last executing test programs: 23m36.092008103s ago: executing program 3 (id=492): syz_emit_ethernet(0x1086, &(0x7f00000005c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd60efb0e4105021fffc000000000000000000000000000000fc020000000000000000000000000000330000000000000004010600000000006c04040204107f00fc000000000000000000000000000000fc02000000000000000000000000000021000000000000004e204e23047190788e222cc607900c1a5c2e241797822c8b1f3a308af00a95c7c1065a825a2f8ebb070816407cd872c82020de617146464fbbd31f39adb431407f19d9e831f886dd49ee46fcc0de87f03c9b76895243ca29ce92d59862775bf6eae0a78318208d58b26613e12f0a18073caacaa6164475e59dd165fd223c234c5c6b01d7d80a6be0fd1db678c5b8c62b701488da54d53c45a4d4c100a84ef85b4dadce322f3ffaadbbf6ac7f93f5ab50cdc4e018072dd4b97d0de7c138cd927c3e65ccface4ba10d4a6568f2351e5142b89095a444a4d34b6f4b0eee9f851d8d5f7b868fe44bed8af6bc8edb76320ba9d9966a4ce4d4c12427100a74b71feb7685a546557a39b634e132b2c8497e04568c28c3cc7b7c116039ee9fa9d9454f797984e1075649ac52fc5d59bfeceb92e7fbf29f324f57e0d890f0dece006e9c996bd2f4a87c95ae9c4decb92205657015ecd012d51ed9f032628f0c1974268d53456c4d968dede57e04d1328e09d032a051f8ac2f54e0c1c57d08d8b38fa01d454256fa23d6e11eebc4b180dbd1d65c8933b04e21e151a44db1745a8a44272445ef8a506339b64eb5bac5089595917b87de07838ad07e1bd32514018183a5e4af0d5fa2bc2ed4c0054858dadb97646c5a665d8b91723762b011ca7136a8b64d358140abc793f5895005d37cc286170223a2d3307cccba4f64fa8b845c7ebd7aae86b3c8a6b5adb410e78050f254eb7682c2ec449d651d60ee188dda2c2c4a041c44313847ad803b78106717862c41410bf00cbe5f9a8ca22241f4757bd6da0a630681076f9d0f265d0311f2dcc3af575e996095775a7346ca95d5a1251bd3879cdb840c46377a674b7c321f19338235ea816a83e519ba7905b8345b22999e98f4a6ac7a075fe29cc9ce9348548b02693e6620b86c691c30d9bfe4eb2e900217dca30c998019672fee3bf8701a69cc1760e06614a3a703df1c48905d6a0cf0876567868a9baa5ed7ce3a38f6318c9cac2059d706b901a3b95ed6ae55fc17bab1c8c56835649cdd175fcdc84237ee6ee2bd4a0a1a009cd03b2d24c7d325117f734fd0710660bcc6680a5ba60b18512a0d477267ccd0d38966321ecf4188c0e768b5e78fe612e9062aab54807f104a7d8cbdaddad57dec81ccaac31f56b70b49cfa187769ba2ab881698dfd0cfebaee184e4f970cdeb445f334e6e0e85a9fcaf25dd04dfb50fb010a728fc489deaa31f2913c59f5087c349dba0391cdbf95e83fcae6e6372da2fc50c756312f3480d2c8693e646dfca5e3fbb2cbaac6249c3289cd5115bc9350118b97ec67907f193001804adb5e2b859099a917d4811e541f61f5dcd2efca1908c81e3ee7b1f673b3e90d95e14b6df7b6c2354d612ec85d2a9e2ee7754fadc9b208f7d10578927d37444e479148916b5412ac9d32852875e12b4d2489b6d53b6eb86f5f22d5c69b68c06525753fcd6ded79a8d1f5c288ebd35d91aa71524faa4938eaf8af8aad9ec2c41ce127320594a4bb73c76c6b728c797b30efd58a2697375d1d27e40e2dccf0e6d7175b7f2675dfbed1023632c4ea828900a98c2168298f8701bcebe01da957231e8c9487d1b2d11ffbfb6d775ca35a73c6e45fde6fe08fec1eb0851a2073aa08eedba2dc30c66d2e74e6ad88dca2318908c15edb67dda859dbf3dac8925f81b873535a6d223a848e24e53679e22c41b9df389b9fc1a33c05516c39d61456876e1a1c85114155b099139184a9db905d3323785d81b15c21735f1e81f6777883ce8480f30c064f9ccfa4f61fc861a2aeb50e7f11394a37ee42f66c24443bc53767395385c3f14569608ce86509768593ef26ed8e2efa635b6a5d4c6158eb42a6a5633f2adcf259e5ef2655de0f5c2939ef4063747d7bd3661ab8504b9fda597a955fe1917593f39aea2f6995265f35c425e3de27b17af2ec60648b62f7c7e79b67002716592e90cff2a8eeb0f46c1c1fd271977b05b672258bd534035e7bf48c265e9481b7ad380d5a9850b5f09ad510942156355d06e957d6ac71e3ac33baba7fd89fce3d9fbdc0ed30bcdc35585d41df88b14ebb683344f70de97f1524142ee2e6293da41bf630e618f329f96c0c8642450043a2b44da687ff44c0c93abe58c67197e65a37a557d43f09e4a682aa02411f9a3d965c27cb24ac0c868ed1a1a42effe9dd3cbedac1976adaed32984b372d340c435fdcfa1d87af649a5b7d2a7ea1750838fc16a13580b7ce7b29b615d0c59ce87ed8a6a462edc02bde607c837d8836e1ac05e8dfe612b7ead57405bb84b7c9d9a876b102ac0a49523f5bb1c806295b591de52f686c85425a5debd39b353d01718965f377d9baeb58696e833ed03cc3a8c9809a5b2da943319f75dae57fcd16242ea84ed4851a727c6ed3cd8bbbf7ab7cd56bd2d6a828d8e2a4b886c643cb1964c136672f44d29a2cace9debf80606c1d49206e494340f26b50dbc88e97e5c74607ad84abd25fa6ae0d4a7d1605751de7dc8479216c2b7eacdd9d6b6c476187c0634e27d00f33d819c27706145275946a075fd0d0a5e019e27668bb135b83678b799edffae022f3a4b101891fb94149b92d84a59d933129341e75ebda6da219d289ea58482494af39b4f2a239d455569fe48518436407d3dfe430031b388bf7581ae63dc722ec8edc3f01393d22ce1b5f9d99cc2a6328f2ae6bb5d145a72d16d97808588ac2c9d1a3b3493e8a40a86c3c4e7bbfe966f010b957b597cd2e2090381645540075e5f99ec169df458adfaeb7a9b29be9ceb48407a2ce1981b19fc5d33e505ebf470cb44bda6c90222d43e23fbdefd72711fdb15b2118f5fe8201f7d712ff9293c51884f5c9dcc054a4e67a58fda4d581f67aa05c9ea82f9daa26db5344d37dc0f8089d6249015825dc100155fdf2fbf8bd4fe0a44f2ad457e3db36e3156f9315d7b3c999079a7cd9f641bc952f858510d0f9162d9e1d0e1f620e519d6bd1c25c258275e9fd49244490df39f03cc19fa01c639e83ea6eb5d1b74a3865c484c9c10f5e9db77c1ed75c606a56da5eaf7a83d9a2129d8cf9d8e04fe72c254fd59eb99e0b7a885cdd695f0f5fed80eb04f51022c7272bef29d449054555024c3dff253a133dc0cf02c725640d44a9572e5ab547e40806c36364861fbb0cf8d3c86db8cb4489570237be07c55f3ec56b95b167a0e1fd462ab9b457d62b55aac157ad5ac03d185a147ba4b24011cb1aa8f14c895aac78f71f206c23eb8555a3a0cf17ba15f9d0fb421adfd7abe0f574c28c652230cb576c9d9e2dda64b85ff8700383a8d666ca2f2a64c01914bfbd87b432b421676087a723781b2303848ff62e11d5032e87a42f438758b56ba6289f9d4e54919ed3f47d610af65bff2a1f4df6e3f72162b381f27ab329d92d3aa1b3ef5364b4a1225232687da7f705b1a41ff7d35518270adb46bc02e5b34df200febf3a2dd6de22bab44d5f7fa32364a67d75701d38842aaaf7102f2cff81914cad1d327bb65816a20a0fc03c045822189446e0ea852870e6b6627934aa2d4cc1e660ec10e88b95263d1a4b6638587dcb7b03e7559acea0f2a6ade0418175f6cb8db116abadd0a626a71b8e5afa4d1fc072b45b9d26580f208099dd49ede57b5b38d1f12dd70112ae1cd5beaaf204ffd32532a2638c342e7ca28da6842c6c66a0270b7fa6177dfeebcff8f73514cdfb3a167569083627d210d445cba7a8dd3a5fe33b018f95fb3715067854ef8e918ba77e9d903a4d5eeec498bc8bef4e4fda51026356771cf9168d2afa153ff3cf7ef736d374e88595aa487fd0858bb7590403418bd9a5a14da980c53405272a441d2c012b70c9ddf341c13ea484fc242e07643a93b62cf090942ef565d600e439b9f70131e6f37b14e5de1e28d72cac7ebf0c6743c174c4374b1e63b04b598491497211bc0f95aef3f61d831a739a7598360ea67ff9077861e5dcd1d0722956d6caf907cbb03be5c10e76e5b9e2b3cef791c917911f00e51a6015f3e3fe5359a8e2643ef14fa9f91b9a79b05483c6605143b54ecae41a046e3174975c41fe5a47b201718eb8ca66448658f04b9db975368915d317b1f252e2a0c92004a1ff833e32edf0a252cb958fcc326711483c8b6f86f06a0af2b27b08a64b6226da6643f69fd2d115e70f5d73b345b78fca3e54b38cf6ab6987a65fe62d517bf7ebb88f3be90a315350dcd438e1d8d44c9cba82c06cbcc95f801268b1e7bf22499ad0eb5e3d555b2e8ae78fb42296a9b88faf3e2edb7de664a6aba4ad6718469bc0ce225e22cef44a98d99bdf0281ca7695fea776a248214be9d673d1aeba6ad29a16cdea3ea374169d218b931cececf0fd61bae81378064a3776840c631876b5e5f70bf1103610088b943955f116886d28a880a67ac8d51b0228258e41c783fbcacc1eee1cbec926208ed8b550e81277adc37441134fb2883a66ab0c7b3d648ea697f694f70bca3ea4e84a62132162fd4e9fd4fe896bcff1d029cca83de90815bc4a318b32bc331c6e8ef6997558d918baf6c2aaa6c6de40bc0e7d5c5f833eaeb4df0c5fed936c0471cdde31f70197379f9485c98bcc3542e2f6c80b5de851392c1b4c1e67eb5a6989cd614786807bae28d920c5bf4fb8b19597d0a6314d80cef8837ead1612415b5d2c315ef5e6f8cc1778273661644acde04a17455fc7c5cf9db042c4a2b373a215b7d9b592dd5effcece44c54e79473a439dc22fc20252b301e1ab64df24b9ed3db28b79da81314dd29265bafd7779d17d4fcb746464d6d3c6ad49ca188c84d4b0b11c2babc4e20796305454ecb33ec22d98f0ce8232b884a0f49a4f3a2b0b62c41027a97360e75742658f986e1e9cd94f8a02aa8807155150a838c762b85d0fabc9355721ee4d9bdc2c9b85307177172672fd280e1ca51b17154e84ac2845871b224303a55fdedc583a059565c0ab1df6d4b07f0b2706393722c2c8a78c7e880e7886944db4f99965b78ac30ed1f"], 0x0) (async) syz_emit_ethernet(0x1086, &(0x7f00000005c0)=ANY=[@ANYBLOB="bbbbbbbbbbbbffffffffffff86dd60efb0e4105021fffc000000000000000000000000000000fc020000000000000000000000000000330000000000000004010600000000006c04040204107f00fc000000000000000000000000000000fc02000000000000000000000000000021000000000000004e204e23047190788e222cc607900c1a5c2e241797822c8b1f3a308af00a95c7c1065a825a2f8ebb070816407cd872c82020de617146464fbbd31f39adb431407f19d9e831f886dd49ee46fcc0de87f03c9b76895243ca29ce92d59862775bf6eae0a78318208d58b26613e12f0a18073caacaa6164475e59dd165fd223c234c5c6b01d7d80a6be0fd1db678c5b8c62b701488da54d53c45a4d4c100a84ef85b4dadce322f3ffaadbbf6ac7f93f5ab50cdc4e018072dd4b97d0de7c138cd927c3e65ccface4ba10d4a6568f2351e5142b89095a444a4d34b6f4b0eee9f851d8d5f7b868fe44bed8af6bc8edb76320ba9d9966a4ce4d4c12427100a74b71feb7685a546557a39b634e132b2c8497e04568c28c3cc7b7c116039ee9fa9d9454f797984e1075649ac52fc5d59bfeceb92e7fbf29f324f57e0d890f0dece006e9c996bd2f4a87c95ae9c4decb92205657015ecd012d51ed9f032628f0c1974268d53456c4d968dede57e04d1328e09d032a051f8ac2f54e0c1c57d08d8b38fa01d454256fa23d6e11eebc4b180dbd1d65c8933b04e21e151a44db1745a8a44272445ef8a506339b64eb5bac5089595917b87de07838ad07e1bd32514018183a5e4af0d5fa2bc2ed4c0054858dadb97646c5a665d8b91723762b011ca7136a8b64d358140abc793f5895005d37cc286170223a2d3307cccba4f64fa8b845c7ebd7aae86b3c8a6b5adb410e78050f254eb7682c2ec449d651d60ee188dda2c2c4a041c44313847ad803b78106717862c41410bf00cbe5f9a8ca22241f4757bd6da0a630681076f9d0f265d0311f2dcc3af575e996095775a7346ca95d5a1251bd3879cdb840c46377a674b7c321f19338235ea816a83e519ba7905b8345b22999e98f4a6ac7a075fe29cc9ce9348548b02693e6620b86c691c30d9bfe4eb2e900217dca30c998019672fee3bf8701a69cc1760e06614a3a703df1c48905d6a0cf0876567868a9baa5ed7ce3a38f6318c9cac2059d706b901a3b95ed6ae55fc17bab1c8c56835649cdd175fcdc84237ee6ee2bd4a0a1a009cd03b2d24c7d325117f734fd0710660bcc6680a5ba60b18512a0d477267ccd0d38966321ecf4188c0e768b5e78fe612e9062aab54807f104a7d8cbdaddad57dec81ccaac31f56b70b49cfa187769ba2ab881698dfd0cfebaee184e4f970cdeb445f334e6e0e85a9fcaf25dd04dfb50fb010a728fc489deaa31f2913c59f5087c349dba0391cdbf95e83fcae6e6372da2fc50c756312f3480d2c8693e646dfca5e3fbb2cbaac6249c3289cd5115bc9350118b97ec67907f193001804adb5e2b859099a917d4811e541f61f5dcd2efca1908c81e3ee7b1f673b3e90d95e14b6df7b6c2354d612ec85d2a9e2ee7754fadc9b208f7d10578927d37444e479148916b5412ac9d32852875e12b4d2489b6d53b6eb86f5f22d5c69b68c06525753fcd6ded79a8d1f5c288ebd35d91aa71524faa4938eaf8af8aad9ec2c41ce127320594a4bb73c76c6b728c797b30efd58a2697375d1d27e40e2dccf0e6d7175b7f2675dfbed1023632c4ea828900a98c2168298f8701bcebe01da957231e8c9487d1b2d11ffbfb6d775ca35a73c6e45fde6fe08fec1eb0851a2073aa08eedba2dc30c66d2e74e6ad88dca2318908c15edb67dda859dbf3dac8925f81b873535a6d223a848e24e53679e22c41b9df389b9fc1a33c05516c39d61456876e1a1c85114155b099139184a9db905d3323785d81b15c21735f1e81f6777883ce8480f30c064f9ccfa4f61fc861a2aeb50e7f11394a37ee42f66c24443bc53767395385c3f14569608ce86509768593ef26ed8e2efa635b6a5d4c6158eb42a6a5633f2adcf259e5ef2655de0f5c2939ef4063747d7bd3661ab8504b9fda597a955fe1917593f39aea2f6995265f35c425e3de27b17af2ec60648b62f7c7e79b67002716592e90cff2a8eeb0f46c1c1fd271977b05b672258bd534035e7bf48c265e9481b7ad380d5a9850b5f09ad510942156355d06e957d6ac71e3ac33baba7fd89fce3d9fbdc0ed30bcdc35585d41df88b14ebb683344f70de97f1524142ee2e6293da41bf630e618f329f96c0c8642450043a2b44da687ff44c0c93abe58c67197e65a37a557d43f09e4a682aa02411f9a3d965c27cb24ac0c868ed1a1a42effe9dd3cbedac1976adaed32984b372d340c435fdcfa1d87af649a5b7d2a7ea1750838fc16a13580b7ce7b29b615d0c59ce87ed8a6a462edc02bde607c837d8836e1ac05e8dfe612b7ead57405bb84b7c9d9a876b102ac0a49523f5bb1c806295b591de52f686c85425a5debd39b353d01718965f377d9baeb58696e833ed03cc3a8c9809a5b2da943319f75dae57fcd16242ea84ed4851a727c6ed3cd8bbbf7ab7cd56bd2d6a828d8e2a4b886c643cb1964c136672f44d29a2cace9debf80606c1d49206e494340f26b50dbc88e97e5c74607ad84abd25fa6ae0d4a7d1605751de7dc8479216c2b7eacdd9d6b6c476187c0634e27d00f33d819c27706145275946a075fd0d0a5e019e27668bb135b83678b799edffae022f3a4b101891fb94149b92d84a59d933129341e75ebda6da219d289ea58482494af39b4f2a239d455569fe48518436407d3dfe430031b388bf7581ae63dc722ec8edc3f01393d22ce1b5f9d99cc2a6328f2ae6bb5d145a72d16d97808588ac2c9d1a3b3493e8a40a86c3c4e7bbfe966f010b957b597cd2e2090381645540075e5f99ec169df458adfaeb7a9b29be9ceb48407a2ce1981b19fc5d33e505ebf470cb44bda6c90222d43e23fbdefd72711fdb15b2118f5fe8201f7d712ff9293c51884f5c9dcc054a4e67a58fda4d581f67aa05c9ea82f9daa26db5344d37dc0f8089d6249015825dc100155fdf2fbf8bd4fe0a44f2ad457e3db36e3156f9315d7b3c999079a7cd9f641bc952f858510d0f9162d9e1d0e1f620e519d6bd1c25c258275e9fd49244490df39f03cc19fa01c639e83ea6eb5d1b74a3865c484c9c10f5e9db77c1ed75c606a56da5eaf7a83d9a2129d8cf9d8e04fe72c254fd59eb99e0b7a885cdd695f0f5fed80eb04f51022c7272bef29d449054555024c3dff253a133dc0cf02c725640d44a9572e5ab547e40806c36364861fbb0cf8d3c86db8cb4489570237be07c55f3ec56b95b167a0e1fd462ab9b457d62b55aac157ad5ac03d185a147ba4b24011cb1aa8f14c895aac78f71f206c23eb8555a3a0cf17ba15f9d0fb421adfd7abe0f574c28c652230cb576c9d9e2dda64b85ff8700383a8d666ca2f2a64c01914bfbd87b432b421676087a723781b2303848ff62e11d5032e87a42f438758b56ba6289f9d4e54919ed3f47d610af65bff2a1f4df6e3f72162b381f27ab329d92d3aa1b3ef5364b4a1225232687da7f705b1a41ff7d35518270adb46bc02e5b34df200febf3a2dd6de22bab44d5f7fa32364a67d75701d38842aaaf7102f2cff81914cad1d327bb65816a20a0fc03c045822189446e0ea852870e6b6627934aa2d4cc1e660ec10e88b95263d1a4b6638587dcb7b03e7559acea0f2a6ade0418175f6cb8db116abadd0a626a71b8e5afa4d1fc072b45b9d26580f208099dd49ede57b5b38d1f12dd70112ae1cd5beaaf204ffd32532a2638c342e7ca28da6842c6c66a0270b7fa6177dfeebcff8f73514cdfb3a167569083627d210d445cba7a8dd3a5fe33b018f95fb3715067854ef8e918ba77e9d903a4d5eeec498bc8bef4e4fda51026356771cf9168d2afa153ff3cf7ef736d374e88595aa487fd0858bb7590403418bd9a5a14da980c53405272a441d2c012b70c9ddf341c13ea484fc242e07643a93b62cf090942ef565d600e439b9f70131e6f37b14e5de1e28d72cac7ebf0c6743c174c4374b1e63b04b598491497211bc0f95aef3f61d831a739a7598360ea67ff9077861e5dcd1d0722956d6caf907cbb03be5c10e76e5b9e2b3cef791c917911f00e51a6015f3e3fe5359a8e2643ef14fa9f91b9a79b05483c6605143b54ecae41a046e3174975c41fe5a47b201718eb8ca66448658f04b9db975368915d317b1f252e2a0c92004a1ff833e32edf0a252cb958fcc326711483c8b6f86f06a0af2b27b08a64b6226da6643f69fd2d115e70f5d73b345b78fca3e54b38cf6ab6987a65fe62d517bf7ebb88f3be90a315350dcd438e1d8d44c9cba82c06cbcc95f801268b1e7bf22499ad0eb5e3d555b2e8ae78fb42296a9b88faf3e2edb7de664a6aba4ad6718469bc0ce225e22cef44a98d99bdf0281ca7695fea776a248214be9d673d1aeba6ad29a16cdea3ea374169d218b931cececf0fd61bae81378064a3776840c631876b5e5f70bf1103610088b943955f116886d28a880a67ac8d51b0228258e41c783fbcacc1eee1cbec926208ed8b550e81277adc37441134fb2883a66ab0c7b3d648ea697f694f70bca3ea4e84a62132162fd4e9fd4fe896bcff1d029cca83de90815bc4a318b32bc331c6e8ef6997558d918baf6c2aaa6c6de40bc0e7d5c5f833eaeb4df0c5fed936c0471cdde31f70197379f9485c98bcc3542e2f6c80b5de851392c1b4c1e67eb5a6989cd614786807bae28d920c5bf4fb8b19597d0a6314d80cef8837ead1612415b5d2c315ef5e6f8cc1778273661644acde04a17455fc7c5cf9db042c4a2b373a215b7d9b592dd5effcece44c54e79473a439dc22fc20252b301e1ab64df24b9ed3db28b79da81314dd29265bafd7779d17d4fcb746464d6d3c6ad49ca188c84d4b0b11c2babc4e20796305454ecb33ec22d98f0ce8232b884a0f49a4f3a2b0b62c41027a97360e75742658f986e1e9cd94f8a02aa8807155150a838c762b85d0fabc9355721ee4d9bdc2c9b85307177172672fd280e1ca51b17154e84ac2845871b224303a55fdedc583a059565c0ab1df6d4b07f0b2706393722c2c8a78c7e880e7886944db4f99965b78ac30ed1f"], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x1004, 0x0) (async) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000005c0)='./binderfs/binder0\x00', 0x1004, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0xbf0, 0x1, 0xfffffffffffffffb, 0x5, 0xc0, 0xd8b, 0xa, 0x7, 0x4, 0x91, 0x4feb, 0xfd4, 0xffffffffffff0001, 0x800, 0x7, 0x2], 0xe000, 0x204000}) (async) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000440)={[0xbf0, 0x1, 0xfffffffffffffffb, 0x5, 0xc0, 0xd8b, 0xa, 0x7, 0x4, 0x91, 0x4feb, 0xfd4, 0xffffffffffff0001, 0x800, 0x7, 0x2], 0xe000, 0x204000}) ioctl$BINDER_GET_FROZEN_INFO(r3, 0xc00c620f, 0xfffffffffffffffd) (async) ioctl$BINDER_GET_FROZEN_INFO(r3, 0xc00c620f, 0xfffffffffffffffd) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000010000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000300)="67f30f090f01d1f366db080fc75fafbad004b80000ef260f01ca66b9800000c00f326635000100000f300f01ca0f3566b9330b000066b80c00000066ba000000000f30", 0x43}], 0x1, 0x0, 0x0, 0x0) r4 = socket(0x40000000015, 0x805, 0x0) getsockopt(r4, 0x114, 0x5, &(0x7f0000019100)=""/102399, &(0x7f00000000c0)=0x18fff) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x80000}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x1, 0xf, &(0x7f0000000140)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xf}, {{0x18, 0x1, 0x1, 0x0, r5}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x17}, {0x85, 0x0, 0x0, 0x6a}}}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x2c, '\x00', 0x0, @fallback=0x2a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), r4) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000240)={[0x5836, 0x8, 0x7, 0x4000000000000e51, 0x101, 0x5479, 0x103b, 0x200000000006, 0x0, 0x32a, 0x1, 0x1, 0x1, 0x40000000009, 0x8000000000005, 0x800000068], 0x8080000, 0xdd1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 23m32.806109465s ago: executing program 3 (id=499): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x20, 0x0) 23m32.468462014s ago: executing program 3 (id=500): r0 = socket$nl_rdma(0x10, 0x3, 0x14) recvmsg(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000000)=""/216, 0xd8}, {&(0x7f0000000100)=""/150, 0x96}, {&(0x7f00000001c0)=""/231, 0xe7}, {&(0x7f00000002c0)=""/108, 0x6c}, {&(0x7f0000000340)=""/169, 0xa9}], 0x5, &(0x7f0000000480)=""/240, 0xf0}, 0x40012000) r1 = openat$mice(0xffffffffffffff9c, &(0x7f00000005c0), 0x4000) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0286405, &(0x7f0000000600)={0x0, 0x0, {0x0}, {}, 0xa, 0x7}) prctl$PR_SCHED_CORE(0x3e, 0x3, r2, 0x0, &(0x7f0000000640)) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000680)={0x0, 0x1ff, 0x9, 0x6, 0x3, [0x0, 0x0, 0x0, 0x0], [0x110819c0, 0x0, 0x81, 0x9], [0x7, 0x2, 0xf, 0x1], [0x7a7, 0x80, 0x7]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000700)={r3, 0x80000}) getsockopt$ARPT_SO_GET_INFO(r1, 0x0, 0x60, &(0x7f0000000740)={'filter\x00', 0x0, [0x6, 0x9, 0xffffff45]}, &(0x7f00000007c0)=0x44) r6 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000800), 0x2, 0x0) r7 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000840), 0x24000, 0x0) recvmmsg(r0, &(0x7f0000004840)=[{{0x0, 0x0, &(0x7f0000000d80)=[{&(0x7f0000000880)=""/26, 0x1a}, {&(0x7f00000008c0)=""/173, 0xad}, {&(0x7f0000000980)=""/4, 0x4}, {&(0x7f00000009c0)=""/60, 0x3c}, {&(0x7f0000000a00)=""/254, 0xfe}, {&(0x7f0000000b00)=""/178, 0xb2}, {&(0x7f0000000bc0)=""/52, 0x34}, {&(0x7f0000000c00)=""/97, 0x61}, {&(0x7f0000000c80)=""/231, 0xe7}], 0x9, &(0x7f0000000e40)=""/199, 0xc7}, 0x80000000}, {{0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000f40)=""/32, 0x20}], 0x1, &(0x7f0000000fc0)=""/72, 0x48}, 0x10000}, {{&(0x7f0000001040)=@xdp={0x2c, 0x0, 0x0}, 0x80, &(0x7f0000002300)=[{&(0x7f00000010c0)=""/4096, 0x1000}, {&(0x7f00000020c0)=""/222, 0xde}, {&(0x7f00000021c0)=""/72, 0x48}, {&(0x7f0000002240)=""/67, 0x43}, {&(0x7f00000022c0)=""/25, 0x19}], 0x5}, 0x1}, {{&(0x7f0000002380)=@l2tp6={0xa, 0x0, 0x0, @dev}, 0x80, &(0x7f0000002700)=[{&(0x7f0000002400)=""/212, 0xd4}, {&(0x7f0000002500)=""/82, 0x52}, {&(0x7f0000002580)=""/156, 0x9c}, {&(0x7f0000002640)=""/166, 0xa6}], 0x4}, 0x8}, {{&(0x7f0000002740)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @mcast2}}}, 0x80, &(0x7f0000002b00)=[{&(0x7f00000027c0)=""/49, 0x31}, {&(0x7f0000002800)=""/210, 0xd2}, {&(0x7f0000002900)=""/129, 0x81}, {&(0x7f00000029c0)=""/108, 0x6c}, {&(0x7f0000002a40)=""/138, 0x8a}], 0x5, &(0x7f0000002b80)=""/160, 0xa0}, 0x401}, {{&(0x7f0000002c40)=@x25, 0x80, &(0x7f0000002e80)=[{&(0x7f0000002cc0)=""/181, 0xb5}, {&(0x7f0000002d80)=""/235, 0xeb}], 0x2}, 0x4}, {{&(0x7f0000002ec0)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @initdev}}}, 0x80, &(0x7f0000003240)=[{&(0x7f0000002f40)=""/35, 0x23}, {&(0x7f0000002f80)=""/1, 0x1}, {&(0x7f0000002fc0)=""/154, 0x9a}, {&(0x7f0000003080)=""/205, 0xcd}, {&(0x7f0000003180)=""/30, 0x1e}, {&(0x7f00000031c0)=""/86, 0x56}], 0x6, &(0x7f00000032c0)=""/175, 0xaf}, 0x7}, {{&(0x7f0000003380)=@nl=@unspec, 0x80, &(0x7f00000045c0)=[{&(0x7f0000003400)=""/165, 0xa5}, {&(0x7f00000034c0)=""/150, 0x96}, {&(0x7f0000003580)=""/4096, 0x1000}, {&(0x7f0000004580)=""/52, 0x34}], 0x4, &(0x7f0000004600)=""/110, 0x6e}, 0x4}, {{&(0x7f0000004680)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private2}}}, 0x80, &(0x7f00000047c0)=[{&(0x7f0000004700)=""/90, 0x5a}, {&(0x7f0000004780)=""/10, 0xa}], 0x2, &(0x7f0000004800)=""/15, 0xf}, 0xfff}], 0x9, 0x0, &(0x7f0000004a80)) ioctl$DMA_HEAP_IOCTL_ALLOC(r1, 0xc0184800, &(0x7f0000004ac0)={0x100000001, r6}) openat$rtc(0xffffffffffffff9c, &(0x7f0000004b00), 0x80800, 0x0) syz_open_dev$usbmon(&(0x7f0000004b40), 0x23fb, 0x4800) ioctl$COMEDI_BUFCONFIG(r11, 0x8020640d, &(0x7f0000004b80)={0x7fffffff, 0x7fffffff, 0x0, 0x6}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r9, 0x89f3, &(0x7f0000004c80)={'ip6gre0\x00', &(0x7f0000004c00)={'syztnl0\x00', r8, 0x29, 0x80, 0xfb, 0x200, 0x40, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local, 0x7, 0x8000, 0xffffffff, 0x7fff}}) sendmsg$nl_route(r11, &(0x7f0000004d80)={&(0x7f0000004bc0)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000004d40)={&(0x7f0000004cc0)=@ipv6_getaddr={0x44, 0x16, 0x400, 0x70bd28, 0x25dfdbfb, {0xa, 0x1, 0x1, 0xc8, r12}, [@IFA_LOCAL={0x14, 0x2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}, @IFA_FLAGS={0x8}, @IFA_RT_PRIORITY={0x8, 0x9, 0x1}, @IFA_FLAGS={0x8, 0x8, 0xa9}]}, 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x200000c0) fcntl$lock(r9, 0x26, &(0x7f0000004dc0)={0x2, 0x3, 0x4dd, 0x100000000, r2}) r13 = accept4$unix(r1, &(0x7f0000004e00), &(0x7f0000004e80)=0x6e, 0x0) r14 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_DEFAULT_SNDINFO(r14, 0x84, 0x22, &(0x7f0000004ec0)={0x8, 0x8, 0xfffffffd, 0x2}, 0x10) ioctl$sock_SIOCSIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r13, 0x8983, &(0x7f0000004f00)={0x8, 'ip6_vti0\x00', {}, 0x5}) setsockopt$inet6_int(r10, 0x29, 0x18, &(0x7f0000004f40)=0x284, 0x4) ioctl$DRM_IOCTL_MODE_GETPLANE(r1, 0xc02064b6, &(0x7f0000004fc0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x7, &(0x7f0000004f80)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_PANTHOR_BO_CREATE(r1, 0xc0186445, &(0x7f0000005000)={0x7, 0x3, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_ADDFB2(r7, 0xc06864b8, &(0x7f0000005040)={r15, 0x200, 0x1, 0x5, 0x3, [r5, r4, r5, r16], [0x5, 0xd, 0x0, 0x1e5], [0x1, 0x4, 0xfffffffd, 0x1000], [0x2, 0x3, 0x4, 0x2]}) openat$ttyprintk(0xffffffffffffff9c, &(0x7f00000050c0), 0x10080, 0x0) syz_kvm_setup_cpu$x86(r13, r11, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000005180)=[@text32={0x20, &(0x7f0000005100)="66baf80cb8fa7e448aef66bafc0c66b8fa6f66ef0f38cd6e00440f20c0350a000000440f22c0c74424000f000100c74424020c000000c7442406000000000f011c24c4c2e9971a0f01c466b80c010f00d88fc804a2710303b98d0a00000f3266baf80cb8eb3cd18eef66bafc0cb018ee", 0x70}], 0x1, 0x22, &(0x7f00000051c0), 0x0) r17 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$TIPC_NL_MEDIA_SET(r17, &(0x7f0000005440)={&(0x7f0000005200)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000005400)={&(0x7f0000005280)={0x154, 0x0, 0x2, 0x70bd2a, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x48, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x800}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x800}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x7}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x9}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x3}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x100000001}]}, @TIPC_NLA_NET={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x1ff}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x1}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x611}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0xffffffffffffffff}]}, @TIPC_NLA_NODE={0x14, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x80}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4230cd5}]}, @TIPC_NLA_NET={0x68, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x8}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x2}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x5}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x2}, @TIPC_NLA_NET_ID={0x8}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x2}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0xfffffffe}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0xfffffffc}]}, @TIPC_NLA_MEDIA={0x50, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1f}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}]}, 0x154}, 0x1, 0x0, 0x0, 0x48000}, 0x10) 23m31.379057359s ago: executing program 3 (id=504): r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000001340)=ANY=[@ANYBLOB="bf16000000000000b70700000100f0ff4870000000000000200000000000e0ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f55ee988e6e06c8206ac6939fc404004900c788b277be1cb79b0a4dcf3ed410f6accd3641110bec4e90a634199e07f8f6eb9604000e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e468eea13c9a77e1c89c5082a703fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea7042ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850bf895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2200af6c7784a1975fabc0c4dd418c005479ecab19bdfb15a32a4fd67ce446adb431d7e74853b7978639be2463308af07db79240acaf0910300000077d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061622718551c20ec23812770d72c700a44e113d17088fdd00600000f7889b8d7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f740586903500090000000000000000be34b10f9d640dd782ac0cbc0abcf72846903243d0d0f4bc7fb0a0d7c5000032daaf281c450e64c33aac8ff7e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b4bfaf5a6b649dd5f13cd776e6c7c4b5c4b0de20e0c81efb5e392a13cdd2ce219e6733b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e863fef0ad9d1ac32276cffe5f1fc21390797d0244cf1ce269d10525745caaa3f77d1b80116cb385a0242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025e2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da09fe8681916d408d753226a83ae2424ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd911e0e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f55136628090702f70000d0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c685492a1689ad4218cea744b332ab232a09cf1ec375627074ce2d3d7619936768a84a1465fff4610cf8838b28319e0f79533d87eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507818231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb511164f1502ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f278ea00cee8a2088359946e726aef83d9ff9281ab79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df0000000010c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481c55e86dcd7816ad8940bd19953603000000adeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016be64dc097982e23462392a0cd05afb2e060fd6424a942ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1af45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5d81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b1495213060000000000000049584655c4fce8c5bb7c54664aef6d780100358aa54bcb49926c4be9ee4659153d9fa95d07cc4efdab2c355efe8e8d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6122f572047ccf3c8edd82660e5d74c52be71d780c30000000000fd00000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f2def52394db3e9d8318bbb9baff3db95bfd69e08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d05b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0a832f5194ddfce51e5aff28f621bb2fd2a5ab719df823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c3348329b0ee77d93596e3f1287552e0c8cdb326c5118d2e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e26aa90c571fa3c07238697b13c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170e42f28cea4105541e11c8605628b9ca935bc252fee8b596a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babb8fa16f3182c5b98493a5aa943aa3a777a751f56e0c7a74f7f63d83ff119561acd5fe560563b051dc29ac586b21148ad5a5498369ac347d19660c132b1df58d65418bc824d8b88b699462c2ce6524eaf0905445413033f041a26b189f2553ef218eba22152a4dc979a0e37396ae1a2883b1e4d44c8af7973d5c1f286c26459209db5a9a51dc69d0ba3fb6c884e50be3598ac53295137c97dabe52d98fed0b352c0b68b7e75ed59931ef57bb5fc28d5b1f914fc8abbb444637a5dfbac5035eb0713efb823360a8da80e4265e599f76952a8082b8c5f7890275a922cd2ccaaf75dcca6849e89e1bab32fe9b598c61d7565dc6ab0a6d43b60f8d08ddf27a286807692d18973edaa6d5401c79b3cafaab4a8d6c946cbe5de350000000022e16a5f72c6d41dc9de8517fdcfa0c0efca880257443cfc3057c353569ffb1588b4bb261a6e99c5936e1b4339d87ec84db99e797f44451fc6b5da1950d24b3d4118f2288804740e605500c1f493c7dc42164cc6c1b01a329ce95272a07a355d4ba705b5e71ce5e1042a0c638e565881e5eedbc62f79407b73ae787c9cdb752eda44aeef962c93ab245f61e8ca5c0d41cc56124840f1b2b30be599fea0afaf905f90dd3e55fef0b94afbfd7144b7"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x41}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r0, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="000000952ba30000000000000000", 0x0, 0x6639, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 23m30.913681777s ago: executing program 3 (id=508): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'pim6reg\x00'}) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_type(r1, &(0x7f0000000240), 0x9) r4 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) write$cgroup_pid(r4, &(0x7f0000000380), 0x12) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f000003a000/0x1000)=nil, &(0x7f00006ef000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r5, &(0x7f0000002700)={0x2020}, 0x2020) syz_usb_connect(0x0, 0x2e, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004044f4a4f73279045179dc6c31e808c3064780000100020301090a1c0001010080fa0904030000010100000a240100010a00020102"], 0x0) 23m29.86638714s ago: executing program 2 (id=510): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x20, 0x0) 23m29.226601177s ago: executing program 2 (id=514): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'pim6reg\x00'}) r1 = openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_type(r1, &(0x7f0000000240), 0x9) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x3, &(0x7f000063c000/0x3000)=nil) mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f000003a000/0x1000)=nil, &(0x7f00006ef000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r3, &(0x7f0000002700)={0x2020}, 0x2020) syz_usb_connect(0x0, 0x2e, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004044f4a4f73279045179dc6c31e808c3064780000100020301090a1c0001010080fa0904030000010100000a240100010a00020102"], 