556149][ T36] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 127.563628][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 127.683723][ T5916] usb 4-1: config index 0 descriptor too short (expected 52555, got 72) [ 127.716549][ T5916] usb 4-1: config index 1 descriptor too short (expected 52555, got 72) [ 127.727704][ T5916] usb 4-1: config index 2 descriptor too short (expected 52555, got 72) [ 127.770412][ T36] veth1_macvtap: left promiscuous mode [ 127.787813][ T36] veth0_macvtap: left promiscuous mode [ 127.794756][ T5916] usb 4-1: config index 3 descriptor too short (expected 52555, got 72) [ 127.810735][ T5834] udevd[5834]: inotify_add_watch(7, /dev/loop5p2, 10) failed: No such file or directory [ 127.825613][ T36] veth1_vlan: left promiscuous mode [ 127.832886][ T5916] usb 4-1: config index 4 descriptor too short (expected 52555, got 72) [ 127.852465][ T36] veth0_vlan: left promiscuous mode [ 127.863919][ T5916] usb 4-1: config index 5 descriptor too short (expected 52555, got 72) [ 127.891938][ T5916] usb 4-1: config index 6 descriptor too short (expected 52555, got 72) [ 127.905318][ T5916] usb 4-1: config index 7 descriptor too short (expected 52555, got 72) [ 127.927309][ T5916] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 127.936959][ T5916] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 127.983543][ T5916] usb 4-1: Product: syz [ 127.998100][ T5916] usb 4-1: Manufacturer: syz [ 128.075595][ T5916] usb 4-1: SerialNumber: syz [ 128.177153][ T5916] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 128.217438][ T24] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 128.575725][ T5959] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 128.725476][ T5959] usb 5-1: device descriptor read/64, error -71 [ 129.052257][ T36] team0 (unregistering): Port device team_slave_1 removed [ 129.085485][ T5959] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 129.188584][ T36] team0 (unregistering): Port device team_slave_0 removed [ 129.354791][ T24] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 129.362176][ T5959] usb 5-1: device descriptor read/64, error -71 [ 129.362926][ T24] ath9k_htc: Failed to initialize the device [ 129.455763][ T24] usb 4-1: ath9k_htc: USB layer deinitialized [ 129.484382][ T5959] usb usb5-port1: attempt power cycle [ 129.535823][ T5836] Bluetooth: hci0: command tx timeout [ 129.774238][ T24] usb 4-1: USB disconnect, device number 13 [ 129.825625][ T5909] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 129.866908][ T5959] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 129.896214][ T5959] usb 5-1: device descriptor read/8, error -71 [ 130.006823][ T5909] usb 1-1: Using ep0 maxpacket: 32 [ 130.029372][ T6244] chnl_net:caif_netlink_parms(): no params data found [ 130.037560][ T5909] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 130.062666][ T5909] usb 1-1: config 0 has no interfaces? [ 130.091193][ T5909] usb 1-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 130.151235][ T5909] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.185474][ T5959] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 130.203297][ T5909] usb 1-1: config 0 descriptor?? [ 130.227913][ T5959] usb 5-1: device descriptor read/8, error -71 [ 130.325463][ T24] usb 4-1: new high-speed USB device number 14 using dummy_hcd [ 130.355863][ T5959] usb usb5-port1: unable to enumerate USB device [ 130.438306][ T5909] usb 1-1: USB disconnect, device number 5 [ 130.539095][ T24] usb 4-1: New USB device found, idVendor=0bed, idProduct=1100, bcdDevice=ec.c3 [ 130.567950][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 130.591279][ T6244] bridge0: port 1(bridge_slave_0) entered blocking state [ 130.615600][ T6244] bridge0: port 1(bridge_slave_0) entered disabled state [ 130.622891][ T6244] bridge_slave_0: entered allmulticast mode [ 130.631074][ T24] usb 4-1: config 0 descriptor?? [ 130.693075][ T6244] bridge_slave_0: entered promiscuous mode [ 130.702833][ T24] cp210x 4-1:0.0: cp210x converter detected [ 130.725100][ T6244] bridge0: port 2(bridge_slave_1) entered blocking state [ 130.735182][ T6244] bridge0: port 2(bridge_slave_1) entered disabled state [ 130.745553][ T6244] bridge_slave_1: entered allmulticast mode [ 130.756348][ T6244] bridge_slave_1: entered promiscuous mode [ 130.805467][ T9] usb 3-1: new high-speed USB device number 5 using dummy_hcd [ 130.892067][ T6244] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 130.908505][ T6347] netlink: 8 bytes leftover after parsing attributes in process `syz.0.114'. [ 130.957106][ T6244] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 131.025517][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 131.045172][ T9] usb 3-1: New USB device found, idVendor=0b89, idProduct=0007, bcdDevice=ef.64 [ 131.082396][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 131.124168][ T24] cp210x 4-1:0.0: failed to get vendor val 0x000e size 3: -32 [ 131.143896][ T9] usb 3-1: config 0 descriptor?? [ 131.197836][ T24] usb 4-1: cp210x converter now attached to ttyUSB0 [ 131.209335][ T6244] team0: Port device team_slave_0 added [ 131.239952][ T6347] netlink: 8 bytes leftover after parsing attributes in process `syz.0.114'. [ 131.261924][ T6244] team0: Port device team_slave_1 added [ 131.295974][ T9] as10x_usb: device has been detected [ 131.302997][ T9] dvbdev: DVB: registering new adapter (nBox DVB-T Dongle) [ 131.397077][ T9] usb 3-1: DVB: registering adapter 1 frontend 0 (nBox DVB-T Dongle)... [ 131.407945][ T6341] ------------[ cut here ]------------ [ 131.413511][ T6341] DEBUG_LOCKS_WARN_ON(lock->magic != lock) [ 131.413540][ T6341] WARNING: kernel/locking/mutex.c:593 at __mutex_lock+0x10a4/0x1300, CPU#1: syz.2.113/6341 [ 131.429900][ T6341] Modules linked in: [ 131.434096][ T6341] CPU: 1 UID: 0 PID: 6341 Comm: syz.2.113 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.445022][ T6341] Tainted: [L]=SOFTLOCKUP [ 131.449513][ T6341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 131.460062][ T6341] RIP: 0010:__mutex_lock+0x10ab/0x1300 [ 131.465832][ T6341] Code: 12 90 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 33 02 00 00 83 3d d9 b8 60 04 00 75 13 48 8d 3d 8c cc 63 04 48 c7 c6 c0 e0 cc 8b <67> 48 0f b9 3a 90 e9 ac f0 ff ff 90 0f 0b 90 e9 73 f4 ff ff 90 0f [ 131.485833][ T6341] RSP: 0018:ffffc9000450fa20 EFLAGS: 00010246 [ 131.491977][ T6341] RAX: 0000000000000000 RBX: 1ffff920008a1f5c RCX: ffff888028469e80 [ 131.500077][ T6341] RDX: 0000000000000000 RSI: ffffffff8bcce0c0 RDI: ffffffff90152180 [ 131.508168][ T6341] RBP: ffffc9000450fbd8 R08: ffffffff90120dc3 R09: 1ffffffff20241b8 [ 131.516556][ T6341] R10: dffffc0000000000 R11: fffffbfff20241b9 R12: ffff88806b93eb60 [ 131.524558][ T6341] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 131.532804][ T6341] FS: 00007fd32e4866c0(0000) GS:ffff888125554000(0000) knlGS:0000000000000000 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 131.542037][ T6341] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 