0x0) 23m27.812783954s ago: executing program 3 (id=517): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDADDIO(r0, 0x4b34, 0x7) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = epoll_create1(0x80000) (async) syz_clone3(&(0x7f0000000080)={0x901400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) select(0x40, &(0x7f0000000040)={0x9, 0x4, 0xff, 0x1, 0x7, 0x1, 0x1, 0x2ec1}, 0x0, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f00000003c0)={0x90000011}) (async) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x20000149) (async) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, 0x0, 0x0) r5 = socket(0x11, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x803, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000500)={0x48, 0x2, r7}) (async) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) close_range(r8, 0xffffffffffffffff, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) (async) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000240)={0x5, {{0x2, 0x4e21, @multicast2}}}, 0x88) (async) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x5) pipe2$9p(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$bpf(0x0, 0x0, 0x0, 0x834, &(0x7f0000000240)=ANY=[@ANYRESHEX, @ANYRESOCT]) (async) mount$9p_fd(0x0, &(0x7f0000002500)='./file7\x00', &(0x7f0000002540), 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r10, @ANYBLOB=',wfdno=', @ANYRESHEX=r11, @ANYBLOB="2c616e616d653d62c58c09d6cb19a2712c76657273696f6e3d3970323030302c63616368653d"]) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r9, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003740)=@newtaction={0xeb8, 0x30, 0xb, 0x0, 0x0, {}, [{0xea4, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x81, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe58, 0x2, 0x0, 0x0, {{0xa}, {0xe2c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x20003, 0xfffffffc}, {0x6, 0x400, 0x8, 0x9, 0x6, 0x7}, {0x5, 0x5, 0xffffffbc, 0x80, 0x3}, {0x3ff, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x80003}, {0xffffffff, 0x3, 0x80, 0x0, 0xacc4, 0x42}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0x1001, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4}, {0x8004, 0x80000001, 0xfffffeff, 0xdf, 0x4, 0x1}, {0x7, 0x80000001, 0x9, 0x7, 0x1000, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x594}, {0x7fffffff, 0x8001, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x310, 0xf}, {0x9b7d, 0x52fc, 0x3, 0x3, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x8, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff419, 0x1, 0x3fd, 0x9}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0xffff, 0x0, 0x3ff, 0x1, 0x400}, {0xf, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x1, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x381, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x5, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0xeb1}, {0xf85, 0x2e, 0x401, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000}, {0x4e2, 0x6b0, 0x2, 0x100, 0x4, 0xd}, {0x4, 0xcad, 0xa5, 0x2, 0x4d800, 0x33}, {0x20, 0x2000007f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x8, 0x0, 0x1}, {0x2, 0x8, 0x2, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0x800}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x3, 0x4, 0x800, 0xf}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0x100, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x3, 0x40007023, 0x1ff, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x0, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0xc000, 0x2, 0x89, 0x2}, {0x10001, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x1, 0x7, 0x2}, {0x7, 0x1, 0x9, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x5}, {0x100, 0x3ff, 0x4, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x4, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xffd, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x8, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x7f, 0x8}, {0x5, 0x25b, 0xe9, 0x3, 0x2, 0x2}, {0x29dbdf0, 0x9, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x55, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800000, 0x3, 0x10, 0x9}, {0x7f, 0x4, 0x6, 0x2, 0x3, 0x5}, {0xfffffff7, 0x80000000, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x40}, {0x6, 0xd, 0x8, 0xfb0000, 0x1, 0x7}, {0xe0, 0x100, 0xf9, 0x7, 0x8, 0x7}, {0xfff, 0x1, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x54, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0xfffffff9, 0x10001, 0x2, 0xce}, {0x4, 0x2, 0x8, 0x3, 0xf, 0x9}, {0x7, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0xc, 0x4, 0x7, 0x4}, {0x4, 0x5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0x40c651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0x1, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x8}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0x1ac6}, {0xa, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdd}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x7, 0x3, 0x400, 0x7e}, {0x970, 0x8000100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0xfffffffe, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x4, 0x101, 0xef}, {0x709e, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x3ff, 0x4, 0x8, 0x5}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d3, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x1, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x808, 0xfffffff9, 0xa, 0x4b64, 0x80000001}, {0x2ad78a25, 0x2, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x2129, 0xebd8}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xf933271}, {0x4a3, 0x0, 0x3, 0x514c, 0xf8b, 0x19}], [{0x5}, {0x4, 0x1}, {}, {0x4}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x5}, {0x3}, {0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {0x4, 0x1}, {0x2}, {0x3}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {}, {0x3}, {0x0, 0x1}, {0x5}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x1, 0x1}, {0x1}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x3, 0x1}, {0x2}, {0x0, 0x1}, {0x2}, {0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x4}, {0x2, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4, 0x1}, {0x6, 0x1}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x8, 0x5, 0x0, 0x1, [{0x4}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb8}}, 0x0) 23m26.120161937s ago: executing program 0 (id=522): ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix={0xfff, 0xcf6, 0x59455247, 0x2, 0xfffffffe, 0x0, 0xb, 0x1, 0x0, 0x2}}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000240)=0x1) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000280)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1000}}, './rpc_pipe\x00'}) ioctl$vim2m_VIDIOC_ENUM_FMT(0xffffffffffffffff, 0xc0405602, &(0x7f0000000000)={0x1, 0x1, 0x10, "da0da0e6dcd2d54c7d93dc83833dd3e83b8b02ef53d27f694e8fcc90a392de2d", 0x33363248}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./mnt\x00', 0x1ff) r0 = open(&(0x7f00000001c0)='./file0\x00', 0x60840, 0x5a) fcntl$setlease(r0, 0x400, 0x1) removexattr(&(0x7f0000000040)='./file0\x00', &(0x7f0000000080)=@known='user.incfs.metadata\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./rpc_pipe\x00', 0x1ff) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0xb, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x3, 0xfdd, &(0x7f0000000540)=""/4061, 0x0, 0x24, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x63ff}, 0x94) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000000)={0x3, 0x0, &(0x7f0000000040)={&(0x7f0000000980)=ANY=[@ANYBLOB="02030003160000002cbd7000ffdbdf2502000900080000001c00000000000000050006003c0000000a004e2400000008ff01000000000000000000000000000100000000000000000200010000000000000009fd000000c005000500000000000a004e24000000090000000000000000000000000000000006000000030000000600"], 0xb0}, 0x1, 0x7}, 0x18004) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r2, 0x4020565a, &(0x7f00000000c0)={0x3, 0x10980900, 0x1}) r3 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000440)=@base={0xa, 0x9, 0x8, 0x2, 0x100}, 0x50) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={r3, &(0x7f0000001380), &(0x7f0000000000)=""/10, 0x2}, 0x20) mount(&(0x7f0000000300)=@filename='127.0.0.1:/test\x00', &(0x7f0000000080)='./mnt\x00', &(0x7f0000000000)='ntfs3\x00', 0x0, &(0x7f0000000380)='addr=127.0.0.1,port=2049,proto=tcp,vers=3,mountport=2049,mountproto=tcp\x00') 23m26.118258921s ago: executing program 2 (id=523): timer_create(0x0, 0x0, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9) timer_settime(r0, 0x1, &(0x7f0000000040), 0x0) r1 = timerfd_create(0x0, 0x0) timerfd_settime(r1, 0x3, 0x0, 0x0) 23m26.038962792s ago: executing program 0 (id=524): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', 0x0, &(0x7f0000000300)='jffs2\x00', 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000200)='./file0\x00', 0x0, 0x20, 0x0) 23m25.947428251s ago: executing program 0 (id=525): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x7, &(0x7f0000000240)={0x1, &(0x7f0000000000)=[{0x6, 0x85, 0x9, 0x7ffc0001}]}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000030c0)=ANY=[], 0xe8}, 0x1, 0x0, 0x0, 0x80}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f0000000100)='proc\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r0, 0x0, 0x0) bpf$BPF_BTF_GET_NEXT_ID(0x17, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) 23m25.590153676s ago: executing program 0 (id=527): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'pim6reg\x00'}) openat$cgroup_type(r0, &(0x7f0000000100), 0x2, 0x0) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r3 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f000003a000/0x1000)=nil, &(0x7f00006ef000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r4, &(0x7f0000002700)={0x2020}, 0x2020) syz_usb_connect(0x0, 0x2e, &(0x7f0000000040)=ANY=[@ANYBLOB="120100020000004044f4a4f73279045179dc6c31e808c3064780000100020301090a1c0001010080fa0904030000010100000a240100010a00020102"], 0x0) 23m24.889974913s ago: executing program 2 (id=528): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x24004045) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000280), 0x4000000004002, 0x0) syz_genetlink_get_family_id$gtp(&(0x7f0000000180), 0xffffffffffffffff) r1 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r1, 0x5000) sendto$inet6(r1, 0x0, 0x0, 0x8810, &(0x7f0000001500)={0xa, 0x4e21, 0x8, @loopback, 0xfffffffb}, 0x1c) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20004041, 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x6, &(0x7f0000000080)=0x2, 0x4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000580), 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) syz_open_dev$video4linux(0x0, 0x3, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='pagemap\x00') madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) (fail_nth: 1) write$binfmt_aout(r1, 0x0, 0xffffffdb) add_key$keyring(&(0x7f0000000140), &(0x7f0000000200)={'syz', 0x3}, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 23m23.951684398s ago: executing program 2 (id=530): r0 = syz_io_uring_setup(0x223d, &(0x7f0000000400)={0x0, 0x268cc, 0x1, 0x0, 0x40054}, &(0x7f0000000000), &(0x7f0000000040), &(0x7f0000000140)) io_uring_register$IORING_REGISTER_FILES(r0, 0x23, 0x0, 0x0) 23m23.781811648s ago: executing program 2 (id=531): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000002c0)={0x8408001e}, 0x10) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)='ubifs\x00', 0x1000, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) rmdir(&(0x7f0000000640)='./file0\x00') r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = add_key(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) add_key(0x0, 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b05003034313230300603551f030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b46064744", 0x150, r3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), r5) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001ec0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100273d7000ffdb7132172f0000180001801400020064756d6d7930"], 0x2c}}, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=@bridge_getneigh={0x28, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x0, 0x2000a}, [@IFLA_WEIGHT={0x8, 0xf, 0xfffffffb}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008451}, 0x20000800) r8 = socket$inet6(0xa, 0x3, 0x83) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@dev={0xac, 0x14, 0x14, 0x35}, 0x4e1f, 0x0, 0x0, 0x42, 0xa, 0x0, 0x0, 0x29}, {0xec, 0x8000000000000000, 0x1, 0x6811221d, 0x5, 0x2, 0x200000200000003, 0x110000000}, {0x4000a, 0xfffffffffffffffd, 0x6, 0x7}, 0x3, 0x6e6bb5, 0x1, 0x0, 0x6, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x2, @in6=@mcast2, 0x3506, 0x1, 0x2, 0x1, 0x7, 0x7, 0xfffffffd}}, 0xe8) 23m22.397702813s ago: executing program 0 (id=532): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeeb, 0x8031, 0xffffffffffffffff, 0xc36e5000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x1b, 0x0, 0x0) io_uring_setup(0x1020, 0x0) ioctl$KDSKBLED(0xffffffffffffffff, 0xc0686611, 0x20000081) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') pread64$ublk_ch(r4, &(0x7f0000001f80)=@buf_max_buf, 0x1000, 0x100000000801) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(0xffffffffffffffff, 0x2, &(0x7f0000000180), 0xfe) bind$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, 0x0, 0x0) r5 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000040)='/sys/kernel/debug/binder/transaction_log\x00', 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r7 = syz_usb_connect(0x9, 0x57, &(0x7f0000000000)=ANY=[@ANYRES16=r5, @ANYRESHEX, @ANYRES32=0x0, @ANYRES64=r5, @ANYRES64=r5], 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x332b4000) r8 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_IOVA_RANGES(r8, 0x3b84, &(0x7f0000000000)={0x20, 0x0, 0x1, 0x0, &(0x7f00000022c0)=[{}]}) syz_usb_control_io(r7, 0x0, 0x0) 23m18.708655873s ago: executing program 0 (id=541): syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x3e2}, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, {0xb, 0xffff}, {0xffff, 0xfff2}, {0x1}}}, 0x24}}, 0x4000080) socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) socket(0x15, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x200000) syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x403) syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) socket(0x2, 0x80805, 0x0) socket(0x10, 0x3, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xfd94, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea4, 0x9, @mcast1, 0x8}, r3, 0x8001}}, 0x48) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 23m12.34571828s ago: executing program 32 (id=515): prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0xffffffffffffffff}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) personality(0x619641b6fb4b8591) r0 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4001, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) syz_open_dev$video4linux(&(0x7f0000001140), 0x8066, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r1, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x48, r2, 0x1, 0x48000000, 0x25dfdbff, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @initial, {0x0, 0x400}}, @sp_mp_open={0xf, 0x1, {0x1913, {}, @val={0x72, 0x6}, @void}}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x408d4}, 0x0) 23m12.240830888s ago: executing program 33 (id=517): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$KDADDIO(r0, 0x4b34, 0x7) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) (async) r2 = socket$inet_tcp(0x2, 0x1, 0x0) r3 = epoll_create1(0x80000) (async) syz_clone3(&(0x7f0000000080)={0x901400, &(0x7f0000000000)=0xffffffffffffffff, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) select(0x40, &(0x7f0000000040)={0x9, 0x4, 0xff, 0x1, 0x7, 0x1, 0x1, 0x2ec1}, 0x0, 0x0, 0x0) (async) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r4, &(0x7f00000003c0)={0x90000011}) (async) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) (async) connect$inet(r2, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x20000149) (async) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, 0x0, 0x0) r5 = socket(0x11, 0x3, 0x0) writev(0xffffffffffffffff, 0x0, 0x0) socket(0x10, 0x803, 0x0) r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000500)={0x48, 0x2, r7}) (async) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0001}]}) close_range(r8, 0xffffffffffffffff, 0x0) (async) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) (async) setsockopt$inet_MCAST_JOIN_GROUP(r5, 0x0, 0x2a, &(0x7f0000000240)={0x5, {{0x2, 0x4e21, @multicast2}}}, 0x88) (async) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) (async) renameat2(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x5) pipe2$9p(&(0x7f00000005c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) mount$bpf(0x0, 0x0, 0x0, 0x834, &(0x7f0000000240)=ANY=[@ANYRESHEX, @ANYRESOCT]) (async) mount$9p_fd(0x0, &(0x7f0000002500)='./file7\x00', &(0x7f0000002540), 0x2, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r10, @ANYBLOB=',wfdno=', @ANYRESHEX=r11, @ANYBLOB="2c616e616d653d62c58c09d6cb19a2712c76657273696f6e3d3970323030302c63616368653d"]) (async) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r9, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000003740)=@newtaction={0xeb8, 0x30, 0xb, 0x0, 0x0, {}, [{0xea4, 0x1, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x81, 0x0, 0x0, 0x0, 0x80006}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_pedit={0xe58, 0x2, 0x0, 0x0, {{0xa}, {0xe2c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS_EX={0xe20, 0x4, {{{0x5, 0xa, 0x4, 0x1, 0x2000000}, 0x5, 0x1}, [{0x9, 0x80000001, 0x1, 0x630, 0x8, 0x1}, {0xdf, 0x4, 0x5, 0x5, 0x10, 0xe}, {0x1, 0x85a, 0x5, 0xe6db, 0x20003, 0xfffffffc}, {0x6, 0x400, 0x8, 0x9, 0x6, 0x7}, {0x5, 0x5, 0xffffffbc, 0x80, 0x3}, {0x3ff, 0xf5, 0x3, 0x9, 0xffffbff8, 0x3}, {0x0, 0x7, 0xfff, 0x2, 0x9163ef6c, 0x80003}, {0xffffffff, 0x3, 0x80, 0x0, 0xacc4, 0x42}, {0x8001, 0xffb, 0x9, 0xffff, 0xfffffffe, 0x81}, {0x8, 0x1001, 0x6, 0xeb84, 0x8, 0x30c4}, {0x7, 0x9, 0xfffffffc, 0x100, 0x4}, {0x8004, 0x80000001, 0xfffffeff, 0xdf, 0x4, 0x1}, {0x7, 0x80000001, 0x9, 0x7, 0x1000, 0x7}, {0x5, 0x2, 0xfffffffd, 0x9, 0x474, 0x594}, {0x7fffffff, 0x8001, 0x8, 0xfffffff9, 0x6, 0xffffffff}, {0x24, 0x5, 0xf, 0x6, 0x6, 0x8000003}, {0xbb, 0x5, 0x2, 0x310, 0xf}, {0x9b7d, 0x52fc, 0x3, 0x3, 0x48, 0x9}, {0xbd, 0x8, 0x10, 0xe4d, 0x7f, 0x3}, {0x8, 0x8, 0x9, 0x27, 0x2, 0x5}, {0x4, 0x1000, 0x5, 0x6, 0x93e, 0x6}, {0x1, 0x7, 0x0, 0x1, 0xff, 0x3}, {0xb, 0x7f, 0xfffff419, 0x1, 0x3fd, 0x9}, {0x4, 0x8, 0x7, 0xb, 0x8, 0x80004d}, {0x34db, 0xffff, 0x0, 0x3ff, 0x1, 0x400}, {0xf, 0xcb1d, 0x8, 0x1, 0x0, 0x4}, {0x5, 0x3, 0x7, 0x8, 0x3, 0x984}, {0x2, 0xffffffff, 0x1, 0x2, 0x9, 0x40}, {0x7, 0x281, 0x7fffffff, 0x381, 0x3, 0x8}, {0x5, 0x4, 0x1, 0x8, 0x4, 0x2f}, {0x6, 0x3, 0x4, 0xd1a1, 0x9, 0x7}, {0x5, 0x3, 0x8, 0x4, 0x16, 0x2}, {0x8001, 0x87, 0x5, 0x1, 0x3, 0x4}, {0x6, 0x9e4, 0x8b7f, 0x11, 0x3}, {0x7, 0x1, 0x800, 0x70f, 0x8001, 0x3}, {0x4, 0x10, 0x6, 0x1, 0x4, 0x22ff}, {0x5, 0x10001, 0x9, 0x0, 0x10001, 0xeb1}, {0xf85, 0x2e, 0x401, 0x3, 0x100, 0xe60c}, {0x2, 0x5, 0x1, 0xe000000}, {0x4e2, 0x6b0, 0x2, 0x100, 0x4, 0xd}, {0x4, 0xcad, 0xa5, 0x2, 0x4d800, 0x33}, {0x20, 0x2000007f, 0x33, 0x2, 0x400, 0x4}, {0x4, 0x62e, 0xb, 0x219c, 0x0, 0x5}, {0x0, 0x4, 0x0, 0x1, 0x1, 0x1}, {0x7f, 0x945a, 0x0, 0x0, 0x8, 0x3}, {0xda1, 0x893, 0x2, 0x9, 0xfffffa2e, 0x6}, {0x1, 0xfffffff3, 0x7fffffff, 0x8, 0x0, 0x1}, {0x2, 0x8, 0x2, 0xe, 0x2, 0x2}, {0x6, 0x100, 0xe, 0x10000, 0x5, 0x7}, {0x0, 0x6, 0x7, 0x4, 0xc, 0x800}, {0x8, 0x10000, 0x1, 0x1, 0x7}, {0x7d5, 0x3, 0x4, 0x800, 0xf}, {0x1, 0x5, 0x6, 0x2, 0x8, 0xc}, {0x2, 0x1, 0x3, 0xc, 0x1, 0x2c3}, {0x1000, 0x3, 0xbc, 0x8001, 0xfa, 0x8}, {0x2, 0x3, 0x9, 0x50e, 0x55ac, 0xa5e2}, {0x0, 0x196680, 0xffffff91, 0x100, 0x3, 0x7}, {0x4, 0x4, 0x2, 0x1, 0x0, 0xe}, {0xfffffff5, 0x3, 0x40007023, 0x1ff, 0x5, 0x851}, {0x3, 0x78, 0x7, 0xa, 0x5dec4cac, 0x6}, {0x4, 0x9, 0x3a, 0x2, 0x8, 0x602}, {0x4, 0x7fffffff, 0x0, 0x8, 0x8, 0xff}, {0x7, 0xfffffff1, 0x2f2c, 0x400, 0x6, 0x6}, {0x10001, 0x81, 0xc000, 0x2, 0x89, 0x2}, {0x10001, 0x8550, 0x4c, 0x3, 0xfffffffa, 0x736d}, {0x7f, 0x199, 0x5, 0x1, 0x7, 0x2}, {0x7, 0x1, 0x9, 0x7, 0x2, 0x7}, {0x9, 0x3f1, 0x4, 0x5, 0x5, 0x5}, {0x100, 0x3ff, 0x4, 0x7f53, 0x7, 0x1}, {0x3ff, 0xc, 0x4, 0x1, 0x4, 0x4}, {0x9, 0x381, 0xffd, 0x5d7c, 0x0, 0x8001}, {0x8, 0x0, 0x7, 0xfffffffb, 0x8, 0x4}, {0xbfffffe, 0x6, 0x101, 0x5, 0x400, 0x400}, {0x7fff, 0xb3, 0x2, 0x10000, 0x6, 0x14}, {0x0, 0x1, 0x4c90, 0x4, 0x7f, 0x8}, {0x5, 0x25b, 0xe9, 0x3, 0x2, 0x2}, {0x29dbdf0, 0x9, 0xfffffffd, 0x7, 0x6, 0x3}, {0x7, 0x1, 0xa, 0x8, 0x5, 0x5}, {0x473, 0x8, 0x2, 0x55, 0x4000000, 0x69b3d6e6}, {0x1, 0xb7bb, 0x22800000, 0x3, 0x10, 0x9}, {0x7f, 0x4, 0x6, 0x2, 0x3, 0x5}, {0xfffffff7, 0x80000000, 0xa, 0x40, 0x863, 0x2}, {0xb, 0x9, 0xc, 0x3c1, 0x6e, 0x40}, {0x6, 0xd, 0x8, 0xfb0000, 0x1, 0x7}, {0xe0, 0x100, 0xf9, 0x7, 0x8, 0x7}, {0xfff, 0x1, 0x0, 0x38, 0x0, 0x9}, {0x82, 0x10, 0x401, 0x0, 0x4, 0xef}, {0x7, 0x2, 0x200, 0x8, 0x9, 0x2}, {0x54, 0x5, 0xa33f, 0x101, 0x2, 0x10001}, {0x1, 0x4, 0xfffffff9, 0x10001, 0x2, 0xce}, {0x4, 0x2, 0x8, 0x3, 0xf, 0x9}, {0x7, 0x5, 0x8, 0xffffffff, 0x405b9, 0x6}, {0x9, 0x0, 0x9, 0x2, 0x9}, {0x0, 0x2, 0xb, 0x7fffffff, 0xfc0, 0x7f1b4893}, {0x4, 0xd, 0xc, 0x4, 0x7, 0x4}, {0x4, 0x5, 0xe, 0x3, 0x3dcb, 0x9}, {0x200, 0x0, 0xe8, 0x1, 0x800000d4, 0x1}, {0x40c651, 0x5f83, 0x2, 0x1, 0xd, 0x8}, {0xfff, 0x5, 0x1, 0x0, 0x49, 0x5}, {0x5, 0x3, 0x7, 0x97fd, 0xef, 0x202}, {0x2, 0xa, 0x1000, 0x1, 0x6, 0xe0}, {0x800, 0x4c, 0x7, 0x0, 0xfffffff7, 0x9}, {0x6, 0xffff, 0xffff8001, 0xa, 0xae36, 0x8}, {0xcfb7, 0x0, 0x101, 0x2, 0x1, 0x1ac6}, {0xa, 0x800, 0xec3d, 0xffffffff, 0xea5, 0x3}, {0x9, 0x5, 0x2, 0x0, 0x0, 0xdd}, {0x6, 0x6, 0x0, 0x1e9, 0x6, 0x1}, {0x3, 0x7, 0x7, 0x3, 0x400, 0x7e}, {0x970, 0x8000100, 0xb2eb, 0x2, 0x3, 0x9}, {0x3, 0x6, 0x8, 0x7, 0xd, 0x474c}, {0xf, 0x101, 0x9a, 0x1000, 0x2, 0xfffffffc}, {0x3, 0x98e, 0xfffffffe, 0x10, 0x7, 0x9}, {0xfffffffb, 0x3, 0x3, 0x2ee8000, 0x8}, {0x3, 0x2, 0x2, 0x3, 0x3, 0x2}, {0x7, 0x4, 0x1, 0x4, 0x101, 0xef}, {0x709e, 0x9, 0x425b597f, 0x1, 0x2, 0x7}, {0x6, 0xc000000, 0x3ff, 0x4, 0x8, 0x5}, {0x3, 0x6, 0x7, 0xfffffff9, 0x0, 0xffffffff}, {0x7, 0x9, 0x8, 0x0, 0x9, 0xd6}, {0x24, 0x10001, 0x6, 0x1, 0x39d6}, {0x401, 0x7d3, 0x9, 0x8000, 0xffff, 0x7}, {0x6, 0x92e4, 0x130, 0x0, 0x4, 0x9}, {0x1, 0x7fff, 0x7, 0x8001, 0x8, 0x5}, {0x7e, 0x808, 0xfffffff9, 0xa, 0x4b64, 0x80000001}, {0x2ad78a25, 0x2, 0x6, 0x6, 0x4, 0x8}, {0x2, 0x9, 0x0, 0x8a7, 0x2129, 0xebd8}, {0x7, 0x2, 0x8, 0x3, 0xe01, 0xf933271}, {0x4a3, 0x0, 0x3, 0x514c, 0xf8b, 0x19}], [{0x5}, {0x4, 0x1}, {}, {0x4}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {}, {0x3, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {}, {0x5}, {0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x1, 0x1}, {0x5, 0x1}, {0x5}, {0x3}, {0x5, 0x1}, {}, {0x0, 0x1}, {0x3}, {0x4, 0x1}, {0x4}, {0x5}, {0x5, 0x1}, {0x3, 0x1}, {}, {0x1}, {0x0, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x1, 0x1}, {0x4}, {0x5}, {0x3}, {0x1}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x0, 0x1}, {0x3, 0x1}, {0x5}, {0x4, 0x1}, {0x2}, {0x3}, {0x5, 0x1}, {0x1}, {0x1}, {0x3}, {0x5, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {}, {0x3}, {0x0, 0x1}, {0x5}, {0x4}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x5}, {0x9, 0x1}, {0x2, 0x1}, {0x2, 0x1}, {}, {0x3, 0x1}, {}, {0x1, 0x1}, {0x1, 0x1}, {0x1}, {0x2, 0x1}, {0x6, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x3}, {0x3, 0x1}, {0x1}, {0x2}, {0x2}, {0x5}, {0x3, 0x1}, {0x2}, {0x0, 0x1}, {0x2}, {0x1}, {0x1, 0x1}, {0x4, 0x1}, {0x5, 0x1}, {0x4}, {0x2, 0x1}, {0x3, 0x1}, {0x4}, {0x1}, {0x5, 0x1}, {0x4, 0x1}, {0x3}, {0x3, 0x1}, {0x0, 0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x5, 0x1}, {0x3}, {0x5, 0x1}, {0x3}, {0x4}, {0x5}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x4, 0x1}, {0x6, 0x1}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x8, 0x5, 0x0, 0x1, [{0x4}]}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0xeb8}}, 0x0) 23m7.849066014s ago: executing program 34 (id=531): socket$nl_netfilter(0x10, 0x3, 0xc) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() fcntl$setlease(0xffffffffffffffff, 0x400, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f00000002c0)={0x8408001e}, 0x10) mount(&(0x7f0000000080)=@loop={'/dev/loop', 0x0}, 0x0, &(0x7f0000000100)='ubifs\x00', 0x1000, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) rmdir(&(0x7f0000000640)='./file0\x00') r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = add_key(&(0x7f0000000000)='keyring\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffc) add_key(0x0, 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b05003034313230300603551f030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b46064744", 0x150, r3) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'bridge_slave_0\x00'}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001880), r5) sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001ec0)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100273d7000ffdb7132172f0000180001801400020064756d6d7930"], 0x2c}}, 0x4) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r4, 0x10e, 0x1, &(0x7f0000000a80)=0x1, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000540)=@bridge_getneigh={0x28, 0x1e, 0x1, 0x70bd26, 0x25dfdbfe, {0x7, 0x0, 0x0, 0x0, 0x0, 0x2000a}, [@IFLA_WEIGHT={0x8, 0xf, 0xfffffffb}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008451}, 0x20000800) r8 = socket$inet6(0xa, 0x3, 0x83) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000980)={{{@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in=@dev={0xac, 0x14, 0x14, 0x35}, 0x4e1f, 0x0, 0x0, 0x42, 0xa, 0x0, 0x0, 0x29}, {0xec, 0x8000000000000000, 0x1, 0x6811221d, 0x5, 0x2, 0x200000200000003, 0x110000000}, {0x4000a, 0xfffffffffffffffd, 0x6, 0x7}, 0x3, 0x6e6bb5, 0x1, 0x0, 0x6, 0x1}, {{@in=@empty, 0x0, 0x32}, 0x2, @in6=@mcast2, 0x3506, 0x1, 0x2, 0x1, 0x7, 0x7, 0xfffffffd}}, 0xe8) 23m2.847044817s ago: executing program 35 (id=541): syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x3e2}, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r0 = socket$nl_route(0x10, 0x3, 0x0) socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0xe0b, 0x0, 0xfffffffc, {0x0, 0x0, 0x0, 0x0, {0xb, 0xffff}, {0xffff, 0xfff2}, {0x1}}}, 0x24}}, 0x4000080) socket$inet6_tcp(0xa, 0x1, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x20000, 0x0) socket(0x15, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x1607c0, 0x78e22799f4a46ffe) syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x200000) syz_open_dev$sg(&(0x7f0000000140), 0x6f5e, 0x403) syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) socket(0x2, 0x80805, 0x0) socket(0x10, 0x3, 0x0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000340), 0x2, 0x0) r2 = socket$unix(0x1, 0x2, 0x0) ppoll(&(0x7f0000000300)=[{r2, 0xc226}], 0x1, 0x0, 0x0, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f00000020c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000002100)={0xffffffffffffffff}, 0x13f, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0xfd94, 0xfa00, {0x0, &(0x7f0000000300), 0x2, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(0xffffffffffffffff, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0xfffb, 0x5, @empty, 0xa098}, {0xa, 0x4ea4, 0x9, @mcast1, 0x8}, r3, 0x8001}}, 0x48) writev(r1, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) 11m59.877306887s ago: executing program 6 (id=1611): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x141) fanotify_mark(0xffffffffffffffff, 0x105, 0x10000839, r3, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/if_inet6\x00') openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x60, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ctinfo={0x42, 0x1, 0x0, 0x0, {{0xb}, {0x38, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000840)={0x0, 0x0, 0x10, 0x2, 0x282}, &(0x7f0000000000)=0x0, &(0x7f0000000300)=0x0, &(0x7f0000000140)=0x0) syz_io_uring_submit(r6, r7, r8, &(0x7f0000000980)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x22, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x2}) syz_ublk_add_dev(r5, r6, r7, r8, &(0x7f0000000540)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0x612, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x4c}}}, 0x0) (fail_nth: 1) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) 11m58.666030712s ago: executing program 6 (id=1612): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000000)) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x18) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f00004b2000/0x400000)=nil) 11m58.416543558s ago: executing program 6 (id=1614): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r1, &(0x7f0000000040)=ANY=[], 0x6) bind$bt_hci(r0, &(0x7f0000000040), 0x6) ioctl$sock_bt_hci(r0, 0x400448e6, &(0x7f0000000500)="d7") r2 = socket$phonet(0x23, 0x2, 0x1) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8085) setsockopt$inet6_buf(r3, 0x29, 0x20, 0x0, 0x0) ioctl$SIOCPNDELRESOURCE(r2, 0x89ef, &(0x7f0000000680)=0x4) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x80dc) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1a, 0x0, 0x0, 0x0, 0x80000002, 0x57, 0x0, 0x0, 0x0, '\x00', 0x0, @tracing=0x1c, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000000)={0x0, 0x1000, 0x0, 0xde0}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f0000000140)={0xffffffffffffffff, 0x20, &(0x7f0000000640)={&(0x7f00000003c0)=""/208, 0xd0, 0x0, &(0x7f0000000700)=""/242, 0xf2}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000300)={0x5, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x41000, 0x2, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, 0x0, 0x0, r4}, 0x94) listen(0xffffffffffffffff, 0x0) getsockopt$inet6_mptcp_buf(0xffffffffffffffff, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, &(0x7f00000015c0)={&(0x7f0000001540)=ANY=[@ANYBLOB="201b00000f1401009fc8df906a18b6110c2dbd7000ffdbdf2508000100020000"], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x4000000) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) getsockopt$bt_BT_RCVMTU(r5, 0x112, 0xd, &(0x7f0000000100)=0xe, &(0x7f0000000180)=0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a1c000000000a0300000000000000000007000000080002400000000244000000090a0104000000000000000007000000087a31000000000900010073797a30000000000800054000002d2d5d0021080007400000002c1c000000160a01010000000000000000010000050800071e00000001140000001000010000000000000000000784000a000000000000000000000000004668a35cc8117909d7683252e1b7ef077f2f1b9f70e2d0135f2b357079dfcdea74a616f8d7896da89cb36cfa048eb07795cbe0af7db86a03f2988d10af38fca273027bb1444d37354f67db650b9fb87fa9"], 0xa4}}, 0x0) r6 = fspick(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x1) ioctl$FIONCLEX(r6, 0x5450) socket$nl_netfilter(0x10, 0x3, 0xc) 11m55.619203812s ago: executing program 6 (id=1618): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x141) fanotify_mark(0xffffffffffffffff, 0x105, 0x10000839, r3, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/if_inet6\x00') openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x60, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ctinfo={0x42, 0x1, 0x0, 0x0, {{0xb}, {0x38, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r5, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008004500001c006800000011907800000000ae481c1b7e745a53f89789bd0000000000004e2000089078"], 0x0) syz_emit_ethernet(0x8a, &(0x7f0000000080)={@random="5bb65d3f2511", @empty, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0xe, 0x78, 0x65, 0x0, 0x3, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x17}, @multicast1}, {0x4e20, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x3, "f66abb6f369aaa15d309a5209a57d6b633de150bf5c0f9eed577c9053e33e8a6", "ad01c9ea336a20bee7eb5eca2632253a", {"d69e4998ec79f919e2f5fdbe24252c46", "94f2cbbb76aeff3f3f60692fd9841b58"}}}}}}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) mount$tmpfs(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x20000, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0x11050ca, 0x0) syz_ublk_setup_io_uring(0x20, &(0x7f0000000840)={0x0, 0xfffffffd, 0x1000, 0x2, 0x282, 0x0, r4}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000140)=0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'bond_slave_1\x00'}) syz_io_uring_submit(r7, r8, r9, &(0x7f0000000980)=@IORING_OP_RECV=@pass_buffer={0x1b, 0x22, 0x0, r6, 0x0, 0x0, 0x0, 0x0, 0x2}) ioctl$TIOCNXCL(0xffffffffffffffff, 0x540d) 11m54.491886998s ago: executing program 6 (id=1621): openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x103001, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[], 0xb8}}, 0x0) r0 = socket$unix(0x1, 0x2, 0x0) bind$unix(r0, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = socket$unix(0x1, 0x2, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @loopback}, 0x10) listen(r2, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./cifs\x00', 0x1ff) mount(&(0x7f0000000500)=@filename='\\\\127.0.0.1\\share\x00', &(0x7f0000000100)='./cifs\x00', 0x0, 0x0, &(0x7f0000000300)='unc=//127.0.0.1/share,ip=127.0.0.1,port=20000,user=root,pass=root,vers=3.0,nodfs\x00') r3 = accept(r2, 0x0, 0x0) sendto$inet(r3, &(0x7f0000002000)="00000080fe534d424000010000000000000001000100"/44, 0x2c, 0x0, 0x0, 0x0) sendto$inet(r3, &(0x7f0000002100)="00000078fe534d4240000100160000c00100010001000000000000000100000000000000000000000000000001000000000000000000000000000000000000000000000009000000480030", 0x4b, 0x0, 0x0, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x14, &(0x7f00000001c0)=ANY=[@ANYBLOB="18000000000100000000000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000007000000850000000600000018110000", @ANYRES32], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x38, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r5 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000340)={{}, &(0x7f0000000300), &(0x7f0000000280)=r4}, 0x20) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0800000008000000000800000100000000000000", @ANYRES32, @ANYBLOB='\a\x00'/20, @ANYRES32=r6, @ANYRES32, @ANYBLOB="03000000030000000100000000000000000000000000000000000000323c92be29a5212116ad1cc1566c9def5a646a40de7ee1fc3129d983578c3bdb6d37353ab4e0a3ea439f1e811fc85ad953"], 0x50) r7 = add_key(&(0x7f0000000000)='dns_resolver\x00', &(0x7f0000000100)={'syz', 0x0}, &(0x7f0000000200)='foo#dnserror=1\x00', 0xf, 0xfffffffffffffffe) keyctl$revoke(0x3, r7) r8 = socket$unix(0x1, 0x2, 0x0) connect$unix(r8, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) sendmmsg(r8, &(0x7f0000002dc0), 0x307017fdb7a66cb, 0x0) connect$unix(r1, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000240)) recvmsg(r8, &(0x7f0000001480)={0x0, 0x0, 0x0}, 0x100) 11m49.094154967s ago: executing program 6 (id=1634): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 11m48.245488717s ago: executing program 36 (id=1634): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x40c0080) 11m6.219983827s ago: executing program 9 (id=1733): bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, 0x0, 0x0}, 0x94) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x0) recvmmsg(r0, &(0x7f0000000080), 0x72a, 0x0, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x30000008}) (fail_nth: 1) 11m5.789575736s ago: executing program 9 (id=1736): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000540)=ANY=[@ANYBLOB="2c0000000102010100000000000000000a000000180001801400018008020100ffffffff08000200ac1414bb"], 0x2c}}, 0x4000000) syz_open_dev$evdev(&(0x7f0000000000), 0x7d4, 0x100100) (async) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x7d4, 0x100100) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f00000003c0)={0x0, 0x0, 0x0, {0x0, 0x1}, {0x45, 0x2}, @cond=[{0x8, 0xfff, 0x44, 0x2, 0x0, 0x7}, {0xfff, 0x3, 0x7fff, 0x8, 0xf, 0x8}]}) write$char_usb(r1, &(0x7f0000000040)="e2", 0x2250) 11m5.41547282s ago: executing program 9 (id=1738): r0 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r0, &(0x7f00000014c0)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000005c0)="5c00000012006bab9a3fe3d96e17aa0a046b876c1d0048007ea60864160af36504001a003800eb0ea3fa01de8eb006000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb000000000017a7016306569fa5dad17a91", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000002d40)=[{&(0x7f0000002f80)=""/4069, 0xfe5}, {&(0x7f0000000b40)=""/204, 0xcc}, {&(0x7f00000002c0)=""/139, 0x8b}, {&(0x7f0000000980)=""/195, 0xc3}, {&(0x7f0000000440)=""/123, 0x7b}, {&(0x7f0000001d40)=""/4092, 0xffc}], 0x6}, 0x0) recvmsg$kcm(r0, &(0x7f0000000840)={0x0, 0x0, 0x0}, 0x10000) 11m4.895125515s ago: executing program 9 (id=1740): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000040)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = openat$dir(0xffffffffffffff9c, 0x0, 0x2, 0x141) fanotify_mark(0xffffffffffffffff, 0x105, 0x10000839, r3, 0x0) syz_open_procfs(0x0, &(0x7f0000000080)='net/if_inet6\x00') openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000240)={'#! ', './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x100) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=@newtaction={0x60, 0x30, 0x871a15abc695fa3d, 0x0, 0x0, {}, [{0x4c, 0x1, [@m_ctinfo={0x42, 0x1, 0x0, 0x0, {{0xb}, {0x38, 0x2, 0x0, 0x1, [@TCA_CTINFO_ACT={0x18}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x60}}, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000008004500001c006800000011907800000000ae481c1b7e745a53f89789bd0000000000004e2000089078"], 0x0) syz_emit_ethernet(0x8a, &(0x7f0000000080)={@random="5bb65d3f2511", @empty, @val={@void, {0x8100, 0x0, 0x0, 0x4}}, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0xe, 0x78, 0x65, 0x0, 0x3, 0x11, 0x0, @dev={0xac, 0x14, 0x14, 0x17}, @multicast1}, {0x4e20, 0x4e20, 0x64, 0x0, @wg=@response={0x2, 0x3, 0x3, "f66abb6f369aaa15d309a5209a57d6b633de150bf5c0f9eed577c9053e33e8a6", "ad01c9ea336a20bee7eb5eca2632253a", {"d69e4998ec79f919e2f5fdbe24252c46", "94f2cbbb76aeff3f3f60692fd9841b58"}}}}}}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$bind(&(0x7f0000000300)='.\x00', &(0x7f00000002c0)='./file0\x00', 0x0, 0x185093, 0x0) 11m3.415363096s ago: executing program 9 (id=1743): sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000180)={0x44, 0x0, 0x100, 0x9, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x44040) (async) sendmsg$TIPC_NL_BEARER_GET(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000180)={0x44, 0x0, 0x100, 0x9, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x30, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8, 0x2, 0x5}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xfffffffe}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x8}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x7}]}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x40040}, 0x44040) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c000c0006"], 0x48}, 0x1, 0x0, 0x0, 0x2c048040}, 0xe800) ioctl$UBLK_U_CMD_END_USER_RECOVERY(0xffffffffffffffff, 0xc0207511, &(0x7f0000000000)={0x0, 0xffff, 0x0, 0x0, 0x0}) sched_setscheduler(r1, 0x0, &(0x7f0000000080)=0x40) 10m59.090404344s ago: executing program 9 (id=1754): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'pim6reg\x00'}) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000240), 0x9) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r3 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x3, &(0x7f000063c000/0x3000)=nil) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x0, &(0x7f0000007000/0x1000)=nil) mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f000003a000/0x1000)=nil, &(0x7f00006ef000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r4, &(0x7f0000002700)={0x2020}, 0x2020) 10m58.296842773s ago: executing program 37 (id=1754): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'pim6reg\x00'}) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_type(0xffffffffffffffff, &(0x7f0000000240), 0x9) ioctl$TIOCVHANGUP(0xffffffffffffffff, 0x5437, 0x0) r3 = openat$cgroup_procs(r0, &(0x7f00000002c0)='cgroup.threads\x00', 0x2, 0x0) mremap(&(0x7f000016c000/0x4000)=nil, 0x4000, 0x40000000, 0x3, &(0x7f000063c000/0x3000)=nil) mremap(&(0x7f000000d000/0x2000)=nil, 0xfffffffffffffe74, 0x1000, 0x0, &(0x7f0000007000/0x1000)=nil) mkdir(&(0x7f0000000000)='mysys\x00', 0x1ff) write$cgroup_pid(r3, &(0x7f0000000380), 0x12) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f000003a000/0x1000)=nil, &(0x7f00006ef000/0x2000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='numa_maps\x00') read$FUSE(r4, &(0x7f0000002700)={0x2020}, 0x2020) 34.661934999s ago: executing program 8 (id=3170): openat$ptmx(0xffffffffffffff9c, 0x0, 0x382, 0x0) mount(0x0, 0x0, 0x0, 0x2002404, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prctl$PR_SCHED_CORE(0x3e, 0x200000000001, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./mnt\x00', 0x1df) mount(&(0x7f00000000c0)=@filename='./dev/sda1\x00', &(0x7f0000000140)='./mnt\x00', 0x0, 0x8410, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) chdir(&(0x7f0000000140)='./file0\x00') r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file2\x00', 0x109042, 0x15) pwrite64(r4, &(0x7f0000000000)="ff", 0x1, 0x1000000) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='io.stat\x00', 0x275a, 0x0) (fail_nth: 1) syz_usb_connect$cdc_ncm(0x6, 0x9b, &(0x7f00000000c0)=ANY=[], 0x0) 30.670670094s ago: executing program 8 (id=3176): futex_waitv(&(0x7f0000000780)=[{0x5, &(0x7f0000000080)=0x5, 0x2}], 0x1, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1) futex(&(0x7f0000000080), 0x3, 0x2, 0x0, &(0x7f0000000000)=0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) clock_gettime(0x0, &(0x7f0000000140)) r0 = socket(0x1e, 0x4, 0x0) socket$nl_audit(0x10, 0x3, 0x9) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='syscall\x00') prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x9, 0x80010, 0xffffffffffffffff, 0x100000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(r2, &(0x7f0000005380)={0x2020}, 0x2020) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1, 0x0, 0xfffffffffffffe68}, 0x0) sendmmsg(r0, &(0x7f00000030c0), 0x4000000000000a4, 0x9200000000000000) socket$rds(0x15, 0x5, 0x0) 28.417378465s ago: executing program 7 (id=3181): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/fs/afs/cells\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='add syz0 127.0.0.1+7:', 0x15) 25.471259174s ago: executing program 8 (id=3188): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') write(0xffffffffffffffff, &(0x7f0000000600)='dir .', 0x5) write(0xffffffffffffffff, &(0x7f0000000700), 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) close_range(r0, 0xffffffffffffffff, 0x0) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) 25.405572519s ago: executing program 1 (id=3189): socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x39, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x400448c9, 0x0) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r0, &(0x7f0000000200)="4a00000011007f0314066f9a70932d490675bc59083301", 0x17) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000580)=@newlink={0x38, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x7a8ba, 0x70823}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x4}}}, @IFLA_VFINFO_LIST={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x24000800) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x16, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000010000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e1a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080e71113610e10d858e8327edb1fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18c65ae1bd4f4390af9a9ceafd07ed00b0000002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a469398685211bbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72c7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9624d37c10223fdae7ed04935c3c9068000000bc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b40000000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f3ca1664fe2f3ced8416dc180604b60c2499d16d7d9158ffffffff00000000ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a9e90d7676074a0bde4471414c99d4894ee7f8139dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8070000001fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b2042b8ff8c21ad702cca54728acad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd20785f653b621491d04aaee0d409731091f4fb94c06006e3c1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e1590bab105b0cb578af7dc7d5e87d48d376444e2de02f47c61e8e84ff828de453f34c2b08660b080efc707e676e1fb4d5865c0ca177a4c7fbb4e829ab0894a1062b445c00f576b2b5cc7f819abd0f885cc4806f47ffb966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d3676329bb8cda690d192a070886df42b2708398773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169cdfaa4252d4ea6b8f6216ff202b5b5a182cb5e8380100632d03a7ca6f6d0339f9953c30930804fdc3690d10ecb65dc5b47481edbf1eee2e8893e903054d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026def743f1213bf817becd9e5a225d67521d1128eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979030000007081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f324661351df747aa6a65872dfdcfa68f65bd06b4082d43e121861b5cc09b986bf56c747d9a1cc5b506892c3a16ff10feea20bdac89bfb758cf3500000000000000000000000000000098e6db5a96055e764a3bfd4ccb20d2e800994f4b602d25b2c076f21c7102687e054bb93b2d013be6227fd99902b074c0de00733128c81c48c5e140b17d71ac48f137d10798c4272826d2ba55bbda0059636528c132ed06759d880d1bc291a76456ed7ee8bcb392fdf886dbc74879ec4b831904d7c101ebbaef3c0ae6d0cf0000000000000000000000000000000011cb735f66a559ef0cdb5163a15c0bb986474bf5d9542e3e48805ce53127e4c076d69d868df543717aaaa07d7aca056f7f036c2bcba0795d1a64868a29ac5321b3cd6ef5b1a741afc7124ee3df3a35e8014d6cb5fd6c054a10bb2146174c1d68b45fcfd7e531090ceae2f05536a4d5d6a4081e743827fb9c031d1fc9f195c2da189c49eaed6c30c71da0452e502ef393efeb02ebe82b1851cae5fa7c958ba23110b5e0e5b890803f28a356b2920e74564e0f8377b0ba5187fed2882b4780a1bcb583f1cb1470003ef9b592b9461328cfc01ebfce0ecdcea714a517dc40000000000000000000000000006bd0561e1cc72880cc3ec1bdf35eb670a9040e3b53cd826b94ad8aeb014e74787fe89fb3247a87d8bfb6d400142369f88964708d1d4db5a5df9d62ea6d805dfce568b885a50ed8e2eaf8a932287a1d3bfac17774e58875a63b77e07298e4b4f515189c6fcac3cd35dac9240e633219bb6a5a25865e6ed8e16caa5406b56702afe0befcabbc9a2a772a1a087f0d633d457bceb695b2cba3a1a2daa2dda796373cc0fe0a53236d028fc1076bb746b2717c8b6052f58c91bb8cc19474ab9d4d2160773829f078727f6c684ca749136a7f46ca28b00bb4237695b409859a3cb7dbf298c7802264387811e20a0d78489eab0b0e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0xc, &(0x7f0000000000)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x3, 0x4f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e45aa5205b109917e9360102030109023d0001000000000904ef0404ff010100090502020800d0000909050800ff030700060705a902e86f4c0905d5"], 0x0) 23.977980153s ago: executing program 7 (id=3191): r0 = socket$inet6(0xa, 0x3, 0x5) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_IPV6_XFRM_POLICY(r0, 0x29, 0x23, 0x0, 0x0) r1 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'bond0\x00', 0x0}) r3 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=@newqdisc={0x88, 0x24, 0xf0b, 0x70bd26, 0x0, {0x0, 0x0, 0x0, r2, {0x0, 0xffff}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0x1, [], 0x0, [0x1, 0x2, 0xfffe, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x5c4, 0x8000, 0x0, 0x0, 0x3dc], [0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000]}}}}]}, 0x88}}, 0x20000000) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000240)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2e, 0xfffbffff, {0x0, 0x0, 0x0, r2, {0x0, 0x8}, {0xffff, 0xffff}, {0x8, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x1c, 0x2, [@TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x10, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0xff}]}]}, @TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0x2}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040010) sendmmsg(r0, &(0x7f0000000480), 0x2e9, 0x0) 23.977318083s ago: executing program 8 (id=3192): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x890d000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$dir(0xffffffffffffff9c, 0x0, 0x4d0300, 0x4) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0xe, 0x4, 0x4, 0x3}, 0x50) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=r3, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000002000000000000000006af59d213ebfa89e7a6a165d36e4c100000000"], 0x50) syz_emit_ethernet(0x19e, &(0x7f00000000c0)={@broadcast, @local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x168, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_ra={0x86, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, [{0x3, 0x9, "bd3e6d4706598080a8030037ffffffffffffff23732472eefa45ad96579269748e254c1e4a8a8b3f0ab0c430d3be27df3e34116d42ca0a5c15b37adac15084dbaf736b41e5af0302"}, {0x1, 0x1, "000000050000000026000400"}, {0x3, 0x20, "77f9290b6e87290b6e871e02f278e94724e20c43c95f9b49204a64d614d4cc9d0d46d954fda9a75d076993e3c57aa99b2454a86662e37b42678a74974ddd50b21e499efae61e3a816a367d019bc7f892d8975f1fc8a3e27139041cd21d2d12f30ee6f029d8d73f80f9b19d138598345b9c0feda226b333c55c668fb17b5b39603ee66b8534f1fbf97e139d35762307516482a1787d8f3bb76940872a0104ac045b59510dfd945672de5f77c0e6136c06847bbe70dd65236ef4d112e88fabdd7d02a2a380eb697adf4e1d9090705f81ddf041bc076775f5d27555d3f60c44192fa92eee16828c1c4aa17f4a743e212cd2c084e5acc9a8e96852cd54afd2d6"}]}}}}}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x18, 0x0, 0x0, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0xd, '\x00', 0x0, @fallback=0xd, 0x0, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = inotify_init1(0x80000) inotify_add_watch(r4, &(0x7f0000000240)='.\x00', 0x60000726) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='.\x00', 0x0, 0x124) r6 = fanotify_init(0x2, 0x2) gettid() fanotify_mark(r6, 0x541, 0x40001019, r5, 0x0) r7 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_mark(0xffffffffffffffff, 0x455, 0x8000003, r7, 0x0) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x0, 0x0}) close_range(r8, 0xffffffffffffffff, 0x0) 22.656069562s ago: executing program 4 (id=3195): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001314210e29"], 0x40}, 0x1, 0x0, 0x0, 0x20015002}, 0x448d0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000008c00000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000003c0)={0x20, r2, 0x5, 0x0, 0x0, {0x22}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4000014) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x201200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x3, 0x3a) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_buf(r4, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000001080)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8000e308, 0x42, 0x1000002, 0x91, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x69, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe7d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) quotactl_fd$Q_GETFMT(r3, 0xffffffff80000400, r12, &(0x7f0000000100)) 22.581595183s ago: executing program 5 (id=3196): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="02000000040000000800000001000000"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f00000005c0)={r0}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x6, 0x11, &(0x7f0000000100)=@framed={{0x18, 0x2, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x7}, [@call={0x85, 0x0, 0x0, 0x2c}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x8006}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r0}}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @xdp=0xdca6bfcc9a561e2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002000/0x18000)=nil, &(0x7f0000000100)=[@text16={0x10, &(0x7f0000000040)="0f01cb650f741065666765f36f0f330f09660f3a0cb9000000752066b9800000c00f326635004000000f300f01d7ba4100ed", 0x32}], 0x1, 0x4498bda7e2139f51, 0x0, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000100)=@abs={0x1, 0x0, 0x4e20}, 0x1c) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0x3) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x40) 21.492526336s ago: executing program 4 (id=3197): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000480), 0x2, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000004c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r0, 0x3ba0, &(0x7f0000000400)={0x48, 0x2, r1, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r0, 0x3ba0, &(0x7f0000000640)={0x48, 0xa, r2}) r3 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) write$binfmt_script(r3, &(0x7f0000000040)={'#! ', '', [], 0xa, "83a2780589c7929a805f"}, 0xe) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fdinfo/3\x00') read$FUSE(r4, &(0x7f00000040c0)={0x2020}, 0x2020) write$binfmt_elf32(r4, &(0x7f0000000180)={{0x7f, 0x45, 0x4c, 0x46, 0x9, 0x7, 0x7, 0x6, 0x4f, 0x2, 0x3e, 0xb997, 0x265, 0x38, 0x32b, 0x8, 0x33a8, 0x20, 0x1, 0xffff, 0x1, 0x8}, [{0x2, 0x2e, 0x800, 0x6, 0x3000, 0x9, 0x6}], "a22a", ['\x00', '\x00']}, 0x25a) cachestat(r3, &(0x7f0000000500)={0x5e3a, 0x1}, &(0x7f0000000540), 0x0) execveat(0xffffffffffffffff, &(0x7f0000000080)='./file0\x00', 0x0, 0x0, 0x800) 21.442377076s ago: executing program 1 (id=3198): futex_waitv(&(0x7f0000000780)=[{0x5, &(0x7f0000000080)=0x5, 0x2}], 0x1, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1) futex(&(0x7f0000000080), 0x3, 0x2, 0x0, &(0x7f0000000000)=0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) clock_gettime(0x0, &(0x7f0000000140)) r0 = socket(0x1e, 0x4, 0x0) socket$nl_audit(0x10, 0x3, 0x9) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='syscall\x00') prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x9, 0x80010, 0xffffffffffffffff, 0x100000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(r2, &(0x7f0000005380)={0x2020}, 0x2020) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1, 0x0, 0xfffffffffffffe68}, 0x0) sendmmsg(r0, &(0x7f00000030c0), 0x4000000000000a4, 0x9200000000000000) sendmsg$rds(0xffffffffffffffff, &(0x7f0000002fc0)={&(0x7f0000000380)={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f0000001ac0)=[{&(0x7f0000000440)=""/143, 0x8f}, {&(0x7f0000000500)=""/1, 0x1}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/166, 0xa6}, {&(0x7f0000001880)=""/227, 0xe3}, {&(0x7f0000001980)=""/176, 0xb0}, {&(0x7f0000001a40)=""/43, 0x2b}, {&(0x7f0000001a80)=""/32, 0x20}], 0x8, &(0x7f0000002ec0)=[@fadd={0x58, 0x114, 0x6, {{0x7, 0x6}, &(0x7f0000001b40)=0xfffffffffffffff7, &(0x7f0000001b80)=0x8, 0x5, 0x400, 0xf, 0x40, 0x8, 0x64b}}, @rdma_args={0x48, 0x114, 0x1, {{0xe3, 0x401}, {&(0x7f0000001bc0)=""/4096, 0x1000}, &(0x7f0000002e00)=[{&(0x7f0000002bc0)=""/174, 0xae}, {&(0x7f0000002c80)=""/132, 0x84}, {&(0x7f0000002d40)=""/136, 0x88}], 0x3, 0x48, 0x5}}, @cswp={0x58, 0x114, 0x7, {{0x0, 0x6}, &(0x7f0000002e40)=0x1000, &(0x7f0000002e80)=0x6, 0x5d7d, 0x200, 0x8000000000000000, 0x6, 0x1, 0x1}}], 0xf8, 0x8840}, 0x2) 21.315843352s ago: executing program 5 (id=3199): futex_waitv(&(0x7f0000000180)=[{0x0, &(0x7f00000001c0), 0x2}], 0x1, 0x0, 0x0, 0x0) 20.860546498s ago: executing program 7 (id=3200): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, 0x0, &(0x7f00000003c0)=0x14) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x108) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f0000000240)={0x200a00000, 0x0, 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r2}}, 0x58) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DONE(r3, 0x0, 0xc9, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) syz_io_uring_setup(0x2e20, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000400)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x40084}, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0x4) io_uring_enter(0xffffffffffffffff, 0x162a, 0xea70, 0x5, &(0x7f0000000180)={[0x4]}, 0x8) 20.418566994s ago: executing program 7 (id=3201): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./proc/fs/afs/cells\x00', 0x1, 0x0) write(r0, &(0x7f0000000100)='add syz0 127.0.0.1+7:', 0x15) 20.398681698s ago: executing program 4 (id=3202): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') write(0xffffffffffffffff, &(0x7f0000000600)='dir .', 0x5) write(0xffffffffffffffff, &(0x7f0000000700), 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r2, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) close_range(r0, 0xffffffffffffffff, 0x0) r3 = getpgrp(0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000040)=0x5) 20.285346455s ago: executing program 1 (id=3203): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000002e00), r0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000002e40)={'batadv_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x20, 0x4, &(0x7f0000000900)=ANY=[@ANYRESDEC=r2, @ANYRESDEC=0x0, @ANYRES32=r1], 0x0, 0xff, 0x0, 0x0, 0x40f00, 0x0, '\x00', r2, @fallback=0x6}, 0x94) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VIDIOC_ENUM_FMT(r4, 0xc0405602, &(0x7f0000000500)={0x5, 0xa, 0x10, "3258c54203baaa001b0000f4ff40000900000000e0e826ba2800", 0x47524247}) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000600)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES8, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000000000000000024000380040001001c0003800c0001"], 0x50}}, 0x0) unshare(0x28000600) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x40000000ae682, 0x0) r6 = dup(r5) fallocate(r6, 0x10, 0x0, 0x1062200) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, 0xffffffffffffffff, 0x0) semop(0x0, &(0x7f0000000000), 0x0) setxattr$trusted_overlay_nlink(&(0x7f0000000080)='./file0\x00', &(0x7f00000004c0), &(0x7f0000000180)={'L+', 0x8c}, 0x16, 0x1) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) sendmsg$IPSET_CMD_GET_BYNAME(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000340)={&(0x7f0000000340)=ANY=[], 0x28}, 0x1, 0x0, 0x0, 0x20000000}, 0x8001) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f00000001c0)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x90001, 0x3, r8}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x6, 0x15, &(0x7f0000000640)=ANY=[@ANYBLOB="85100000000000008510000000000000851000000000000085100000080000008510000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="0000000000000000b70500000800000085000000a500000085100000feffffff18450000fbffffff0000000000000000d8af1eebeeaca0c71a09d572e8135cdf9854dc6e5ee85b1b8ab05754d12415389198ce8e8d80ca184bddf72eae190b1ce2d075d7eb283be020c412d490b9e7e894d201cfd9c3608a35800062bf32043f49190011cce3ee075c7c907007e2cc20744c134e6aa898538c05d3ab58d0ac16b32359c3e00216eb613bbaba7e46a5ca221ec4bc"], &(0x7f0000000780)='GPL\x00'}, 0x90) clock_gettime(0x7, &(0x7f0000000400)={0x0, 0x0}) clock_gettime(0x0, &(0x7f0000000480)={0x0, 0x0}) timer_settime(r7, 0x1, &(0x7f0000000440)={{r9, r10+10000000}, {r11, r12+10000000}}, 0x0) mount(&(0x7f0000000380)=@loop={'/dev/loop', 0x0}, &(0x7f0000000100)='.