131.548703][ T6341] CR2: 000000110c3d5ce5 CR3: 000000007f98e000 CR4: 00000000003526f0 [ 131.556884][ T6341] Call Trace: [ 131.560214][ T6341] [ 131.563220][ T6341] ? __mutex_lock+0x319/0x1300 [ 131.568163][ T6341] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 131.573823][ T6341] ? dmx_section_feed_allocate_filter+0x34f/0x3e0 [ 131.580302][ T6341] ? __pfx___mutex_lock+0x10/0x10 [ 131.585453][ T6341] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 131.591145][ T6341] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 131.597202][ T6341] ? do_raw_spin_lock+0x12b/0x2f0 [ 131.602267][ T6341] as102_dvb_dmx_start_feed+0x70/0x290 [ 131.608022][ T6341] dmx_section_feed_start_filtering+0x518/0x6c0 [ 131.614301][ T6341] dvb_dmxdev_filter_start+0xcf4/0x10e0 [ 131.620188][ T6341] ? dvb_dmxdev_filter_set+0x2d1/0x580 [ 131.625778][ T6341] dvb_demux_do_ioctl+0x470/0x540 [ 131.631152][ T6341] dvb_usercopy+0x199/0x2e0 [ 131.635787][ T5836] Bluetooth: hci0: command tx timeout [ 131.641502][ T6341] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 131.643992][ T9] as10x_usb: error during firmware upload part1 [ 131.647159][ T6341] ? __pfx_dvb_usercopy+0x10/0x10 [ 131.647201][ T6341] ? __fget_files+0x3a0/0x420 [ 131.663286][ T6341] ? __fget_files+0x2a/0x420 [ 131.667945][ T9] Registered device nBox DVB-T Dongle [ 131.668030][ T6341] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 131.678831][ T6341] dvb_demux_ioctl+0x29/0x40 [ 131.683522][ T6341] __se_sys_ioctl+0xfc/0x170 [ 131.688242][ T6341] do_syscall_64+0x14d/0xf80 [ 131.692893][ T6341] ? trace_irq_disable+0x3b/0x150 [ 131.698749][ T6341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.704918][ T6341] ? clear_bhb_loop+0x40/0x90 [ 131.709741][ T6341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 131.715761][ T6341] RIP: 0033:0x7fd32d59c819 [ 131.717195][ T6244] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 131.720228][ T6341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 131.747345][ T6341] RSP: 002b:00007fd32e486028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 131.756125][ T6341] RAX: ffffffffffffffda RBX: 00007fd32d815fa0 RCX: 00007fd32d59c819 [ 131.764152][ T6341] RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000007 [ 131.772262][ T6341] RBP: 00007fd32d632c91 R08: 0000000000000000 R09: 0000000000000000 [ 131.780383][ T6341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 131.788487][ T6341] R13: 00007fd32d816038 R14: 00007fd32d815fa0 R15: 00007fd32d93fa48 [ 131.795841][ T6244] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 131.796625][ T6341] [ 131.825628][ T6341] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 131.832965][ T6341] CPU: 1 UID: 0 PID: 6341 Comm: syz.2.113 Tainted: G L syzkaller #0 PREEMPT(full) [ 131.843906][ T6341] Tainted: [L]=SOFTLOCKUP [ 131.848274][ T6341] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 131.858378][ T6341] Call Trace: [ 131.861712][ T6341] [ 131.864684][ T6341] vpanic+0x56c/0xa60 [ 131.868710][ T6341] ? __pfx__printk+0x10/0x10 [ 131.873516][ T6341] ? __pfx_vpanic+0x10/0x10 [ 131.878057][ T6341] ? is_bpf_text_address+0x292/0x2b0 [ 131.883376][ T6341] ? is_bpf_text_address+0x26/0x2b0 [ 131.888611][ T6341] panic+0xc5/0xd0 [ 131.892372][ T6341] ? __pfx_panic+0x10/0x10 [ 131.896821][ T6341] __warn+0x315/0x4f0 [ 131.900925][ T6341] ? __mutex_lock+0x10a4/0x1300 [ 131.905807][ T6341] ? __mutex_lock+0x10a4/0x1300 [ 131.910783][ T6341] __report_bug+0x29a/0x540 [ 131.915334][ T6341] ? dvb_demux_do_ioctl+0x470/0x540 [ 131.920657][ T6341] ? __mutex_lock+0x10a4/0x1300 [ 131.925808][ T6341] ? __pfx___report_bug+0x10/0x10 [ 131.930863][ T6341] ? pfn_valid+0x125/0x4c0 [ 131.935313][ T6341] ? __lock_acquire+0x6b5/0x2cf0 [ 131.940279][ T6341] report_bug_entry+0x19a/0x290 [ 131.945165][ T6341] ? __mutex_lock+0x10ab/0x1300 [ 131.950048][ T6341] ? __mutex_lock+0x10b0/0x1300 [ 131.954946][ T6341] handle_bug+0xce/0x200 [ 131.959228][ T6341] exc_invalid_op+0x1a/0x50 [ 131.963771][ T6341] asm_exc_invalid_op+0x1a/0x20 [ 131.968649][ T6341] RIP: 0010:__mutex_lock+0x10ab/0x1300 [ 131.974263][ T6341] Code: 12 90 48 c1 e8 03 42 0f b6 04 28 84 c0 0f 85 33 02 00 00 83 3d d9 b8 60 04 00 75 13 48 8d 3d 8c cc 63 04 48 c7 c6 c0 e0 cc 8b <67> 48 0f b9 3a 90 e9 ac f0 ff ff 90 0f 0b 90 e9 73 f4 ff ff 90 0f [ 131.994158][ T6341] RSP: 0018:ffffc9000450fa20 EFLAGS: 00010246 [ 132.000252][ T6341] RAX: 0000000000000000 RBX: 1ffff920008a1f5c RCX: ffff888028469e80 [ 132.008347][ T6341] RDX: 0000000000000000 RSI: ffffffff8bcce0c0 RDI: ffffffff90152180 [ 132.016354][ T6341] RBP: ffffc9000450fbd8 R08: ffffffff90120dc3 R09: 1ffffffff20241b8 [ 132.024365][ T6341] R10: dffffc0000000000 R11: fffffbfff20241b9 R12: ffff88806b93eb60 [ 132.032446][ T6341] R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 [ 132.040466][ T6341] ? __mutex_lock+0x319/0x1300 [ 132.045358][ T6341] ? as102_dvb_dmx_start_feed+0x70/0x290 [ 132.051069][ T6341] ? dmx_section_feed_allocate_filter+0x34f/0x3e0 [ 132.057516][ T6341] ? __pfx___mutex_lock+0x10/0x10 [ 132.062569][ T6341] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 132.068238][ T6341] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 132.074250][ T6341] ? do_raw_spin_lock+0x12b/0x2f0 [ 132.079304][ T6341] as102_dvb_dmx_start_feed+0x70/0x290 [ 132.084796][ T6341] dmx_section_feed_start_filtering+0x518/0x6c0 [ 132.091073][ T6341] dvb_dmxdev_filter_start+0xcf4/0x10e0 [ 132.096660][ T6341] ? dvb_dmxdev_filter_set+0x2d1/0x580 [ 132.102155][ T6341] dvb_demux_do_ioctl+0x470/0x540 [ 132.107302][ T6341] dvb_usercopy+0x199/0x2e0 [ 132.111937][ T6341] ? __pfx_dvb_demux_do_ioctl+0x10/0x10 [ 132.117600][ T6341] ? __pfx_dvb_usercopy+0x10/0x10 [ 132.122666][ T6341] ? __fget_files+0x3a0/0x420 [ 132.127465][ T6341] ? __fget_files+0x2a/0x420 [ 132.132160][ T6341] ? __pfx_dvb_demux_ioctl+0x10/0x10 [ 132.137481][ T6341] dvb_demux_ioctl+0x29/0x40 [ 132.142113][ T6341] __se_sys_ioctl+0xfc/0x170 [ 132.146735][ T6341] do_syscall_64+0x14d/0xf80 [ 132.151367][ T6341] ? trace_irq_disable+0x3b/0x150 [ 132.156435][ T6341] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.162535][ T6341] ? clear_bhb_loop+0x40/0x90 [ 132.167244][ T6341] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 132.173159][ T6341] RIP: 0033:0x7fd32d59c819 [ 132.177602][ T6341] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 132.197621][ T6341] RSP: 002b:00007fd32e486028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 132.206156][ T6341] RAX: ffffffffffffffda RBX: 00007fd32d815fa0 RCX: 00007fd32d59c819 [ 132.214231][ T6341] RDX: 0000200000000200 RSI: 00000000403c6f2b RDI: 0000000000000007 [ 132.222224][ T6341] RBP: 00007fd32d632c91 R08: 0000000000000000 R09: 0000000000000000 [ 132.230213][ T6341] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 132.238206][ T6341] R13: 00007fd32d816038 R14: 00007fd32d815fa0 R15: 00007fd32d93fa48 [ 132.246227][ T6341] [ 132.249437][ T6341] Kernel Offset: disabled [ 132.253774][ T6341] Rebooting in 86400 seconds..