\x00', &(0x7f0000000040)='gfs2\x00', 0x0, 0x0) timer_getoverrun(r7) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) ioctl$UFFDIO_UNREGISTER(r6, 0x8010aa01, &(0x7f0000000140)={&(0x7f0000ffd000/0x1000)=nil, 0x1000}) getdents(0xffffffffffffffff, &(0x7f0000000ec0)=""/4096, 0x1000) 20.24882682s ago: executing program 8 (id=3204): setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/cpuinfo\x00', 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xb, 0x4, 0x8, 0xffff8001, 0x4}, 0x50) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$MSR(&(0x7f0000000200), 0x3, 0x0) r3 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f0000000080)={0xa, 0x85, 0xf497}) syz_usb_connect$uac1(0x5ea364e6b4b6dbb1, 0xaa, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000580)={'syztnl0\x00', 0x0, 0x1, 0x7, 0x9, 0x7fffffff, {{0x1f, 0x4, 0x0, 0x4, 0x7c, 0x66, 0x0, 0x3, 0x4, 0x0, @multicast2, @multicast1, {[@timestamp_prespec={0x44, 0x24, 0x33, 0x3, 0x4, [{@broadcast, 0x1}, {@local, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}]}, @rr={0x7, 0xf, 0xfe, [@multicast1, @local, @rand_addr=0x64010102]}, @noop, @noop, @noop, @rr={0x7, 0x1b, 0x85, [@local, @rand_addr=0x64010101, @private=0xa010102, @loopback, @multicast1, @multicast1]}, @rr={0x7, 0x7, 0x97, [@loopback]}, @generic={0x86, 0xd, "f96b9061cb770bb67d6e00"}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0xd, 0x5, &(0x7f0000000100)=@framed={{}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x200}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r4, 0xe}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000180), 0x2, 0x208080) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"}) r7 = syz_open_pts(r6, 0x141601) write(r7, &(0x7f0000000000)="d5", 0xfffffedf) close_range(r5, 0xffffffffffffffff, 0x0) getrlimit(0xa, &(0x7f0000000040)) 20.197923135s ago: executing program 5 (id=3205): socket$packet(0x11, 0x3, 0x300) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) r0 = getpid() sched_setscheduler(r0, 0x5, &(0x7f0000000100)=0x5) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000d40)=@newlink={0x44, 0x10, 0xff05, 0x8000000, 0x4, {0x0, 0x0, 0x4a00, 0x0, 0xbc2a4219f6b787c3}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @gre={{0x8}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_OFLAGS={0x6, 0x3, 0x2}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_ENCAP_TYPE={0x6, 0xe, 0x2}]}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc010}, 0x20000840) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="f8000000160001000000000000000000ac14140d000000000000000000000000fc000000000000000000000000000001fffe00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=r1], 0xf8}}, 0x0) (async) sendmsg$nl_xfrm(r4, &(0x7f0000000540)={0x0, 0x0, 0x0}, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020100020a0000000000000000000000030006002b20000002004e24ac1414aa0000000000000000030005000000000002000a01000000000000000000000000020013"], 0xfffffffffffffea5}, 0x1, 0x7}, 0x20000000) (async) r6 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) getsockopt$bt_BT_CHANNEL_POLICY(r6, 0x112, 0x4, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) close(0x3) (async) socket$nl_route(0x10, 0x3, 0x0) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) (async) setsockopt$sock_int(r7, 0x1, 0x20, &(0x7f0000001740)=0x7ffffffd, 0x4) (async) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000040), r8) (async) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) accept(r10, 0x0, 0x0) (async) sendmsg$IEEE802154_ASSOCIATE_REQ(r8, &(0x7f0000000180)={0x0, 0x58, &(0x7f0000000100)={&(0x7f0000000080)={0x24, r9, 0x65426c5ed9174461, 0x70bd25, 0x25dfdbff, {}, [@IEEE802154_ATTR_CHANNEL={0x5, 0x7, 0x13}, @IEEE802154_ATTR_COORD_PAN_ID={0x6, 0xa, 0xffff}]}, 0x24}, 0x1, 0x0, 0x0, 0x8815}, 0x10) creat(&(0x7f0000000000)='./file0\x00', 0x4) 18.607532126s ago: executing program 8 (id=3206): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = socket$inet6(0xa, 0x1, 0x84) set_mempolicy(0x4005, &(0x7f0000000040)=0x1001, 0x4) getsockopt$bt_hci(r1, 0x84, 0x6d, &(0x7f0000002e80)=""/4086, &(0x7f0000000040)=0xff6) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f0000000180)="84", 0x1}], 0x1) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 18.470743393s ago: executing program 4 (id=3207): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_DELLINK(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001314210e29"], 0x40}, 0x1, 0x0, 0x0, 0x20015002}, 0x448d0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="18020000004000000000000000000000850000008c00000095"], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100}, 0x94) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000ac0), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000003c0)={0x20, r2, 0x5, 0x0, 0x0, {0x22}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x40}, 0x4000014) r3 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x201200, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x2, 0x1) socket$nl_generic(0x10, 0x3, 0x10) socket(0xa, 0x3, 0x3a) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_xfrm(0x10, 0x3, 0x6) mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) getsockopt$inet6_buf(r4, 0x29, 0x3d, 0x0, &(0x7f00000000c0)=0x37) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r6, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r5, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300)=0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) r11 = dup(r10) syz_ublk_setup_queues(r11, r9, &(0x7f00000004c0)={0x0, 0xbd, 0x10, 0x1, 0x7f}, &(0x7f0000001080)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x8000e308, 0x42, 0x1000002, 0x91, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x3b00, 0x2, 0x1, 0x3aa}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x93ea, 0x2000, 0x4003bfff, 0x69, 0x0, r8}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe7d, 0x800, 0x1, 0x26d}}], 0x1, 0x0, 0x0) getresuid(&(0x7f0000000040)=0x0, &(0x7f0000000080), &(0x7f00000000c0)) quotactl_fd$Q_GETFMT(r3, 0xffffffff80000400, r12, &(0x7f0000000100)) 18.421907088s ago: executing program 7 (id=3208): socket$nl_route(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x39, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl(r0, 0x400448c9, 0x0) bind$bt_hci(r0, &(0x7f0000000100)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r0, &(0x7f0000000200)="4a00000011007f0314066f9a70932d490675bc59083301", 0x17) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000580)=@newlink={0x38, 0x10, 0xffffffffffffffff, 0x70bd2b, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x7a8ba, 0x70823}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ipoib={{0xa}, {0x4}}}, @IFLA_VFINFO_LIST={0x4}]}, 0x38}, 0x1, 0x0, 0x0, 0x80}, 0x24000800) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x16, 0x0, 0x0, &(0x7f00000000c0)='syzkaller\x00', 0x9, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000000780)=ANY=[@ANYBLOB="b702000003000000bfa30000000000000703000000feffff7a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065040400010000000404000001007d60b7030000000000006a0a00fe00000000850000000d000000b70000000000000095000010000000005ecefab8f2e85c6c1ca711fcd0cdfa146ec561750379585e5a076d83923dd29c034055b67dafe6c8dc3d5d78c07fa1f7e655ce34e4d5b3185fec0e07004e1a3aa502cd2424a66e6d2ef831ab7ea0c34f17e3946ef3bb622003b538dfd8e012e79578e51bc53099e90f4580d760551b5b341a29f31e3106d1ddd6152f7cbdb9cd38bdb2ca8eeb9c15ab3a14817ac61e4dd11183a13477bf7e860e3670ef0e789f65f1328d6704902cbe7bc04b82d2789cb132b8667c2147661df28d9961b63e1a9cf6c2a660a1fe3c184b751c51160fb20b1c581e7be6ba0dc001c4110555850915148ba532e6ea09c346dfebd38608b3280080005d9a9500000000000000334d83239dd27080e71113610e10d858e8327edb1fb6c86adac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e95767d42b4e54861d0227dbfd2e6d7f715a7f3deadd7130856f756436303767d2e24f29e5dad9796edb697aeea0182babd18c65ae1bd4f4390af9a9ceafd07ed00b0000002cab154ad029a1090000002780870014f51c3c975d5aec84222fff0d7216fdb0d3a0ec4be3e563112f0b39501aafe234870072858dc06e7c337642d3e5a815232f5e16c1b30c3a2a71bc85018e5ff2c910496f18afc9ffc2cc788bee1b47683db01a469398685211bbae3e2ed0a50e7313bff5d4c391ddece00fc772dd6b4d4de2a41990f05ca3bdfc92c88c5b8dcd36e7487afa447e2edfae4f390a8337841cef386e22cc22ee17476d738952229682e24b92533ac2a9f5a699593f084419cae0b4532bcc97d3ae486aca54183fb01c73f979ca9857399537f5dc2acb72c7ead0509d380578673f8b6e74ce23877a6b24db0e067345560942fa629fbef2461c96a088a22e8b15c3e233db7ab22e30d46a9624d37c10223fdae7ed04935c3c9068000000bc8619d73415cda2130f5011e48455b5a8b90dfae158b94f50adab988dd8e12baf5cc9398fff00404d5d99f82e20ee6a8c88e18c2977aab37d9ac4cfc1c7b40000000000000007ff57c39495c826b956ba859ac8e3c177b91bd7d5e41ff868f3ca1664fe2f3ced8416dc180604b60c2499d16d7d9158ffffffff00000000ef069dc42749289f854797f2f900c2a12d8c38a967c1bbe09315c29877a331bcc87dc3addb08141bdee5d27874b2f663ddeef0005b3d96c7aabf4df517d90bdc01e73835d5a3e1a9e90d7676074a0bde4471414c99d4894ee7f8139dc1e3428d2129369ee1b85af6eb2eea0d0df414b315f651c8070000001fa83ee830548f11e1038debd64cbe359454a3f2239cfe35f81b7aded448859968ff0e90500d0b07c0dd00490f167e6d5c1109681739dc33f75b2042b8ff8c21ad702cca54728acad5b39eef213d1ca296d2a27798c8ce2a305c0c7d35cf4b22549a4bd92052188bd20785f653b621491d04aaee0d409731091f4fb94c06006e3c1be2f633c1d987591ec3db58a7bb3042ec3f771f7a1338a5c3dd35e926049fe86e09c58e273cd905deb28c13c1ed1c0d9cae846bcbfa8cce7b893e1590bab105b0cb578af7dc7d5e87d48d376444e2de02f47c61e8e84ff828de453f34c2b08660b080efc707e676e1fb4d5865c0ca177a4c7fbb4e829ab0894a1062b445c00f576b2b5cc7f819abd0f885cc4806f47ffb966fcf1e54f5a2d38708194cd6f496e5dee734fe7da3770845cf442d488afdc0e17000000000000000000000000000000000000000000000000000005205000000dc1c56d59f35d3676329bb8cda690d192a070886df42b2708398773b45198b4a34ac977ebd4450e121d01342703f5bf030e935878a6d169cdfaa4252d4ea6b8f6216ff202b5b5a182cb5e8380100632d03a7ca6f6d0339f9953c30930804fdc3690d10ecb65dc5b47481edbf1eee2e8893e903054d16d29c28eb5167e9936ed327fb237a56224e49d9ea955a5f0dec1b3ccd35364600000000000000000000000000000000000000000000000000000000000026def743f1213bf817becd9e5a225d67521d1128eac7d80a5656ac2cbde21d3ebfbf69ff861f4394836ddf128d6d19079e64336e7c676505c78ad67548f4b192be1827fcd95cf107753cb0a6a979030000007081c6281e2d8429a863903ca75f4c7df3ea8fc2018d07af1491ef060cd4403a099f324661351df747aa6a65872dfdcfa68f65bd06b4082d43e121861b5cc09b986bf56c747d9a1cc5b506892c3a16ff10feea20bdac89bfb758cf3500000000000000000000000000000098e6db5a96055e764a3bfd4ccb20d2e800994f4b602d25b2c076f21c7102687e054bb93b2d013be6227fd99902b074c0de00733128c81c48c5e140b17d71ac48f137d10798c4272826d2ba55bbda0059636528c132ed06759d880d1bc291a76456ed7ee8bcb392fdf886dbc74879ec4b831904d7c101ebbaef3c0ae6d0cf0000000000000000000000000000000011cb735f66a559ef0cdb5163a15c0bb986474bf5d9542e3e48805ce53127e4c076d69d868df543717aaaa07d7aca056f7f036c2bcba0795d1a64868a29ac5321b3cd6ef5b1a741afc7124ee3df3a35e8014d6cb5fd6c054a10bb2146174c1d68b45fcfd7e531090ceae2f05536a4d5d6a4081e743827fb9c031d1fc9f195c2da189c49eaed6c30c71da0452e502ef393efeb02ebe82b1851cae5fa7c958ba23110b5e0e5b890803f28a356b2920e74564e0f8377b0ba5187fed2882b4780a1bcb583f1cb1470003ef9b592b9461328cfc01ebfce0ecdcea714a517dc40000000000000000000000000006bd0561e1cc72880cc3ec1bdf35eb670a9040e3b53cd826b94ad8aeb014e74787fe89fb3247a87d8bfb6d400142369f88964708d1d4db5a5df9d62ea6d805dfce568b885a50ed8e2eaf8a932287a1d3bfac17774e58875a63b77e07298e4b4f515189c6fcac3cd35dac9240e633219bb6a5a25865e6ed8e16caa5406b56702afe0befcabbc9a2a772a1a087f0d633d457bceb695b2cba3a1a2daa2dda796373cc0fe0a53236d028fc1076bb746b2717c8b6052f58c91bb8cc19474ab9d4d2160773829f078727f6c684ca749136a7f46ca28b00bb4237695b409859a3cb7dbf298c7802264387811e20a0d78489eab0b0e"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x13}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0xc, &(0x7f0000000000)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x9, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @flow_dissector=0x11, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_usb_connect(0x3, 0x4f, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000e45aa5205b109917e9360102030109023d0001000000000904ef0404ff010100090502020800d0000909050800ff030700060705a902e86f4c0905d5"], 0x0) 18.231857732s ago: executing program 1 (id=3209): syz_open_dev$loop(&(0x7f0000000100), 0xf01c, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TEST(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000b6af9c73d87699a8dff06010800000000000000000200000210000780090012007379c143176c18bb0530adcbeec17a30000000000500010007000000"], 0x38}, 0x1, 0x0, 0x0, 0xc041}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000200)="68000000000905040000000000000000020000000900010073797a3000000000140002800600010000020000050002000600000008000f00000000002c0004800800010000000001200002800c000100706f6c69637930f50800020000000002080003000000001e", 0x68}], 0x1}, 0x0) syz_open_procfs(0x0, &(0x7f0000000c80)='io\x00') r2 = getpid() syz_pidfd_open(r2, 0x0) socket(0x200000000000011, 0x2, 0x4) socket$nl_route(0x10, 0x3, 0x0) socket$kcm(0x10, 0x400000002, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$packet(0x11, 0x2, 0x300) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000280)) r3 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r3, 0x10e, 0xc, &(0x7f0000000040)=0x7f, 0x4) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="380000001a00010000000000000000000a008000", @ANYRES32=0x0, @ANYBLOB="0000000008001f00000000001400", @ANYRES64=r3], 0x38}}, 0x0) 18.179063129s ago: executing program 5 (id=3210): sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)}, 0x3400c8d4) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) sendmsg$NL80211_CMD_LEAVE_OCB(r0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000300)={&(0x7f0000000240)={0x20, r1, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x100, 0x36}}}}, ["", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4000085) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'netdevsim0\x00'}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="280000005fd4a55db5d080b322bebd346dfcad9d7a87e15cf25cbd4ef85627d24a98bcbc07c4a9b1e4596dce7ebc2790d3c31741dee6012bc3f69913be89dad8c018af184a9f1fa650349b1937e8", @ANYRES16=r2, @ANYBLOB="01000000000000000000100000000c00018008000100", @ANYRES8=r3, @ANYBLOB="0800119b1d423244810f88e34146b9cb7b80bfdba8e2f41737ff0b89828c408283f194073b37532d0664c63d98cb2868c4904f8c7fb2daf98f8ead0ddf6c2a9d2a7b2f56940dc0f0ef8a78d3b6df6c510f528cada413105ff14fe43482c80350b30b3533cab354c95028d6abc61a69ff3a"], 0x28}, 0x1, 0x0, 0x0, 0x40000c5}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000000c0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0xfb, 0x0, 0xfffff010}, {0x6}]}, 0x10) sendmsg$nl_route_sched(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=@newqdisc={0x24, 0x24, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xb, 0x5}, {0xb, 0x3}, {0x10, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x400cc00}, 0x20080000) 17.978002163s ago: executing program 5 (id=3211): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_ASSOC_STATS(r1, 0x84, 0x70, 0x0, &(0x7f00000003c0)=0x14) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x108) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) syz_clone3(&(0x7f0000000240)={0x200a00000, 0x0, 0x0, 0x0, {0x2c}, 0x0, 0x0, 0x0, 0x0, 0x0, {r2}}, 0x58) rmdir(&(0x7f0000000080)='./cgroup/../file0\x00') r3 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_DONE(r3, 0x0, 0xc9, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x6, 0x3, &(0x7f0000000680)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) syz_io_uring_setup(0x2e20, 0x0, &(0x7f0000000340), 0x0, &(0x7f0000000400)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={0x0, 0x50}, 0x1, 0x0, 0x0, 0x40084}, 0x0) ioctl$KDDELIO(r0, 0x4b35, 0x4) io_uring_enter(0xffffffffffffffff, 0x162a, 0xea70, 0x5, &(0x7f0000000180)={[0x4]}, 0x8) 17.914925464s ago: executing program 1 (id=3212): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0xfb, 0x0, 0xfffff010}, {0x6}]}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=@newqdisc={0x24, 0x24, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xb, 0x5}, {0xb, 0x3}, {0x10, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x400cc00}, 0x20080000) 17.887693746s ago: executing program 5 (id=3213): futex_waitv(&(0x7f0000000780)=[{0x5, &(0x7f0000000080)=0x5, 0x2}], 0x1, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1) futex(&(0x7f0000000080), 0x3, 0x2, 0x0, &(0x7f0000000000)=0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) clock_gettime(0x0, &(0x7f0000000140)) r0 = socket(0x1e, 0x4, 0x0) socket$nl_audit(0x10, 0x3, 0x9) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='syscall\x00') prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x9, 0x80010, 0xffffffffffffffff, 0x100000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(r2, &(0x7f0000005380)={0x2020}, 0x2020) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1, 0x0, 0xfffffffffffffe68}, 0x0) sendmmsg(r0, &(0x7f00000030c0), 0x4000000000000a4, 0x9200000000000000) sendmsg$rds(0xffffffffffffffff, &(0x7f0000002fc0)={&(0x7f0000000380)={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f0000001ac0)=[{&(0x7f0000000440)=""/143, 0x8f}, {&(0x7f0000000500)=""/1, 0x1}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/166, 0xa6}, {&(0x7f0000001880)=""/227, 0xe3}, {&(0x7f0000001980)=""/176, 0xb0}, {&(0x7f0000001a40)=""/43, 0x2b}, {&(0x7f0000001a80)=""/32, 0x20}], 0x8, &(0x7f0000002ec0)=[@fadd={0x58, 0x114, 0x6, {{0x7, 0x6}, &(0x7f0000001b40)=0xfffffffffffffff7, &(0x7f0000001b80)=0x8, 0x5, 0x400, 0xf, 0x40, 0x8, 0x64b}}, @rdma_args={0x48, 0x114, 0x1, {{0xe3, 0x401}, {&(0x7f0000001bc0)=""/4096, 0x1000}, &(0x7f0000002e00)=[{&(0x7f0000002bc0)=""/174, 0xae}, {&(0x7f0000002c80)=""/132, 0x84}, {&(0x7f0000002d40)=""/136, 0x88}], 0x3, 0x48, 0x5}}, @cswp={0x58, 0x114, 0x7, {{0x0, 0x6}, &(0x7f0000002e40)=0x1000, &(0x7f0000002e80)=0x6, 0x5d7d, 0x200, 0x8000000000000000, 0x6, 0x1, 0x1}}], 0xf8, 0x8840}, 0x2) 17.748652135s ago: executing program 4 (id=3214): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0xfffff010}, {0x20, 0xfb, 0x0, 0xfffff010}, {0x6}]}, 0x10) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000740)=@newqdisc={0x24, 0x24, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xb, 0x5}, {0xb, 0x3}, {0x10, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x400cc00}, 0x20080000) (fail_nth: 1) 17.738900278s ago: executing program 1 (id=3215): io_setup(0x20008, &(0x7f0000000600)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setscheduler(r0, 0x6, &(0x7f0000000040)=0x2d) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) mprotect(&(0x7f00000f8000/0x3000)=nil, 0x3000, 0x1) ptrace$setsig(0x4203, r0, 0xe, 0x0) r1 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioperm(0x8, 0x9, 0x5a) r3 = openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="11000000040000000400000006"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x50}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2000006}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r6 = openat$cgroup_ro(r3, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f00000005c0)={0x2020}, 0x2020) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 17.237864553s ago: executing program 4 (id=3216): setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/cpuinfo\x00', 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xb, 0x4, 0x8, 0xffff8001, 0x4}, 0x50) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$MSR(&(0x7f0000000200), 0x3, 0x0) r3 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f0000000080)={0xa, 0x85, 0xf497}) syz_usb_connect$uac1(0x5ea364e6b4b6dbb1, 0xaa, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000580)={'syztnl0\x00', 0x0, 0x1, 0x7, 0x9, 0x7fffffff, {{0x1f, 0x4, 0x0, 0x4, 0x7c, 0x66, 0x0, 0x3, 0x4, 0x0, @multicast2, @multicast1, {[@timestamp_prespec={0x44, 0x24, 0x33, 0x3, 0x4, [{@broadcast, 0x1}, {@local, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}]}, @rr={0x7, 0xf, 0xfe, [@multicast1, @local, @rand_addr=0x64010102]}, @noop, @noop, @noop, @rr={0x7, 0x1b, 0x85, [@local, @rand_addr=0x64010101, @private=0xa010102, @loopback, @multicast1, @multicast1]}, @rr={0x7, 0x7, 0x97, [@loopback]}, @generic={0x86, 0xd, "f96b9061cb770bb67d6e00"}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0xd, 0x5, &(0x7f0000000100)=@framed={{}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x200}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r4, 0xe}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000180), 0x2, 0x208080) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"}) r7 = syz_open_pts(r6, 0x141601) write(r7, &(0x7f0000000000)="d5", 0xfffffedf) close_range(r5, 0xffffffffffffffff, 0x0) getrlimit(0xa, &(0x7f0000000040)) 15.253413581s ago: executing program 7 (id=3217): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') write(0xffffffffffffffff, &(0x7f0000000600)='dir .', 0x5) write(0xffffffffffffffff, &(0x7f0000000700), 0x0) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) epoll_create1(0x80000) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) close_range(r0, 0xffffffffffffffff, 0x0) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) 3.501550683s ago: executing program 38 (id=3206): r0 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[], 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = socket$inet6(0xa, 0x1, 0x84) set_mempolicy(0x4005, &(0x7f0000000040)=0x1001, 0x4) getsockopt$bt_hci(r1, 0x84, 0x6d, &(0x7f0000002e80)=""/4086, &(0x7f0000000040)=0xff6) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./security/ima/policy\x00', 0x1, 0x0) writev(r2, &(0x7f0000000200)=[{&(0x7f0000000180)="84", 0x1}], 0x1) sendmsg(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)}, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 1.900764819s ago: executing program 39 (id=3213): futex_waitv(&(0x7f0000000780)=[{0x5, &(0x7f0000000080)=0x5, 0x2}], 0x1, 0x0, &(0x7f00000000c0)={0x77359400}, 0x1) futex(&(0x7f0000000080), 0x3, 0x2, 0x0, &(0x7f0000000000)=0x2, 0x0) socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'vxcan1\x00'}) clock_gettime(0x0, &(0x7f0000000140)) r0 = socket(0x1e, 0x4, 0x0) socket$nl_audit(0x10, 0x3, 0x9) setsockopt$packet_tx_ring(r0, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) r1 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r1, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x2, 0x81, 0x1fd, 0x1, 0x1}, 0x1c) openat$ptp0(0xffffffffffffff9c, 0x0, 0x2001, 0x0) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000300)='syscall\x00') prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x9, 0x80010, 0xffffffffffffffff, 0x100000000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) read$FUSE(r2, &(0x7f0000005380)={0x2020}, 0x2020) recvmsg$unix(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000280)=""/246, 0xf6}], 0x1}, 0x20) sendmmsg(r1, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmsg$unix(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)=""/254, 0xfe}], 0x1, 0x0, 0xfffffffffffffe68}, 0x0) sendmmsg(r0, &(0x7f00000030c0), 0x4000000000000a4, 0x9200000000000000) sendmsg$rds(0xffffffffffffffff, &(0x7f0000002fc0)={&(0x7f0000000380)={0x2, 0x4e21, @broadcast}, 0x10, &(0x7f0000001ac0)=[{&(0x7f0000000440)=""/143, 0x8f}, {&(0x7f0000000500)=""/1, 0x1}, {&(0x7f00000007c0)=""/4096, 0x1000}, {&(0x7f00000017c0)=""/166, 0xa6}, {&(0x7f0000001880)=""/227, 0xe3}, {&(0x7f0000001980)=""/176, 0xb0}, {&(0x7f0000001a40)=""/43, 0x2b}, {&(0x7f0000001a80)=""/32, 0x20}], 0x8, &(0x7f0000002ec0)=[@fadd={0x58, 0x114, 0x6, {{0x7, 0x6}, &(0x7f0000001b40)=0xfffffffffffffff7, &(0x7f0000001b80)=0x8, 0x5, 0x400, 0xf, 0x40, 0x8, 0x64b}}, @rdma_args={0x48, 0x114, 0x1, {{0xe3, 0x401}, {&(0x7f0000001bc0)=""/4096, 0x1000}, &(0x7f0000002e00)=[{&(0x7f0000002bc0)=""/174, 0xae}, {&(0x7f0000002c80)=""/132, 0x84}, {&(0x7f0000002d40)=""/136, 0x88}], 0x3, 0x48, 0x5}}, @cswp={0x58, 0x114, 0x7, {{0x0, 0x6}, &(0x7f0000002e40)=0x1000, &(0x7f0000002e80)=0x6, 0x5d7d, 0x200, 0x8000000000000000, 0x6, 0x1, 0x1}}], 0xf8, 0x8840}, 0x2) 1.755507513s ago: executing program 40 (id=3215): io_setup(0x20008, &(0x7f0000000600)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setscheduler(r0, 0x6, &(0x7f0000000040)=0x2d) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) mprotect(&(0x7f00000f8000/0x3000)=nil, 0x3000, 0x1) ptrace$setsig(0x4203, r0, 0xe, 0x0) r1 = fsopen(&(0x7f0000000080)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x8) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) ioperm(0x8, 0x9, 0x5a) r3 = openat$cgroup(r2, &(0x7f00000000c0)='syz0\x00', 0x200002, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="11000000040000000400000006"], 0x50) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}, [@call={0x85, 0x0, 0x0, 0x50}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r4}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x2000006}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {}, {0x85, 0x0, 0x0, 0x33}}]}, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r5, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r6 = openat$cgroup_ro(r3, &(0x7f0000000240)='cpu.stat\x00', 0x0, 0x0) read$FUSE(r6, &(0x7f00000005c0)={0x2020}, 0x2020) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 1.488260494s ago: executing program 41 (id=3216): setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x2c41, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/cpuinfo\x00', 0x0, 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x6) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xb, 0x4, 0x8, 0xffff8001, 0x4}, 0x50) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$MSR(&(0x7f0000000200), 0x3, 0x0) r3 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sched_setscheduler(0x0, 0x2, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) ioctl$VIDIOC_EXPBUF(r3, 0xc0405610, &(0x7f0000000080)={0xa, 0x85, 0xf497}) syz_usb_connect$uac1(0x5ea364e6b4b6dbb1, 0xaa, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000480)={'syztnl1\x00', &(0x7f0000000580)={'syztnl0\x00', 0x0, 0x1, 0x7, 0x9, 0x7fffffff, {{0x1f, 0x4, 0x0, 0x4, 0x7c, 0x66, 0x0, 0x3, 0x4, 0x0, @multicast2, @multicast1, {[@timestamp_prespec={0x44, 0x24, 0x33, 0x3, 0x4, [{@broadcast, 0x1}, {@local, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x5}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4}]}, @rr={0x7, 0xf, 0xfe, [@multicast1, @local, @rand_addr=0x64010102]}, @noop, @noop, @noop, @rr={0x7, 0x1b, 0x85, [@local, @rand_addr=0x64010101, @private=0xa010102, @loopback, @multicast1, @multicast1]}, @rr={0x7, 0x7, 0x97, [@loopback]}, @generic={0x86, 0xd, "f96b9061cb770bb67d6e00"}]}}}}}) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0xd, 0x5, &(0x7f0000000100)=@framed={{}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x200}]}, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', r4, 0xe}, 0x94) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) r6 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) syz_open_dev$evdev(&(0x7f0000000180), 0x2, 0x208080) ioctl$TCSETS(r6, 0x40045431, &(0x7f0000000140)={0x0, 0xc, 0x0, 0x0, 0x0, "810000cc2b000000000000fa25ffff00ffffff"}) r7 = syz_open_pts(r6, 0x141601) write(r7, &(0x7f0000000000)="d5", 0xfffffedf) close_range(r5, 0xffffffffffffffff, 0x0) getrlimit(0xa, &(0x7f0000000040)) 0s ago: executing program 42 (id=3217): syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) ioctl$CEC_S_MODE(0xffffffffffffffff, 0x40046109, 0x0) syz_open_dev$cec(&(0x7f0000002340), 0x0, 0x0) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(&(0x7f00000000c0)='./file1\x00') openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='net_prio.prioidx\x00', 0x275a, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xc0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x0) mkdir(&(0x7f0000000200)='./bus\x00', 0x10) mount$overlay(0x0, &(0x7f0000000100)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f00000021c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') write(0xffffffffffffffff, &(0x7f0000000600)='dir .', 0x5) write(0xffffffffffffffff, &(0x7f0000000700), 0x0) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) epoll_create1(0x80000) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_mreq(r1, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) close_range(r0, 0xffffffffffffffff, 0x0) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x5) kernel console output (not intermixed with test programs): Documentation/mm/remap_file_pages.rst. [ 1547.915443][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915587][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915634][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915728][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915772][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915815][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915908][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.915952][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1547.916053][T18212] netlink: 4 bytes leftover after parsing attributes in process `syz.7.2715'. [ 1548.199483][T14201] gspca_spca1528: reg_w err -71 [ 1548.199613][T14201] spca1528 6-1:0.1: probe with driver spca1528 failed with error -71 [ 1548.241817][T14201] usb 6-1: USB disconnect, device number 36 [ 1548.875921][T18219] FAULT_INJECTION: forcing a failure. [ 1548.875921][T18219] name failslab, interval 1, probability 0, space 0, times 0 [ 1548.884457][T18219] CPU: 1 UID: 0 PID: 18219 Comm: syz.1.2719 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1548.884488][T18219] Tainted: [L]=SOFTLOCKUP [ 1548.884495][T18219] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1548.884505][T18219] Call Trace: [ 1548.884514][T18219] [ 1548.884523][T18219] dump_stack_lvl+0xe8/0x150 [ 1548.884556][T18219] should_fail_ex+0x46b/0x600 [ 1548.884585][T18219] should_failslab+0xa8/0x100 [ 1548.884629][T18219] __kmalloc_cache_noprof+0xa1/0x680 [ 1548.884654][T18219] ? trace_parse_run_command+0x5f/0x380 [ 1548.884676][T18219] ? trace_parse_run_command+0x5f/0x380 [ 1548.884705][T18219] trace_parse_run_command+0x5f/0x380 [ 1548.884728][T18219] ? __pfx_create_or_delete_trace_uprobe+0x10/0x10 [ 1548.884754][T18219] ? __pfx_probes_write+0x10/0x10 [ 1548.884776][T18219] vfs_write+0x29f/0xbb0 [ 1548.884806][T18219] ? __pfx_vfs_write+0x10/0x10 [ 1548.884829][T18219] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1548.884854][T18219] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1548.884874][T18219] ? mutex_lock_nested+0x152/0x1d0 [ 1548.884905][T18219] ? fdget_pos+0x252/0x320 [ 1548.884933][T18219] ksys_write+0x156/0x270 [ 1548.884957][T18219] ? __pfx_ksys_write+0x10/0x10 [ 1548.884989][T18219] do_syscall_64+0x166/0x520 [ 1548.885009][T18219] ? trace_irq_disable+0x3b/0x140 [ 1548.885030][T18219] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.885049][T18219] ? clear_bhb_loop+0x70/0xc0 [ 1548.885072][T18219] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1548.885090][T18219] RIP: 0033:0x7f9b7b54e159 [ 1548.885109][T18219] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1548.885125][T18219] RSP: 002b:00007f9b797a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1548.885145][T18219] RAX: ffffffffffffffda RBX: 00007f9b7b7d5fa0 RCX: 00007f9b7b54e159 [ 1548.885158][T18219] RDX: 0000000000000017 RSI: 00002000000002c0 RDI: 0000000000000004 [ 1548.885170][T18219] RBP: 00007f9b797a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1548.885182][T18219] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1548.885193][T18219] R13: 00007f9b7b7d6038 R14: 00007f9b7b7d5fa0 R15: 00007ffe4914a508 [ 1548.885225][T18219] [ 1551.722140][T18241] FAULT_INJECTION: forcing a failure. [ 1551.722140][T18241] name failslab, interval 1, probability 0, space 0, times 0 [ 1551.722222][T18241] CPU: 0 UID: 0 PID: 18241 Comm: syz.1.2730 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1551.722247][T18241] Tainted: [L]=SOFTLOCKUP [ 1551.722253][T18241] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1551.722262][T18241] Call Trace: [ 1551.722268][T18241] [ 1551.722274][T18241] dump_stack_lvl+0xe8/0x150 [ 1551.722304][T18241] should_fail_ex+0x46b/0x600 [ 1551.722331][T18241] should_failslab+0xa8/0x100 [ 1551.722356][T18241] ? do_getname+0x2e/0x250 [ 1551.722380][T18241] kmem_cache_alloc_noprof+0x9e/0x690 [ 1551.722402][T18241] ? do_getname+0x2e/0x250 [ 1551.722425][T18241] ? rt_mutex_slowunlock+0x219/0x460 [ 1551.722453][T18241] do_getname+0x2e/0x250 [ 1551.722475][T18241] ? getname_flags+0x11/0x20 [ 1551.722500][T18241] do_sys_openat2+0xcc/0x200 [ 1551.722528][T18241] ? __pfx_do_sys_openat2+0x10/0x10 [ 1551.722552][T18241] ? ksys_write+0x248/0x270 [ 1551.722573][T18241] ? __pfx_ksys_write+0x10/0x10 [ 1551.722597][T18241] __x64_sys_openat+0x138/0x170 [ 1551.722626][T18241] do_syscall_64+0x166/0x520 [ 1551.722646][T18241] ? trace_irq_disable+0x3b/0x140 [ 1551.722666][T18241] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1551.722684][T18241] ? clear_bhb_loop+0x70/0xc0 [ 1551.722706][T18241] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1551.722724][T18241] RIP: 0033:0x7f9b7b54e159 [ 1551.722742][T18241] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1551.722757][T18241] RSP: 002b:00007f9b79785028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1551.722776][T18241] RAX: ffffffffffffffda RBX: 00007f9b7b7d6090 RCX: 00007f9b7b54e159 [ 1551.722790][T18241] RDX: 0000000000880cc2 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 1551.722803][T18241] RBP: 00007f9b79785090 R08: 0000000000000000 R09: 0000000000000000 [ 1551.722815][T18241] R10: 0000000000000020 R11: 0000000000000246 R12: 0000000000000001 [ 1551.722826][T18241] R13: 00007f9b7b7d6128 R14: 00007f9b7b7d6090 R15: 00007ffe4914a508 [ 1551.722856][T18241] [ 1552.631629][T18255] FAULT_INJECTION: forcing a failure. [ 1552.631629][T18255] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1552.631845][T18255] CPU: 0 UID: 0 PID: 18255 Comm: syz.4.2732 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1552.631872][T18255] Tainted: [L]=SOFTLOCKUP [ 1552.631879][T18255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1552.631890][T18255] Call Trace: [ 1552.631898][T18255] [ 1552.631907][T18255] dump_stack_lvl+0xe8/0x150 [ 1552.631939][T18255] should_fail_ex+0x46b/0x600 [ 1552.631963][T18255] _copy_to_user+0x31/0xb0 [ 1552.631983][T18255] simple_read_from_buffer+0xe1/0x170 [ 1552.632005][T18255] proc_fail_nth_read+0x1be/0x230 [ 1552.632031][T18255] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1552.632064][T18255] ? rw_verify_area+0x250/0x4d0 [ 1552.632086][T18255] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1552.632104][T18255] vfs_read+0x219/0xa90 [ 1552.632132][T18255] ? __pfx_vfs_read+0x10/0x10 [ 1552.632154][T18255] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1552.632178][T18255] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1552.632198][T18255] ? mutex_lock_nested+0x152/0x1d0 [ 1552.632221][T18255] ? fdget_pos+0x252/0x320 [ 1552.632248][T18255] ksys_read+0x156/0x270 [ 1552.632270][T18255] ? __pfx_ksys_read+0x10/0x10 [ 1552.632300][T18255] do_syscall_64+0x166/0x520 [ 1552.632320][T18255] ? trace_irq_disable+0x3b/0x140 [ 1552.632341][T18255] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1552.632359][T18255] ? clear_bhb_loop+0x70/0xc0 [ 1552.632381][T18255] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1552.632399][T18255] RIP: 0033:0x7fe25992e98e [ 1552.632416][T18255] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1552.632431][T18255] RSP: 002b:00007fe257ba4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1552.632451][T18255] RAX: ffffffffffffffda RBX: 00007fe257ba56c0 RCX: 00007fe25992e98e [ 1552.632465][T18255] RDX: 000000000000000f RSI: 00007fe257ba50a0 RDI: 0000000000000004 [ 1552.632477][T18255] RBP: 00007fe257ba5090 R08: 0000000000000000 R09: 0000000000000000 [ 1552.632489][T18255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1552.632500][T18255] R13: 00007fe259bf6128 R14: 00007fe259bf6090 R15: 00007ffc86cf02f8 [ 1552.632530][T18255] [ 1553.012234][ T5721] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 1553.171632][ T5721] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1553.185202][ T5721] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1553.191521][ T5721] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1553.236346][ T5721] usb 2-1: config 0 descriptor?? [ 1553.421133][ T9944] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 1553.469698][T18253] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1553.470354][T18253] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1553.488338][ T5721] usbhid 2-1:0.0: can't add hid device: -71 [ 1553.492116][T18259] rnbd_client L127: Can't parse path ip:: -22 [ 1553.502312][ T5721] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1553.523767][ T5721] usb 2-1: USB disconnect, device number 74 [ 1553.590812][ T9944] usb 5-1: Using ep0 maxpacket: 16 [ 1553.591669][ T9944] usb 5-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1553.594857][ T9944] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1553.594880][ T9944] usb 5-1: config 0 has no interface number 0 [ 1553.609272][ T9944] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.609296][ T9944] usb 5-1: Product: syz [ 1553.609310][ T9944] usb 5-1: Manufacturer: syz [ 1553.609324][ T9944] usb 5-1: SerialNumber: syz [ 1553.622313][ T9944] usb 5-1: config 0 descriptor?? [ 1553.640357][ T9944] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1553.859877][T18257] netlink: 'syz.4.2734': attribute type 15 has an invalid length. [ 1553.860468][T18257] __nla_validate_parse: 45 callbacks suppressed [ 1553.860481][T18257] netlink: 24 bytes leftover after parsing attributes in process `syz.4.2734'. [ 1554.060637][ T5721] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 1554.216448][ T5721] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1554.234215][ T5721] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1554.245177][ T5721] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1554.275580][ T5721] usb 2-1: config 0 descriptor?? [ 1555.581523][ T5721] aiptek 2-1:0.0: Aiptek using 400 ms programming speed [ 1555.595753][ T5721] input: Aiptek as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/input/input50 [ 1555.800931][ T9944] gspca_spca1528: reg_w err -71 [ 1555.801140][ T9944] spca1528 5-1:0.1: probe with driver spca1528 failed with error -71 [ 1555.818097][ T9944] usb 5-1: USB disconnect, device number 75 [ 1555.978403][ T5721] usb 2-1: USB disconnect, device number 75 [ 1555.978522][ C1] aiptek 2-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1560.889826][T18317] FAULT_INJECTION: forcing a failure. [ 1560.889826][T18317] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1560.904017][T18317] CPU: 1 UID: 0 PID: 18317 Comm: syz.1.2754 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1560.904043][T18317] Tainted: [L]=SOFTLOCKUP [ 1560.904049][T18317] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1560.904058][T18317] Call Trace: [ 1560.904065][T18317] [ 1560.904072][T18317] dump_stack_lvl+0xe8/0x150 [ 1560.904101][T18317] should_fail_ex+0x46b/0x600 [ 1560.904123][T18317] _copy_to_user+0x31/0xb0 [ 1560.904144][T18317] simple_read_from_buffer+0xe1/0x170 [ 1560.904165][T18317] proc_fail_nth_read+0x1be/0x230 [ 1560.904187][T18317] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1560.904209][T18317] ? rw_verify_area+0x250/0x4d0 [ 1560.904230][T18317] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1560.904247][T18317] vfs_read+0x219/0xa90 [ 1560.904269][T18317] ? __pfx_vfs_read+0x10/0x10 [ 1560.904287][T18317] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1560.904307][T18317] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1560.904324][T18317] ? mutex_lock_nested+0x152/0x1d0 [ 1560.904344][T18317] ? fdget_pos+0x252/0x320 [ 1560.904365][T18317] ksys_read+0x156/0x270 [ 1560.904383][T18317] ? __pfx_ksys_read+0x10/0x10 [ 1560.904414][T18317] do_syscall_64+0x166/0x520 [ 1560.904434][T18317] ? trace_irq_disable+0x3b/0x140 [ 1560.904453][T18317] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1560.904476][T18317] ? clear_bhb_loop+0x70/0xc0 [ 1560.904493][T18317] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1560.904507][T18317] RIP: 0033:0x7f9b7b50e98e [ 1560.904521][T18317] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1560.904533][T18317] RSP: 002b:00007f9b79784fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1560.904550][T18317] RAX: ffffffffffffffda RBX: 00007f9b797856c0 RCX: 00007f9b7b50e98e [ 1560.904560][T18317] RDX: 000000000000000f RSI: 00007f9b797850a0 RDI: 0000000000000005 [ 1560.904569][T18317] RBP: 00007f9b79785090 R08: 0000000000000000 R09: 0000000000000000 [ 1560.904578][T18317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1560.904586][T18317] R13: 00007f9b7b7d6128 R14: 00007f9b7b7d6090 R15: 00007ffe4914a508 [ 1560.904610][T18317] [ 1561.175328][ T5721] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 1561.892194][ T5721] usb 5-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1561.922769][ T5721] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1561.924629][ T5721] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1561.924660][ T5721] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1561.924683][ T5721] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1561.924738][ T5721] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1562.010970][ T5721] usb 5-1: config 0 descriptor?? [ 1562.274222][T18328] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2756'. [ 1563.617581][ T5721] usbhid 5-1:0.0: can't add hid device: -71 [ 1563.617740][ T5721] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1563.623422][ T5721] usb 5-1: USB disconnect, device number 76 [ 1563.932332][ T8256] usb 9-1: new full-speed USB device number 67 using dummy_hcd [ 1564.154898][ T8256] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1564.291112][ T8256] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1564.291193][ T8256] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1564.291217][ T8256] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1564.313199][ T8256] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1564.313225][ T8256] usb 9-1: Product: syz [ 1564.313239][ T8256] usb 9-1: Manufacturer: syz [ 1564.313252][ T8256] usb 9-1: SerialNumber: syz [ 1564.343625][ T8256] usb 9-1: config 0 descriptor?? [ 1564.344659][T18331] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1564.460655][ T8256] rc_core: IR keymap rc-streamzap not found [ 1564.460715][ T8256] Registered IR keymap rc-empty [ 1564.468950][ T8256] rc rc0: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 1564.497904][ T8256] input: Streamzap PC Remote Infrared Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input51 [ 1564.539005][T18347] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2760'. [ 1564.679694][ T8256] usb 9-1: USB disconnect, device number 67 [ 1565.730648][ T5721] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1566.044913][ T5721] usb 6-1: Using ep0 maxpacket: 16 [ 1566.129657][ T5721] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1566.140750][ T5721] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1566.150494][ T5721] usb 6-1: config 0 has no interface number 0 [ 1566.172491][ T5721] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1566.175719][ T5721] usb 6-1: Product: syz [ 1566.175736][ T5721] usb 6-1: Manufacturer: syz [ 1566.175750][ T5721] usb 6-1: SerialNumber: syz [ 1566.231559][ T5721] usb 6-1: config 0 descriptor?? [ 1566.246952][ T5721] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1566.317826][T18379] FAULT_INJECTION: forcing a failure. [ 1566.317826][T18379] name failslab, interval 1, probability 0, space 0, times 0 [ 1566.739311][T18368] netlink: 'syz.5.2768': attribute type 15 has an invalid length. [ 1566.739601][T18368] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2768'. [ 1566.775559][T18379] CPU: 0 UID: 0 PID: 18379 Comm: syz.4.2771 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1566.775591][T18379] Tainted: [L]=SOFTLOCKUP [ 1566.775596][T18379] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1566.775603][T18379] Call Trace: [ 1566.775610][T18379] [ 1566.775618][T18379] dump_stack_lvl+0xe8/0x150 [ 1566.775642][T18379] should_fail_ex+0x46b/0x600 [ 1566.775669][T18379] should_failslab+0xa8/0x100 [ 1566.775698][T18379] __kmalloc_noprof+0xfb/0x790 [ 1566.775721][T18379] ? kernfs_fop_write_iter+0x158/0x540 [ 1566.775744][T18379] ? kernfs_fop_write_iter+0x158/0x540 [ 1566.775771][T18379] kernfs_fop_write_iter+0x158/0x540 [ 1566.775788][T18379] vfs_write+0x61e/0xbb0 [ 1566.775805][T18379] ? __pfx_vfs_write+0x10/0x10 [ 1566.775826][T18379] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1566.775854][T18379] ? mutex_lock_nested+0x152/0x1d0 [ 1566.775878][T18379] ? fdget_pos+0x252/0x320 [ 1566.775906][T18379] ksys_write+0x156/0x270 [ 1566.775928][T18379] ? __pfx_ksys_write+0x10/0x10 [ 1566.775946][T18379] do_syscall_64+0x166/0x520 [ 1566.775964][T18379] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1566.775974][T18379] ? clear_bhb_loop+0x70/0xc0 [ 1566.775994][T18379] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1566.776017][T18379] RIP: 0033:0x7fe25996e159 [ 1566.776035][T18379] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1566.776051][T18379] RSP: 002b:00007fe257bc6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1566.776072][T18379] RAX: ffffffffffffffda RBX: 00007fe259bf5fa0 RCX: 00007fe25996e159 [ 1566.776086][T18379] RDX: 0000000000000012 RSI: 0000200000000040 RDI: 0000000000000003 [ 1566.776098][T18379] RBP: 00007fe257bc6090 R08: 0000000000000000 R09: 0000000000000000 [ 1566.776105][T18379] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1566.776111][T18379] R13: 00007fe259bf6038 R14: 00007fe259bf5fa0 R15: 00007ffc86cf02f8 [ 1566.776128][T18379] [ 1567.489008][T18387] veth0_macvtap: left promiscuous mode [ 1567.549525][T18387] netlink: 'syz.8.2773': attribute type 1 has an invalid length. [ 1567.552353][T18387] netlink: 'syz.8.2773': attribute type 2 has an invalid length. [ 1567.670690][ T5857] usb 9-1: new high-speed USB device number 68 using dummy_hcd [ 1568.114386][ T5721] gspca_spca1528: reg_w err -71 [ 1568.116464][ T5721] spca1528 6-1:0.1: probe with driver spca1528 failed with error -71 [ 1568.130886][ T5857] usb 9-1: Using ep0 maxpacket: 16 [ 1568.154518][ T5857] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1568.154633][ T5857] usb 9-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1568.185689][ T5857] usb 9-1: config 9 has an invalid interface number: 57 but max is 0 [ 1568.186790][ T5857] usb 9-1: config 9 has no interface number 0 [ 1568.186826][ T5857] usb 9-1: config 9 interface 57 has no altsetting 0 [ 1568.190158][ T5721] usb 6-1: USB disconnect, device number 37 [ 1568.231346][ T5857] usb 9-1: string descriptor 0 read error: -22 [ 1568.232739][ T5857] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1568.670739][T12732] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 1568.800697][T12732] usb 5-1: device descriptor read/64, error -71 [ 1569.050785][T12732] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 1569.111804][T18401] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2777'. [ 1569.161165][ T5857] video4linux radio48: keene_cmd_main failed (-71) [ 1569.191972][T12732] usb 5-1: device descriptor read/64, error -71 [ 1569.211154][ T5857] radio-keene 9-1:9.57: V4L2 device registered as radio48 [ 1569.256432][ T5857] usb 9-1: USB disconnect, device number 68 [ 1569.304990][T12732] usb usb5-port1: attempt power cycle [ 1569.650699][T12732] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 1569.685011][T12732] usb 5-1: device descriptor read/8, error -71 [ 1569.920727][T12732] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 1569.958084][T12732] usb 5-1: device descriptor read/8, error -71 [ 1570.071712][T12732] usb usb5-port1: unable to enumerate USB device [ 1570.212993][T18407] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1570.227802][T18407] block device autoloading is deprecated and will be removed. [ 1570.871453][T18417] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18416] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18417] [ 1576.446525][T18438] random: crng reseeded on system resumption [ 1578.706867][T18457] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18456] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18457] [ 1580.090718][T12732] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1580.252934][T12732] usb 6-1: Using ep0 maxpacket: 16 [ 1580.257201][T12732] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1580.268456][T12732] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1580.277184][T12732] usb 6-1: config 0 has no interface number 0 [ 1580.298097][T12732] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1580.298275][T12732] usb 6-1: Product: syz [ 1580.298291][T12732] usb 6-1: Manufacturer: syz [ 1580.298305][T12732] usb 6-1: SerialNumber: syz [ 1580.339101][T12732] usb 6-1: config 0 descriptor?? [ 1580.340956][T18464] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2796'. [ 1580.365628][T12732] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1580.606376][T18453] netlink: 'syz.5.2787': attribute type 15 has an invalid length. [ 1580.614981][T18453] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2787'. [ 1581.641078][T12732] gspca_spca1528: reg_w err -71 [ 1581.642386][T12732] spca1528 6-1:0.1: probe with driver spca1528 failed with error -71 [ 1581.679523][T12732] usb 6-1: USB disconnect, device number 38 [ 1581.718501][ T9550] udevd[9550]: setting owner of /dev/bus/usb/006/038 to uid=0, gid=0 failed: No such file or directory [ 1584.248375][T18496] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18495] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18496] [ 1585.646795][ T31] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 1585.790707][ T31] usb 5-1: device descriptor read/64, error -71 [ 1586.033135][ T31] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 1586.202587][ T31] usb 5-1: device descriptor read/64, error -71 [ 1586.319556][ T31] usb usb5-port1: attempt power cycle [ 1586.680853][ T31] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 1586.745193][ T31] usb 5-1: device descriptor read/8, error -71 [ 1587.036706][T13830] Bluetooth: hci5: command 0x0406 tx timeout [ 1587.150945][ T31] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 1587.473977][ T31] usb 5-1: device descriptor read/8, error -71 [ 1587.581541][ T31] usb usb5-port1: unable to enumerate USB device [ 1587.619023][T18512] netlink: 'syz.4.2811': attribute type 5 has an invalid length. [ 1588.130646][ T31] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 1588.245980][T18524] netlink: 'syz.4.2815': attribute type 5 has an invalid length. [ 1588.290676][ T31] usb 6-1: Using ep0 maxpacket: 16 [ 1588.297650][ T31] usb 6-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1588.300986][ T31] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1588.306077][ T31] usb 6-1: config 0 has no interface number 0 [ 1588.331729][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.335022][ T31] usb 6-1: Product: syz [ 1588.335039][ T31] usb 6-1: Manufacturer: syz [ 1588.335054][ T31] usb 6-1: SerialNumber: syz [ 1588.365766][ T31] usb 6-1: config 0 descriptor?? [ 1588.397486][ T31] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1588.598680][T18517] netlink: 'syz.5.2813': attribute type 15 has an invalid length. [ 1588.606689][T18517] netlink: 24 bytes leftover after parsing attributes in process `syz.5.2813'. [ 1588.961279][T18530] ptrace attach of "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18529] was attempted by "ci-upstream-kasan-gce-smack-root/syz-executor exec"[18530] [ 1589.796526][ T31] gspca_spca1528: reg_w err -110 [ 1589.810684][ T31] spca1528 6-1:0.1: probe with driver spca1528 failed with error -110 [ 1590.544713][T18534] FAULT_INJECTION: forcing a failure. [ 1590.544713][T18534] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1590.551569][T18534] CPU: 0 UID: 0 PID: 18534 Comm: syz.1.2818 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1590.551600][T18534] Tainted: [L]=SOFTLOCKUP [ 1590.551608][T18534] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1590.551619][T18534] Call Trace: [ 1590.551627][T18534] [ 1590.551635][T18534] dump_stack_lvl+0xe8/0x150 [ 1590.551668][T18534] should_fail_ex+0x46b/0x600 [ 1590.551694][T18534] _copy_from_user+0x2d/0xb0 [ 1590.551717][T18534] do_semtimedop+0x235/0x3a0 [ 1590.551742][T18534] ? __pfx_do_semtimedop+0x10/0x10 [ 1590.551812][T18534] __x64_sys_semtimedop+0x156/0x1c0 [ 1590.551836][T18534] ? __pfx___x64_sys_semtimedop+0x10/0x10 [ 1590.551868][T18534] do_syscall_64+0x166/0x520 [ 1590.551888][T18534] ? trace_irq_disable+0x3b/0x140 [ 1590.551910][T18534] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1590.551930][T18534] ? clear_bhb_loop+0x70/0xc0 [ 1590.551952][T18534] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1590.551971][T18534] RIP: 0033:0x7f9b7b54e159 [ 1590.551988][T18534] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1590.552005][T18534] RSP: 002b:00007f9b797a6028 EFLAGS: 00000246 ORIG_RAX: 00000000000000dc [ 1590.552025][T18534] RAX: ffffffffffffffda RBX: 00007f9b7b7d5fa0 RCX: 00007f9b7b54e159 [ 1590.552039][T18534] RDX: 000000000000003e RSI: 0000200000001080 RDI: 0000000000000000 [ 1590.552059][T18534] RBP: 00007f9b797a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1590.552071][T18534] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1590.552082][T18534] R13: 00007f9b7b7d6038 R14: 00007f9b7b7d5fa0 R15: 00007ffe4914a508 [ 1590.552113][T18534] [ 1591.311280][ T31] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 1591.382406][ T5857] usb 6-1: USB disconnect, device number 39 [ 1591.472410][ T31] usb 2-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1591.488759][ T31] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1591.496288][ T31] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1591.501434][ T31] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1591.715510][ T31] usb 2-1: config 0 descriptor?? [ 1592.063186][T18545] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1592.082512][T18545] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1592.117374][T12732] usb 2-1: USB disconnect, device number 76 [ 1593.070921][T12732] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 1593.290708][T12732] usb 2-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1593.375783][T12732] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1593.388226][T12732] usb 2-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1593.388919][T12732] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1593.594201][T12732] usb 2-1: config 0 descriptor?? [ 1594.562145][T18564] netlink: 'syz.7.2826': attribute type 5 has an invalid length. [ 1594.670092][T18566] netlink: 'syz.5.2827': attribute type 5 has an invalid length. [ 1595.046256][ T5857] usb 2-1: USB disconnect, device number 77 [ 1595.087887][T18572] veth0_macvtap: left promiscuous mode [ 1595.111165][T12732] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1595.163247][T18572] netlink: 'syz.7.2829': attribute type 1 has an invalid length. [ 1595.163352][T18572] netlink: 'syz.7.2829': attribute type 2 has an invalid length. [ 1595.270716][T12732] usb 6-1: Using ep0 maxpacket: 16 [ 1595.279499][T12732] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1595.298093][T12732] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1595.299758][T12732] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1595.324149][T12732] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1595.332636][T12732] usb 6-1: Product: syz [ 1595.332657][T12732] usb 6-1: Manufacturer: syz [ 1595.332672][T12732] usb 6-1: SerialNumber: syz [ 1595.357730][T12732] usb 6-1: config 0 descriptor?? [ 1595.372656][T12732] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1595.383089][T12732] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1595.463137][T18585] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2834'. [ 1595.669643][ T8256] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 1596.983198][T12732] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1596.997942][T12732] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1598.009368][T12732] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1598.016818][T12732] em28xx 6-1:0.0: No AC97 audio processor [ 1598.660630][ T8256] usb 5-1: Using ep0 maxpacket: 16 [ 1598.661712][ T8256] usb 5-1: device descriptor read/all, error -71 [ 1598.863195][T18596] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2836'. [ 1598.910271][T18601] netlink: 'syz.8.2839': attribute type 5 has an invalid length. [ 1599.910908][ T8256] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 1599.975194][T18617] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2845'. [ 1600.072529][ T8256] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1600.082945][ T31] usb 6-1: USB disconnect, device number 40 [ 1600.090378][ T8256] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1600.090446][ T8256] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1600.090481][ T8256] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1600.091754][T18620] netlink: 312 bytes leftover after parsing attributes in process `syz.1.2846'. [ 1600.091775][T18620] netlink: 'syz.1.2846': attribute type 1 has an invalid length. [ 1600.148662][ T31] em28xx 6-1:0.0: Disconnecting em28xx [ 1600.154290][ T8256] usb 5-1: config 0 descriptor?? [ 1600.288960][ T31] em28xx: Freeing device [ 1600.375445][T18609] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1600.378738][T18609] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1600.389512][T12732] usb 5-1: USB disconnect, device number 86 [ 1600.472810][T18627] netlink: 48 bytes leftover after parsing attributes in process `syz.5.2848'. [ 1601.322399][ T9944] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 1601.643725][ T9944] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1601.654373][ T9944] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1601.662255][ T9944] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1601.662299][ T9944] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1601.704648][ T9944] usb 5-1: config 0 descriptor?? [ 1601.995434][T18647] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2856'. [ 1604.144766][ T9944] usb 5-1: USB disconnect, device number 87 [ 1605.029011][T18679] netlink: 48 bytes leftover after parsing attributes in process `syz.4.2869'. [ 1605.161315][ T9944] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 1605.311715][ T9944] usb 9-1: Using ep0 maxpacket: 8 [ 1605.318409][ T9944] usb 9-1: New USB device found, idVendor=045e, idProduct=00f9, bcdDevice= 0.00 [ 1605.330652][ T9944] usb 9-1: too many endpoints for config 0 interface 0 altsetting 254: 65, using maximum allowed: 30 [ 1605.341725][ T9944] usb 9-1: config 0 interface 0 altsetting 254 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 1605.341756][ T9944] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1605.341791][ T9944] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1605.385316][ T9944] usb 9-1: config 0 descriptor?? [ 1605.391709][ T31] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 1606.514876][ T31] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1606.526026][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1606.526126][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1606.531375][ T31] usb 5-1: config 0 descriptor?? [ 1606.664492][ T9944] microsoft 0003:045E:00F9.000E: unknown main item tag 0x2 [ 1606.671841][ T9944] microsoft 0003:045E:00F9.000E: unknown main item tag 0x6 [ 1606.671943][ T9944] microsoft 0003:045E:00F9.000E: ignoring exceeding usage max [ 1606.704843][ T9944] microsoft 0003:045E:00F9.000E: hidraw0: USB HID v0.02 Device [HID 045e:00f9] on usb-dummy_hcd.8-1/input0 [ 1606.909258][T18681] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1606.922301][T18681] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1606.937313][ T31] usbhid 5-1:0.0: can't add hid device: -71 [ 1606.942116][ T31] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1606.969643][ T31] usb 5-1: USB disconnect, device number 88 [ 1607.087813][ T9944] usb 9-1: USB disconnect, device number 69 [ 1607.334702][T18695] fido_id[18695]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.8/usb9/report_descriptor': No such file or directory [ 1607.354516][ T1325] ieee802154 phy0 wpan0: encryption failed: -22 [ 1608.276563][ T31] usb 5-1: new high-speed USB device number 89 using dummy_hcd [ 1608.849004][T18708] netlink: 65047 bytes leftover after parsing attributes in process `syz.4.2880'. [ 1608.934525][T18711] veth0_macvtap: left promiscuous mode [ 1609.014377][T18711] netlink: 'syz.1.2879': attribute type 1 has an invalid length. [ 1609.014460][T18711] netlink: 'syz.1.2879': attribute type 2 has an invalid length. [ 1609.160745][ T9944] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 1609.238317][T18719] netlink: 'syz.5.2883': attribute type 5 has an invalid length. [ 1609.325885][ T9944] usb 2-1: Using ep0 maxpacket: 16 [ 1609.335812][ T9944] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1609.335905][ T9944] usb 2-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1609.353119][ T9944] usb 2-1: config 9 has an invalid interface number: 57 but max is 0 [ 1609.353170][ T9944] usb 2-1: config 9 has no interface number 0 [ 1609.353202][ T9944] usb 2-1: config 9 interface 57 has no altsetting 0 [ 1609.377142][ T9944] usb 2-1: string descriptor 0 read error: -22 [ 1609.377335][ T9944] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1609.386842][T18723] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2884'. [ 1610.526081][ T9944] video4linux radio48: keene_cmd_set failed (-71) [ 1610.526157][ T9944] radio-keene 2-1:9.57: V4L2 device registered as radio48 [ 1610.530710][ T9944] usb 2-1: USB disconnect, device number 78 [ 1611.640991][ T31] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 1611.911101][ T31] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1611.969073][ T31] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1611.972814][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1612.104247][ T31] usb 5-1: config 0 descriptor?? [ 1612.896758][T18742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1612.924620][T18742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1613.004217][ T31] usbhid 5-1:0.0: can't add hid device: -71 [ 1613.004381][ T31] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1613.027140][ T31] usb 5-1: USB disconnect, device number 90 [ 1615.021283][T18759] netlink: 'syz.8.2895': attribute type 5 has an invalid length. [ 1615.031006][ T31] usb 5-1: new high-speed USB device number 91 using dummy_hcd [ 1618.035408][ T9944] usb 9-1: new high-speed USB device number 70 using dummy_hcd [ 1618.264924][ T9944] usb 9-1: Using ep0 maxpacket: 8 [ 1618.550698][T14201] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1618.665419][T18780] veth0_macvtap: left promiscuous mode [ 1619.065556][T14201] usb 6-1: Using ep0 maxpacket: 16 [ 1619.407020][T14201] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1619.453448][T14201] usb 6-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1619.590703][T14201] usb 6-1: config 9 has an invalid interface number: 57 but max is 0 [ 1619.620599][T14201] usb 6-1: config 9 has no interface number 0 [ 1619.621240][T14201] usb 6-1: config 9 interface 57 has no altsetting 0 [ 1619.676113][ T9944] usb 9-1: device descriptor read/all, error -71 [ 1619.695454][T14201] usb 6-1: string descriptor 0 read error: -22 [ 1619.695636][T14201] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.783050][T18780] netlink: 'syz.5.2902': attribute type 1 has an invalid length. [ 1619.783124][T18780] netlink: 'syz.5.2902': attribute type 2 has an invalid length. [ 1620.432709][T14201] video4linux radio48: keene_cmd_set failed (-71) [ 1620.432801][T14201] radio-keene 6-1:9.57: V4L2 device registered as radio48 [ 1620.444372][T14201] usb 6-1: USB disconnect, device number 41 [ 1620.477625][T18796] netlink: 'syz.1.2908': attribute type 5 has an invalid length. [ 1621.890692][ T9944] usb 9-1: new high-speed USB device number 72 using dummy_hcd [ 1622.042030][ T9944] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1622.055849][ T9944] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1622.055896][ T9944] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1622.101232][ T9944] usb 9-1: config 0 descriptor?? [ 1622.337842][T18798] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1622.338533][T18798] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1623.438828][ T9944] usbhid 9-1:0.0: can't add hid device: -71 [ 1623.439026][ T9944] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1623.494842][ T9944] usb 9-1: USB disconnect, device number 72 [ 1624.872669][T14201] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1625.010867][T14201] usb 6-1: device descriptor read/64, error -71 [ 1625.250633][T14201] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 1625.390688][T14201] usb 6-1: device descriptor read/64, error -71 [ 1625.501041][T14201] usb usb6-port1: attempt power cycle [ 1625.791757][ T9944] usb 9-1: new high-speed USB device number 73 using dummy_hcd [ 1625.840670][T14201] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 1625.861436][T14201] usb 6-1: device descriptor read/8, error -71 [ 1626.231646][T18842] netlink: 'syz.1.2920': attribute type 5 has an invalid length. [ 1626.240697][T14201] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 1626.261535][T14201] usb 6-1: device descriptor read/8, error -71 [ 1626.371321][T14201] usb usb6-port1: unable to enumerate USB device [ 1626.896343][T18850] netlink: 132 bytes leftover after parsing attributes in process `syz.1.2924'. [ 1628.171246][T18859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1628.174611][T18859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1628.507031][T18859] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1628.517090][T18859] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1628.541948][T18864] veth0_macvtap: left promiscuous mode [ 1628.636587][T12339] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 1628.759008][T18864] netlink: 'syz.4.2922': attribute type 1 has an invalid length. [ 1628.759086][T18864] netlink: 'syz.4.2922': attribute type 2 has an invalid length. [ 1629.100572][T12339] usb 5-1: Using ep0 maxpacket: 16 [ 1629.103439][T12339] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1629.103493][T12339] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1629.104911][T12339] usb 5-1: config 9 has an invalid interface number: 57 but max is 0 [ 1629.104940][T12339] usb 5-1: config 9 has no interface number 0 [ 1629.104970][T12339] usb 5-1: config 9 interface 57 has no altsetting 0 [ 1629.116455][T12339] usb 5-1: string descriptor 0 read error: -22 [ 1629.116685][T12339] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1629.509184][T18877] netlink: 'syz.7.2931': attribute type 5 has an invalid length. [ 1629.681393][T14201] usb 9-1: new high-speed USB device number 74 using dummy_hcd [ 1629.799837][T12339] video4linux radio48: keene_cmd_set failed (-71) [ 1629.799919][T12339] radio-keene 5-1:9.57: V4L2 device registered as radio48 [ 1629.836976][T12339] usb 5-1: USB disconnect, device number 92 [ 1629.897187][T18885] netlink: 'syz.5.2933': attribute type 5 has an invalid length. [ 1629.992835][T14201] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1630.003945][T14201] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1630.003992][T14201] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.095489][T14201] usb 9-1: config 0 descriptor?? [ 1630.325873][T18874] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1630.336212][T18874] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1630.351353][T14201] usbhid 9-1:0.0: can't add hid device: -71 [ 1630.357479][T14201] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1630.390871][T14201] usb 9-1: USB disconnect, device number 74 [ 1630.459747][T18898] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2938'. [ 1630.710428][T18901] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2939'. [ 1630.920626][T14201] usb 9-1: new high-speed USB device number 75 using dummy_hcd [ 1631.082839][T14201] usb 9-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1631.145267][T14201] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1631.148844][T14201] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1631.174591][T14201] usb 9-1: config 0 descriptor?? [ 1631.180761][ T5721] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 1631.330680][ T5721] usb 2-1: Using ep0 maxpacket: 16 [ 1631.337108][ T5721] usb 2-1: New USB device found, idVendor=0e66, idProduct=0021, bcdDevice=52.ca [ 1631.340257][ T5721] usb 2-1: config 3 has an invalid interface number: 28 but max is 2 [ 1631.340283][ T5721] usb 2-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 1631.340302][ T5721] usb 2-1: config 3 has 1 interface, different from the descriptor's value: 3 [ 1631.340386][ T5721] usb 2-1: config 3 has no interface number 0 [ 1631.340428][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1631.340450][ T5721] usb 2-1: config 3 interface 28 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 1631.340475][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1631.354909][ T5721] usb 2-1: config 3 interface 28 altsetting 0 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 1631.354940][ T5721] usb 2-1: config 3 interface 28 altsetting 0 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 1631.355025][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1631.355047][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has an endpoint descriptor with address 0xDE, changing to 0x8E [ 1631.355071][ T5721] usb 2-1: config 3 interface 28 altsetting 0 endpoint 0x8E has invalid maxpacket 2048, setting to 64 [ 1631.355096][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 1631.355118][ T5721] usb 2-1: config 3 interface 28 altsetting 0 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 1631.375785][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has an endpoint descriptor with address 0xC7, changing to 0x87 [ 1631.375817][ T5721] usb 2-1: config 3 interface 28 altsetting 0 has a duplicate endpoint with address 0x87, skipping [ 1631.538284][ T5721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1631.541853][ T5721] usb 2-1: Product: Т [ 1631.541873][ T5721] usb 2-1: Manufacturer: Џ [ 1632.135808][T14201] aiptek 9-1:0.0: Aiptek using 400 ms programming speed [ 1632.264474][T14201] input: Aiptek as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input52 [ 1632.443056][ T5721] usb 2-1: USB disconnect, device number 79 [ 1632.637576][ T8256] usb 9-1: USB disconnect, device number 75 [ 1632.637760][ C1] aiptek 9-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1634.679172][T18929] FAULT_INJECTION: forcing a failure. [ 1634.679172][T18929] name failslab, interval 1, probability 0, space 0, times 0 [ 1634.702645][ T5721] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 1634.720634][T18929] CPU: 1 UID: 0 PID: 18929 Comm: syz.8.2950 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1634.720665][T18929] Tainted: [L]=SOFTLOCKUP [ 1634.720673][T18929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1634.720684][T18929] Call Trace: [ 1634.720693][T18929] [ 1634.720701][T18929] dump_stack_lvl+0xe8/0x150 [ 1634.720738][T18929] should_fail_ex+0x46b/0x600 [ 1634.720767][T18929] should_failslab+0xa8/0x100 [ 1634.720796][T18929] __kmalloc_noprof+0xfb/0x790 [ 1634.720821][T18929] ? kernfs_fop_write_iter+0x158/0x540 [ 1634.720846][T18929] ? kernfs_fop_write_iter+0x158/0x540 [ 1634.720878][T18929] kernfs_fop_write_iter+0x158/0x540 [ 1634.720907][T18929] vfs_write+0x61e/0xbb0 [ 1634.720937][T18929] ? __pfx_vfs_write+0x10/0x10 [ 1634.720959][T18929] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1634.720985][T18929] ? mutex_lock_nested+0x152/0x1d0 [ 1634.721009][T18929] ? fdget_pos+0x252/0x320 [ 1634.721038][T18929] ksys_write+0x156/0x270 [ 1634.721060][T18929] ? __pfx_ksys_write+0x10/0x10 [ 1634.721093][T18929] do_syscall_64+0x166/0x520 [ 1634.721113][T18929] ? trace_irq_disable+0x3b/0x140 [ 1634.721136][T18929] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1634.721156][T18929] ? clear_bhb_loop+0x70/0xc0 [ 1634.721180][T18929] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1634.721198][T18929] RIP: 0033:0x7ff8ad04e159 [ 1634.721215][T18929] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1634.721230][T18929] RSP: 002b:00007ff8ab2a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 1634.721251][T18929] RAX: ffffffffffffffda RBX: 00007ff8ad2d5fa0 RCX: 00007ff8ad04e159 [ 1634.721264][T18929] RDX: 0000000000000001 RSI: 0000200000000180 RDI: 0000000000000003 [ 1634.721276][T18929] RBP: 00007ff8ab2a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1634.721287][T18929] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1634.721298][T18929] R13: 00007ff8ad2d6038 R14: 00007ff8ad2d5fa0 R15: 00007ffc79fb1268 [ 1634.721330][T18929] [ 1634.921908][T18934] netlink: 'syz.5.2952': attribute type 1 has an invalid length. [ 1634.921930][T18934] netlink: 'syz.5.2952': attribute type 2 has an invalid length. [ 1634.965865][ T5721] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 1634.978579][ T5721] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1634.996365][ T5721] usb 2-1: config 0 descriptor?? [ 1635.160804][ T9944] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 1635.310717][ T9944] usb 6-1: Using ep0 maxpacket: 16 [ 1635.319005][ T9944] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1635.319058][ T9944] usb 6-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1635.322631][ T9944] usb 6-1: config 9 has an invalid interface number: 57 but max is 0 [ 1635.322654][ T9944] usb 6-1: config 9 has no interface number 0 [ 1635.322686][ T9944] usb 6-1: config 9 interface 57 has no altsetting 0 [ 1635.331672][ T9944] usb 6-1: string descriptor 0 read error: -22 [ 1635.331806][ T9944] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1635.842492][T18921] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2947'. [ 1636.025183][ T9944] video4linux radio48: keene_cmd_set failed (-71) [ 1636.025257][ T9944] radio-keene 6-1:9.57: V4L2 device registered as radio48 [ 1636.040525][ T9944] usb 6-1: USB disconnect, device number 46 [ 1636.283032][T18945] netlink: 280 bytes leftover after parsing attributes in process `syz.1.2947'. [ 1636.918078][T18954] FAULT_INJECTION: forcing a failure. [ 1636.918078][T18954] name failslab, interval 1, probability 0, space 0, times 0 [ 1636.932602][T18954] CPU: 1 UID: 0 PID: 18954 Comm: syz.8.2959 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1636.932630][T18954] Tainted: [L]=SOFTLOCKUP [ 1636.932638][T18954] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1636.932649][T18954] Call Trace: [ 1636.932657][T18954] [ 1636.932666][T18954] dump_stack_lvl+0xe8/0x150 [ 1636.932697][T18954] should_fail_ex+0x46b/0x600 [ 1636.932731][T18954] should_failslab+0xa8/0x100 [ 1636.932759][T18954] __kmalloc_noprof+0xfb/0x790 [ 1636.932779][T18954] ? tomoyo_realpath_from_path+0xef/0x640 [ 1636.932800][T18954] ? tomoyo_realpath_from_path+0xef/0x640 [ 1636.932824][T18954] tomoyo_realpath_from_path+0xef/0x640 [ 1636.932855][T18954] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1636.932875][T18954] tomoyo_path_number_perm+0x246/0x5f0 [ 1636.932897][T18954] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1636.932915][T18954] ? __lock_acquire+0x6df/0x2e40 [ 1636.932952][T18954] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1636.932972][T18954] ? hook_file_ioctl+0x1f5/0x610 [ 1636.933049][T18954] ? __fget_files+0x2a/0x420 [ 1636.933069][T18954] ? __fget_files+0x2a/0x420 [ 1636.933085][T18954] ? __fget_files+0x3a8/0x420 [ 1636.933101][T18954] ? __fget_files+0x2a/0x420 [ 1636.933123][T18954] security_file_ioctl+0xc3/0x2a0 [ 1636.933145][T18954] __se_sys_ioctl+0x47/0x170 [ 1636.933170][T18954] do_syscall_64+0x166/0x520 [ 1636.933190][T18954] ? trace_irq_disable+0x3b/0x140 [ 1636.933211][T18954] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1636.933230][T18954] ? clear_bhb_loop+0x70/0xc0 [ 1636.933252][T18954] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1636.933270][T18954] RIP: 0033:0x7ff8ad04e159 [ 1636.933288][T18954] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1636.933303][T18954] RSP: 002b:00007ff8ab2a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1636.933324][T18954] RAX: ffffffffffffffda RBX: 00007ff8ad2d5fa0 RCX: 00007ff8ad04e159 [ 1636.933338][T18954] RDX: 00002000000000c0 RSI: 0000000040045613 RDI: 0000000000000003 [ 1636.933349][T18954] RBP: 00007ff8ab2a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1636.933362][T18954] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1636.933373][T18954] R13: 00007ff8ad2d6038 R14: 00007ff8ad2d5fa0 R15: 00007ffc79fb1268 [ 1636.933404][T18954] [ 1636.933412][T18954] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1636.941723][ T5721] usb 2-1: Cannot set autoneg [ 1636.941962][ T5721] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 1636.967116][ T5721] usb 2-1: USB disconnect, device number 80 [ 1637.114570][T18957] FAULT_INJECTION: forcing a failure. [ 1637.114570][T18957] name failslab, interval 1, probability 0, space 0, times 0 [ 1637.114605][T18957] CPU: 1 UID: 0 PID: 18957 Comm: syz.5.2961 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1637.114629][T18957] Tainted: [L]=SOFTLOCKUP [ 1637.114636][T18957] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1637.114647][T18957] Call Trace: [ 1637.114654][T18957] [ 1637.114662][T18957] dump_stack_lvl+0xe8/0x150 [ 1637.114701][T18957] should_fail_ex+0x46b/0x600 [ 1637.114728][T18957] should_failslab+0xa8/0x100 [ 1637.114756][T18957] __kmalloc_noprof+0xfb/0x790 [ 1637.114778][T18957] ? tomoyo_realpath_from_path+0xef/0x640 [ 1637.114800][T18957] ? tomoyo_realpath_from_path+0xef/0x640 [ 1637.114829][T18957] tomoyo_realpath_from_path+0xef/0x640 [ 1637.114859][T18957] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1637.114879][T18957] tomoyo_path_number_perm+0x246/0x5f0 [ 1637.114901][T18957] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1637.114920][T18957] ? __lock_acquire+0x6df/0x2e40 [ 1637.114955][T18957] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1637.114976][T18957] ? hook_file_ioctl+0x1f5/0x610 [ 1637.115020][T18957] ? __fget_files+0x2a/0x420 [ 1637.115041][T18957] ? __fget_files+0x2a/0x420 [ 1637.115058][T18957] ? __fget_files+0x3a8/0x420 [ 1637.115074][T18957] ? __fget_files+0x2a/0x420 [ 1637.115096][T18957] security_file_ioctl+0xc3/0x2a0 [ 1637.115118][T18957] __se_sys_ioctl+0x47/0x170 [ 1637.115144][T18957] do_syscall_64+0x166/0x520 [ 1637.115164][T18957] ? trace_irq_disable+0x3b/0x140 [ 1637.115184][T18957] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1637.115203][T18957] ? clear_bhb_loop+0x70/0xc0 [ 1637.115225][T18957] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1637.115243][T18957] RIP: 0033:0x7f4e0230e159 [ 1637.115260][T18957] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1637.115276][T18957] RSP: 002b:00007f4e00566028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1637.115296][T18957] RAX: ffffffffffffffda RBX: 00007f4e02595fa0 RCX: 00007f4e0230e159 [ 1637.115310][T18957] RDX: 00002000000000c0 RSI: 000000004008ae89 RDI: 0000000000000005 [ 1637.115322][T18957] RBP: 00007f4e00566090 R08: 0000000000000000 R09: 0000000000000000 [ 1637.115334][T18957] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1637.115346][T18957] R13: 00007f4e02596038 R14: 00007f4e02595fa0 R15: 00007ffc7a82dc98 [ 1637.115376][T18957] [ 1637.115396][T18957] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1638.780020][T18979] netlink: 48 bytes leftover after parsing attributes in process `syz.1.2967'. [ 1639.292829][T18987] FAULT_INJECTION: forcing a failure. [ 1639.292829][T18987] name failslab, interval 1, probability 0, space 0, times 0 [ 1639.292916][T18987] CPU: 1 UID: 0 PID: 18987 Comm: syz.1.2971 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1639.292944][T18987] Tainted: [L]=SOFTLOCKUP [ 1639.292952][T18987] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1639.292963][T18987] Call Trace: [ 1639.292972][T18987] [ 1639.292980][T18987] dump_stack_lvl+0xe8/0x150 [ 1639.293013][T18987] should_fail_ex+0x46b/0x600 [ 1639.293041][T18987] should_failslab+0xa8/0x100 [ 1639.293068][T18987] __kmalloc_noprof+0xfb/0x790 [ 1639.293091][T18987] ? tomoyo_realpath_from_path+0xef/0x640 [ 1639.293114][T18987] ? tomoyo_realpath_from_path+0xef/0x640 [ 1639.293143][T18987] tomoyo_realpath_from_path+0xef/0x640 [ 1639.293179][T18987] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1639.293200][T18987] tomoyo_path_number_perm+0x246/0x5f0 [ 1639.293223][T18987] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1639.293241][T18987] ? __lock_acquire+0x6df/0x2e40 [ 1639.293279][T18987] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1639.293301][T18987] ? hook_file_ioctl+0x1f5/0x610 [ 1639.293345][T18987] ? __fget_files+0x2a/0x420 [ 1639.293366][T18987] ? __fget_files+0x2a/0x420 [ 1639.293384][T18987] ? __fget_files+0x3a8/0x420 [ 1639.293401][T18987] ? __fget_files+0x2a/0x420 [ 1639.293423][T18987] security_file_ioctl+0xc3/0x2a0 [ 1639.293446][T18987] __se_sys_ioctl+0x47/0x170 [ 1639.293472][T18987] do_syscall_64+0x166/0x520 [ 1639.293500][T18987] ? trace_irq_disable+0x3b/0x140 [ 1639.293522][T18987] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1639.293541][T18987] ? clear_bhb_loop+0x70/0xc0 [ 1639.293564][T18987] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1639.293582][T18987] RIP: 0033:0x7f9b7b54e159 [ 1639.293600][T18987] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1639.293615][T18987] RSP: 002b:00007f9b797a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1639.293636][T18987] RAX: ffffffffffffffda RBX: 00007f9b7b7d5fa0 RCX: 00007f9b7b54e159 [ 1639.293650][T18987] RDX: 0000200000000240 RSI: 0000000000005412 RDI: 0000000000000003 [ 1639.293662][T18987] RBP: 00007f9b797a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1639.293674][T18987] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1639.293686][T18987] R13: 00007f9b7b7d6038 R14: 00007f9b7b7d5fa0 R15: 00007ffe4914a508 [ 1639.293717][T18987] [ 1639.295355][T18987] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1640.195732][T18992] netlink: 'syz.4.2969': attribute type 1 has an invalid length. [ 1640.195802][T18992] netlink: 'syz.4.2969': attribute type 2 has an invalid length. [ 1640.990883][ T8256] usb 5-1: new high-speed USB device number 93 using dummy_hcd [ 1641.891670][ T8256] usb 5-1: Using ep0 maxpacket: 16 [ 1641.908466][ T8256] usb 5-1: unable to get BOS descriptor or descriptor too short [ 1641.910683][ T8256] usb 5-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1641.918826][ T8256] usb 5-1: config 9 has an invalid interface number: 57 but max is 0 [ 1641.918851][ T8256] usb 5-1: config 9 has no interface number 0 [ 1641.918883][ T8256] usb 5-1: config 9 interface 57 has no altsetting 0 [ 1641.956087][ T8256] usb 5-1: string descriptor 0 read error: -22 [ 1641.958977][ T8256] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1642.168780][T19005] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2976'. [ 1644.098892][ T8256] video4linux radio48: keene_cmd_set failed (-110) [ 1644.105807][ T8256] radio-keene 5-1:9.57: V4L2 device registered as radio48 [ 1644.687835][ T8256] usb 5-1: USB disconnect, device number 93 [ 1645.213688][T19023] FAULT_INJECTION: forcing a failure. [ 1645.213688][T19023] name failslab, interval 1, probability 0, space 0, times 0 [ 1645.213801][T19023] CPU: 0 UID: 0 PID: 19023 Comm: syz.8.2980 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1645.213828][T19023] Tainted: [L]=SOFTLOCKUP [ 1645.213834][T19023] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1645.213844][T19023] Call Trace: [ 1645.213849][T19023] [ 1645.213854][T19023] dump_stack_lvl+0xe8/0x150 [ 1645.213875][T19023] should_fail_ex+0x46b/0x600 [ 1645.213890][T19023] should_failslab+0xa8/0x100 [ 1645.213906][T19023] ? do_getname+0x2e/0x250 [ 1645.213921][T19023] kmem_cache_alloc_noprof+0x9e/0x690 [ 1645.213934][T19023] ? do_getname+0x2e/0x250 [ 1645.213953][T19023] do_getname+0x2e/0x250 [ 1645.213966][T19023] ? getname_flags+0x11/0x20 [ 1645.213981][T19023] do_sys_openat2+0xcc/0x200 [ 1645.213996][T19023] ? lockdep_hardirqs_on+0x7b/0x110 [ 1645.214009][T19023] ? __pfx_do_sys_openat2+0x10/0x10 [ 1645.214030][T19023] __x64_sys_openat+0x138/0x170 [ 1645.214047][T19023] do_syscall_64+0x166/0x520 [ 1645.214059][T19023] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1645.214069][T19023] ? clear_bhb_loop+0x70/0xc0 [ 1645.214082][T19023] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1645.214092][T19023] RIP: 0033:0x7ff8ad04e159 [ 1645.214102][T19023] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1645.214111][T19023] RSP: 002b:00007ff8ab285028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1645.214122][T19023] RAX: ffffffffffffffda RBX: 00007ff8ad2d6090 RCX: 00007ff8ad04e159 [ 1645.214129][T19023] RDX: 000000000000275a RSI: 0000200000000040 RDI: ffffffffffffff9c [ 1645.214136][T19023] RBP: 00007ff8ab285090 R08: 0000000000000000 R09: 0000000000000000 [ 1645.214143][T19023] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1645.214149][T19023] R13: 00007ff8ad2d6128 R14: 00007ff8ad2d6090 R15: 00007ffc79fb1268 [ 1645.214165][T19023] [ 1646.689675][T19030] FAULT_INJECTION: forcing a failure. [ 1646.689675][T19030] name failslab, interval 1, probability 0, space 0, times 0 [ 1646.689753][T19030] CPU: 1 UID: 0 PID: 19030 Comm: syz.1.2983 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1646.689775][T19030] Tainted: [L]=SOFTLOCKUP [ 1646.689780][T19030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1646.689789][T19030] Call Trace: [ 1646.689795][T19030] [ 1646.689803][T19030] dump_stack_lvl+0xe8/0x150 [ 1646.689833][T19030] should_fail_ex+0x46b/0x600 [ 1646.689859][T19030] should_failslab+0xa8/0x100 [ 1646.689885][T19030] ? security_file_alloc+0x34/0x310 [ 1646.689905][T19030] kmem_cache_alloc_noprof+0x9e/0x690 [ 1646.689934][T19030] ? rcu_is_watching+0x16/0xb0 [ 1646.689999][T19030] ? security_file_alloc+0x34/0x310 [ 1646.690019][T19030] ? alloc_empty_file+0x5b/0x1d0 [ 1646.690047][T19030] security_file_alloc+0x34/0x310 [ 1646.690069][T19030] init_file+0x96/0x2d0 [ 1646.690095][T19030] alloc_empty_file+0x74/0x1d0 [ 1646.690122][T19030] path_openat+0xa2/0x1d60 [ 1646.690162][T19030] do_file_open+0x23e/0x4a0 [ 1646.690189][T19030] ? __pfx_do_file_open+0x10/0x10 [ 1646.690232][T19030] ? alloc_fd+0x654/0x6d0 [ 1646.690267][T19030] do_sys_openat2+0x115/0x200 [ 1646.690292][T19030] ? __se_sys_futex+0x3a8/0x450 [ 1646.690319][T19030] ? __pfx_do_sys_openat2+0x10/0x10 [ 1646.690349][T19030] ? rcu_is_watching+0x16/0xb0 [ 1646.690377][T19030] __x64_sys_openat+0x138/0x170 [ 1646.690406][T19030] do_syscall_64+0x166/0x520 [ 1646.690426][T19030] ? trace_irq_disable+0x3b/0x140 [ 1646.690449][T19030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.690467][T19030] ? clear_bhb_loop+0x70/0xc0 [ 1646.690491][T19030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.690509][T19030] RIP: 0033:0x7f9b7b50e98e [ 1646.690527][T19030] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1646.690543][T19030] RSP: 002b:00007f9b797a5f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1646.690564][T19030] RAX: ffffffffffffffda RBX: 00007f9b797a66c0 RCX: 00007f9b7b50e98e [ 1646.690579][T19030] RDX: 0000000000000002 RSI: 00007f9b7b5e492b RDI: ffffffffffffff9c [ 1646.690592][T19030] RBP: 00007f9b7b5e5024 R08: 0000000000000000 R09: 0000000000000000 [ 1646.690604][T19030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1646.690616][T19030] R13: 00007f9b7b7d6038 R14: 00007f9b7b7d5fa0 R15: 00007ffe4914a508 [ 1646.690647][T19030] [ 1646.878462][T19031] FAULT_INJECTION: forcing a failure. [ 1646.878462][T19031] name failslab, interval 1, probability 0, space 0, times 0 [ 1646.879260][T19031] CPU: 1 UID: 0 PID: 19031 Comm: syz.5.2985 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1646.879287][T19031] Tainted: [L]=SOFTLOCKUP [ 1646.879295][T19031] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1646.879305][T19031] Call Trace: [ 1646.879314][T19031] [ 1646.879322][T19031] dump_stack_lvl+0xe8/0x150 [ 1646.879355][T19031] should_fail_ex+0x46b/0x600 [ 1646.879383][T19031] should_failslab+0xa8/0x100 [ 1646.879412][T19031] __kmalloc_cache_noprof+0xa1/0x680 [ 1646.879437][T19031] ? adfs_init_fs_context+0x54/0x2b0 [ 1646.879477][T19031] ? adfs_init_fs_context+0x54/0x2b0 [ 1646.879506][T19031] adfs_init_fs_context+0x54/0x2b0 [ 1646.879537][T19031] alloc_fs_context+0x9a3/0xd00 [ 1646.879579][T19031] __se_sys_fsopen+0xa5/0x2c0 [ 1646.879605][T19031] do_syscall_64+0x166/0x520 [ 1646.879626][T19031] ? trace_irq_disable+0x3b/0x140 [ 1646.879647][T19031] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.879667][T19031] ? clear_bhb_loop+0x70/0xc0 [ 1646.879690][T19031] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1646.879708][T19031] RIP: 0033:0x7f4e0230e159 [ 1646.879726][T19031] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1646.879742][T19031] RSP: 002b:00007f4e00566028 EFLAGS: 00000246 ORIG_RAX: 00000000000001ae [ 1646.879763][T19031] RAX: ffffffffffffffda RBX: 00007f4e02595fa0 RCX: 00007f4e0230e159 [ 1646.879777][T19031] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00002000000000c0 [ 1646.879790][T19031] RBP: 00007f4e023a5024 R08: 0000000000000000 R09: 0000000000000000 [ 1646.879802][T19031] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1646.879813][T19031] R13: 00007f4e02596038 R14: 00007f4e02595fa0 R15: 00007ffc7a82dc98 [ 1646.879843][T19031] [ 1647.186456][T19035] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2988'. [ 1648.822167][T19040] random: crng reseeded on system resumption [ 1649.420998][ T5596] usb 5-1: new high-speed USB device number 94 using dummy_hcd [ 1649.427584][T19051] netlink: 'syz.5.2992': attribute type 1 has an invalid length. [ 1649.427605][T19051] netlink: 'syz.5.2992': attribute type 2 has an invalid length. [ 1649.562685][T19054] netlink: 48 bytes leftover after parsing attributes in process `syz.7.2981'. [ 1649.593347][ T5596] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1649.603860][ T5596] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1649.605460][ T5596] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1649.605500][ T5596] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1649.649205][ T5596] usb 5-1: config 0 descriptor?? [ 1649.672156][ T5721] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 1649.797432][T19062] netlink: 'syz.1.2994': attribute type 5 has an invalid length. [ 1649.820676][ T5721] usb 6-1: Using ep0 maxpacket: 16 [ 1649.824427][ T5721] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1649.824481][ T5721] usb 6-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1649.827505][ T5721] usb 6-1: config 9 has an invalid interface number: 57 but max is 0 [ 1649.827530][ T5721] usb 6-1: config 9 has no interface number 0 [ 1649.827562][ T5721] usb 6-1: config 9 interface 57 has no altsetting 0 [ 1649.848913][ T5721] usb 6-1: string descriptor 0 read error: -22 [ 1649.849103][ T5721] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1649.980989][T19044] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1650.009734][T19044] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1650.043835][ T31] usb 5-1: USB disconnect, device number 94 [ 1650.514553][ T5721] video4linux radio48: keene_cmd_set failed (-71) [ 1650.516303][ T5721] radio-keene 6-1:9.57: V4L2 device registered as radio48 [ 1650.549024][ T5721] usb 6-1: USB disconnect, device number 47 [ 1650.615343][ T31] usb 5-1: new high-speed USB device number 95 using dummy_hcd [ 1650.815806][ T31] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1650.827613][ T31] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1650.827637][ T31] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1650.827673][ T31] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1650.895882][ T31] usb 5-1: config 0 descriptor?? [ 1651.061691][T19070] FAULT_INJECTION: forcing a failure. [ 1651.061691][T19070] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1651.061793][T19070] CPU: 0 UID: 0 PID: 19070 Comm: syz.1.2996 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1651.061817][T19070] Tainted: [L]=SOFTLOCKUP [ 1651.061823][T19070] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1651.061831][T19070] Call Trace: [ 1651.061837][T19070] [ 1651.061845][T19070] dump_stack_lvl+0xe8/0x150 [ 1651.061875][T19070] should_fail_ex+0x46b/0x600 [ 1651.061909][T19070] _copy_from_user+0x2d/0xb0 [ 1651.061932][T19070] ___sys_sendmsg+0x1c6/0x360 [ 1651.061960][T19070] ? __lock_acquire+0x6df/0x2e40 [ 1651.061985][T19070] ? __pfx____sys_sendmsg+0x10/0x10 [ 1651.062041][T19070] ? __fget_files+0x2a/0x420 [ 1651.062059][T19070] ? __fget_files+0x3a8/0x420 [ 1651.062087][T19070] __x64_sys_sendmsg+0x1b7/0x290 [ 1651.062113][T19070] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1651.062156][T19070] do_syscall_64+0x166/0x520 [ 1651.062177][T19070] ? trace_irq_disable+0x3b/0x140 [ 1651.062198][T19070] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1651.062216][T19070] ? clear_bhb_loop+0x70/0xc0 [ 1651.062238][T19070] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1651.062255][T19070] RIP: 0033:0x7f9b7b54e159 [ 1651.062272][T19070] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1651.062288][T19070] RSP: 002b:00007f9b797a6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1651.062308][T19070] RAX: ffffffffffffffda RBX: 00007f9b7b7d5fa0 RCX: 00007f9b7b54e159 [ 1651.062321][T19070] RDX: 0000000000044000 RSI: 0000200000000540 RDI: 0000000000000003 [ 1651.062333][T19070] RBP: 00007f9b797a6090 R08: 0000000000000000 R09: 0000000000000000 [ 1651.062344][T19070] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1651.062355][T19070] R13: 00007f9b7b7d6038 R14: 00007f9b7b7d5fa0 R15: 00007ffe4914a508 [ 1651.062385][T19070] [ 1651.834277][T19074] overlayfs: overlapping lowerdir path [ 1652.872303][T19080] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3000'. [ 1652.936890][ T5721] usb 5-1: USB disconnect, device number 95 [ 1653.838002][T19088] random: crng reseeded on system resumption [ 1654.904332][T19098] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3005'. [ 1655.508773][ T37] kauditd_printk_skb: 66 callbacks suppressed [ 1655.509177][ T37] audit: type=1326 audit(1788631139.247:900): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.541688][ T37] audit: type=1326 audit(1788631139.247:901): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.566274][ T37] audit: type=1326 audit(1788631139.247:902): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.566322][ T37] audit: type=1326 audit(1788631139.247:903): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.568061][ T37] audit: type=1326 audit(1788631139.247:904): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.568115][ T37] audit: type=1326 audit(1788631139.307:905): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=46 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.568153][ T37] audit: type=1326 audit(1788631139.307:906): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.568191][ T37] audit: type=1326 audit(1788631139.307:907): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.568854][ T37] audit: type=1326 audit(1788631139.307:908): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=191 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1655.568896][ T37] audit: type=1326 audit(1788631139.307:909): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19104 comm="syz.8.2997" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x7ffc0000 [ 1656.165738][T19109] netlink: 'syz.4.3006': attribute type 5 has an invalid length. [ 1656.500699][T12732] usb 2-1: new high-speed USB device number 81 using dummy_hcd [ 1656.652256][T12732] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1656.670761][T12732] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1656.678496][T12732] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1656.705584][T12732] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1656.707255][T12732] usb 2-1: Product: syz [ 1656.707272][T12732] usb 2-1: Manufacturer: syz [ 1656.707286][T12732] usb 2-1: SerialNumber: syz [ 1656.880921][ T5857] usb 9-1: new high-speed USB device number 76 using dummy_hcd [ 1656.899105][T12732] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 1656.961688][T12732] ums-sddr09 2-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1656.961688][T12732] Please send a copy of this message to and [ 1657.039355][ T5857] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1657.051819][ T5857] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1657.055785][ T5857] usb 9-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1657.055865][ T5857] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1657.153178][ T5857] usb 9-1: config 0 descriptor?? [ 1657.214004][ T5857] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 1658.037189][T19119] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1658.065627][T19119] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1658.069336][ T5857] usb 9-1: USB disconnect, device number 76 [ 1658.179442][T12732] ums-sddr09 2-1:1.0: probe with driver ums-sddr09 failed with error -32 [ 1658.549385][T19131] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3014'. [ 1659.973561][ T5857] usb 9-1: new high-speed USB device number 77 using dummy_hcd [ 1660.201617][ T5721] usb 2-1: USB disconnect, device number 81 [ 1660.313107][T19143] random: crng reseeded on system resumption [ 1660.632196][T19145] ip6gretap1: entered allmulticast mode [ 1660.633900][T19145] batman_adv: Cannot find parent device. Skipping batadv-on-batadv check for ip6gretap1 [ 1660.634558][T19145] batman_adv: batadv0: Adding interface: ip6gretap1 [ 1660.634572][T19145] batman_adv: batadv0: The MTU of interface ip6gretap1 is too small (1434) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1660.634608][T19145] batman_adv: batadv0: Interface activated: ip6gretap1 [ 1660.640585][T19145] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3018'. [ 1660.726846][T19148] netlink: 'syz.1.3020': attribute type 5 has an invalid length. [ 1660.736432][T19148] loop3: detected capacity change from 0 to 7 [ 1660.741231][T19148] Dev loop3: unable to read RDB block 7 [ 1660.741257][T19148] loop3: AHDI p3 p4 [ 1660.741276][T19148] loop3: partition table partially beyond EOD, truncated [ 1660.741525][T19148] loop3: p3 start 1702000233 is beyond EOD, truncated [ 1664.590177][T19173] netlink: 'syz.7.3027': attribute type 1 has an invalid length. [ 1665.135294][T19179] netlink: 24 bytes leftover after parsing attributes in process `syz.4.3028'. [ 1665.558660][T19191] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3032'. [ 1665.813345][T19196] netlink: 48 bytes leftover after parsing attributes in process `syz.1.3033'. [ 1667.437726][T19208] random: crng reseeded on system resumption [ 1668.831813][ T1325] ieee802154 phy0 wpan0: encryption failed: -22 [ 1671.001015][ T8256] usb 2-1: new full-speed USB device number 82 using dummy_hcd [ 1671.161747][ T8256] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32 [ 1671.178190][ T8256] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 255, setting to 64 [ 1671.185590][T19228] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3044'. [ 1671.207819][ T8256] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1671.217195][ T8256] usb 2-1: Product: syz [ 1671.217215][ T8256] usb 2-1: Manufacturer: syz [ 1671.217227][ T8256] usb 2-1: SerialNumber: syz [ 1671.258539][ T8256] usb 2-1: config 0 descriptor?? [ 1671.264464][T19225] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1671.704448][T14201] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 1671.880599][T14201] usb 6-1: Using ep0 maxpacket: 8 [ 1671.881721][T14201] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1671.883251][T14201] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 1671.883281][T14201] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 1671.883305][T14201] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1671.883328][T14201] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1671.883449][T14201] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1672.163988][T14201] usb 6-1: GET_CAPABILITIES returned 0 [ 1672.164085][T14201] usbtmc 6-1:16.0: can't read capabilities [ 1673.441047][ T9944] usb 6-1: USB disconnect, device number 48 [ 1673.598495][T19244] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3048'. [ 1673.904332][T19248] netlink: 'syz.7.3049': attribute type 10 has an invalid length. [ 1673.959965][T19248] syz_tun: entered promiscuous mode [ 1674.104878][T19248] bond0: (slave syz_tun): Enslaving as an active interface with an up link [ 1674.710654][ T31] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 1674.880441][ T31] usb 6-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1674.989713][ T31] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1674.990422][ T31] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1675.029020][ T8256] dm9601 2-1:0.0: probe with driver dm9601 failed with error -71 [ 1675.120901][ T8256] usb 2-1: USB disconnect, device number 82 [ 1675.127316][ T31] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1675.127484][ T31] usb 6-1: Product: syz [ 1675.127547][ T31] usb 6-1: Manufacturer: syz [ 1675.127612][ T31] usb 6-1: SerialNumber: syz [ 1676.209066][ T31] ums-sddr09 6-1:1.0: USB Mass Storage device detected [ 1676.253034][ T31] ums-sddr09 6-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1676.253034][ T31] Please send a copy of this message to and [ 1677.171708][T19275] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3056'. [ 1677.724968][T19286] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3063'. [ 1677.845270][ T31] ums-sddr09 6-1:1.0: probe with driver ums-sddr09 failed with error -5 [ 1677.880583][ T8256] usb 5-1: new high-speed USB device number 96 using dummy_hcd [ 1677.880608][ T31] usb 6-1: USB disconnect, device number 49 [ 1678.041859][ T8256] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1678.052306][ T8256] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1678.052368][ T8256] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1678.052406][ T8256] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1678.093898][ T8256] usb 5-1: config 0 descriptor?? [ 1678.316975][T19281] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.319136][T19281] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.336439][T14201] usb 5-1: USB disconnect, device number 96 [ 1678.380643][ T31] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 1678.538700][ T31] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1678.554480][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1678.554584][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1678.589573][ T31] usb 6-1: config 0 descriptor?? [ 1678.803524][T19296] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1678.811550][T14201] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 1678.823566][T19296] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.845236][ T31] usbhid 6-1:0.0: can't add hid device: -71 [ 1678.849936][ T31] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1678.878677][ T31] usb 6-1: USB disconnect, device number 50 [ 1679.587903][T14201] usb 5-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1679.617755][T14201] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1679.617839][T14201] usb 5-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1679.617875][T14201] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1679.627401][T14201] usb 5-1: config 0 descriptor?? [ 1679.910776][ T31] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 1680.146518][ T31] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1680.527716][ T31] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1680.538734][ T31] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1680.569391][ T31] usb 6-1: config 0 descriptor?? [ 1680.928140][T12732] usb 5-1: USB disconnect, device number 97 [ 1680.940710][ T5721] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 1681.078643][T19324] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3073'. [ 1681.093040][ T5721] usb 2-1: New USB device found, idVendor=04e6, idProduct=0005, bcdDevice= 1.00 [ 1681.102659][ T5721] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1681.105834][ T5721] usb 2-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1681.127036][ T5721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1681.135126][ T5721] usb 2-1: Product: syz [ 1681.135145][ T5721] usb 2-1: Manufacturer: syz [ 1681.135159][ T5721] usb 2-1: SerialNumber: syz [ 1681.171869][ T5721] ums-sddr09 2-1:1.0: USB Mass Storage device detected [ 1681.188711][ T5721] ums-sddr09 2-1:1.0: This device (04e6,0005,0100 S 06 P 50) has an unneeded SubClass entry in unusual_devs.h (kernel syzkaller) [ 1681.188711][ T5721] Please send a copy of this message to and [ 1681.315895][T19330] netlink: 48 bytes leftover after parsing attributes in process `syz.7.3075'. [ 1681.401400][ T31] aiptek 6-1:0.0: Aiptek using 400 ms programming speed [ 1681.418983][ T31] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input53 [ 1681.548962][T19334] netlink: 'syz.8.3077': attribute type 2 has an invalid length. [ 1681.806927][T12732] usb 6-1: USB disconnect, device number 51 [ 1681.807031][ C1] aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1682.830618][T12732] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 1682.990652][T12732] usb 6-1: Using ep0 maxpacket: 16 [ 1682.997961][T12732] usb 6-1: New USB device found, idVendor=0e66, idProduct=0021, bcdDevice=52.ca [ 1683.000124][T12732] usb 6-1: config 3 has an invalid interface number: 28 but max is 2 [ 1683.000149][T12732] usb 6-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 1683.000167][T12732] usb 6-1: config 3 has 1 interface, different from the descriptor's value: 3 [ 1683.000188][T12732] usb 6-1: config 3 has no interface number 0 [ 1683.000287][T12732] usb 6-1: config 3 interface 28 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1683.000309][T12732] usb 6-1: config 3 interface 28 altsetting 0 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 1683.000334][T12732] usb 6-1: config 3 interface 28 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1683.000355][T12732] usb 6-1: config 3 interface 28 altsetting 0 endpoint 0x8 has invalid maxpacket 1024, setting to 64 [ 1683.000435][T12732] usb 6-1: config 3 interface 28 altsetting 0 endpoint 0xD has invalid maxpacket 1024, setting to 64 [ 1683.005963][T12732] usb 6-1: config 3 interface 28 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1683.006001][T12732] usb 6-1: config 3 interface 28 altsetting 0 has an endpoint descriptor with address 0xDE, changing to 0x8E [ 1683.023473][T12732] usb 6-1: config 3 interface 28 altsetting 0 endpoint 0x8E has invalid maxpacket 2048, setting to 64 [ 1683.023502][T12732] usb 6-1: config 3 interface 28 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 1683.023533][T12732] usb 6-1: config 3 interface 28 altsetting 0 endpoint 0xC has invalid maxpacket 1024, setting to 64 [ 1683.023556][T12732] usb 6-1: config 3 interface 28 altsetting 0 has an endpoint descriptor with address 0xC7, changing to 0x87 [ 1683.040389][T12732] usb 6-1: config 3 interface 28 altsetting 0 has a duplicate endpoint with address 0x87, skipping [ 1683.197768][T12732] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1683.205960][T12732] usb 6-1: Product: Т [ 1683.205980][T12732] usb 6-1: Manufacturer: Џ [ 1683.426399][T19358] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3087'. [ 1683.615385][T12732] usb 6-1: USB disconnect, device number 52 [ 1686.155761][ T5721] ums-sddr09 2-1:1.0: probe with driver ums-sddr09 failed with error -5 [ 1686.160893][ T5721] usb 2-1: USB disconnect, device number 83 [ 1686.265975][T19372] netlink: 'syz.1.3089': attribute type 1 has an invalid length. [ 1686.266067][T19372] netlink: 'syz.1.3089': attribute type 2 has an invalid length. [ 1686.570669][ T5721] usb 2-1: new high-speed USB device number 84 using dummy_hcd [ 1686.579207][T14201] usb 9-1: new high-speed USB device number 78 using dummy_hcd [ 1686.730739][ T5721] usb 2-1: Using ep0 maxpacket: 16 [ 1686.731439][T14201] usb 9-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1686.733099][T14201] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1686.733143][T14201] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1686.772480][ T5721] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1686.780253][ T5721] usb 2-1: New USB device found, idVendor=046d, idProduct=0a0e, bcdDevice=61.f7 [ 1686.781765][ T5721] usb 2-1: config 9 has an invalid interface number: 57 but max is 0 [ 1686.781788][ T5721] usb 2-1: config 9 has no interface number 0 [ 1686.781816][ T5721] usb 2-1: config 9 interface 57 has no altsetting 0 [ 1686.814848][ T5721] usb 2-1: string descriptor 0 read error: -22 [ 1686.815029][ T5721] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1686.833910][T14201] usb 9-1: config 0 descriptor?? [ 1686.880604][ T1993] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 1687.040621][ T1993] usb 6-1: Using ep0 maxpacket: 32 [ 1687.041584][ T1993] usb 6-1: New USB device found, idVendor=105b, idProduct=1799, bcdDevice=36.e9 [ 1687.043595][ T1993] usb 6-1: config 0 has an invalid interface number: 239 but max is 0 [ 1687.043619][ T1993] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1687.043637][ T1993] usb 6-1: config 0 has no interface number 0 [ 1687.043680][ T1993] usb 6-1: config 0 interface 239 altsetting 4 bulk endpoint 0x2 has invalid maxpacket 8 [ 1687.043703][ T1993] usb 6-1: config 0 interface 239 altsetting 4 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1687.043726][ T1993] usb 6-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xA9, changing to 0x89 [ 1687.043750][ T1993] usb 6-1: config 0 interface 239 altsetting 4 endpoint 0x89 has invalid maxpacket 28648, setting to 1024 [ 1687.043775][ T1993] usb 6-1: config 0 interface 239 altsetting 4 bulk endpoint 0x89 has invalid maxpacket 1024 [ 1687.043797][ T1993] usb 6-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xD5, changing to 0x85 [ 1687.043821][ T1993] usb 6-1: config 0 interface 239 altsetting 4 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1687.043842][ T1993] usb 6-1: config 0 interface 239 has no altsetting 0 [ 1687.048764][ T1993] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1687.048787][ T1993] usb 6-1: Product: syz [ 1687.048801][ T1993] usb 6-1: Manufacturer: syz [ 1687.048816][ T1993] usb 6-1: SerialNumber: syz [ 1687.081591][ T1993] usb 6-1: config 0 descriptor?? [ 1687.084582][T19383] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1687.085365][T19383] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1687.108449][T19377] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1687.109030][T19377] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1687.229390][T14201] usbhid 9-1:0.0: can't add hid device: -71 [ 1687.236878][T14201] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1687.291975][T14201] usb 9-1: USB disconnect, device number 78 [ 1687.366746][ T5596] usb 6-1: USB disconnect, device number 53 [ 1687.519549][ T5721] video4linux radio48: keene_cmd_set failed (-71) [ 1687.532624][ T5721] radio-keene 2-1:9.57: V4L2 device registered as radio48 [ 1687.539331][ T5721] usb 2-1: USB disconnect, device number 84 [ 1687.672888][T19394] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3099'. [ 1687.680765][T14201] usb 9-1: new high-speed USB device number 79 using dummy_hcd [ 1687.834253][T14201] usb 9-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1687.836583][T14201] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1687.836629][T14201] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1687.871170][T14201] usb 9-1: config 0 descriptor?? [ 1688.694598][T14201] aiptek 9-1:0.0: Aiptek using 400 ms programming speed [ 1688.710085][T14201] input: Aiptek as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/input/input54 [ 1689.027042][T19408] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3104'. [ 1689.152913][ T5596] usb 9-1: USB disconnect, device number 79 [ 1689.153176][ C1] aiptek 9-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1690.450061][T19428] lo: entered promiscuous mode [ 1690.492824][T19428] tunl0: entered promiscuous mode [ 1690.657285][T19428] gre0: entered promiscuous mode [ 1691.395079][T19428] gretap0: entered promiscuous mode [ 1691.541489][T19428] erspan0: entered promiscuous mode [ 1691.660123][T19428] ip_vti0: entered promiscuous mode [ 1691.675022][T19428] ip6_vti0: entered promiscuous mode [ 1691.687061][T19428] sit0: entered promiscuous mode [ 1691.702506][T19428] ip6tnl0: entered promiscuous mode [ 1691.716779][T19428] ip6gre0: entered promiscuous mode [ 1691.769026][T19443] netlink: 12 bytes leftover after parsing attributes in process `syz.4.3113'. [ 1691.859487][T19428] syz_tun: entered promiscuous mode [ 1691.907163][T19428] ip6gretap0: entered promiscuous mode [ 1691.924097][T19428] bridge0: port 2(bridge_slave_1) entered disabled state [ 1691.972204][T19428] bridge0: port 1(bridge_slave_0) entered disabled state [ 1691.983029][T19428] bridge0: entered promiscuous mode [ 1692.015670][T19428] vcan0: entered promiscuous mode [ 1692.210941][T19428] bond0: entered promiscuous mode [ 1692.211011][T19428] bond_slave_0: entered promiscuous mode [ 1692.211341][T19428] bond_slave_1: entered promiscuous mode [ 1692.232419][T19428] team0: entered promiscuous mode [ 1692.232440][T19428] team_slave_0: entered promiscuous mode [ 1692.234210][T19428] team_slave_1: entered promiscuous mode [ 1692.487329][T19428] dummy0: entered promiscuous mode [ 1692.829786][T19428] nlmon0: entered promiscuous mode [ 1693.279322][T19428] batadv0: entered promiscuous mode [ 1693.401924][T19428] vxcan0: entered promiscuous mode [ 1693.413755][T19428] vxcan1: entered promiscuous mode [ 1693.423543][T19428] veth0: entered promiscuous mode [ 1693.441370][T19428] veth1: entered promiscuous mode [ 1693.513708][T19428] wg0: entered promiscuous mode [ 1693.595479][T19428] wg1: entered promiscuous mode [ 1693.655242][T19428] wg2: entered promiscuous mode [ 1693.690049][T19428] veth0_to_bridge: entered promiscuous mode [ 1693.852325][ T1993] usb 6-1: new high-speed USB device number 54 using dummy_hcd [ 1693.878408][T19428] veth1_to_bridge: entered promiscuous mode [ 1694.001356][ T1993] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1694.013669][ T1993] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1694.020640][ T1993] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1694.031168][T19428] veth0_to_bond: entered promiscuous mode [ 1694.059135][T19428] veth1_to_bond: entered promiscuous mode [ 1694.067328][ T1993] usb 6-1: config 0 descriptor?? [ 1694.095762][T19428] veth0_to_team: entered promiscuous mode [ 1694.115343][T19471] FAULT_INJECTION: forcing a failure. [ 1694.115343][T19471] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1694.115378][T19471] CPU: 1 UID: 0 PID: 19471 Comm: syz.4.3123 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1694.115412][T19471] Tainted: [L]=SOFTLOCKUP [ 1694.115420][T19471] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1694.115431][T19471] Call Trace: [ 1694.115439][T19471] [ 1694.115448][T19471] dump_stack_lvl+0xe8/0x150 [ 1694.115481][T19471] should_fail_ex+0x46b/0x600 [ 1694.115508][T19471] _copy_to_user+0x31/0xb0 [ 1694.115534][T19471] simple_read_from_buffer+0xe1/0x170 [ 1694.115559][T19471] proc_fail_nth_read+0x1be/0x230 [ 1694.115584][T19471] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1694.115608][T19471] ? rw_verify_area+0x250/0x4d0 [ 1694.115630][T19471] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1694.115651][T19471] vfs_read+0x219/0xa90 [ 1694.115678][T19471] ? __pfx_vfs_read+0x10/0x10 [ 1694.115700][T19471] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 1694.115723][T19471] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1694.115743][T19471] ? mutex_lock_nested+0x152/0x1d0 [ 1694.115767][T19471] ? fdget_pos+0x252/0x320 [ 1694.115792][T19471] ksys_read+0x156/0x270 [ 1694.115810][T19471] ? __pfx_filldir+0x10/0x10 [ 1694.115835][T19471] ? __pfx_ksys_read+0x10/0x10 [ 1694.115866][T19471] do_syscall_64+0x166/0x520 [ 1694.115886][T19471] ? trace_irq_disable+0x3b/0x140 [ 1694.115907][T19471] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1694.115926][T19471] ? clear_bhb_loop+0x70/0xc0 [ 1694.115948][T19471] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1694.115965][T19471] RIP: 0033:0x7fe25992e98e [ 1694.115983][T19471] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 [ 1694.115999][T19471] RSP: 002b:00007fe257ba4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1694.116019][T19471] RAX: ffffffffffffffda RBX: 00007fe257ba56c0 RCX: 00007fe25992e98e [ 1694.116033][T19471] RDX: 000000000000000f RSI: 00007fe257ba50a0 RDI: 0000000000000005 [ 1694.116046][T19471] RBP: 00007fe257ba5090 R08: 0000000000000000 R09: 0000000000000000 [ 1694.116058][T19471] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1694.116069][T19471] R13: 00007fe259bf6128 R14: 00007fe259bf6090 R15: 00007ffc86cf02f8 [ 1694.116103][T19471] [ 1694.162237][T19428] veth1_to_team: entered promiscuous mode [ 1694.231938][T19474] netlink: 48 bytes leftover after parsing attributes in process `syz.8.3121'. [ 1694.286561][T19428] veth0_to_batadv: entered promiscuous mode [ 1694.313546][T19428] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1694.324392][T19428] batadv_slave_0: entered promiscuous mode [ 1694.363020][T19428] veth1_to_batadv: entered promiscuous mode [ 1694.433257][T19462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1694.444751][T19462] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1694.468097][T19428] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1694.469486][T19428] batadv_slave_1: entered promiscuous mode [ 1694.483277][ T1993] usbhid 6-1:0.0: can't add hid device: -71 [ 1694.489389][ T1993] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1694.502419][ T1993] usb 6-1: USB disconnect, device number 54 [ 1694.509725][T19428] xfrm0: entered promiscuous mode [ 1694.540909][T19428] veth0_to_hsr: entered promiscuous mode [ 1694.590295][T19428] veth1_to_hsr: entered promiscuous mode [ 1694.644497][T19428] hsr0: entered promiscuous mode [ 1694.675491][T19428] veth1_virt_wifi: entered promiscuous mode [ 1694.749824][T19428] veth0_virt_wifi: entered promiscuous mode [ 1694.805811][T19428] virt_wifi0: entered promiscuous mode [ 1694.864597][T19428] vlan0: entered promiscuous mode [ 1694.878003][T19428] vlan1: entered promiscuous mode [ 1694.924611][T19428] macvlan0: entered promiscuous mode [ 1694.964481][T19428] macvlan1: entered promiscuous mode [ 1694.983699][T19428] ipvlan0: entered promiscuous mode [ 1694.984405][T19428] ipvlan1: entered promiscuous mode [ 1695.021164][T19428] veth0_macvtap: entered promiscuous mode [ 1695.138472][T19495] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3127'. [ 1695.203930][T19428] macvtap0: entered promiscuous mode [ 1695.204506][T19428] macsec0: entered promiscuous mode [ 1695.257664][T19428] geneve0: entered promiscuous mode [ 1695.324597][T19428] geneve1: entered promiscuous mode [ 1695.408180][T19428] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 1695.504839][ T5590] Bluetooth: hci0: unexpected event for opcode 0x1003 [ 1695.671480][T19428] netdevsim netdevsim1 netdevsim1: entered promiscuous mode [ 1695.770937][ T5857] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 1695.870788][T19428] netdevsim netdevsim1 netdevsim2: entered promiscuous mode [ 1695.890615][ T5721] usb 9-1: new high-speed USB device number 80 using dummy_hcd [ 1695.932702][ T5857] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.40 [ 1695.946409][ T5857] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1695.946497][ T5857] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1695.967857][ T5857] usb 6-1: config 0 descriptor?? [ 1695.968262][T19428] netdevsim netdevsim1 netdevsim3: entered promiscuous mode [ 1696.046753][ T5721] usb 9-1: Using ep0 maxpacket: 8 [ 1696.055875][ T5721] usb 9-1: New USB device found, idVendor=0bc7, idProduct=0008, bcdDevice=4f.c8 [ 1696.058302][ T5721] usb 9-1: config 0 has an invalid descriptor of length 9, skipping remainder of the config [ 1696.058365][ T5721] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF9, changing to 0x89 [ 1696.058445][ T5721] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x89 has an invalid bInterval 0, changing to 7 [ 1696.058469][ T5721] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid maxpacket 59391, setting to 1024 [ 1696.058495][ T5721] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1696.058519][ T5721] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1696.121297][ T5721] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1696.121323][ T5721] usb 9-1: Product: syz [ 1696.121388][ T5721] usb 9-1: Manufacturer: syz [ 1696.121403][ T5721] usb 9-1: SerialNumber: syz [ 1696.192517][ T5721] usb 9-1: config 0 descriptor?? [ 1696.195765][T19502] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1696.215580][ T5721] ati_remote 9-1:0.0: ati_remote_probe: Unexpected endpoint_out [ 1696.506307][T19503] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1696.506882][T19503] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1696.561524][T19516] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1696.566219][T19516] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1696.572296][T19515] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3128'. [ 1696.572341][T19515] netlink: 48 bytes leftover after parsing attributes in process `syz.8.3128'. [ 1696.572355][T19515] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3128'. [ 1696.718752][ T5590] Bluetooth: hci0: ACL packet for unknown connection handle 0 [ 1696.729565][ T5590] Bluetooth: hci0: ACL packet for unknown connection handle 0 [ 1696.822025][ T5857] aiptek 6-1:0.0: Aiptek using 400 ms programming speed [ 1696.837309][ T5857] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input55 [ 1697.207239][ T5857] usb 6-1: USB disconnect, device number 55 [ 1697.207357][ C1] aiptek 6-1:0.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1697.340155][T19428] mac80211_hwsim hwsim32 wlan0: entered promiscuous mode [ 1697.645309][T19428] mac80211_hwsim hwsim33 wlan1: entered promiscuous mode [ 1697.665931][T19428] erspan0.1: entered promiscuous mode [ 1697.881306][T12567] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1697.882825][ T176] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1697.882866][ T176] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1697.882898][ T176] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1697.933101][ T5596] usb 9-1: USB disconnect, device number 80 [ 1698.057941][T19535] netlink: 48 bytes leftover after parsing attributes in process `syz.5.3137'. [ 1698.406030][T19538] netlink: 'syz.7.3139': attribute type 1 has an invalid length. [ 1699.945380][T19560] : renamed from bond_slave_0 (while UP) [ 1700.110667][ T37] kauditd_printk_skb: 23 callbacks suppressed [ 1700.115912][ T37] audit: type=1326 audit(1788631183.847:933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19559 comm="syz.8.3145" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7ff8ad04e159 code=0x0 [ 1701.223972][T19574] netlink: 48 bytes leftover after parsing attributes in process `syz.8.3151'. [ 1702.848507][T19612] FAULT_INJECTION: forcing a failure. [ 1702.848507][T19612] name failslab, interval 1, probability 0, space 0, times 0 [ 1702.848898][T19612] CPU: 1 UID: 0 PID: 19612 Comm: syz.4.3158 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1702.848928][T19612] Tainted: [L]=SOFTLOCKUP [ 1702.848936][T19612] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1702.848948][T19612] Call Trace: [ 1702.848957][T19612] [ 1702.848965][T19612] dump_stack_lvl+0xe8/0x150 [ 1702.848999][T19612] should_fail_ex+0x46b/0x600 [ 1702.849029][T19612] should_failslab+0xa8/0x100 [ 1702.849059][T19612] __kmalloc_node_track_caller_noprof+0xfb/0x7b0 [ 1702.849084][T19612] ? __lock_acquire+0x6df/0x2e40 [ 1702.849116][T19612] ? __kernfs_new_node+0xac/0xa70 [ 1702.849139][T19612] ? __kernfs_new_node+0xac/0xa70 [ 1702.849168][T19612] kstrdup+0x42/0x100 [ 1702.849201][T19612] __kernfs_new_node+0xac/0xa70 [ 1702.849232][T19612] ? __pfx___kernfs_new_node+0x10/0x10 [ 1702.849255][T19612] ? kernfs_root+0x1c/0x230 [ 1702.849282][T19612] ? kernfs_root+0x1c/0x230 [ 1702.849303][T19612] ? kernfs_root+0x1c/0x230 [ 1702.849321][T19612] ? kernfs_root+0x1c/0x230 [ 1702.849347][T19612] kernfs_create_dir_ns+0xfe/0x230 [ 1702.849376][T19612] sysfs_create_dir_ns+0x12f/0x2a0 [ 1702.849401][T19612] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 1702.849427][T19612] ? rt_spin_unlock+0x165/0x200 [ 1702.849456][T19612] kobject_add_internal+0x62c/0xce0 [ 1702.849568][T19612] kobject_init_and_add+0x12b/0x1a0 [ 1702.849600][T19612] ? __pfx_kobject_init_and_add+0x10/0x10 [ 1702.849628][T19612] ? __rt_spin_lock_init+0x3e/0x50 [ 1702.849655][T19612] bus_add_driver+0x258/0x670 [ 1702.849748][T19612] driver_register+0x23a/0x320 [ 1702.849779][T19612] usb_gadget_register_driver_owner+0xf9/0x270 [ 1702.849882][T19612] raw_ioctl+0x1503/0x40d0 [ 1702.849956][T19612] ? tomoyo_path_number_perm+0x219/0x5f0 [ 1702.849982][T19612] ? do_vfs_ioctl+0x1184/0x1550 [ 1702.850009][T19612] ? __pfx_raw_ioctl+0x10/0x10 [ 1702.850046][T19612] ? hook_file_ioctl+0x1f5/0x610 [ 1702.850075][T19612] ? __asan_memset+0x22/0x50 [ 1702.850098][T19612] ? smack_file_ioctl+0x265/0x370 [ 1702.850127][T19612] ? __pfx_smack_file_ioctl+0x10/0x10 [ 1702.850156][T19612] ? __fget_files+0x2a/0x420 [ 1702.850175][T19612] ? __fget_files+0x3a8/0x420 [ 1702.850194][T19612] ? __fget_files+0x2a/0x420 [ 1702.850216][T19612] ? bpf_lsm_file_ioctl+0x9/0x20 [ 1702.850237][T19612] ? __pfx_raw_ioctl+0x10/0x10 [ 1702.850261][T19612] __se_sys_ioctl+0xff/0x170 [ 1702.850288][T19612] do_syscall_64+0x166/0x520 [ 1702.850325][T19612] ? trace_irq_disable+0x3b/0x140 [ 1702.850349][T19612] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.850369][T19612] ? clear_bhb_loop+0x70/0xc0 [ 1702.850392][T19612] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1702.850412][T19612] RIP: 0033:0x7fe25996ddeb [ 1702.850431][T19612] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1c 48 8b 44 24 18 64 48 2b 04 25 28 00 00 [ 1702.850447][T19612] RSP: 002b:00007fe257ba2f00 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1702.850466][T19612] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe25996ddeb [ 1702.850479][T19612] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000004 [ 1702.850491][T19612] RBP: 00007fe257ba3fd0 R08: 0000000000000001 R09: 00000000ffffffff [ 1702.850504][T19612] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1702.850517][T19612] R13: 0000200000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1702.850547][T19612] [ 1702.995848][T19612] kobject: kobject_add_internal failed for raw-gadget.0 (error: -12 parent: drivers) [ 1702.995906][T19612] UDC core: USB Raw Gadget: driver registration failed: -12 [ 1702.995926][T19612] misc raw-gadget: fail, usb_gadget_register_driver returned -12 [ 1703.232812][T19617] netlink: 68 bytes leftover after parsing attributes in process `syz.5.3161'. [ 1703.758415][T19627] sctp: [Deprecated]: syz.8.3166 (pid 19627) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1703.758415][T19627] Use struct sctp_sack_info instead [ 1703.975935][T19632] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3169'. [ 1704.749355][T19647] FAULT_INJECTION: forcing a failure. [ 1704.749355][T19647] name failslab, interval 1, probability 0, space 0, times 0 [ 1704.749470][T19647] CPU: 0 UID: 0 PID: 19647 Comm: syz.8.3170 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1704.749496][T19647] Tainted: [L]=SOFTLOCKUP [ 1704.749503][T19647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1704.749514][T19647] Call Trace: [ 1704.749523][T19647] [ 1704.749531][T19647] dump_stack_lvl+0xe8/0x150 [ 1704.749557][T19647] should_fail_ex+0x46b/0x600 [ 1704.749572][T19647] should_failslab+0xa8/0x100 [ 1704.749588][T19647] ? do_getname+0x2e/0x250 [ 1704.749603][T19647] kmem_cache_alloc_noprof+0x9e/0x690 [ 1704.749617][T19647] ? do_getname+0x2e/0x250 [ 1704.749630][T19647] ? build_open_flags+0x58/0x600 [ 1704.749647][T19647] do_getname+0x2e/0x250 [ 1704.749665][T19647] ? getname_flags+0x11/0x20 [ 1704.749680][T19647] do_sys_openat2+0xcc/0x200 [ 1704.749695][T19647] ? lockdep_hardirqs_on+0x7b/0x110 [ 1704.749707][T19647] ? __pfx_do_sys_openat2+0x10/0x10 [ 1704.749728][T19647] __x64_sys_openat+0x138/0x170 [ 1704.749745][T19647] do_syscall_64+0x166/0x520 [ 1704.749757][T19647] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1704.749767][T19647] ? clear_bhb_loop+0x70/0xc0 [ 1704.749779][T19647] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1704.749789][T19647] RIP: 0033:0x7ff8ad04e159 [ 1704.749800][T19647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1704.749809][T19647] RSP: 002b:00007ff8ab264028 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1704.749821][T19647] RAX: ffffffffffffffda RBX: 00007ff8ad2d6180 RCX: 00007ff8ad04e159 [ 1704.749828][T19647] RDX: 000000000000275a RSI: 0000200000000040 RDI: ffffffffffffff9c [ 1704.749836][T19647] RBP: 00007ff8ab264090 R08: 0000000000000000 R09: 0000000000000000 [ 1704.749842][T19647] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1704.749849][T19647] R13: 00007ff8ad2d6218 R14: 00007ff8ad2d6180 R15: 00007ffc79fb1268 [ 1704.749864][T19647] [ 1705.527772][ T37] audit: type=1326 audit(1788631189.267:934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553253][ T37] audit: type=1326 audit(1788631189.267:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553309][ T37] audit: type=1326 audit(1788631189.267:936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553402][ T37] audit: type=1326 audit(1788631189.267:937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553446][ T37] audit: type=1326 audit(1788631189.277:938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553484][ T37] audit: type=1326 audit(1788631189.277:939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553522][ T37] audit: type=1326 audit(1788631189.277:940): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553560][ T37] audit: type=1326 audit(1788631189.277:941): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553599][ T37] audit: type=1326 audit(1788631189.277:942): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1705.553637][ T37] audit: type=1326 audit(1788631189.287:943): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=19649 comm="syz.5.3171" exe="/root/ci-upstream-kasan-gce-smack-root/syz-executor" sig=0 arch=c000003e syscall=431 compat=0 ip=0x7f4e0230e159 code=0x7ffc0000 [ 1710.687474][T19683] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3183'. [ 1716.087986][ T8256] usb 2-1: new high-speed USB device number 85 using dummy_hcd [ 1716.272239][T19732] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3195'. [ 1716.640829][ T8256] usb 2-1: Using ep0 maxpacket: 32 [ 1716.647161][ T8256] usb 2-1: New USB device found, idVendor=105b, idProduct=1799, bcdDevice=36.e9 [ 1716.649672][ T8256] usb 2-1: config 0 has an invalid interface number: 239 but max is 0 [ 1716.649698][ T8256] usb 2-1: config 0 has an invalid descriptor of length 108, skipping remainder of the config [ 1716.649717][ T8256] usb 2-1: config 0 has no interface number 0 [ 1716.649762][ T8256] usb 2-1: config 0 interface 239 altsetting 4 bulk endpoint 0x2 has invalid maxpacket 8 [ 1716.649787][ T8256] usb 2-1: config 0 interface 239 altsetting 4 endpoint 0x8 has invalid maxpacket 1023, setting to 64 [ 1716.649812][ T8256] usb 2-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xA9, changing to 0x89 [ 1716.649836][ T8256] usb 2-1: config 0 interface 239 altsetting 4 endpoint 0x89 has invalid maxpacket 28648, setting to 1024 [ 1716.649859][ T8256] usb 2-1: config 0 interface 239 altsetting 4 bulk endpoint 0x89 has invalid maxpacket 1024 [ 1716.649881][ T8256] usb 2-1: config 0 interface 239 altsetting 4 has an endpoint descriptor with address 0xD5, changing to 0x85 [ 1716.649904][ T8256] usb 2-1: config 0 interface 239 altsetting 4 endpoint 0x85 has an invalid bInterval 107, changing to 10 [ 1716.649928][ T8256] usb 2-1: config 0 interface 239 altsetting 4 endpoint 0x85 has invalid maxpacket 25209, setting to 1024 [ 1716.649951][ T8256] usb 2-1: config 0 interface 239 has no altsetting 0 [ 1716.681249][ T8256] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1716.681276][ T8256] usb 2-1: Product: syz [ 1716.681289][ T8256] usb 2-1: Manufacturer: syz [ 1716.681303][ T8256] usb 2-1: SerialNumber: syz [ 1716.735921][ T8256] usb 2-1: config 0 descriptor?? [ 1716.736958][T19707] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1716.737284][T19707] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1717.290112][T19740] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1717.931654][ T8256] usb 2-1: USB disconnect, device number 85 [ 1717.966594][T13830] Bluetooth: hci1: sending frame failed (-19) [ 1718.010217][ T5590] Bluetooth: hci1: BCM: Reset failed (-19) [ 1720.580004][T19782] netlink: 48 bytes leftover after parsing attributes in process `syz.4.3207'. [ 1720.944152][T19795] FAULT_INJECTION: forcing a failure. [ 1720.944152][T19795] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1720.958914][T19795] CPU: 1 UID: 0 PID: 19795 Comm: syz.4.3214 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} [ 1720.958948][T19795] Tainted: [L]=SOFTLOCKUP [ 1720.958955][T19795] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 1720.958966][T19795] Call Trace: [ 1720.958974][T19795] [ 1720.958983][T19795] dump_stack_lvl+0xe8/0x150 [ 1720.959016][T19795] should_fail_ex+0x46b/0x600 [ 1720.959043][T19795] _copy_from_user+0x2d/0xb0 [ 1720.959067][T19795] ___sys_sendmsg+0x1c6/0x360 [ 1720.959093][T19795] ? __lock_acquire+0x6df/0x2e40 [ 1720.959121][T19795] ? __pfx____sys_sendmsg+0x10/0x10 [ 1720.959180][T19795] ? __fget_files+0x2a/0x420 [ 1720.959198][T19795] ? __fget_files+0x3a8/0x420 [ 1720.959227][T19795] __x64_sys_sendmsg+0x1b7/0x290 [ 1720.959255][T19795] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1720.959300][T19795] do_syscall_64+0x166/0x520 [ 1720.959322][T19795] ? trace_irq_disable+0x3b/0x140 [ 1720.959344][T19795] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.959362][T19795] ? clear_bhb_loop+0x70/0xc0 [ 1720.959385][T19795] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1720.959410][T19795] RIP: 0033:0x7fe25996e159 [ 1720.959429][T19795] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 1720.959445][T19795] RSP: 002b:00007fe257bc6028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1720.959466][T19795] RAX: ffffffffffffffda RBX: 00007fe259bf5fa0 RCX: 00007fe25996e159 [ 1720.959480][T19795] RDX: 0000000020080000 RSI: 0000200000000040 RDI: 0000000000000003 [ 1720.959492][T19795] RBP: 00007fe257bc6090 R08: 0000000000000000 R09: 0000000000000000 [ 1720.959504][T19795] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1720.959515][T19795] R13: 00007fe259bf6038 R14: 00007fe259bf5fa0 R15: 00007ffc86cf02f8 [ 1720.959545][T19795] [ 1735.390177][T13830] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1735.455708][T13830] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1735.472805][T13830] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1735.481711][T13830] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1735.499664][T13830] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1736.575716][T19812] bridge0: port 1(bridge_slave_0) entered blocking state [ 1736.584783][T19812] bridge0: port 1(bridge_slave_0) entered disabled state [ 1736.585002][T19812] bridge_slave_0: entered allmulticast mode [ 1736.608127][T19812] bridge_slave_0: entered promiscuous mode [ 1736.638779][T19812] bridge0: port 2(bridge_slave_1) entered blocking state [ 1736.646161][T19812] bridge0: port 2(bridge_slave_1) entered disabled state [ 1736.646372][T19812] bridge_slave_1: entered allmulticast mode [ 1736.656888][T19812] bridge_slave_1: entered promiscuous mode [ 1736.896224][T19812] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1736.912981][T19812] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1737.106074][T19812] team0: Port device team_slave_0 added [ 1737.140055][T19812] team0: Port device team_slave_1 added [ 1737.212290][T19812] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1737.219358][T19812] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1737.219388][T19812] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1737.259234][T19812] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1737.266286][T19812] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1737.266317][T19812] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1737.486161][ T5590] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1737.554058][ T5590] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1737.562464][ T5590] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1737.564173][ T5590] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1737.566335][ T5590] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1737.590636][ T5590] Bluetooth: hci1: command tx timeout [ 1738.029830][ T5590] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1738.089691][ T5590] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1738.108390][ T5590] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1738.118001][ T5590] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1738.118773][ T5590] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1738.993433][T13830] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1739.057791][T13830] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1739.065186][T13830] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1739.090085][T13830] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1739.097963][T13830] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1739.245930][T13830] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 1739.307963][T13830] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 1739.320562][T13830] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 1739.595595][T13830] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 1739.613401][T13830] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 1739.674767][T13830] Bluetooth: hci1: command tx timeout [ 1739.751414][T13830] Bluetooth: hci6: command tx timeout [ 1740.231381][ T5590] Bluetooth: hci7: command tx timeout [ 1741.350642][ T5590] Bluetooth: hci8: command tx timeout [ 1741.670715][ T5590] Bluetooth: hci9: command tx timeout [ 1741.750742][ T5590] Bluetooth: hci1: command tx timeout [ 1741.830639][ T5590] Bluetooth: hci6: command tx timeout [ 1742.310931][ T5590] Bluetooth: hci7: command tx timeout [ 1743.430662][ T5590] Bluetooth: hci8: command tx timeout [ 1743.750609][ T5590] Bluetooth: hci9: command tx timeout [ 1743.830670][ T5590] Bluetooth: hci1: command tx timeout [ 1743.910557][ T5590] Bluetooth: hci6: command tx timeout [ 1744.390622][ T5590] Bluetooth: hci7: command tx timeout [ 1745.510719][ T5590] Bluetooth: hci8: command tx timeout [ 1745.830627][ T5590] Bluetooth: hci9: command tx timeout [ 1745.990685][ T5590] Bluetooth: hci6: command tx timeout [ 1746.470629][ T5590] Bluetooth: hci7: command tx timeout [ 1747.590578][ T5590] Bluetooth: hci8: command tx timeout [ 1747.910543][ T5590] Bluetooth: hci9: command tx timeout [ 1795.317560][T13830] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1 [ 1795.383343][T13830] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9 [ 1795.424585][T13830] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9 [ 1795.436162][T13830] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4 [ 1795.444399][T13830] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2 [ 1797.670601][ T5590] Bluetooth: hci10: command tx timeout [ 1798.132576][T13830] Bluetooth: hci11: unexpected cc 0x0c03 length: 249 > 1 [ 1798.305982][T19847] Bluetooth: hci11: unexpected cc 0x1003 length: 249 > 9 [ 1798.382353][T19847] Bluetooth: hci11: unexpected cc 0x1001 length: 249 > 9 [ 1798.401697][T19847] Bluetooth: hci12: unexpected cc 0x0c03 length: 249 > 1 [ 1798.535082][T17781] Bluetooth: hci11: unexpected cc 0x0c23 length: 249 > 4 [ 1798.541028][T17781] Bluetooth: hci11: unexpected cc 0x0c38 length: 249 > 2 [ 1798.607935][T19847] Bluetooth: hci12: unexpected cc 0x1003 length: 249 > 9 [ 1798.753369][T19847] Bluetooth: hci12: unexpected cc 0x1001 length: 249 > 9 [ 1798.766705][T19847] Bluetooth: hci12: unexpected cc 0x0c23 length: 249 > 4 [ 1798.778583][T19847] Bluetooth: hci12: unexpected cc 0x0c38 length: 249 > 2 [ 1799.035498][T13830] Bluetooth: hci13: unexpected cc 0x0c03 length: 249 > 1 [ 1799.108594][T13830] Bluetooth: hci13: unexpected cc 0x1003 length: 249 > 9 [ 1799.117494][T13830] Bluetooth: hci13: unexpected cc 0x1001 length: 249 > 9 [ 1799.136601][T13830] Bluetooth: hci13: unexpected cc 0x0c23 length: 249 > 4 [ 1799.144203][T13830] Bluetooth: hci13: unexpected cc 0x0c38 length: 249 > 2 [ 1799.637734][T13830] Bluetooth: hci14: unexpected cc 0x0c03 length: 249 > 1 [ 1799.709976][T13830] Bluetooth: hci14: unexpected cc 0x1003 length: 249 > 9 [ 1799.722073][T13830] Bluetooth: hci14: unexpected cc 0x1001 length: 249 > 9 [ 1799.748450][T13830] Bluetooth: hci14: unexpected cc 0x0c23 length: 249 > 4 [ 1799.749276][T13830] Bluetooth: hci14: unexpected cc 0x0c38 length: 249 > 2 [ 1799.759604][T13830] Bluetooth: hci10: command tx timeout [ 1800.712139][ T5590] Bluetooth: hci11: command tx timeout [ 1800.950603][ T5590] Bluetooth: hci12: command tx timeout [ 1801.350646][ T5590] Bluetooth: hci13: command tx timeout [ 1801.830623][ T5590] Bluetooth: hci10: command tx timeout [ 1801.990630][ T5590] Bluetooth: hci14: command tx timeout [ 1802.790915][ T5590] Bluetooth: hci11: command tx timeout [ 1803.030547][ T5590] Bluetooth: hci12: command tx timeout [ 1803.430794][ T5590] Bluetooth: hci13: command tx timeout [ 1803.910517][ T5590] Bluetooth: hci10: command tx timeout [ 1804.070539][ T5590] Bluetooth: hci14: command tx timeout [ 1804.871341][ T5590] Bluetooth: hci11: command tx timeout [ 1805.110620][ T5590] Bluetooth: hci12: command tx timeout [ 1805.510600][ T5590] Bluetooth: hci13: command tx timeout [ 1806.150556][ T5590] Bluetooth: hci14: command tx timeout [ 1806.950782][ T5590] Bluetooth: hci11: command tx timeout [ 1807.190563][ T5590] Bluetooth: hci12: command tx timeout [ 1807.590539][ T5590] Bluetooth: hci13: command tx timeout [ 1808.230517][ T5590] Bluetooth: hci14: command tx timeout [ 1827.730437][ C0] rcu: INFO: rcu_preempt detected stalls on CPUs/tasks: [ 1827.737491][ C0] rcu: Tasks blocked on level-0 rcu_node (CPUs 0-1): P1459/3:b..l P19805/1:b..l [ 1827.746636][ C0] rcu: (detected by 0, t=10503 jiffies, g=109557, q=8756 ncpus=2) [ 1827.754531][ C0] task:syz.5.3213 state:D stack:27240 pid:19805 tgid:19789 ppid:8726 task_flags:0x400040 flags:0x00080002 [ 1827.766448][ C0] Call Trace: [ 1827.769722][ C0] [ 1827.772663][ C0] __schedule+0x16d9/0x5700 [ 1827.777177][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1827.782138][ C0] ? __pfx___schedule+0x10/0x10 [ 1827.786989][ C0] schedule_rtlock+0x30/0x70 [ 1827.791568][ C0] rtlock_slowlock_locked+0x35c9/0x3c20 [ 1827.797098][ C0] ? rtlock_slowlock_locked+0x2ab/0x3c20 [ 1827.802709][ C0] ? __pfx_rtlock_slowlock_locked+0x10/0x10 [ 1827.808579][ C0] ? rcu_is_watching+0x16/0xb0 [ 1827.813324][ C0] rt_spin_lock+0x165/0x400 [ 1827.817803][ C0] ? __pfx_rt_spin_lock+0x10/0x10 [ 1827.822816][ C0] ? rcu_is_watching+0x16/0xb0 [ 1827.827557][ C0] ? __local_bh_disable_ip+0x3d/0x420 [ 1827.832931][ C0] ? lock_sock_nested+0x69/0x130 [ 1827.837902][ C0] ? lock_sock_nested+0x69/0x130 [ 1827.842833][ C0] lock_sock_nested+0x7e/0x130 [ 1827.847574][ C0] tipc_recvmsg+0x154/0x1400 [ 1827.852154][ C0] ? stack_trace_save+0xa9/0x100 [ 1827.857080][ C0] ? kasan_save_track+0x4f/0x80 [ 1827.861922][ C0] ? __pfx_tipc_recvmsg+0x10/0x10 [ 1827.866937][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1827.871849][ C0] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 1827.877113][ C0] ? security_socket_recvmsg+0x7e/0x2c0 [ 1827.882641][ C0] ? __pfx_tipc_recvmsg+0x10/0x10 [ 1827.887640][ C0] sock_recvmsg+0x196/0x1e0 [ 1827.892125][ C0] ____sys_recvmsg+0x1f2/0x4b0 [ 1827.896870][ C0] ? __pfx_____sys_recvmsg+0x10/0x10 [ 1827.902137][ C0] ? import_iovec+0x73/0xa0 [ 1827.906628][ C0] ___sys_recvmsg+0x213/0x5a0 [ 1827.911292][ C0] ? __pfx____sys_recvmsg+0x10/0x10 [ 1827.916469][ C0] ? lock_acquire+0x115/0x350 [ 1827.921139][ C0] ? __fget_files+0x3a8/0x420 [ 1827.925798][ C0] __x64_sys_recvmsg+0x1b4/0x290 [ 1827.930710][ C0] ? __pfx___x64_sys_recvmsg+0x10/0x10 [ 1827.936146][ C0] ? __pfx_kcov_ioctl+0x10/0x10 [ 1827.941002][ C0] do_syscall_64+0x166/0x520 [ 1827.945565][ C0] ? trace_irq_disable+0x3b/0x140 [ 1827.950562][ C0] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1827.956618][ C0] ? clear_bhb_loop+0x70/0xc0 [ 1827.961275][ C0] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1827.967139][ C0] RIP: 0033:0x7f4e0230e159 [ 1827.971528][ C0] RSP: 002b:00007f4e00101028 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1827.979913][ C0] RAX: ffffffffffffffda RBX: 00007f4e02596270 RCX: 00007f4e0230e159 [ 1827.987858][ C0] RDX: 0000000000000000 RSI: 0000200000000100 RDI: 0000000000000004 [ 1827.995801][ C0] RBP: 00007f4e023a5024 R08: 0000000000000000 R09: 0000000000000000 [ 1828.003756][ C0] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1828.011714][ C0] R13: 00007f4e02596308 R14: 00007f4e02596270 R15: 00007ffc7a82dc98 [ 1828.019669][ C0] [ 1828.022666][ C0] task:kworker/u8:9 state:R running task stack:20488 pid:1459 tgid:1459 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1828.036194][ C0] Workqueue: tipc_send tipc_conn_send_work [ 1828.041979][ C0] Call Trace: [ 1828.045234][ C0] [ 1828.048142][ C0] __schedule+0x16d9/0x5700 [ 1828.052624][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.057540][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.062455][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.067370][ C0] ? __pfx___schedule+0x10/0x10 [ 1828.072202][ C0] preempt_schedule_irq+0x4b/0x90 [ 1828.077197][ C0] irqentry_exit+0x14f/0x910 [ 1828.081760][ C0] ? trace_irq_disable+0x3b/0x140 [ 1828.086765][ C0] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1828.092717][ C0] RIP: 0010:unwind_next_frame+0x1202/0x2550 [ 1828.098585][ C0] Code: 24 30 42 0f b6 04 20 84 c0 4c 8b 04 24 0f 85 46 0e 00 00 42 0f b6 44 25 00 84 c0 0f 85 62 0e 00 00 0f b7 32 c1 ee 04 83 e6 0f <83> fe 08 0f 84 6c 07 00 00 83 fe 04 0f 84 f9 06 00 00 85 f6 0f 85 [ 1828.118166][ C0] RSP: 0018:ffffc90006d16460 EFLAGS: 00000202 [ 1828.124206][ C0] RAX: 0000000000000000 RBX: ffffc90006d16558 RCX: 0000000000000000 [ 1828.132150][ C0] RDX: ffffffff9043cdac RSI: 0000000000000008 RDI: ffffc90006d16568 [ 1828.140093][ C0] RBP: 1ffffffff20879b5 R08: ffffc90006d17e80 R09: 0000000000000000 [ 1828.148039][ C0] R10: ffffc90006d16558 R11: fffff52000da2cad R12: dffffc0000000000 [ 1828.155997][ C0] R13: ffffffff9043cda8 R14: ffffc90006d16508 R15: ffffc90006d16550 [ 1828.163958][ C0] ? kthread+0x38b/0x470 [ 1828.168205][ C0] ? unwind_next_frame+0x8f/0x2550 [ 1828.173291][ C0] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 1828.179417][ C0] arch_stack_walk+0x11b/0x150 [ 1828.184176][ C0] ? ret_from_fork+0x514/0xb70 [ 1828.188929][ C0] stack_trace_save+0xa9/0x100 [ 1828.193668][ C0] ? __pfx_stack_trace_save+0x10/0x10 [ 1828.199013][ C0] ? __kfree_skb+0x5d/0x210 [ 1828.203493][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.208422][ C0] kasan_save_track+0x3e/0x80 [ 1828.213077][ C0] ? kasan_save_track+0x3e/0x80 [ 1828.217902][ C0] ? kasan_save_free_info+0x40/0x50 [ 1828.223073][ C0] ? __kasan_slab_free+0x5c/0x80 [ 1828.227986][ C0] ? kmem_cache_free+0x187/0x6d0 [ 1828.232901][ C0] ? tipc_group_filter_msg+0xaba/0x1630 [ 1828.238420][ C0] ? tipc_sk_filter_rcv+0x3031/0x3240 [ 1828.243765][ C0] ? tipc_sk_rcv+0x8c4/0x2b30 [ 1828.248415][ C0] ? tipc_node_xmit+0x218/0xf10 [ 1828.253235][ C0] ? tipc_node_distr_xmit+0x2da/0x420 [ 1828.258578][ C0] ? tipc_sk_rcv+0x273c/0x2b30 [ 1828.263316][ C0] ? tipc_conn_send_work+0x6cd/0xa50 [ 1828.268574][ C0] ? process_scheduled_works+0xc3d/0x1630 [ 1828.274269][ C0] ? worker_thread+0xa47/0xfb0 [ 1828.279006][ C0] ? kthread+0x38b/0x470 [ 1828.283245][ C0] ? tipc_group_filter_msg+0xaba/0x1630 [ 1828.288764][ C0] kasan_save_free_info+0x40/0x50 [ 1828.293761][ C0] __kasan_slab_free+0x5c/0x80 [ 1828.298500][ C0] kmem_cache_free+0x187/0x6d0 [ 1828.303255][ C0] ? tipc_group_filter_msg+0xaba/0x1630 [ 1828.308776][ C0] tipc_group_filter_msg+0xaba/0x1630 [ 1828.314133][ C0] tipc_sk_filter_rcv+0x3031/0x3240 [ 1828.319306][ C0] ? __bfs+0x153/0x290 [ 1828.323352][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.328268][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.333193][ C0] ? __pfx_tipc_sk_filter_rcv+0x10/0x10 [ 1828.338716][ C0] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1828.343988][ C0] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1828.349337][ C0] tipc_sk_rcv+0x8c4/0x2b30 [ 1828.353829][ C0] ? tipc_sk_rcv+0x8c4/0x2b30 [ 1828.358482][ C0] ? ret_from_fork+0x514/0xb70 [ 1828.363225][ C0] ? tipc_sk_rcv+0x299/0x2b30 [ 1828.367885][ C0] ? __pfx_tipc_sk_rcv+0x10/0x10 [ 1828.372803][ C0] ? tipc_loopback_trace+0x48/0x1b0 [ 1828.377980][ C0] tipc_node_xmit+0x218/0xf10 [ 1828.382629][ C0] ? __pfx_tipc_sk_proto_rcv+0x10/0x10 [ 1828.388081][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.392991][ C0] ? __bfs+0xc0/0x290 [ 1828.396946][ C0] ? __pfx_hlock_conflict+0x10/0x10 [ 1828.402118][ C0] ? __pfx_tipc_node_xmit+0x10/0x10 [ 1828.407291][ C0] ? tipc_sk_filter_rcv+0x2f37/0x3240 [ 1828.412640][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.417574][ C0] ? __lock_acquire+0x6df/0x2e40 [ 1828.422495][ C0] tipc_node_distr_xmit+0x2da/0x420 [ 1828.427672][ C0] ? __pfx_tipc_node_distr_xmit+0x10/0x10 [ 1828.433364][ C0] ? rt_mutex_slowunlock+0x4ee/0xa30 [ 1828.438642][ C0] ? __local_bh_enable_ip+0x1ad/0x2b0 [ 1828.443991][ C0] ? lockdep_hardirqs_on+0x7b/0x110 [ 1828.449178][ C0] tipc_sk_rcv+0x273c/0x2b30 [ 1828.453751][ C0] ? tipc_sk_rcv+0x299/0x2b30 [ 1828.458409][ C0] ? __pfx_tipc_sk_rcv+0x10/0x10 [ 1828.463342][ C0] ? lock_acquire+0x115/0x350 [ 1828.467998][ C0] ? tipc_conn_send_work+0x19c/0xa50 [ 1828.473260][ C0] tipc_conn_send_work+0x6cd/0xa50 [ 1828.478348][ C0] ? tipc_conn_send_work+0x19c/0xa50 [ 1828.483608][ C0] ? __pfx_tipc_conn_send_work+0x10/0x10 [ 1828.489229][ C0] ? rcu_is_watching+0x16/0xb0 [ 1828.493968][ C0] ? process_scheduled_works+0x97a/0x1630 [ 1828.499660][ C0] process_scheduled_works+0xc3d/0x1630 [ 1828.505196][ C0] ? __pfx_process_scheduled_works+0x10/0x10 [ 1828.511152][ C0] ? assign_work+0x3cf/0x5d0 [ 1828.515724][ C0] worker_thread+0xa47/0xfb0 [ 1828.520307][ C0] ? __kthread_parkme+0x71/0x1f0 [ 1828.525228][ C0] kthread+0x38b/0x470 [ 1828.529268][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1828.534354][ C0] ? __pfx_kthread+0x10/0x10 [ 1828.538931][ C0] ret_from_fork+0x514/0xb70 [ 1828.543518][ C0] ? __pfx_ret_from_fork+0x10/0x10 [ 1828.548620][ C0] ? __switch_to+0xc89/0x1420 [ 1828.553286][ C0] ? __pfx_kthread+0x10/0x10 [ 1828.557853][ C0] ret_from_fork_asm+0x1a/0x30 [ 1828.562614][ C0] SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor)