last executing test programs: 1m59.268832025s ago: executing program 2 (id=2259): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8900, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB='3'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd_index=0x4, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 1m58.902722544s ago: executing program 2 (id=2261): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$kcm(0x10, 0x2, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x800, 0x0) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f0000000040)={'custom1\x00'}) syz_init_net_socket$llc(0x1a, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x0, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffeee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800"/13], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007fff}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0xa, 0x4, 0x1, 0x0, r5}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r6, &(0x7f0000000900)}, 0x20) openat$audio(0xffffff9c, 0x0, 0x800, 0x0) 1m55.006096175s ago: executing program 2 (id=2272): socketpair$unix(0x1, 0x3, 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) fsopen(&(0x7f00000007c0)='erofs\x00', 0x1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_RECVMSG={0xa, 0x4, 0x1cd83f7c25e05491, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x100, 0x1, {0x3}}) io_uring_enter(r2, 0x47bc, 0x273c, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x200000005c832, 0xffffffffffffffff, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 1m53.229151653s ago: executing program 2 (id=2275): syz_mount_image$erofs(&(0x7f00000003c0), &(0x7f0000000880)='./file0\x00', 0x8000c6, &(0x7f0000000240)=ANY=[], 0x0, 0x17d, &(0x7f0000001ac0)="$eJzsmLFP+kAUx7/vyg/yMy6uLg4SxcHSFjUuxLA5mogaNwlUghYx0EGYdPH/cHZwdvOPMM7qYFwY3Uxqej3oQQR10MT4PsPj+7h313evyXcoGIb5szw+vNyvFe+EAWASaaTU/89GXCO0+tfb83Jraj1/OfeUv041robPIwBB8PnnJwDcFAz4Kg+Cwd1p9VuE6OstCCwovQOCqfQeBLaVdkHYVfpA042w3jT3a55rlhteJRRWGOwwOGHIDffXPSNUtP5IW2+1O4clz3Ob3yg+ml+3IJDX+tPfV282ljY/GwK20jkQNpVeRao3m2gk2v2nE/H5xg/fnwULFr9NxP4UXBDmNX9KaP6R9evH2Va7s1irl6pu1T1ynNyKtWRZy05WGlEUx/jff+lPE9r5/0bUJimJk5LvN+0o9nMniu85rpD+J5CZjfLQ+5Mju4nWSe0jqTLGmHKGYRiGYRiGYRiGYRiGYZgvMAOSX0EldIo4GcDZkNVvAQAA///an3MA") mkdirat(0xffffffffffffff9c, &(0x7f0000000840)='./bus\x00', 0x110) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) mount(0x0, 0x0, &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0xffff) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000780)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000003d030100000000009500000c000000006926000000000000bf67000000000000150600000fff070067060000200000006a0200000ee60000bf050000000000003d350000000000006507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff4e53010000000000840400000000000073720000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a1574aefc97d8addaa65b925cd3ded25b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf73b18e509402a4de1c2ea17f04537fc211576846ac629d1d93265ba474580047a9dc88de358ce795731891a2031de4e09740c64e5306f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfac2e6d4421c49fb6641cbf56914e76702f673b586c767562a90a3967093b000e3806f825f1d0da2a304e06543b56d35235d78b7a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664a44e22b72e843e7cf55f394cf75d1cd3ee79a25fb98cc45b3fde43e42e150d4a2fddd9a9767748ca3522443097c55dc97c09d38485b18ad2cff787338bab324336f50c97b751f2ed2c4281858b428d1b2c1194b06f9bb7ffcc95c1bcf"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x4e}, 0x48) chdir(&(0x7f0000000140)='./bus\x00') syz_emit_ethernet(0x0, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) syz_open_dev$usbmon(0x0, 0x0, 0x0) socket(0x2, 0x3, 0x6) r3 = socket$inet_udplite(0x2, 0x2, 0x88) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mount$overlay(0x0, 0x0, 0x0, 0x200240e, 0x0) r4 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x60) fsync(r4) setsockopt$IPT_SO_SET_REPLACE(r3, 0x4000000000000, 0x40, 0x0, 0x0) 1m51.995811522s ago: executing program 2 (id=2277): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000100)={[], [{@fsuuid={'fsuuid', 0x3d, {[0x61, 0x33, 0x31, 0x33, 0x39, 0x38, 0x65, 0x33], 0x2d, [0x31, 0x35, 0x0, 0x62], 0x2d, [0x31, 0x64, 0xa6, 0x62], 0x2d, [0x33, 0x31, 0x31, 0x33], 0x2d, [0x64, 0x65, 0x62, 0x31, 0x65, 0x38, 0x54, 0x39]}}}, {@fowner_gt={'fowner>', 0xee01}}, {@appraise_type}, {@dont_appraise}, {@euid_gt}, {@context={'context', 0x3d, 'unconfined_u'}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@obj_user}, {@fowner_eq={'fowner', 0x3d, 0xee00}}]}, 0x4, 0x50f, &(0x7f0000000940)="$eJzs3c9PXFsdAPDvnTLA4w2PPn0LNeqrz6fVNB1+9JU0dWG70ZimibFx5aJFmBLCTAcZqAW7oEv3JjZxpX+COxNNunLhzp3u3NSFSa2Nppi4GHPv3MLwYwq8AlOYzye53HvOufR7DtNzztzDjxNAzzoXEWsR0R8RdyJiJM9P8iOutY70vpcvHk6vv3g4nUSzeet5kpWnedH2Oal3839zMCJ+8N2IHyc74zZWVuenqtXKYp4eXaotjDZWVi/OFfKcicnxybErly5PHLxRzdy27A9rv332nbkbP/zD77709M9r3/xZWq3Sz4ezsvZ2HKZW04tRasvri4gbRxGsS/ry/z+cPGlv+0xEfJT1/5E4k72aAMBp1myORHOkPQ0AnHbp838pkkI5XwsoRaFQLrfW8D6IoUK13li6MFJfvjcT2RrW2SgW7s5VK2P5WuHZKCZpejy73kxPbEtfioj3I+IXA+9k6fJ0vTrTzTc+ANDD3t02//9noDX/AwCn3OAB7/cjAgBw8h10/gcATj7zPwD0ngPM/5b+AeCU8PwPAL3H/A8AvWfP+f/R8dQDADgW3795Mz2a6/nfv565v7L8rdL9izOVxny5tjxdnq4vLpRn6/XZaqU8veNPau9QrdcXxj/ZSDZWVm/X6sv3lm7P1aZmK7crxeEjbhAAsKf3P3zy1yQi1q6+kx3RtpdDsas1A45aodsVALrmTLcrAHSN3+eB3rWPZ3zLAHDK7bJF7xYdf0Tosc1f4aQ6//ls/f/5Wlue9X/oDdb/oXd9uvX/bx96PYDjZ/0felezmdjzHwB6jDV+4I2+/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9qpQdSaGc7QW+ln4slMsRwxFxNorJ3blqZSwi3ouIvwwUB9L0eLcrDQC8ocI/knz/r/MjH5e2l/Yn/x3IzhHx01/d+uWDqaWlxfE0/18b+UuP8/yJ/m40AABod21nVmuezs9tD/IvXzycfnUcZxWfXW9tLprGXc+PVklf/D6/pxgRQ/9Ooq/t89L3K2cOIf7ao4j43Gb7H7RFKGVrIK2dT7fHT2MPH0H8za//9viFLfELWVl6LmZfi88eQl2g1zy53hon876XdrG8/xXiXHbevf8PZiPUm3s1/q3vGP9e9ffBbKzZGj/J+vy5jfTra/Lskz9+b0dmc6RV9ijiC327xU824icdxt+P99nGv33xyx91Kmv+OuJ87B6/pZYNs6NLtYXRxsrqxbna1GxltnJvYmJyfHLsyqXLE6PZGnXr4592i/HPqxfe25qzuZt12v6hDvEH92j/1/bZ/t/8786PvtKhLI3/ja/u/vp/8Jr46Zz49X3Gnxq61nH77jT+TIf27/X6X9gj7vJPWuenf1+d2WdVAYBj0FhZnZ+qViuLe1yk7zX3usfFybyItYi3oBr5RX+8FdXo+Ytuj0zAUdvs9N2uCQAAAAAAAAAAAAAA0EljZXV+II7214m63UYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOr/8HAAD//2b+15Y=") r0 = creat(&(0x7f0000000000)='./file1\x00', 0x4) fcntl$setstatus(r0, 0x4, 0x6000) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_open_dev$usbfs(0x0, 0x1ff, 0xa401) ioctl$USBDEVFS_CONTROL(r5, 0xc0185500, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) truncate(&(0x7f0000000900)='./file1\x00', 0xb73d) writev(0xffffffffffffffff, 0x0, 0x0) io_setup(0x202, &(0x7f0000000200)) pipe2$9p(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r8 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x121042, 0x115) r9 = inotify_init() inotify_add_watch(r9, 0x0, 0x16000f57) write$P9_RVERSION(r7, &(0x7f0000000780)=ANY=[@ANYBLOB="15ec3dbe65ffff0600000008003950"], 0x15) splice(r6, 0x0, r8, 0x0, 0x50f5d137, 0xd) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200), 0x0, 0x0, 0x0, 0x0) unlinkat$binderfs_device(0xffffffffffffff9c, &(0x7f0000000300)='./binderfs/binder1\x00') 1m48.808139905s ago: executing program 2 (id=2280): write$tun(0xffffffffffffffff, &(0x7f00000006c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@generic={0x3, 0x6, "b9e7a9", 0x190, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, {[@dstopts={0x0, 0x30, '\x00', [@generic={0x6, 0xf7, "5cab3ad2ec4e922222f0940d70aec90d220a57322c1a4fa58fd1fafcbb83b5ade430ac264433cbd74d1931f2b0e2dc4fd0dff2e22f95ab5ec3befc07d245875b674e928551d385aa7d1845a34858eabe94e4828d23bef83b1e8b1e278415d62273a92662f8a76ec9340c33a9c5b581e122e79533ade1a17f278b478b9d4c02d019c8843b199b3530e161006c3cea85bbd84a2ae3ddfb22e98ae6eb1048dc18d50c3fca6412a4e0c9acf23a26deffc88632269874e642a334a3bc74079dc85282e4c79bd143b58761f0b477a21f6e5ccfd6bc0f471cacfd73247dbddf6a28050b4b4b3a9d25eef16d077325713c036c23b8827466933cbc"}, @enc_lim={0x4, 0x1, 0x5}, @pad1, @generic={0x3, 0x73, "74f28bffb14222ae9c1e902d81db22909590ce76ec4e748de38495fb6670c3a488f98846c545a6c17843c7f1aaa5465e207afaf4db0b117ebbd5e60f34eb2de8a8550a8a284f96aa36243f1ecd6e4d3c3f6692d4cb044e585c036e9d1643ee2989b67a531bd5eff472a2fffe50476460d2535b"}, @jumbo={0xc2, 0x4, 0x9}, @enc_lim, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @pad1]}]}}}}, 0x1c6) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB], 0x6f4}}, 0x0) 1m32.297965538s ago: executing program 32 (id=2280): write$tun(0xffffffffffffffff, &(0x7f00000006c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@generic={0x3, 0x6, "b9e7a9", 0x190, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, {[@dstopts={0x0, 0x30, '\x00', [@generic={0x6, 0xf7, "5cab3ad2ec4e922222f0940d70aec90d220a57322c1a4fa58fd1fafcbb83b5ade430ac264433cbd74d1931f2b0e2dc4fd0dff2e22f95ab5ec3befc07d245875b674e928551d385aa7d1845a34858eabe94e4828d23bef83b1e8b1e278415d62273a92662f8a76ec9340c33a9c5b581e122e79533ade1a17f278b478b9d4c02d019c8843b199b3530e161006c3cea85bbd84a2ae3ddfb22e98ae6eb1048dc18d50c3fca6412a4e0c9acf23a26deffc88632269874e642a334a3bc74079dc85282e4c79bd143b58761f0b477a21f6e5ccfd6bc0f471cacfd73247dbddf6a28050b4b4b3a9d25eef16d077325713c036c23b8827466933cbc"}, @enc_lim={0x4, 0x1, 0x5}, @pad1, @generic={0x3, 0x73, "74f28bffb14222ae9c1e902d81db22909590ce76ec4e748de38495fb6670c3a488f98846c545a6c17843c7f1aaa5465e207afaf4db0b117ebbd5e60f34eb2de8a8550a8a284f96aa36243f1ecd6e4d3c3f6692d4cb044e585c036e9d1643ee2989b67a531bd5eff472a2fffe50476460d2535b"}, @jumbo={0xc2, 0x4, 0x9}, @enc_lim, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @pad1]}]}}}}, 0x1c6) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB], 0x6f4}}, 0x0) 20.730945856s ago: executing program 0 (id=2392): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x11c0, 0x0) open(0x0, 0x840, 0x191) creat(&(0x7f0000000000)='./file0\x00', 0x168) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x20600, 0x0) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x1, 0x4800003e, r0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_init(0x200, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x8d2, &(0x7f00000001c0)={0x0, 0x54a5, 0x400, 0x1, 0x37a}, &(0x7f00000002c0)=0x0, &(0x7f0000000080)=0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prctl$PR_SET_SECUREBITS(0x1c, 0x78) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r4, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) 19.846217817s ago: executing program 4 (id=2394): bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x19, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x9, '\x00', 0x0, @cgroup_sockopt=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) fsmount(r0, 0x0, 0x80) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_udp(0xa, 0x2, 0x0) openat$thread_pidfd(0xffffffffffffff9c, &(0x7f00000000c0), 0x101000, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_route(0x10, 0x3, 0x0) r1 = socket$igmp(0x2, 0x3, 0x2) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000000)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r5, @ANYBLOB="1f003300d000000008021100000108021100000050505050505000001502", @ANYRES8=r3], 0x3c}, 0x1, 0x0, 0x0, 0x4008840}, 0x10) 19.430430011s ago: executing program 4 (id=2395): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8900, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd_index=0x4, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 19.085282827s ago: executing program 4 (id=2396): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x0, 0x0}) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000001000000000000000000000095"], 0x0, 0x8, 0x0, 0x0, 0x41100, 0x30, '\x00', 0x0, 0x24}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) socket$netlink(0x10, 0x3, 0x8000000004) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000440)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x800}, 0x240080c0) unshare(0x62040200) r4 = syz_pidfd_open(0x0, 0x0) pidfd_getfd(r4, r4, 0x0) prctl$PR_TASK_PERF_EVENTS_DISABLE(0x1f) 17.000080418s ago: executing program 3 (id=2397): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) 16.840899258s ago: executing program 3 (id=2398): write$tun(0xffffffffffffffff, &(0x7f00000006c0)={@val={0x0, 0x86dd}, @val={0x0, 0x0, 0x12}, @mpls={[], @ipv6=@generic={0x3, 0x6, "b9e7a9", 0x148, 0x0, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @mcast2, {[@dstopts={0x0, 0x27, '\x00', [@generic={0x6, 0xf7, "5cab3ad2ec4e922222f0940d70aec90d220a57322c1a4fa58fd1fafcbb83b5ade430ac264433cbd74d1931f2b0e2dc4fd0dff2e22f95ab5ec3befc07d245875b674e928551d385aa7d1845a34858eabe94e4828d23bef83b1e8b1e278415d62273a92662f8a76ec9340c33a9c5b581e122e79533ade1a17f278b478b9d4c02d019c8843b199b3530e161006c3cea85bbd84a2ae3ddfb22e98ae6eb1048dc18d50c3fca6412a4e0c9acf23a26deffc88632269874e642a334a3bc74079dc85282e4c79bd143b58761f0b477a21f6e5ccfd6bc0f471cacfd73247dbddf6a28050b4b4b3a9d25eef16d077325713c036c23b8827466933cbc"}, @enc_lim={0x4, 0x1, 0x5}, @pad1, @generic={0x3, 0x29, "74f28bffb14222ae9c1e902d81db22909590ce76ec4e748de38495fb6670c3a488f98846c545a6c178"}, @jumbo={0xc2, 0x4, 0x9}, @enc_lim, @padn={0x1, 0x3, [0x0, 0x0, 0x0]}, @pad1]}]}}}}, 0x17e) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00'}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) 13.744240198s ago: executing program 5 (id=2401): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000180)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, 0x0, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_int(r3, 0x0, 0x2, 0x0, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) capset(&(0x7f0000000100)={0x20071026}, &(0x7f0000000140)={0x3, 0x5, 0x7, 0x20000, 0x3, 0x6}) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b000000080000000c0000000300000001"], 0x19) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r5}, 0x38) 12.939975738s ago: executing program 0 (id=2402): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip6_vti0\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x0, 0x3, 0x5, 0x12, @mcast2, @private0, 0x0, 0x8007, 0x100, 0x5}}) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) recvmmsg(r4, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001180)=""/4096, 0x1000}, {&(0x7f0000000440)=""/128, 0x80}], 0x2, &(0x7f00000004c0)=""/193, 0xc1}, 0x7f}, {{&(0x7f00000005c0)=@in, 0x80, &(0x7f0000000700)=[{0x0}], 0x1, &(0x7f0000000740)=""/23, 0x17}, 0x3}], 0x2, 0x40012100, 0x0) r5 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000029000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf090000000000006609010000000000060000000b000000180100002020702500000000002020207b9af8ff00000000"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x6, 0x0, 0x6}, {0x6, 0x0, 0x0, 0xb}}, [@printk={@p, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x1, 0xa, 0x1, 0x9}, {0x7, 0x0, 0x3}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x5}, {0x56}}], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) r7 = socket$alg(0x26, 0x5, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000026c0)=[{{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000380)="9c2dc1140d93ef5f17d64c95d5fcb455b3c721e52fbb4cb53403ef4679a59b169e32f662db9ada3fe878c52999d7d45553858b52bbf22c4a1c4214497d24fb064fccd400c9f291323c170daa3c41ed71c9101aec85d175d223c6c52863f15e3121598d85c6e57a", 0x67}], 0x1, &(0x7f0000000880)=[@pktinfo={{0x24, 0x29, 0x32, {@remote, r3}}}], 0x28}}, {{&(0x7f00000008c0)={0xa, 0x4e20, 0x9, @private2, 0x8}, 0x1c, &(0x7f0000000f40)=[{&(0x7f0000000b40)="b45edbbeb4d072815d189a9ef4404e978cc7ef82b52c779a43a8b28b1c34b539072160e1e2b690fa3bec240bc5b720b52f742a8093935c1d851840bab4d6f37d07af2589a794d0451af5d97b71b3e695a3b97467e8d5ea5a5484a5887d31e5d434bcec9b963bf6ec72f15b0777655fbf751f27033558f5f7ad4256cb9fd9796a82e51b86d7c0854f89290aca1c61b7db3a6d059080942d1aafbfed1a81a8f803d3b3f78dbb9e6d9bfdd233521b8cd517c0dc3b0aab8d1479bd47423874400430a4c70aa35064657d9c068b4cacff1098d36d0e0901b057a9d0da027c43065f464f560c25de9f66ba1de75d4a0421cd704fd99037", 0xf4}, {&(0x7f0000000900)="17b2a15c0f5a4d25f5b7d86b372ee02c239170e1682cccf460c6ba9fce37006c4cc7fd4c34c63be5354e688e6e18f473130cc4ef8538de944a86d41e149f391ae3ae97fb4f59278c5daf48f733bc875233efb624ca0c149e04ba68ae48", 0x5d}, {&(0x7f0000002d40)="aaf4c6b52a92e4b6a201fb9e8e3d6e64c251346e48741b0ec54de4f4e477fbc926fd02f618bc7762bfd668789bbb93f7456128f6c21794f67f54f9e88c47f610ffffa3e264581520fc771460dd8b4308d8eab75f0ce43cf45e9eae1efb1d7e076ab982f0d62adeaeb0280c191dbb39b37c15eb095746083063487b139f784d18ba316427717b684cc6cdd65d5582a64c6d4702d16457dee09e2ec71b36bfb573bb0ea372af06f64d178c91edd9b5684663667e765cd94dde5731cfe6157470ce9deda28acdeefd41c6848c80c731295e9e6e218ad2faacb51b51a7531dc0955daf6a514ed21600338dd4692fca1eab55c1ef2e3abf0f5444dd2e968a694f4a25adc8725947faa8095363952662180785abc28f64a96be17c436af07e53bbb509a76a03bf8a7d295415e7adc6d79b08f60513210ebbcfdd2c923301e80c2e17b07d5da2e3aa990b11fd2e79828f21183c2bf5d91f54173eabc3b6eb7c49b3769e5d5c903fdd3eca10291b8a49b537146a795c148a673c899d24d04f0f4e76b13061bf6bb6a930bf73b3496302eb60fe9da1e33b2f44d333438633d267dee9afc1fc2d341c520c4fe1b4512655d7d52c50718e42f68e3cdb0e0ef3c89c9967cae103aba9b7ea9ddd7e831f3b72367ad9ee6aa479ee36ccfe9615349296817889d22e79709ecdd85af204715dcd32bd274f7a97c89b52f4e370826664a172157bc307624c3e950c344afbb599cdb8497b6eb61da9db8514ee08d00e02635e6385544da90fc32be55117cbabf85f96482ec8156b5a88f8681274dbea06c26610b6eba59d0e7068e35b3adcdb2a34a593814ba033826cefbf370fcb65dcc2169470c231f2aa03b239cde1adbf547abab71738ef92cbd9b4f84c905d0d0f6fc1b0013a687c522c47df9f49748c49ebcae16ef6928ab52ecd3d263ec7ac31f049e171fd9d45c69f8759f330ba9b94b0f222f187abb38c40018e00ae806270227256dc970af47e18206cea8b361a0ce657d21b47f6eeb500fdf3ce40c7ff32dbeb8492941fceccea6a9e18c464ec92e81828c4f719314ad4f6acb9f821cc8d948ce730e35e1e0a78a14942fbfd14543d57da5bdf2985d9a917e3eb8b7bca9bae422917195b59a777c98355b58d5d8eca9587c124c26e33e1bed79a6c6873ff161f2ba5de3366ba2c9ef89c9f484419d0e0126577dbd3d7ce7fbd27386872659484efb82e13128dc96698c88a72618c3fda1e191c85c056536f93b5114b9d3da8356fc0bfa3f3515556de4d62770bd4e70bc9a6064d8a8b0efc240c327c7575551ae292eb54346d5fc7d84e236c412ec111611d9cf276641ab6c505b7e7a517dd6468c04fe43bf36a7fcc9e29c90bac265986c155f31e7ee654aa0a0e5c852a5b5c08037c0662a55f30bd6681892b011e3be92134785bfe10bd9ee19ff8365371d1c7e9c0244e4e9ce1468e6e4a48226569b938a171a01498b47d5750efc5b0eda522bc5f8bd23cc347f4626eabb73dd2291c1782bdd548de43c7196bea20f30f421e59f09d320d01ba18ca9fdec64031d3477b2075fc020d2182681f05ace68ce55bd56dda28126ddbb40723ee01401ede005e6f4cbded13dd55a1989975c4eaa2607267c594838138c0ab80bd43fcd4f06438d62bfd7b4abe6852284c7ecd3af8c1b54ba35cfaf3f2575fe80da7aa1ae89b2d321ed7a15d1efee81a894903455582234e8e9c79165384a6b2763c1fd2947ba0b0e1af14a762cc5dfc37d97a6dd65ac129d2464bc5c5f4f47e9ba571f43dcaff9506bb90729d56fb2e2dbb1b4afface7be7a3efb856ab1cf9b3b8ce74593c34f9474b18f4f2ae1f40ed1ba6a94bb45514395f0b835049f098e6afcab08c0c069b24e40d339b71535296ede932956bbb0365189bfb27c5c8c7e587c080b3706157321e80603ad7311ec6c6b5bcd19032bda3e8075a357637e65335aea3d66413afef2b3d22950c63f83ed8ab08347f519bac8f434b696330a2ef5273f5a72638434d6f8764259d32d13f3bc591c0095426c3ce62a1a425a079a6d664ead4c5d38911f7b2a7ab11990c75b733b2f0aa1ca4144aca008f5e7895b7b1688de646f9ea80fe5f0e9aa0996f150b4e45441553b44a433046a85b02ed4070cc085377d610fb35d5447e9d22670f411fa8bd7cfb553ca741a574beb7a68705c7c2cab1d49d934de59b14a6f68b64153694bae541233d0681b0e1cc90bbe197de0c41b7c9b456213d70ddf0fae651494570811c33c6f15f3a003f71e96bf546ffcce1278f029924f997d515efb85b4abeddad320c73ac17084e7493be25b358ed0c48752a49d7a52182a21afb46d2be3488f5f23a1c6d12e77191db235eb3b2b5cd99f5e78d68f10d2777eb09ff44ee9368278cb542266e3fa315a24720bda34ee2c647cb6b8683ef34b9dab790d4654f2340921cb12b931e8062eb83d7ec99c911a2f691016fe32bf7e5d967f22d140002a3ed6d6643d936728a9558a53354d88d4b97a2b6741207dc3d3d8d97b52d446b846edc9046bae50479f48ba34189e2ce3260401d42a6cd23956340604b173a2d2afcf6cd876aef5ac36f121def26125fec74e04f4e2e4107eda79c5439794ebb71fdda66d8badd89d02d38d4a0b858994d31059432aa5663d5af24dc47a6fbafb7bfa366a678dd4032e20fa36119cf1819e22b53ceb51c0afc93e49b3169f228c0ad8953a8e33871dc92a3d1e69d6ec084fc9d5ef07a4682e2e53dba3c9ce54b3955095ca604fc34fd30a2ef77157f46e898e3f760a6de7a7a56b10de76350208308f56f438dee24aaf1b10ad67319259754420bdc58b5b38cc6e3c2a087a1fd90f4923d80a32e856b268c57549109a738dc30aad5cb4d5c0fcd6697e108e6a896afbe6684d6c3abf1eda7247e1a18293167f7ee97f962902602f1016a754cd3684f0464680cb74c720e08f821a395206414d787bbd6697a0b5cde27293d7b667540393a827e74f962e094ecd4f5819233581ec59cae0f5c26f2844815b05106064886424b845fdb229d55bbd20f79c6619c4d36b49c13f1f7396d73c8a7be8a0d5b15685a4075fdc79d5fc6330f7643e08a61df84d6540672c778f51b3c0dffdcc8c38ebe3a7a85f4cc4123013c59c672b8579271af9cc14adcf8fe3a35f31c88f50c801e68e5430e287c7456c47fa895ad52dd047510803f963883c91b0c0f27c160af1ec3ca479eb025977566553be378820b3e9dca96707525d135e8092133ee2e5719057e630e56ee243b2febbce0521b34fa640b8d86b98e7b99bd4d58bb4e191381a689c58bb9daddab2396efd9f95064479404ad25ea00260c21b6491dd18b1b50e258f41f53f2017bf1cac6fe17f6ad5c8a4ab226e0884a1a296116010fe8557081b27940b2a5c5d2087e93665665d8e908a7e53e62fda0d31c3c94b35859d49193e6d76109475ca9daf7aafefd9a5396ab5853a553f1994f71caf841baf13a8a52602423bbac19ad63d55b20d26cf62904ae4035299888da0cdc1186162f0e1b4eefdfa35a806a18095e0cfeb458db452a63e1e6e2c3adde58fd30461f00fbb03cf6ed12d3782f1127db80fbb52061196556bd3ccc6a62245aa18e90ecd538002ac2b7d71354ace6b53ef1ca17e58efde77fe8b9bf64d5879b407ec5e5b15ec2d888b68f47b454fea2d2e4bcfd59f57c476a069c7f7c8b654d2127e46c36e10766197fd3a23154c715c8ef154e7c50e6ae4e68b185ebd30a629a5166bc7e7b7410364c9fde04f6642242928df8fe705ee311d88c41b4004b2eebe6e26abacde5a05529f3476b2f44783ca0a99ad015bafb1de2343f30608a15416ceb38282cc20b94bb444a30c69ec113fe4050709de899be9726b803c1da0e79db93a714a88a88efc0ed8ae57a9853c34dadd35cd39a2f30e70910ce4901d6835b58141ca32bbb282b7f36b906bd44acedcab7ee85d2044379b49bd8836b2f17a849bf33de9b83fb4b897dff7b9e8e211436f88f46d7acec1d94d0119ed2d9c1b7e6c6a7f3e7e33a8e112633bbaa0733d61c18b2b5d3d358c85cb7cb8d6ffaa1faa62d9c78b9469ef8b6b216e1e1ba8914a07667757ed20c99e4f973774cd0470cdd4395956655014cbf9faa2702f62f7aa371f178ef8f9dcd061e499eb3b18afde0a71c8026d8a8ad92671f6f33d20eb5e032df0261ea5d7b13f36d77410ab14a7234b6310803ef2d463630ac6244ec4f74e1d574b71ccdcbabcc844affffe724fe38b5f11fab030f49cc8de5ca48a1d03209800db1327e2e33eb2bb886c4f88695f7a7ee67810691e0506d782409718248f267a34e741ecd8f70dff878783cfea8bbe278e84238773550b585f7308a488aa6b56ce339d420751206c9787a9fa73a65f69a95c77c9f68153a399830d6c06c3fa1fd1e5bd51170e4d40214a73789f52d1472f2cac07babc4e6eca53b8badafd68ea5de0ff3cbb521144b4c93391a0185ae77a03199e3ad49965a2c8bc20124b2c2937ce64dbb0c147521c24364e56054d0b44178461d04ba734841969637fb3a9c88c780ef351d0ef284ac6509f3222713e6688b6a211d5558349d19f9d698fe859cef466ca0a332194b1efc9642fbf36d5984fd695d99a0c2f87d3292651dfcb914d431839f410ddcc904a62f844afcc765be065c61659f0a7030b365a221761d52e985733ac120c0f79d75666cba712f39bee33f5307b0476ec99c768d4f2959db12a6d95f2f39128f94611c2def9f5f4fe5c30ab1bb6a8caf2d4bb83d7a873990b9d6ae75a0366e4c002b9c3ed488e2cdb83677445839eb8156c1850231e3b2e687364475077458421bcce3d56ce3b52a39d95b7d49a49cb2c97db7700280cc76149c5f2eb3ced87933fe33b8d7dcb6ba76a7645ee13fd02f390629810e230ab497aa3092d4d047d342e3914c5587a355df6679a5e723f0e43f2579ba69999c82b875154f2a90dca504d416d71a2e83ebf1f0932c404d591c313e7749c4ed6c4cd922ca6f7be34f86a9f830730c3a7cdffd8cdf15f6606d10ab136c0fb729ff39500b717064d3165b8ae20de7d6d7b71566d8a2b97101cd234c79b4eb4e8fe5d6567cbedb2f9c0b375ea0b164b6051a697625a6132bbd2eecd836415e277fad007253f13eacd723136415d25e352275a111b0789ed61dae824581ade5214c2c3141c703f6c52822640993b03dce246c9b28bfad79d5bd0a5f7296056e8c2240a8640df9d09f507e152d5914e1d6091b623d812bb743edf870ba1abeaff879c9d5064bc8e543b541f4c660801eae1295fd8f5815dc67cbbcfd1ece914112e43d8155d3223ec70b6f3d77784f7b3008013cc45258b288c0fb0920d6e54b99ecc1f0c23fbb9f30b57f2b6fa623d79ea5a1bdb51f4fcf29ef3b911d30302bbd98c33460dcb1ec14f8e50975a5068e26db0067b4ba3c9ec5bd07a36574b896d65c64966bd37955fb8a4cec1fe2cca0eeabd97ad3cfda488be2947869e115df516f19fe9b09b4e720f8762392f7ba8c4afed55b16dec556ddb75753d6d9b7f3c442855f2694fb49bf97053bf7bbee58564075eb24711a1bb70c96fc0070110f57180f7f31f21edcb2f84c9eb08ec3f50ddb62367b6ecfb53b2bff9b50e5969f791f99d538ec06dbeda23a089c46499328db47720b8d90111f2f4698b65b72c20261091d33c3dd1d50c00dd8ba0293fe24d80e675ab1507be363be38ab3ee8520bfc8e15c913710c81514a2ef7548fbd18409748a8369e9cdf10e4a821992731faa95a3957f5b2249f61c27e74ae7c95b350fe929", 0x1000}, {&(0x7f0000000980)="90015dd143eff5f6027c36dc8dcc9f9572f92521c878c4bd2c55a386696feffb9a354a68e2a872c819e4", 0x2a}, {&(0x7f0000000a40)="d9e3f463bcb793e60aa641209de4f077b6a1fbb578e091136ff0761b64a282556884f2a39e402d", 0x27}, {&(0x7f0000000c40)="b8b67ec37c95e6c4b8cba51a5bc972ce83c26dc67d34c39b7b233e5acb1e4d71471717594e8153a89d1e514c501eceb64aaebd48a6c9d6c9c5e3f63a12333dbb1eeb0bb85b17adce99c347f8a3a3b7adf551c99391f7465494193403c768940f66efc31dce13db2da5b1f807ecf611010657062655491ffcc5178eb81c020ce5b176ebb96f4dac4fa89d1f439b6047836d2159d84611bd2521105ab18b1b7d5448096d9916dc229e05c5ed14d15ff9f79e0e25475cd2959a47f53548c8e7a8f782900221b258c72281a9b82e36cc7d5bf874afa96429e307f227006344e6ebb373ff8add1ed5d5935675c867", 0xec}, {&(0x7f0000000a80)="1bacd02bfe43d4634a43c978eb63d8d3e3cb6b1dcef931704d731977856fe7b87db3021c3cfb12f49f69868da34625d75d8c1a6fa9c322bc82c4c3aadd6b28146362e601c7f59df36330ff5781c7f8e27ea49f5f2a35fc37b13e3b2063d5917082", 0x61}, {&(0x7f0000000d40)="74080fb3a63fed83c2b689281bb5530310a433b3b61d03d93c04d85e058f5de3e23ebcde0bb26e9d01f32c46efb829bebd13509cd1bbbecd9d1286f99ddf4eca7a7adc0c87724826e4a83492d538e54211b24822b01a8b9cc069b73ba365daddaad7e8b12e9ee2518d3d104146788483d05c6390cbd62a7fe8374d0768bf63ed9459c320dd3623992e77329e02646dff33124ef6d5153ca91af5b805954917940938401fccaf7d5d134eb368972a96fad9a66d6564a7150d67e15ada4f19a8f8e96e8fa46a7395e1ef4a2d140e20396b8b2cf6ac29e9d26936160f3fbc", 0xdd}, {&(0x7f0000000e40)="498cb885793957aab484ac49b148535eb769f0526c43c113c7713e14472027f5c8af279fd5f26c5f7eafed7e283862375a09eed46b72e408df8c2958acde221a804568ce", 0x44}, {&(0x7f0000000ec0)="5da45a5149a51da7b7316491657b2903baed1fc2e3919d75726486ea1962b5b1f9dfd14f421788eb07259128aba64bba40ca875fe287260178d309f89db7c94f8e6429fdc7a19328f7abbdb21657df97e93e844f11489e7eabd91a7b", 0x5c}], 0xa, &(0x7f0000002180)=[@rthdrdstopts={{0x100, 0x29, 0x37, {0x2b, 0x1c, '\x00', [@hao={0xc9, 0x10, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @enc_lim={0x4, 0x1, 0x7}, @ra={0x5, 0x2, 0x7}, @padn={0x1, 0x1, [0x0]}, @generic={0xc1, 0xab, "e65adf25929c912e7248aa06a54fdd57ac3b07ad59dc5ed54f89525ddf1ccaab4135b125142bc418bcc8880c82d0e3cfb40ffe9e50ea35ad1c02c3b2bc97f5631f624bdcef01bf94c1e6c8f5827352a18ccc3a9635bcad769f4422dfb23ef5eef9207513ef69f2cf66686b322a549f336cfd8e3df2ff884f046487e4c74dccdda302ea92f2843ac8cd6eb5ac8b1e6eaccf57f4957b808482e602408831fda0a861be9c589ed615cf7141d1"}, @hao={0xc9, 0x10, @mcast2}, @enc_lim={0x4, 0x1, 0xa}, @enc_lim={0x4, 0x1, 0xf}]}}}, @hoplimit={{0x14, 0x29, 0x34, 0xa2ca}}, @dontfrag={{0x14, 0x29, 0x3e, 0x59}}, @hopopts_2292={{0x140, 0x29, 0x36, {0x2c, 0x24, '\x00', [@generic={0x5, 0xc9, "725c3bbe2ab64d1b14b002f522e3e11207a9269839ef8d8410a13a10692094eef065cff88e677f8da3823058ec701772287c61879398897d08e42acf3fb38f238b29203abb3c07ded7d9c5952256f211c0ccb1236e6213e849ad593c4a5acaed798104f61dabe513dbfa042b6522970cca51a12ea43e2ffa5a4d150d472a7df28c7c4df80ef230e2ab42248fd17a943c88ab27637e9d8ae9a8d0593cfc7a768c6c96e0cb29192777105b359f5e442194fc0c965996287c23ea9c39be751620fd00e9d6d79c21c33857"}, @hao={0xc9, 0x10, @private2={0xfc, 0x2, '\x00', 0x1}}, @enc_lim={0x4, 0x1, 0x8}, @calipso={0x7, 0x40, {0x3, 0xe, 0xe, 0x40, [0x9, 0x4, 0x1, 0x40, 0xa0e, 0x8, 0x3]}}]}}}, @flowinfo={{0x14, 0x29, 0xb, 0x4}}, @hopopts={{0xa8, 0x29, 0x36, {0x89, 0x12, '\x00', [@calipso={0x7, 0x38, {0x0, 0xc, 0x9, 0x6, [0x9, 0x6, 0x5d25, 0x5, 0x8000000000000000, 0x0]}}, @calipso={0x7, 0x38, {0x3, 0xc, 0x10, 0x2, [0x7ff, 0x4a, 0x6, 0x1, 0x9f9a, 0x10000]}}, @hao={0xc9, 0x10, @empty}, @ra={0x5, 0x2, 0x1}, @jumbo={0xc2, 0x4, 0xbb}]}}}], 0x330}}, {{&(0x7f0000001000)={0xa, 0x4e21, 0x81, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x10000}, 0x1c, 0x0, 0x0, &(0x7f0000002500)=[@pktinfo={{0x24, 0x29, 0x32, {@rand_addr=' \x01\x00'}}}, @rthdr={{0x28, 0x29, 0x39, {0x21, 0x2, 0x1, 0x5, 0x0, [@rand_addr=' \x01\x00']}}}, @rthdr={{0x78, 0x29, 0x39, {0x2c, 0xc, 0x2, 0x3, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @mcast2, @ipv4={'\x00', '\xff\xff', @empty}, @private2, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2]}}}, @rthdr={{0x78, 0x29, 0x39, {0x1d, 0xc, 0x0, 0x10, 0x0, [@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x0, 0x0}}, @empty, @local, @empty, @private1]}}}, @rthdrdstopts={{0x20, 0x29, 0x37, {0x2b, 0x0, '\x00', [@pad1, @pad1]}}}, @pktinfo={{0x24, 0x29, 0x32, {@mcast1, r3}}}], 0x188}}], 0x3, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)=[@iv={0x90, 0x117, 0x2, 0x7b, "2aff84e950b563656b60d5bb6ab24f3f9679941122db790d4737b2334b8854943ce8952cd85f6d298833b1832560c092ce83a9f785d48fe34273b1841f9413cd12c2058e86fcb01f5ebbfe09cf7c7b124095259bb7bd90f7841cae359c2b19a581e5a43d8ea826328439999c7f5e0d197d43c4fadf66c714d9dc3e"}], 0x90}], 0x1, 0x40800) recvmsg(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000540)="c145098a49de90cb684f701701afa087aab0b90c9e0d19eec0da6a9270abd0512241a2e1a7aefb3d72517d35039a0db14b28f934f10ba53d85e591db18684e050068d37a0e5f4fc6b21f743cff56e141d22ebbf8082f1a", 0x57) 10.537838677s ago: executing program 5 (id=2403): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x9, 0x7fff0006}]}) timerfd_settime(0xffffffffffffffff, 0x3, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket(0x2c, 0x6, 0x8) dup2(0xffffffffffffffff, 0xffffffffffffffff) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) shutdown(r0, 0x1) getpid() syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0x88e, &(0x7f0000000080)={[{@errors_remount}, {@mblk_io_submit}, {@inlinecrypt}, {@test_dummy_encryption_v1}, {@barrier}, {@mblk_io_submit}, {@nogrpid}]}, 0x3, 0x445, &(0x7f0000000800)="$eJzs3M9rHFUcAPDv7CZt06YmlvqjadVoFYM/kiattQcvioIHBUEP9RiTtMRuG2ki2BI0itSjFLyLR8G/wJNeRD0JXvUuhSK5tIqHldmdSXY3u2k2blzNfj4wyXszb3nvuzNv9715mQTQs0bTH0nEYET8EhFD1Wx9gdHqr9uryzN/rC7PJFEuv/57Uil3a3V5Ji+av+5AnumLKHycxNEm9S5euXphulSau5zlJ5YuvjOxeOXq0/MXp8/PnZ+7NHXmzKmTk8+ennqmI3Gmcd0aeX/h2JGX37z+6szZ62/98FWSx98QR4eMbnbwsXK5w9V118GadNLXxYbQlmK1m0Z/pf8PRTHWT95QvPRRVxsH7KhyuVy+t/XhlTKwiyXR7RYA3ZF/0afz33zbfMDQ0eFH1918vjoBSuO+nW3VI31RyMr0N8xvO2k0Is6u/Pl5usXO3IcAAKjzTTr+earZ+K8QtfeF7srWUIYj4u6IOBQRpyPicETcE1Epe19E3N9m/Y2LJBvHP4Ub2wpsi9Lx33PZ2lb9+C8f/cVwMcsdrMTfn5ybL82dyN6Tsejfm+YnN6nj2xd//rTVsdrxX7ql9edjwawdN/r21r9mdnpp+p/EXOvmhxEjfc3iT9ZWApKIOBIRI9usY/6JL4+1Onbn+JurvCUdWGcqfxHxePX8r0RD/Llk8/XJiX1RmjsxkV8VG/3407XXWtW/3fg7JT3/+5te/2vxDye167WL7ddx7ddPWs5ptnv970neqNv33vTS0uXJiD3JK9VG1+6faig3tV4+jX/sePP+fyjW34mjEZFexA9ExIMR8VDW9ocj4pGIOL5J/N+/8OjbdTvGBtuIf2el8c+2df7XE3uicU/zRPHCd1/XVTocbcSfnv9TldRYtmcrn39badf2rmYAAAD4/ylExGAkhfG1dKEwPl79G/7Dsb9QWlhcevLcwruXZqvPCAxHfyG/0zVUcz90MpvW5/mphvzJ7L7xZ8WBSn58ZqE02+3goccdaNH/U78Vu906YMd5Xgt6l/4PvUv/h96l/0PvatL/Bzbu+qvhkUFgN2j2/f9BF9oB/Psa+r9lP+gh5v/Qu/R/6F36P/SkxYG480PyEhIbElH4TzRj5xP7tvhvLnZZotufTAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJ3xdwAAAP//FX7vJg==") prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) chmod(&(0x7f0000000180)='./file0\x00', 0xe0) 10.170002673s ago: executing program 1 (id=2404): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e) r2 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000000)=0xfffffffe) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019100)='net/udp6\x00') openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) r3 = syz_usb_connect$hid(0x4, 0x3f, &(0x7f0000000140)={{0x12, 0x1, 0x250, 0x0, 0x0, 0x0, 0x40, 0x1532, 0x11b, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x3, 0xe0, 0x4, [{{0x9, 0x4, 0x0, 0xff, 0x1, 0x3, 0x1, 0x3, 0x2, {0x9, 0x21, 0xfffe, 0x6, 0x1, {0x22, 0xdbb}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x7, 0x9, 0x1}}, [{{0x9, 0x5, 0x2, 0x3, 0x7ff, 0x3, 0x8, 0x81}}]}}}]}}]}}, &(0x7f0000000300)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x250, 0x6, 0x4, 0x4, 0xff, 0xbb}, 0x8, &(0x7f0000000240)={0x5, 0xf, 0x8, 0x1, [@ptm_cap={0x3}]}, 0x1, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x437}}]}) syz_usb_control_io$hid(r3, &(0x7f00000005c0)={0x24, 0x0, 0x0, &(0x7f0000000380)={0x0, 0x22, 0x5, {[@main=@item_4={0x3, 0x0, 0x8, "48b603de"}]}}, 0x0}, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDELRT(r4, 0x890c, 0x0) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r5, 0xffffffffffffffff, 0x0) 10.169465154s ago: executing program 3 (id=2405): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x3) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) r3 = socket(0xa, 0x3, 0x3a) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x24008040) setsockopt$MRT6_INIT(r3, 0x29, 0xc8, &(0x7f0000000340), 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, 0x0, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, 0x0, 0x0) close(r3) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@ifindex, 0x16, 0x0, 0x401, &(0x7f0000000140)=[0x0, 0x0], 0x2, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x3c, 0x2c, 0xd27, 0xffffffff, 0x25dfd9ff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xffe0}, {}, {0x1c, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8847}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004081}, 0x40) socket$inet6(0xa, 0x80802, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000002400)={0x34, 0x0, 0x301, 0x0, 0x0, {0x17}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x34000804}, 0x0) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) ppoll(0x0, 0x0, 0x0, 0x0, 0x0) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x6, 0x4) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x40, 0x0, 0x1, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x0, 0x0, 0x1}}}}}}, 0x0) syz_emit_ethernet(0x38, &(0x7f0000000580)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x4}, {"c516"}}}}}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xffe0}, {0xf}, {0xe}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x4, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4040c00) 9.617856235s ago: executing program 4 (id=2406): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 8.631733859s ago: executing program 0 (id=2407): socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, 0x0) r2 = syz_io_uring_setup(0x237, &(0x7f0000000480)={0x0, 0x8900, 0x400, 0x0, 0x2cf}, &(0x7f0000000040)=0x0, &(0x7f0000000600)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) sendmsg$rds(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000440), 0x0, 0x0, 0x0, 0x20000800}, 0x4000008) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x5, 0x12, 0x0, 0x3}, 0x9c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r5, &(0x7f00000001c0)=ANY=[@ANYBLOB], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r5, 0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000000)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x24, 0x2007, @fd_index=0x4, 0x800, 0x0, 0x0, 0x18, 0x0, {0x2}}) io_uring_enter(r2, 0x47ba, 0x0, 0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) 8.230924164s ago: executing program 0 (id=2408): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000600)={0x17}) 7.940812127s ago: executing program 0 (id=2409): r0 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002c40)=ANY=[@ANYBLOB="140000002500091d1fbd7008f5ffffff02000008"], 0x14}, 0x1, 0x0, 0x0, 0x10008977}, 0x20040094) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000200)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@float={0x10, 0x0, 0x0, 0x10, 0x4}]}}, &(0x7f0000000100)=""/141, 0x26, 0x8d, 0x1, 0x7}, 0x28) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000100)=ANY=[@ANYRES8, @ANYRES32, @ANYBLOB="0000000000000000400012800c0001"], 0x68}}, 0x0) r3 = socket$igmp6(0xa, 0x3, 0x2) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00', {0x2}}) write$tun(r2, &(0x7f0000000100)=ANY=[@ANYBLOB="06000000bbbbbbbbbbbbaaaaaaaaaabb88f5"], 0x72) 7.781385211s ago: executing program 3 (id=2410): socket$igmp6(0xa, 0x3, 0x2) socket$inet6(0xa, 0x5, 0x800) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, 0x0, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r2, @ANYBLOB="0000000000004a641c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c00000010001fff0000000001000000000000d7", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800a000100767863616e0000000400028008000a00", @ANYRES32=r2], 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000030425bd70000000000000000000", @ANYRES32=0x0, @ANYBLOB="0005000082180000140012800b00010062726964676500000400028008000a00", @ANYRES32=r5], 0x3c}, 0x1, 0x0, 0x0, 0x24000804}, 0x8000) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket(0x1, 0x803, 0x0) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket(0x10, 0x803, 0x8) sendmsg$IPVS_CMD_SET_INFO(r9, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) getsockname$packet(r9, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x60, &(0x7f0000000300)={&(0x7f0000000900)=ANY=[@ANYBLOB="5c00000010001ffffcffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="0000000000000000340012800b0001006772657461700000240002800800070064010100060003001008000008001500700f0d0008000700ac1414bb08000a00", @ANYRES32=r10], 0x5c}}, 0x40) getsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1e, 0x0, 0x0) getsockname$packet(r7, 0x0, &(0x7f00000002c0)) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="4c00000010000104000000000009000000000000", @ANYRES32=0x0, @ANYBLOB="00030000000000001c0012800c0001006d6163766c616e000c000280080001000800000008000500", @ANYRES32, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x4c}}, 0x884) 6.448209509s ago: executing program 5 (id=2411): lseek(0xffffffffffffffff, 0x7fff, 0x1) r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = socket$inet6(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x2, 0x3, 0x424, 0x5a, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x8007, 0x180, 0x5}}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80021}, 0xc, &(0x7f0000000380)={&(0x7f0000004d80)=ANY=[@ANYBLOB="901000002900100027bd7000fddbdf2500000000000000000000ffffac1e0001fe8000000000000000000000000000bb4e2100004e2000000a0080005c000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYBLOB="b06b6e000100000008001d0006000000371001007368613531322d6e656f6e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000787f0000c27a56a3af0ee88304243b7abb8fbeed88214aed6285d0ec1be006764eaf417cf41ee8f4537d711b0b0bbad340e410f4413d7ce146812324a7e79779ff2388dbeec67efccf459cfa0312ccb52450d7cfa445c7b1ef32ba72cafd5e7d237e22008338621b9e82fe5f804774865b789c60334b1681718c2a1dc0e8a21ac115e66f20d20bece7704a6a393fea1dc4ed062ea7e1271464085c4bfde9acdb2a53119f1fb7e7b4eeb523d81f9ec12e5bf5e7e232b7b952ae54fef5ab8ea3f486e3206572fbdd16199c6dc9207581da5e8f4d955885c68ef32c37f905a0788888717529a842655e600c2db3322b78fe42799c9c110c6dc8e1500b18c24608442be4ebd1b7215fa5b776aa45d19ae289b0915ac208711abfe3b70abccbc1087ecc9b3676a5365b1a2d91eb102fccde2474881b6211f2eb57c7ea328e7a099683890d90b0c234e19fadac59b0430003e4f7ac898a34326c0c3c7343011130f54b37a3e667edc93d9b175379441ee69681af9a7bfee47da79117f8750b7379fc293e60d583215c4820ac82b18c6c8557c0bcf6cf49961731b33fb6b1213e535ec60b9bb1a4abe5140eca29fd4d728e1bbd4b27205aae2f5c4fc2c7bbeda0142b35b699fd429d7e267b3abd5f47942c1ba3af1f05e5470f90b7f277cbb55867b6eb4f02232ae00bcb802352a7f431781232ec6574f6ca4c2c5c78a6af806a03c12abc28971038f9e15adbaa104f70cb86e08df2d9667f0c629a95971f4e9f33bf1217d4c455e3975dc9929ef06e9327ab2fab34f80be88a3c9a162f9cd33e6538d1b9888405caa97a389c6e206c28fc4ed25fa7e1155bc9e7682c664571792e00beca5e0a4c058bd51c1a24f747254caab1daf6916e8838b79f20e73f9424245ce531f1176f1dcd72fb0e881380162e4c3d0d4e5517c19d3e8ea1cfa7587403ff56e445d1bd10151300f8dbb0b4330b088216e26b55ea72960441859cc74ad10b3f3c6d28a392114afbd2c1263b34159b87ae53fa318db400980865da20303746dcb8968f26b752fc77283ce205f542847bd95631ca0c07203088809ea4dedd543d85fd0593adb1001a129c7ece1f2c321c1fa30ac9c7f24c90aedaa0bcde13c00cc4ae584c615c237c3702603fc3200d1da2646a1ddaa92650f5c998f50f0caf33a0205ea14e4de99da644e2cefeb6647b4a5525951237725c89a786e2b3304179b64b799836ba6f9fdfd6ac160c5bb8b14f252013bd204ab9d424e1c3092ecb774c116c36a5e353e4300bf76f610349d16e4d542862082439e540178e89adb1d54a9efe174ba33ceb3afb7feb5977e8f6036dd006f07d214f743bdcc2e429574026fd4a581f270dad57bac9baade152bbdab76c0c203aa262f347cd9ab5313ed9e884d71b8dd5d5ac1abaf147a587f703d388df263de8053b2ed95d2158530990168afadcb02116ea5985cd1132fa9b9f64a557b4c30a01c3e2cd891fe34b61e8b61de6a848ee6d864d0e2234e8f9b6702cc9939f5cf21415f402b8b9a67a0c5d20c68f4b29a6294aa39dbec96e213f9c99151728ed7aa9614356c44dd1c0e120a3e1665d8ff4914d0699f6f7ae3911cf6c90b1f8a499550436fe244b49cc6ecf85137a03aa1be9dd58c49375eab55e77ac451d55c1e17d6a13ccde36d49ad40359f3521ed2dd40c0a805ad3f8bd77f117d2bb359e1330c69527f6df8195a35b2550eb9d592c5993b746b83020f8fda3136b76cd291d6c62e95974feddf0ac784acf1268ada9235b0eb07c8e4c8026e4c273e9b98b9cb64777bc213664ba4dedb49a546ef3b50e9fe17de8d912c61d6207281e0e44f46255770f64d18e23e39d70d8c49eac50e06d3840909be357ed30f3cb04e745d488675eb282f526c2fd66f06bcf04bf2586a3c51d608aefb2bf5e5b351919b5249d6b2ca42419da7c25fc4999ea9c5d9ee95bbfec225e47903dd01c4aeab2e50db844028a756d40a6e46d57dc5dd1255c8168c07973ee86b57e91133f03155add06cdfa7f0baa2819ae8ff980ae66ba2aa7f24aef69addec39151e597e8965564439ca672fe8616fcc51365cf7c4ea1450d3eb40fe967954d10b85d8762177f5dd7f6e60552e8d31da062743a3ee11b6e5bbf7398d06b0f129db35d101198992fecc1af1029552917ad8b9ea2655e73bf6b79f72faad6cde339be24919ab366c5c9f5d3af3a172ba83a1fc1dbcdaff0b5df47c1239b1fbf935f9138f7a9969246771fa1b52a3beef7358bb9313ccdc4a32f4a130dd6fd4d96433a9f8e6e22d33f7949815aff7610105bb0c70ae2e41bc69343037975374974262c36af1526dd0dab1778887e2082fdbec941eaa57f31cbd62d14f4adc3fcdc1de729f1164390569dd0a8fc051e46378b50ad7c33b5afbd71a0f7c65b928c4c0368214af33d3e64b0cc27a73446c9ece59b900bfdc1859e89240645e26969b819bbec70ef069846a550aea6449e045c2a19199527acb92dfbad832f3ca19428f51b36c60f8aff3334fcec318c3db4bc52c3528241fec66d3bf74209f422029118c55e59e80371b475f091edff3c7c614e6f1f002ee3dfc069813c9bef6b00195b5d8b4898f6cd6d28b891462279005c0baa604b60473fc5a185c01e3366bc05ebf80f92fab85a8aea96f634344ba79b8407c4e3ed61d7d1df6ab77a34024c2d8252d8e50927e88e1c0a42685af36b2d01a6f50b3db187bd6ae36809146178702eb28456d1eb43ba3334dfa7e9c486ea431e52f8f5c56926fa52fe0986e4d10595e695c695e8ea4d289e551be0261eb2385d020be750dc17c070a849f57bd707cd01d68abed2cf4dd28bae7ba323105e1561884a52145319af75da1284db5372fd4d582caa8279cfebe62c8ed964cb32b8eeabe53cc9b5a7258fdc55ef6b01461e485b3b1897630a09d27a40901b2ec7b47e94da9889588ee339f08b4594799d299be67117ae41b7b74f868f74c278a07bcf87ba29b455291c9c5161b1318bae1f68ba81e3f9772c9750a5f9735c7e69817aaa64f17e77b5f4d1c6911af22ee159a8995fa75437a1c7a319f1815fba764d442ea69509edb7d5ed3ded780a96cace4a9e9ea1d007fecd0c9882450368adfbe7e3b114968e62f45642b695375aca14e29cb11bc8f4e2607bbded8f97052cb65ce178baa1bf7d903c17ca53299a34ee7efc1732b45e773f48f9267a887995c10efc7bf9e0aea56ae7804c3f900f3e454f529e8de26ae0fa4871ef30db12ded3aab98bd25a3feb70e3bc782165b0deaada39af126b3e66635d3710aca947e6e1ae5458fcae25ec3e10285ca9f9c33883a0ef73d120dffdef81d0451949f0a3a633211e1dd0cc3d653a7ec33108eb7dcbb295974528e79a1608ddddaf75edee6161eb0c70aa66a323e96aaa1b75fd872eefc482787332fdb696cfc5dd87636d4068b8b83387149123044ef95c816905c3c88cc79d62671670772350568856a2653e85fee5e1a5b9849d2acbe9011944a5fb8aee797f216909fa9a76f24cd2eed1d9c68a12f3aad45d27e5e1efcbc4877f9f41eaa0932fdb87e29462cdce56abebd38a39d8ba61c96a97521d97e308a8485565ce673daae1ea4a8f7a00c68a524c98385853f7195543e851f8d401d0a8b569615f74bca76889c60facae3017e92bace610ffee82fee71b972c8c73b104e8b839033bcbebf867dc9bcb8fca57d89a1beb3188244a8f63c9a465207cccfde0fe5fdb9087a0b82381c94837fc4ba46c7797c250fac01d19f25ecd38a0cbfc26cc9d0393d3b460859e29fab53a4da205b3ca5d1bc1022637a712155a47148cf926d9d056853edbe0b993b3cbd531e4d55b82b68bf28b73b2c1e8d491d226660b2fb079f85d1e3d0a2a869e18676aaabf40608c6cf125164ac08ba569112e2c876b397dde4aa57277671967319a4201dbae45d6e49e5b05b8b5c01c6d648924e68a723c19e0b93ed5f3199720f090f4803c067a64e5909f382cf124a16b90af34e949541158e989c0f1c5e19fd92e9705a6d21bf1342a4794a19062c64875066827b418c55e65b247d03211b506197213d53422f3da6146eff828db6b9ef89d17fcaa7923e31534d7d5a8d530335b9098aa8a3235c073119beff9faade8cae67ea616aa3d9f61236a4102fb767097adaa7b1599a1b9cfe280adfad3f47862d152f5379b8debbee1b807fc3b6f5afacac02a34e7a122b294166f7cc4ccb7530d976ae2c7df638c917c809f884a7fb097c7f62c31245ef0422664d4921405ee899a83d2d8ff9ffedbbd0a96692ccc8e6e8530237cf4f2ebd876b66075f8aaa005da6875d3495ba4cb7cec1626a4c406ee637c89581dbf9a3dcbf0cef2983a4536f00b1a8ff9865eaa89d293f371744a6288fb636c47bc2d36a1b6e3b5ad54609e26479172af210fb23a39146e212ce460d9e2619cc33717c05999fdc9f4bdae51c779a39b509ebc4b917f622991f5e1452550450e704d38591d29de7ce710dc110a09f9fefeed390ce7ab8ca83ac5c1f68364c70698c09e484f017d9f7f27858055d38e41659db237bf1c797a9e4c410ced3e26bfcfc86b22ab6c7d1ca83c48ebb92005c57f51eae615efb7a4c1085bcf752f2d43b29f70a693db5dd829167be7546509b014d8cf85d0406f89cc51b7e44d54d0ee99f1b62682df1fe0b0415977955f0089f223cedc821a7a2c4b2a8f75615d1ef1c5c4cf578d55b0a808db2a120e23f671a53bfca468429ee759f2d50487509777811eaca97b15780d149fa0d1cdb27941b6fd3ea4adbb2e155fef664c4c7c2e76010a26b8780a5571c2aa51daeb5c1e7b7d7c75edc363311eca85b22e8dddf41880f13df478829413952295163e7ea4666759c7095ae31b6e5605b7e1b7dc15fb232924ddae880e52e0bfdc2a1e477d8c54fe72d628711332959899a96589f6822bc6d4922fe7f7e51996d968f997b75aa2d4fd33085441ad5003ccd18643523b95f27386c61fda659d9beeda658bd96ad313c2daf796d6c448c0b426627a0ebb79d4cb4033db1453f23f331ad974e06eda58e37e2e8f0a8f3bab0c19a1da46b1bcb4c7d53bfeef46e3ae3826d04414ee6552564be82cde0b27b972f2082a651ac0a57e13193ce4a2fd488c7f885a3987177ffa69a4018ea4d9930e2611f12f6e34a2c5a56b1e2116bffff530a4b24f67d1b5c593948e210a45d998b55764b43c3b17ba31ee9255c9590fcca239a86dedaedf9bc7c70c860597ef951e11a1eafc22949068c03e98c8b2c693ee39495ec52c32db6f16b2e62f7fd510a61c8fd430c37ccecc60164b07e033ea611309255710e8126601920189dafaec0ec94e9627a7eb3e1a6cd6d128ce3c14d6db80424118df0f5b2242b8053b5f92623f2c92622b615c01dc753655ebde4119f9e0cb64492c0c8a6cbd55b290433c10490034a037458b9eda9b9bb2bb8486c549a79fc613979addb4f3a3a04f3f6dad560d97d78dd5f8ea1735f5072193a0d76701ea79f3902b5e6378b6b104a53cd9c46948c388dd968d38c3f23ee6231a9385227b1191f37f47bfe54a7c414f75569db3a4153c911d42f9553629d57feb96e94de6596827bc12847d79bfcc3e044402d12fef0c4b7916ed4f099aa538c162c08ae391e951494e23ee53f8b82902d05a57cf6fcf42fb43696c34b8d9d1bffc022afb51bd395a823f9135159d9262784f1721a6485edc8af8a5b5a6bc60011a7d6db50d716ee498fd7845272e761dcca2f18b756a4dacbdd33095a8c50789b0b9acb8f760a00"], 0x1090}, 0x1, 0x0, 0x0, 0x20000000}, 0x28880) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0f, 0xffffffff}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r3, &(0x7f0000004a00)=[{{&(0x7f0000000400)=@qipcrtr, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000600)=""/122, 0x7a}, 0x9}, {{&(0x7f0000000680)=@generic, 0x80, &(0x7f0000007f80)=[{&(0x7f0000000a40)=""/183, 0xb7}, {0x0}, {&(0x7f0000001040)=""/142, 0x8e}, {0x0}, {&(0x7f0000000700)=""/108, 0x6c}, {&(0x7f0000004c40)=""/4, 0x4}, {&(0x7f0000004c80)=""/223, 0xdf}, {&(0x7f0000007e40)=""/153, 0x99}, {0x0}, {&(0x7f0000007f40)}], 0xa, &(0x7f0000001200)=""/4096, 0x1000}, 0x6}, {{&(0x7f0000002200)=@in6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f00000022c0)=[{&(0x7f0000000300)=""/16, 0x10}, {&(0x7f0000002280)=""/61, 0x3d}], 0x2, &(0x7f0000002300)=""/23, 0x17}, 0x80000001}, {{&(0x7f0000002340)=@tipc=@id, 0x80, 0x0}, 0xfffffffa}, {{&(0x7f00000025c0)=@nfc_llcp, 0x80, &(0x7f0000002680)=[{0x0}, {&(0x7f0000002d40)=""/4096, 0x1000}], 0x2, &(0x7f00000026c0)=""/122, 0x7a}, 0x800}, {{&(0x7f0000002740)=@phonet, 0x80, &(0x7f0000002b80)=[{&(0x7f00000027c0)=""/11, 0xb}, {&(0x7f0000002800)=""/134, 0x86}, {&(0x7f00000028c0)=""/96, 0x60}, {&(0x7f0000002940)=""/86, 0x56}, {&(0x7f0000002a00)=""/45, 0x2d}, {&(0x7f0000002a40)=""/145, 0x91}, {&(0x7f0000002b00)=""/71, 0x47}], 0x7, &(0x7f0000002c00)=""/31, 0x1f}, 0x7}, {{0x0, 0x0, &(0x7f00000040c0)=[{&(0x7f0000003dc0)=""/134, 0x86}, {&(0x7f0000003e80)=""/118, 0x76}, {&(0x7f0000003f00)=""/59, 0x3b}, {&(0x7f0000003f40)=""/76, 0x4c}, {&(0x7f0000003fc0)=""/49, 0x31}, {&(0x7f0000005e40)=""/4096, 0x1000}, {&(0x7f0000004000)=""/31, 0x1f}, {&(0x7f0000004040)=""/103, 0x67}], 0x8}, 0x3d5f}, {{&(0x7f0000004180)=@hci, 0x80, &(0x7f0000004480)=[{&(0x7f0000006e40)=""/4096, 0x1000}, {&(0x7f0000004200)=""/131, 0x83}, {&(0x7f00000042c0)=""/223, 0xdf}, {&(0x7f00000043c0)=""/48, 0x30}, {&(0x7f0000004400)=""/74, 0x4a}], 0x5, &(0x7f0000004500)=""/250, 0xfa}, 0x5}, {{&(0x7f0000004600)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}, 0x80, &(0x7f0000004940)=[{&(0x7f0000004680)=""/64, 0x40}, {&(0x7f00000046c0)=""/124, 0x7c}, {&(0x7f0000004740)=""/26, 0x1a}, {&(0x7f0000004780)=""/239, 0xef}, {&(0x7f0000004880)=""/185, 0xb9}], 0x5, &(0x7f00000049c0)=""/29, 0x1d}, 0x7}], 0x9, 0x40012100, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x1e, &(0x7f0000000b40)=ANY=[@ANYBLOB="181100003526c0ef9970b54c705181afaaad30af23a13a489576322cf4bc4950a2045cbe749a8f6f9a60d1383a626d5eac155972d8f7201270188c53454f4fa0ea2d567e62fc43f28954bac93ac2df328d98400fa592457654f4d72e7821cf5ccbfae36a20690c45df97c71b950ad7db41310bf006fe8b4c134246c11cb10d24a8bed3e1eb5131216157ffb3462e7b50ea16610482905c7abcd1a39e7a366b0d9b11b6b629d28402cd3ed01a0d9c2514a1a654119aa8f00206863fd9fc561243cfcaa2d85b9b4aa474379cb51b2b399b89512f8085a0b3bfa980dbe659b9f95bda27bc10db4614ab40da9eb6e98fdcc31feaf376f2709c0ada342e768b7c4e519a8db207f0d7f929d2f0e7dd6257dec2815b5c178d7523434eaaee4f30a4461f78cccd669dd60e4290102d7042ada1069d348667ed3e3a14006634032c437814f0ef965668b2bff9a8c73005f517ad0c95ae54ad15cbfc549172e7efe57aa3ed51add85d9f20", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001865000001000000000000002d07000018590000030000000000000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000da9400008500"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$inet6(r1, &(0x7f0000000180)="900000001d001f4d154a817393278bff0a80a578020000000404840014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000766436c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de", 0x7f, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000100)={0xa, 0xa9d, 0x3, @mcast1}, 0x1c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000008000000000000000"], 0x48) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0xfd9d, 0x20000, 0x40801c, 0x40024f, 0x0, r0}, &(0x7f0000000180), 0x0) 6.164949538s ago: executing program 5 (id=2412): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000600)={{0x12, 0x1, 0x0, 0x35, 0xff, 0xaa, 0x20, 0xccd, 0x10af, 0x384e, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x59, 0x2, 0x1, 0x9b, 0x1e, 0x2a, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 5.753883245s ago: executing program 0 (id=2413): mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x11c0, 0x0) open(&(0x7f0000000000)='./file0\x00', 0x840, 0x191) creat(0x0, 0x168) r0 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x20600, 0x0) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x1, 0x4800003e, r0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) fanotify_init(0x200, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000240)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0x8d2, &(0x7f00000001c0)={0x0, 0x54a5, 0x400, 0x1, 0x37a}, &(0x7f00000002c0)=0x0, &(0x7f0000000080)=0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prctl$PR_SET_SECUREBITS(0x1c, 0x78) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000240)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r4, 0x47ba, 0x3e82, 0x60, 0x0, 0x0) 5.682702479s ago: executing program 1 (id=2414): getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00'}, 0x90) socket$isdn(0x22, 0x3, 0x1) ioctl$EXT4_IOC_PRECACHE_EXTENTS(0xffffffffffffffff, 0x6612) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r2, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4000010) sendto$packet(r0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x11, 0x1c, r3, 0x1, 0x0, 0x6, @local}, 0x14) 5.414385906s ago: executing program 1 (id=2415): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, 0x0, 0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, &(0x7f00000003c0)={0x8, {{0x2, 0x4e1f, @empty=0xe0000000}}, {{0x2, 0x4e21, @broadcast}}}, 0x108) r3 = syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0x79af, 0x3180, 0x8000, 0xd6}, &(0x7f0000000340)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000200)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha384\x00'}, 0x49) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x800) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x6000, @fd=r7, 0xffffffffffffffff, &(0x7f00000006c0)=""/210, 0xd2, 0x2, 0x1}) io_uring_enter(r3, 0x627, 0x4c1, 0x43, 0x0, 0x30) 5.125821991s ago: executing program 3 (id=2416): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f00000013c0)='./file0/file0\x00', 0x42, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@metacopy_on}]}) mknodat$loop(0xffffffffffffffff, &(0x7f0000000200)='./file1\x00', 0x40, 0x1) chdir(&(0x7f00000003c0)='./bus\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000600)='./file1\x00', 0x2) execve(&(0x7f0000019100)='./file0\x00', 0x0, 0x0) 4.757007571s ago: executing program 3 (id=2417): r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) socket$kcm(0x10, 0x2, 0x0) r1 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder-control\x00', 0x800, 0x0) ioctl$BINDER_CTL_ADD(r1, 0xc1086201, &(0x7f0000000040)={'custom1\x00'}) syz_init_net_socket$llc(0x1a, 0x1, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="040000000400000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x16, 0x0, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffeee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc}, 0x94) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000ae00"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4007fff}, 0x94) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x4, 0x9}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0xa, 0x4, 0x1, 0x0, r5}, 0x50) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000380)={r6, &(0x7f0000000900)}, 0x20) openat$audio(0xffffff9c, 0x0, 0x800, 0x0) 4.376568428s ago: executing program 1 (id=2418): socket$inet6_sctp(0xa, 0x801, 0x84) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0xd, 0x0, &(0x7f0000000280)) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x40400d4) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000060000008500000023000000"], &(0x7f0000000380)='GPL\x00'}, 0x94) socket$isdn(0x22, 0x3, 0x1) ioctl$EXT4_IOC_PRECACHE_EXTENTS(r0, 0x6612) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) openat$cgroup_int(0xffffffffffffffff, 0x0, 0x2, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x4000010) sendto$packet(r1, &(0x7f0000000180)="a6bea8a120e5f8320c30ce5088a8", 0xe, 0x0, &(0x7f0000000140)={0x11, 0x1c, r4, 0x1, 0x0, 0x6, @local}, 0x14) 3.95006884s ago: executing program 1 (id=2419): r0 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000040)={0x4, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042"}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, 0x0) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f0000000000)='./bus\x00', 0xe, &(0x7f0000000140)={[{}, {@oldalloc}, {@resuid}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x80}}, {@dax_never}, {@jqfmt_vfsv1}]}, 0x1, 0x45f, &(0x7f0000000880)="$eJzs27tvHEUYAPBv92yHvLATwiMPwBAQFg87dgKkoAGBRAESEhShNLYThTgxio1EoogEhEKJItFRIAoKJP4CKmgQUCHRQo8iRShNAtWivduN78535uycfcD9ftIlM7uzmvlud/ZmdrwB9K3R/J8kYkdE/BoRw7VsY4HR2n83r1+Y+fP6hZkksuz1P5JquRvXL8yURcvjtheZsTQi/SiJ/S3qXTx3/tT0/Pzc2SI/sXT6nYnFc+efOnl6+sTcri1npo4ePXJ48tlnpp7uSpx5m27se3/hwN6X37zy6syxK2/9+HVSxt8UR5eMrrbz0SzrcnW9tbMunQz0sCGsSSUi8tM1WO3/w1GJ5ZM3HC992NPGARsqy7Jse/vdlzLgfyyJXrcA6I1y5pbPf8vP5o0+eu/a87UJUB73zeJT2zMQaVFmsGl+202jEXHs0l+f55/YmOcQAAANvs3HP0+2Gv+lcU9duTuLtaGRiNgVEbsj4q6I2BMRd0dUy94bEfetqfbPViySrBz/pFfXGVpH8vHfc8XaVuP4rxz9xUilyO2sxj+YHD85P3eo+E7GYnBLnp9cpY7vXvzlk3b76sd/+SevvxwLFu24OrCl8ZjZ6aXp24m53rUPIvYNtIo/ubUSkETE3ojYt846Tj7+1YF2+/45/lV0YZ0p+yLisdr5vxRN8ZeSFeuTJ+bq1icn7oj5uUMT5VWx0k8/X36tXf23FX8X5Od/Wy3+rFLb1Bz/SFK/Xru49jou//Zx2zlNZ9d/drH+mPz6H0reqKaHim3vTS8tnZ2MGEpeqTW6fvvU8rFlviyfxz92sHX/3x3L38T+iMgv4vsj4oGIeLBo+0MR8XBEHFwl/h9eeOTt9ce/sfL4Z1ve/9qd/+XEUDRvaZ2onPr+m4ZKR9YSf37+j1RTY8WWTu5/nbRrfVczAAAA/PekEbEjknT8VjpNx8drfy+/J7al8wuLS08cX3j3zGztHYGRGEzLJ13Ddc9DJ4tpfZmfiviyPn+4eG78aWVrNT8+szA/2+vgoc9tb9P/c79Xet06YMN5Xwv6l/4P/Uv/h/6l/0P/atH/t/aiHcDma/X7f7EH7QA2X1P/t+wHfcT8H/pXB/0/2Yx2AJvP7z/0pcWtscpL8vnvfocv0kv0WSLSf0UzJLqTSCOiYcvKe8VIL25QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAt+nvAAAA///0aOEH") bpf$MAP_CREATE(0x0, 0x0, 0x50) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$vcs(0xffffffffffffff9c, &(0x7f0000001980), 0x0, 0x0) read$FUSE(r3, &(0x7f00000019c0)={0x2020}, 0xfffffdda) 3.77852959s ago: executing program 5 (id=2420): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, 0x0, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22}, 0x1c) listen(r1, 0x3) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000040)='syz_tun\x00', 0x10) r3 = socket(0xa, 0x3, 0x3a) sendmsg$IPCTNL_MSG_EXP_GET(0xffffffffffffffff, 0x0, 0x24008040) setsockopt$MRT6_INIT(r3, 0x29, 0xc8, &(0x7f0000000340), 0x4) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000780)={0x6, 0x4, 0x0, &(0x7f00000005c0)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00}, 0x94) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, 0x0, 0x0) close(r3) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000280)={@ifindex, 0x16, 0x0, 0x401, &(0x7f0000000140)=[0x0, 0x0], 0x2, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=@newtfilter={0x3c, 0x2c, 0xd27, 0xffffffff, 0x25dfd9ff, {0x0, 0x0, 0x0, 0x0, {0x10, 0xffe0}, {}, {0x1c, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0xc, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8847}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20004081}, 0x40) socket$inet6(0xa, 0x80802, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(0xffffffffffffffff, &(0x7f0000002780)={0x0, 0x0, &(0x7f0000002740)={&(0x7f0000002400)={0x34, 0x0, 0x301, 0x0, 0x0, {0x17}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x34000804}, 0x0) bpf$BPF_LINK_CREATE(0x1c, 0x0, 0x0) ppoll(&(0x7f00000005c0), 0x0, 0x0, 0x0, 0x0) setsockopt$MRT6_FLUSH(r3, 0x29, 0xd4, &(0x7f0000000080)=0x6, 0x4) syz_emit_ethernet(0x36, &(0x7f00000000c0)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x40, 0x0, 0x1, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x2, 0x0, 0x0, 0x1}}}}}}, 0x0) syz_emit_ethernet(0x38, &(0x7f0000000580)={@local, @link_local, @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x0, 0x0, 0x2a, 0x0, 0x0, 0x0, 0x6, 0x0, @rand_addr=0x64010101, @local}, {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x6, 0x5, 0x4}, {"c516"}}}}}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@newqdisc={0x54, 0x10, 0x1, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, {0xffe0, 0xffe0}, {0xf}, {0xe}}, [@TCA_RATE={0x6, 0x5, {0x9, 0x1}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x491, 0x0, 0x0, 0x4, 0x8, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x80}, 0x4040c00) 2.500441097s ago: executing program 1 (id=2421): r0 = syz_usb_connect(0x0, 0x24, &(0x7f00000009c0)=ANY=[@ANYBLOB="120100007a982a08cd0ca310a223010203170902120001000000000904"], 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000880)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="40fc08"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 1.983297721s ago: executing program 4 (id=2422): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) openat$uhid(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fe9000/0x3000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) io_uring_setup(0x6356, &(0x7f0000000040)={0x0, 0xc8a5, 0xc000, 0x8, 0xc1}) 1.84293928s ago: executing program 5 (id=2423): lseek(0xffffffffffffffff, 0x7fff, 0x1) r0 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = socket$inet6(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f00000000c0)={'syztnl2\x00', &(0x7f0000000280)={'ip6_vti0\x00', 0x0, 0x4, 0x2, 0x3, 0x424, 0x5a, @mcast2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x8007, 0x180, 0x5}}) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80021}, 0xc, &(0x7f0000000380)={&(0x7f0000004d80)=ANY=[@ANYBLOB="901000002900100027bd7000fddbdf2500000000000000000000ffffac1e0001fe8000000000000000000000000000bb4e2100004e2000000a0080005c000000", @ANYRES32=r2, @ANYRES32=0x0, @ANYBLOB="b06b6e000100000008001d0006000000371001007368613531322d6e656f6e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000787f0000c27a56a3af0ee88304243b7abb8fbeed88214aed6285d0ec1be006764eaf417cf41ee8f4537d711b0b0bbad340e410f4413d7ce146812324a7e79779ff2388dbeec67efccf459cfa0312ccb52450d7cfa445c7b1ef32ba72cafd5e7d237e22008338621b9e82fe5f804774865b789c60334b1681718c2a1dc0e8a21ac115e66f20d20bece7704a6a393fea1dc4ed062ea7e1271464085c4bfde9acdb2a53119f1fb7e7b4eeb523d81f9ec12e5bf5e7e232b7b952ae54fef5ab8ea3f486e3206572fbdd16199c6dc9207581da5e8f4d955885c68ef32c37f905a0788888717529a842655e600c2db3322b78fe42799c9c110c6dc8e1500b18c24608442be4ebd1b7215fa5b776aa45d19ae289b0915ac208711abfe3b70abccbc1087ecc9b3676a5365b1a2d91eb102fccde2474881b6211f2eb57c7ea328e7a099683890d90b0c234e19fadac59b0430003e4f7ac898a34326c0c3c7343011130f54b37a3e667edc93d9b175379441ee69681af9a7bfee47da79117f8750b7379fc293e60d583215c4820ac82b18c6c8557c0bcf6cf49961731b33fb6b1213e535ec60b9bb1a4abe5140eca29fd4d728e1bbd4b27205aae2f5c4fc2c7bbeda0142b35b699fd429d7e267b3abd5f47942c1ba3af1f05e5470f90b7f277cbb55867b6eb4f02232ae00bcb802352a7f431781232ec6574f6ca4c2c5c78a6af806a03c12abc28971038f9e15adbaa104f70cb86e08df2d9667f0c629a95971f4e9f33bf1217d4c455e3975dc9929ef06e9327ab2fab34f80be88a3c9a162f9cd33e6538d1b9888405caa97a389c6e206c28fc4ed25fa7e1155bc9e7682c664571792e00beca5e0a4c058bd51c1a24f747254caab1daf6916e8838b79f20e73f9424245ce531f1176f1dcd72fb0e881380162e4c3d0d4e5517c19d3e8ea1cfa7587403ff56e445d1bd10151300f8dbb0b4330b088216e26b55ea72960441859cc74ad10b3f3c6d28a392114afbd2c1263b34159b87ae53fa318db400980865da20303746dcb8968f26b752fc77283ce205f542847bd95631ca0c07203088809ea4dedd543d85fd0593adb1001a129c7ece1f2c321c1fa30ac9c7f24c90aedaa0bcde13c00cc4ae584c615c237c3702603fc3200d1da2646a1ddaa92650f5c998f50f0caf33a0205ea14e4de99da644e2cefeb6647b4a5525951237725c89a786e2b3304179b64b799836ba6f9fdfd6ac160c5bb8b14f252013bd204ab9d424e1c3092ecb774c116c36a5e353e4300bf76f610349d16e4d542862082439e540178e89adb1d54a9efe174ba33ceb3afb7feb5977e8f6036dd006f07d214f743bdcc2e429574026fd4a581f270dad57bac9baade152bbdab76c0c203aa262f347cd9ab5313ed9e884d71b8dd5d5ac1abaf147a587f703d388df263de8053b2ed95d2158530990168afadcb02116ea5985cd1132fa9b9f64a557b4c30a01c3e2cd891fe34b61e8b61de6a848ee6d864d0e2234e8f9b6702cc9939f5cf21415f402b8b9a67a0c5d20c68f4b29a6294aa39dbec96e213f9c99151728ed7aa9614356c44dd1c0e120a3e1665d8ff4914d0699f6f7ae3911cf6c90b1f8a499550436fe244b49cc6ecf85137a03aa1be9dd58c49375eab55e77ac451d55c1e17d6a13ccde36d49ad40359f3521ed2dd40c0a805ad3f8bd77f117d2bb359e1330c69527f6df8195a35b2550eb9d592c5993b746b83020f8fda3136b76cd291d6c62e95974feddf0ac784acf1268ada9235b0eb07c8e4c8026e4c273e9b98b9cb64777bc213664ba4dedb49a546ef3b50e9fe17de8d912c61d6207281e0e44f46255770f64d18e23e39d70d8c49eac50e06d3840909be357ed30f3cb04e745d488675eb282f526c2fd66f06bcf04bf2586a3c51d608aefb2bf5e5b351919b5249d6b2ca42419da7c25fc4999ea9c5d9ee95bbfec225e47903dd01c4aeab2e50db844028a756d40a6e46d57dc5dd1255c8168c07973ee86b57e91133f03155add06cdfa7f0baa2819ae8ff980ae66ba2aa7f24aef69addec39151e597e8965564439ca672fe8616fcc51365cf7c4ea1450d3eb40fe967954d10b85d8762177f5dd7f6e60552e8d31da062743a3ee11b6e5bbf7398d06b0f129db35d101198992fecc1af1029552917ad8b9ea2655e73bf6b79f72faad6cde339be24919ab366c5c9f5d3af3a172ba83a1fc1dbcdaff0b5df47c1239b1fbf935f9138f7a9969246771fa1b52a3beef7358bb9313ccdc4a32f4a130dd6fd4d96433a9f8e6e22d33f7949815aff7610105bb0c70ae2e41bc69343037975374974262c36af1526dd0dab1778887e2082fdbec941eaa57f31cbd62d14f4adc3fcdc1de729f1164390569dd0a8fc051e46378b50ad7c33b5afbd71a0f7c65b928c4c0368214af33d3e64b0cc27a73446c9ece59b900bfdc1859e89240645e26969b819bbec70ef069846a550aea6449e045c2a19199527acb92dfbad832f3ca19428f51b36c60f8aff3334fcec318c3db4bc52c3528241fec66d3bf74209f422029118c55e59e80371b475f091edff3c7c614e6f1f002ee3dfc069813c9bef6b00195b5d8b4898f6cd6d28b891462279005c0baa604b60473fc5a185c01e3366bc05ebf80f92fab85a8aea96f634344ba79b8407c4e3ed61d7d1df6ab77a34024c2d8252d8e50927e88e1c0a42685af36b2d01a6f50b3db187bd6ae36809146178702eb28456d1eb43ba3334dfa7e9c486ea431e52f8f5c56926fa52fe0986e4d10595e695c695e8ea4d289e551be0261eb2385d020be750dc17c070a849f57bd707cd01d68abed2cf4dd28bae7ba323105e1561884a52145319af75da1284db5372fd4d582caa8279cfebe62c8ed964cb32b8eeabe53cc9b5a7258fdc55ef6b01461e485b3b1897630a09d27a40901b2ec7b47e94da9889588ee339f08b4594799d299be67117ae41b7b74f868f74c278a07bcf87ba29b455291c9c5161b1318bae1f68ba81e3f9772c9750a5f9735c7e69817aaa64f17e77b5f4d1c6911af22ee159a8995fa75437a1c7a319f1815fba764d442ea69509edb7d5ed3ded780a96cace4a9e9ea1d007fecd0c9882450368adfbe7e3b114968e62f45642b695375aca14e29cb11bc8f4e2607bbded8f97052cb65ce178baa1bf7d903c17ca53299a34ee7efc1732b45e773f48f9267a887995c10efc7bf9e0aea56ae7804c3f900f3e454f529e8de26ae0fa4871ef30db12ded3aab98bd25a3feb70e3bc782165b0deaada39af126b3e66635d3710aca947e6e1ae5458fcae25ec3e10285ca9f9c33883a0ef73d120dffdef81d0451949f0a3a633211e1dd0cc3d653a7ec33108eb7dcbb295974528e79a1608ddddaf75edee6161eb0c70aa66a323e96aaa1b75fd872eefc482787332fdb696cfc5dd87636d4068b8b83387149123044ef95c816905c3c88cc79d62671670772350568856a2653e85fee5e1a5b9849d2acbe9011944a5fb8aee797f216909fa9a76f24cd2eed1d9c68a12f3aad45d27e5e1efcbc4877f9f41eaa0932fdb87e29462cdce56abebd38a39d8ba61c96a97521d97e308a8485565ce673daae1ea4a8f7a00c68a524c98385853f7195543e851f8d401d0a8b569615f74bca76889c60facae3017e92bace610ffee82fee71b972c8c73b104e8b839033bcbebf867dc9bcb8fca57d89a1beb3188244a8f63c9a465207cccfde0fe5fdb9087a0b82381c94837fc4ba46c7797c250fac01d19f25ecd38a0cbfc26cc9d0393d3b460859e29fab53a4da205b3ca5d1bc1022637a712155a47148cf926d9d056853edbe0b993b3cbd531e4d55b82b68bf28b73b2c1e8d491d226660b2fb079f85d1e3d0a2a869e18676aaabf40608c6cf125164ac08ba569112e2c876b397dde4aa57277671967319a4201dbae45d6e49e5b05b8b5c01c6d648924e68a723c19e0b93ed5f3199720f090f4803c067a64e5909f382cf124a16b90af34e949541158e989c0f1c5e19fd92e9705a6d21bf1342a4794a19062c64875066827b418c55e65b247d03211b506197213d53422f3da6146eff828db6b9ef89d17fcaa7923e31534d7d5a8d530335b9098aa8a3235c073119beff9faade8cae67ea616aa3d9f61236a4102fb767097adaa7b1599a1b9cfe280adfad3f47862d152f5379b8debbee1b807fc3b6f5afacac02a34e7a122b294166f7cc4ccb7530d976ae2c7df638c917c809f884a7fb097c7f62c31245ef0422664d4921405ee899a83d2d8ff9ffedbbd0a96692ccc8e6e8530237cf4f2ebd876b66075f8aaa005da6875d3495ba4cb7cec1626a4c406ee637c89581dbf9a3dcbf0cef2983a4536f00b1a8ff9865eaa89d293f371744a6288fb636c47bc2d36a1b6e3b5ad54609e26479172af210fb23a39146e212ce460d9e2619cc33717c05999fdc9f4bdae51c779a39b509ebc4b917f622991f5e1452550450e704d38591d29de7ce710dc110a09f9fefeed390ce7ab8ca83ac5c1f68364c70698c09e484f017d9f7f27858055d38e41659db237bf1c797a9e4c410ced3e26bfcfc86b22ab6c7d1ca83c48ebb92005c57f51eae615efb7a4c1085bcf752f2d43b29f70a693db5dd829167be7546509b014d8cf85d0406f89cc51b7e44d54d0ee99f1b62682df1fe0b0415977955f0089f223cedc821a7a2c4b2a8f75615d1ef1c5c4cf578d55b0a808db2a120e23f671a53bfca468429ee759f2d50487509777811eaca97b15780d149fa0d1cdb27941b6fd3ea4adbb2e155fef664c4c7c2e76010a26b8780a5571c2aa51daeb5c1e7b7d7c75edc363311eca85b22e8dddf41880f13df478829413952295163e7ea4666759c7095ae31b6e5605b7e1b7dc15fb232924ddae880e52e0bfdc2a1e477d8c54fe72d628711332959899a96589f6822bc6d4922fe7f7e51996d968f997b75aa2d4fd33085441ad5003ccd18643523b95f27386c61fda659d9beeda658bd96ad313c2daf796d6c448c0b426627a0ebb79d4cb4033db1453f23f331ad974e06eda58e37e2e8f0a8f3bab0c19a1da46b1bcb4c7d53bfeef46e3ae3826d04414ee6552564be82cde0b27b972f2082a651ac0a57e13193ce4a2fd488c7f885a3987177ffa69a4018ea4d9930e2611f12f6e34a2c5a56b1e2116bffff530a4b24f67d1b5c593948e210a45d998b55764b43c3b17ba31ee9255c9590fcca239a86dedaedf9bc7c70c860597ef951e11a1eafc22949068c03e98c8b2c693ee39495ec52c32db6f16b2e62f7fd510a61c8fd430c37ccecc60164b07e033ea611309255710e8126601920189dafaec0ec94e9627a7eb3e1a6cd6d128ce3c14d6db80424118df0f5b2242b8053b5f92623f2c92622b615c01dc753655ebde4119f9e0cb64492c0c8a6cbd55b290433c10490034a037458b9eda9b9bb2bb8486c549a79fc613979addb4f3a3a04f3f6dad560d97d78dd5f8ea1735f5072193a0d76701ea79f3902b5e6378b6b104a53cd9c46948c388dd968d38c3f23ee6231a9385227b1191f37f47bfe54a7c414f75569db3a4153c911d42f9553629d57feb96e94de6596827bc12847d79bfcc3e044402d12fef0c4b7916ed4f099aa538c162c08ae391e951494e23ee53f8b82902d05a57cf6fcf42fb43696c34b8d9d1bffc022afb51bd395a823f9135159d9262784f1721a6485edc8af8a5b5a6bc60011a7d6db50d716ee498fd7845272e761dcca2f18b756a4dacbdd33095a8c50789b0b9acb8f760a00"], 0x1090}, 0x1, 0x0, 0x0, 0x20000000}, 0x28880) sched_setattr(0x0, &(0x7f0000000200)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa0f, 0xffffffff}, 0x0) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002d00)=ANY=[@ANYBLOB="200000001000010700000000000000000a0000000c0002006e6c3830323131"], 0x20}}, 0x800) recvmmsg(r3, &(0x7f0000004a00)=[{{&(0x7f0000000400)=@qipcrtr, 0x80, &(0x7f0000000240), 0x0, &(0x7f0000000600)=""/122, 0x7a}, 0x9}, {{&(0x7f0000000680)=@generic, 0x80, &(0x7f0000007f80)=[{&(0x7f0000000a40)=""/183, 0xb7}, {0x0}, {&(0x7f0000001040)=""/142, 0x8e}, {0x0}, {&(0x7f0000000700)=""/108, 0x6c}, {&(0x7f0000004c40)=""/4, 0x4}, {&(0x7f0000004c80)=""/223, 0xdf}, {&(0x7f0000007e40)=""/153, 0x99}, {0x0}, {&(0x7f0000007f40)}], 0xa, &(0x7f0000001200)=""/4096, 0x1000}, 0x6}, {{&(0x7f0000002200)=@in6={0xa, 0x0, 0x0, @private1}, 0x80, &(0x7f00000022c0)=[{&(0x7f0000000300)=""/16, 0x10}, {&(0x7f0000002280)=""/61, 0x3d}], 0x2, &(0x7f0000002300)=""/23, 0x17}, 0x80000001}, {{&(0x7f0000002340)=@tipc=@id, 0x80, 0x0}, 0xfffffffa}, {{&(0x7f00000025c0)=@nfc_llcp, 0x80, &(0x7f0000002680)=[{0x0}, {&(0x7f0000002d40)=""/4096, 0x1000}], 0x2, &(0x7f00000026c0)=""/122, 0x7a}, 0x800}, {{&(0x7f0000002740)=@phonet, 0x80, &(0x7f0000002b80)=[{&(0x7f00000027c0)=""/11, 0xb}, {&(0x7f0000002800)=""/134, 0x86}, {&(0x7f00000028c0)=""/96, 0x60}, {&(0x7f0000002940)=""/86, 0x56}, {&(0x7f0000002a00)=""/45, 0x2d}, {&(0x7f0000002a40)=""/145, 0x91}, {&(0x7f0000002b00)=""/71, 0x47}], 0x7, &(0x7f0000002c00)=""/31, 0x1f}, 0x7}, {{0x0, 0x0, &(0x7f00000040c0)=[{&(0x7f0000003dc0)=""/134, 0x86}, {&(0x7f0000003e80)=""/118, 0x76}, {&(0x7f0000003f00)=""/59, 0x3b}, {&(0x7f0000003f40)=""/76, 0x4c}, {&(0x7f0000003fc0)=""/49, 0x31}, {&(0x7f0000005e40)=""/4096, 0x1000}, {&(0x7f0000004000)=""/31, 0x1f}, {&(0x7f0000004040)=""/103, 0x67}], 0x8}, 0x3d5f}, {{&(0x7f0000004180)=@hci, 0x80, &(0x7f0000004480)=[{&(0x7f0000006e40)=""/4096, 0x1000}, {&(0x7f0000004200)=""/131, 0x83}, {&(0x7f00000042c0)=""/223, 0xdf}, {&(0x7f00000043c0)=""/48, 0x30}, {&(0x7f0000004400)=""/74, 0x4a}], 0x5, &(0x7f0000004500)=""/250, 0xfa}, 0x5}, {{&(0x7f0000004600)=@in6={0xa, 0x0, 0x0, @ipv4={""/10, ""/2, @loopback}}, 0x80, &(0x7f0000004940)=[{&(0x7f0000004680)=""/64, 0x40}, {&(0x7f00000046c0)=""/124, 0x7c}, {&(0x7f0000004740)=""/26, 0x1a}, {&(0x7f0000004780)=""/239, 0xef}, {&(0x7f0000004880)=""/185, 0xb9}], 0x5, &(0x7f00000049c0)=""/29, 0x1d}, 0x7}], 0x9, 0x40012100, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x1e, &(0x7f0000000b40)=ANY=[@ANYBLOB="181100003526c0ef9970b54c705181afaaad30af23a13a489576322cf4bc4950a2045cbe749a8f6f9a60d1383a626d5eac155972d8f7201270188c53454f4fa0ea2d567e62fc43f28954bac93ac2df328d98400fa592457654f4d72e7821cf5ccbfae36a20690c45df97c71b950ad7db41310bf006fe8b4c134246c11cb10d24a8bed3e1eb5131216157ffb3462e7b50ea16610482905c7abcd1a39e7a366b0d9b11b6b629d28402cd3ed01a0d9c2514a1a654119aa8f00206863fd9fc561243cfcaa2d85b9b4aa474379cb51b2b399b89512f8085a0b3bfa980dbe659b9f95bda27bc10db4614ab40da9eb6e98fdcc31feaf376f2709c0ada342e768b7c4e519a8db207f0d7f929d2f0e7dd6257dec2815b5c178d7523434eaaee4f30a4461f78cccd669dd60e4290102d7042ada1069d348667ed3e3a14006634032c437814f0ef965668b2bff9a8c73005f517ad0c95ae54ad15cbfc549172e7efe57aa3ed51add85d9f20", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000000000000850000008600000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000001865000001000000000000002d07000018590000030000000000000000000000180100002020732500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000da9400008500"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) sendto$inet6(r1, &(0x7f0000000180)="900000001d001f4d154a817393278bff0a80a578020000000404840014000100ac1414bb0542d6401051a2d708f37ac8da1a297e0099c5ac0000c5b068d0bf46d323456536016466fcb78dcaaf6c3efed495a46215be0000766436c0c80cefd28581d158ba86c9d2896c6d3bca2d0000000b0015009e49a6560641263da4de", 0x7f, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r4, &(0x7f0000000100)={0xa, 0xa9d, 0x3, @mcast1}, 0x1c) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000008000000000000000"], 0x48) syz_io_uring_setup(0x49a, &(0x7f00000000c0)={0x0, 0xfd9d, 0x20000, 0x40801c, 0x40024f, 0x0, r0}, &(0x7f0000000180), 0x0) 0s ago: executing program 4 (id=2424): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x1000410, &(0x7f0000000100)={[], [{@fsuuid={'fsuuid', 0x3d, {[0x61, 0x33, 0x31, 0x33, 0x39, 0x38, 0x65, 0x33], 0x2d, [0x31, 0x35, 0x0, 0x62], 0x2d, [0x31, 0x64, 0xa6, 0x62], 0x2d, [0x33, 0x31, 0x31, 0x33], 0x2d, [0x64, 0x65, 0x62, 0x31, 0x65, 0x38, 0x54, 0x39]}}}, {@fowner_gt={'fowner>', 0xee01}}, {@appraise_type}, {@dont_appraise}, {@euid_gt}, {@context={'context', 0x3d, 'unconfined_u'}}, {@func={'func', 0x3d, 'MMAP_CHECK'}}, {@obj_user}, {@fowner_eq={'fowner', 0x3d, 0xee00}}]}, 0x4, 0x50f, &(0x7f0000000940)="$eJzs3c9PXFsdAPDvnTLA4w2PPn0LNeqrz6fVNB1+9JU0dWG70ZimibFx5aJFmBLCTAcZqAW7oEv3JjZxpX+COxNNunLhzp3u3NSFSa2Nppi4GHPv3MLwYwq8AlOYzye53HvOufR7DtNzztzDjxNAzzoXEWsR0R8RdyJiJM9P8iOutY70vpcvHk6vv3g4nUSzeet5kpWnedH2Oal3839zMCJ+8N2IHyc74zZWVuenqtXKYp4eXaotjDZWVi/OFfKcicnxybErly5PHLxRzdy27A9rv332nbkbP/zD77709M9r3/xZWq3Sz4ezsvZ2HKZW04tRasvri4gbRxGsS/ry/z+cPGlv+0xEfJT1/5E4k72aAMBp1myORHOkPQ0AnHbp838pkkI5XwsoRaFQLrfW8D6IoUK13li6MFJfvjcT2RrW2SgW7s5VK2P5WuHZKCZpejy73kxPbEtfioj3I+IXA+9k6fJ0vTrTzTc+ANDD3t02//9noDX/AwCn3OAB7/cjAgBw8h10/gcATj7zPwD0ngPM/5b+AeCU8PwPAL3H/A8AvWfP+f/R8dQDADgW3795Mz2a6/nfv565v7L8rdL9izOVxny5tjxdnq4vLpRn6/XZaqU8veNPau9QrdcXxj/ZSDZWVm/X6sv3lm7P1aZmK7crxeEjbhAAsKf3P3zy1yQi1q6+kx3RtpdDsas1A45aodsVALrmTLcrAHSN3+eB3rWPZ3zLAHDK7bJF7xYdf0Tosc1f4aQ6//ls/f/5Wlue9X/oDdb/oXd9uvX/bx96PYDjZ/0felezmdjzHwB6jDV+4I2+/w8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA9qpQdSaGc7QW+ln4slMsRwxFxNorJ3blqZSwi3ouIvwwUB9L0eLcrDQC8ocI/knz/r/MjH5e2l/Yn/x3IzhHx01/d+uWDqaWlxfE0/18b+UuP8/yJ/m40AABod21nVmuezs9tD/IvXzycfnUcZxWfXW9tLprGXc+PVklf/D6/pxgRQ/9Ooq/t89L3K2cOIf7ao4j43Gb7H7RFKGVrIK2dT7fHT2MPH0H8za//9viFLfELWVl6LmZfi88eQl2g1zy53hon876XdrG8/xXiXHbevf8PZiPUm3s1/q3vGP9e9ffBbKzZGj/J+vy5jfTra/Lskz9+b0dmc6RV9ijiC327xU824icdxt+P99nGv33xyx91Kmv+OuJ87B6/pZYNs6NLtYXRxsrqxbna1GxltnJvYmJyfHLsyqXLE6PZGnXr4592i/HPqxfe25qzuZt12v6hDvEH92j/1/bZ/t/8786PvtKhLI3/ja/u/vp/8Jr46Zz49X3Gnxq61nH77jT+TIf27/X6X9gj7vJPWuenf1+d2WdVAYBj0FhZnZ+qViuLe1yk7zX3usfFybyItYi3oBr5RX+8FdXo+Ytuj0zAUdvs9N2uCQAAAAAAAAAAAAAA0EljZXV+II7214m63UYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABOr/8HAAD//2b+15Y=") r0 = creat(&(0x7f0000000000)='./file1\x00', 0x4) fcntl$setstatus(r0, 0x4, 0x6000) r1 = getpgrp(0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000000)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = syz_open_dev$usbfs(0x0, 0x1ff, 0xa401) ioctl$USBDEVFS_CONTROL(r5, 0xc0185500, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) truncate(&(0x7f0000000900)='./file1\x00', 0xb73d) writev(0xffffffffffffffff, 0x0, 0x0) io_setup(0x202, &(0x7f0000000200)) r6 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x121042, 0x115) inotify_init() write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000780)=ANY=[@ANYBLOB="15ec3dbe65ffff0600000008003950"], 0x15) splice(0xffffffffffffffff, 0x0, r6, 0x0, 0x50f5d137, 0xd) kernel console output (not intermixed with test programs): 7ef, idProduct=7203, bcdDevice=2e.36 [ 837.121514][ T5916] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 837.171645][ T5916] usb 3-1: Product: syz [ 837.205502][ T5916] usb 3-1: Manufacturer: syz [ 837.210154][ T5916] usb 3-1: SerialNumber: syz [ 837.247772][ T5916] usb 3-1: config 0 descriptor?? [ 837.275709][T12226] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 837.511393][T12224] raw-gadget.1 gadget.2: fail, usb_ep_enable returned -22 [ 837.716981][T10090] usb 4-1: selecting invalid altsetting 0 [ 837.724462][ T5916] asix 3-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 837.740958][T10090] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 837.765737][T10090] uvcvideo 4-1:220.0: No valid video chain found. [ 837.794895][T10090] usb 4-1: selecting invalid altsetting 0 [ 837.819557][T10090] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 837.821418][ T5916] asix 3-1:0.188: probe with driver asix failed with error -61 [ 837.895751][T10090] usb 4-1: USB disconnect, device number 16 [ 837.961107][T12233] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1543'. [ 838.128338][T12233] netlink: 40 bytes leftover after parsing attributes in process `syz.3.1543'. [ 839.111025][ T5916] usb 3-1: USB disconnect, device number 16 [ 839.290229][T12240] netlink: 'syz.2.1545': attribute type 1 has an invalid length. [ 839.545675][T12242] bond5: (slave vxcan3): The slave device specified does not support setting the MAC address [ 839.581720][T12242] bond5: (slave vxcan3): Error -95 calling set_mac_address [ 839.675921][T12249] random: crng reseeded on system resumption [ 839.770753][T10498] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 839.823881][T12240] macvlan2: entered promiscuous mode [ 839.840818][T12240] macvlan2: entered allmulticast mode [ 839.859044][T12240] bond5: entered promiscuous mode [ 839.876097][T12240] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 839.903075][T12240] bond5: left promiscuous mode [ 839.918105][ T30] audit: type=1804 audit(1769915374.491:383): pid=12253 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.1548" name="file0" dev="ramfs" ino=28914 res=1 errno=0 [ 839.950295][T10498] usb 6-1: Using ep0 maxpacket: 8 [ 839.982432][T10498] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8D has an invalid bInterval 42, changing to 9 [ 840.006394][T10498] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 840.019231][T10498] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 840.032717][T10498] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8B has invalid maxpacket 12592, setting to 1024 [ 840.047503][T10498] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 1024 [ 840.062056][T10498] usb 6-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 840.074087][T10498] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 840.097720][T10498] usb 6-1: config 0 descriptor?? [ 840.106847][T12244] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 840.539672][T12255] netlink: 44 bytes leftover after parsing attributes in process `syz.4.1549'. [ 840.557201][T10081] usb 6-1: USB disconnect, device number 10 [ 840.584665][ T5847] Bluetooth: hci6: Opcode 0x0c03 failed: -71 [ 840.676022][T12255] netlink: 200 bytes leftover after parsing attributes in process `syz.4.1549'. [ 841.274968][T12270] random: crng reseeded on system resumption [ 841.589500][T12275] netlink: 'syz.0.1556': attribute type 1 has an invalid length. [ 842.078498][T12282] bond10: (slave vxcan3): The slave device specified does not support setting the MAC address [ 842.091411][T12282] bond10: (slave vxcan3): Error -95 calling set_mac_address [ 842.120479][ T5916] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 842.485477][ T5916] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 842.544128][ T5916] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 842.808876][T12284] macvlan3: entered promiscuous mode [ 842.878509][T12288] overlayfs: failed to clone upperpath [ 843.383476][ T5916] usb 6-1: config 220 has no interface number 2 [ 843.403741][T12284] macvlan3: entered allmulticast mode [ 843.417803][T12284] bond10: entered promiscuous mode [ 843.423397][ T5916] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 843.595625][ T5916] usb 6-1: config 220 interface 0 has no altsetting 0 [ 843.606550][ T5916] usb 6-1: config 220 interface 76 has no altsetting 0 [ 843.628962][T12284] 8021q: adding VLAN 0 to HW filter on device macvlan3 [ 843.698960][ T5916] usb 6-1: config 220 interface 1 has no altsetting 0 [ 843.726052][T12284] bond10: left promiscuous mode [ 843.740731][ T5916] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 844.008224][ T5916] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 844.210500][ T5916] usb 6-1: Product: syz [ 844.214739][ T5916] usb 6-1: Manufacturer: syz [ 844.219348][ T5916] usb 6-1: SerialNumber: syz [ 844.348602][T12294] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1558'. [ 846.715471][T12315] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1563'. [ 846.724653][T12315] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1563'. [ 846.833391][T12315] syz_tun: entered promiscuous mode [ 846.898803][T12315] syz_tun: left promiscuous mode [ 847.071818][T10081] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 847.265922][ T30] audit: type=1804 audit(1769915381.841:384): pid=12326 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.1567" name="file0" dev="ramfs" ino=28107 res=1 errno=0 [ 847.300606][T10081] usb 3-1: Using ep0 maxpacket: 32 [ 847.322042][T10081] usb 3-1: config 0 has an invalid interface number: 184 but max is 0 [ 847.344220][T10081] usb 3-1: config 0 has no interface number 0 [ 847.423894][T10081] usb 3-1: config 0 interface 184 has no altsetting 0 [ 847.571756][T10081] usb 3-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 847.585761][T10081] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 847.597324][T10081] usb 3-1: Product: syz [ 847.602046][ T5916] usb 6-1: selecting invalid altsetting 0 [ 847.609282][T10081] usb 3-1: Manufacturer: syz [ 847.614786][ T5916] uvcvideo 6-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 847.628863][T10081] usb 3-1: SerialNumber: syz [ 847.634073][ T5916] uvcvideo 6-1:220.0: No valid video chain found. [ 847.643863][T10081] usb 3-1: config 0 descriptor?? [ 847.662702][T10081] smsc75xx v1.0.0 [ 847.674347][ T5916] usb 6-1: selecting invalid altsetting 0 [ 847.684823][ T5916] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 847.767391][ T5916] usb 6-1: USB disconnect, device number 11 [ 848.484641][T10081] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 848.580513][T10081] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 848.960577][T10115] usb 5-1: new full-speed USB device number 13 using dummy_hcd [ 849.136669][T10115] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 849.158640][T10115] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 849.227794][T10115] usb 5-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 849.260661][T10115] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 849.312196][T10115] usb 5-1: config 0 descriptor?? [ 849.385929][T12351] random: crng reseeded on system resumption [ 849.615391][T12340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 849.676261][T12340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 849.769135][T12340] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1572'. [ 849.826029][T10115] usbhid 5-1:0.0: can't add hid device: -71 [ 849.848621][T10115] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 849.976136][T10115] usb 5-1: USB disconnect, device number 13 [ 850.863615][T10081] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -32 [ 850.893272][T10081] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -32 [ 850.912743][T10081] smsc75xx 3-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -32 [ 851.660704][T10081] smsc75xx 3-1:0.184: probe with driver smsc75xx failed with error -32 [ 851.821012][T10081] usb 3-1: USB disconnect, device number 17 [ 852.236810][T12371] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1580'. [ 853.978507][T12390] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1586'. [ 854.091704][T12390] netlink: 16 bytes leftover after parsing attributes in process `syz.4.1586'. [ 854.283928][T12390] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1586'. [ 854.424639][T12390] netlink: 'syz.4.1586': attribute type 10 has an invalid length. [ 854.590739][T12392] netlink: 'syz.4.1586': attribute type 10 has an invalid length. [ 854.745300][T12390] team0: Failed to send options change via netlink (err -105) [ 854.796254][T12390] team0: Port device dummy0 added [ 854.827764][T12392] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 854.962304][T12392] team0: Failed to send options change via netlink (err -105) [ 855.012500][T12392] team0: Failed to send port change of device dummy0 via netlink (err -105) [ 855.070539][T12392] team0: Port device dummy0 removed [ 855.160110][T12392] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 858.700491][T10110] usb 4-1: new high-speed USB device number 17 using dummy_hcd [ 858.922419][T10110] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 858.950518][T10110] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 859.010772][T10110] usb 4-1: config 220 has no interface number 2 [ 859.032732][T10110] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 859.082224][T10110] usb 4-1: config 220 interface 0 has no altsetting 0 [ 859.123125][T10110] usb 4-1: config 220 interface 76 has no altsetting 0 [ 859.146251][T10110] usb 4-1: config 220 interface 1 has no altsetting 0 [ 859.202347][T10110] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 859.255702][T10110] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 859.320189][T10110] usb 4-1: Product: syz [ 859.336535][T10110] usb 4-1: Manufacturer: syz [ 859.361231][T10110] usb 4-1: SerialNumber: syz [ 859.551933][T12441] bridge0: port 2(bridge_slave_1) entered disabled state [ 859.561168][T12441] bridge0: port 1(bridge_slave_0) entered disabled state [ 860.748726][T12441] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 860.834323][T12441] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 861.177119][T12448] Cannot find add_set index 0 as target [ 862.077874][T10110] usb 4-1: selecting invalid altsetting 0 [ 862.109316][T10110] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 862.155973][T12443] team0 (unregistering): Port device team_slave_0 removed [ 862.190470][T10110] uvcvideo 4-1:220.0: No valid video chain found. [ 862.241863][T10110] usb 4-1: selecting invalid altsetting 0 [ 862.288493][T10110] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 862.318270][T12443] team0 (unregistering): Port device team_slave_1 removed [ 862.380187][T10110] usb 4-1: USB disconnect, device number 17 [ 862.396390][T12461] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1602'. [ 862.471384][ T1032] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 862.480503][T12461] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1602'. [ 862.491091][T12449] netdevsim netdevsim0: Direct firmware load for / [ 862.491091][T12449] failed with error -2 [ 862.941149][ T6792] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.000656][ T6792] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.033047][T12449] netdevsim netdevsim0: Falling back to sysfs fallback for: / [ 863.033047][T12449] [ 863.190510][ T5930] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 863.394756][ T5930] usb 3-1: config 220 has an invalid interface number: 76 but max is 2 [ 863.403520][ T5930] usb 3-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 863.422399][ T1032] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 863.458920][ T5930] usb 3-1: config 220 has no interface number 2 [ 863.620753][ T5930] usb 3-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 863.646211][T12474] random: crng reseeded on system resumption [ 863.730218][ T5930] usb 3-1: config 220 interface 0 has no altsetting 0 [ 863.759768][ T5930] usb 3-1: config 220 interface 76 has no altsetting 0 [ 863.853495][ T5930] usb 3-1: config 220 interface 1 has no altsetting 0 [ 863.933098][ T5930] usb 3-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 863.963101][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 863.995882][ T5930] usb 3-1: Product: syz [ 864.015134][ T5930] usb 3-1: Manufacturer: syz [ 864.051020][ T5930] usb 3-1: SerialNumber: syz [ 864.780573][ T30] audit: type=1326 audit(1769915399.241:385): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 864.983966][ T30] audit: type=1326 audit(1769915399.251:386): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.162144][ T30] audit: type=1326 audit(1769915399.251:387): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.324857][ T30] audit: type=1326 audit(1769915399.251:388): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.417829][ T30] audit: type=1326 audit(1769915399.251:389): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.499950][ T30] audit: type=1326 audit(1769915399.251:390): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.685526][ T30] audit: type=1326 audit(1769915399.271:391): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.793865][ T30] audit: type=1326 audit(1769915399.271:392): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 865.902846][ T30] audit: type=1326 audit(1769915399.381:393): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 866.030522][ T30] audit: type=1326 audit(1769915399.421:394): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12481 comm="syz.5.1610" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8abc99aeb9 code=0x7ffc0000 [ 866.621698][ T5930] usb 3-1: selecting invalid altsetting 0 [ 866.710530][ T5930] uvcvideo 3-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 866.717884][ T5930] uvcvideo 3-1:220.0: No valid video chain found. [ 866.835637][ T5930] usb 3-1: selecting invalid altsetting 0 [ 866.870539][ T5930] usbtest 3-1:220.1: probe with driver usbtest failed with error -22 [ 867.029341][ T5930] usb 3-1: USB disconnect, device number 18 [ 869.374296][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 869.392803][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.108860][T12529] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1624'. [ 871.181726][T12529] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1624'. [ 871.240751][T12529] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1624'. [ 871.315869][T12528] netlink: 'syz.5.1624': attribute type 10 has an invalid length. [ 871.411028][T12528] netlink: 'syz.5.1624': attribute type 10 has an invalid length. [ 871.763416][T12528] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 872.386859][T12545] netdevsim netdevsim3: Direct firmware load for / [ 872.386859][T12545] failed with error -2 [ 872.407761][ T30] kauditd_printk_skb: 1 callbacks suppressed [ 872.407780][ T30] audit: type=1326 audit(1769915406.961:396): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 872.556989][ T30] audit: type=1326 audit(1769915406.961:397): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 872.780832][T12545] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 872.780832][T12545] [ 872.830575][ T30] audit: type=1326 audit(1769915406.961:398): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.021813][ T30] audit: type=1326 audit(1769915406.961:399): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.098475][ T30] audit: type=1326 audit(1769915407.091:400): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.598619][ T30] audit: type=1326 audit(1769915407.091:401): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.650922][ T30] audit: type=1326 audit(1769915407.091:402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.691563][ T30] audit: type=1326 audit(1769915407.091:403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.721112][ T30] audit: type=1326 audit(1769915407.091:404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 873.749049][ T30] audit: type=1326 audit(1769915407.091:405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12540 comm="syz.2.1627" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 874.340613][T12556] geneve2: entered promiscuous mode [ 874.369582][ T60] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.378542][ T60] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.396737][ T60] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.418608][ T60] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 874.623676][T12557] random: crng reseeded on system resumption [ 877.802689][T12593] netlink: 88 bytes leftover after parsing attributes in process `syz.4.1643'. [ 877.920494][T10076] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 878.074919][T10076] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 878.088152][T10076] usb 3-1: config 0 has no interface number 0 [ 878.150797][T10076] usb 3-1: config 0 interface 122 has no altsetting 0 [ 878.223177][T10076] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 878.250915][T10076] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 878.472870][T10076] usb 3-1: Product: syz [ 878.495407][T10076] usb 3-1: Manufacturer: syz [ 878.520062][T10076] usb 3-1: SerialNumber: syz [ 878.550068][T10076] usb 3-1: config 0 descriptor?? [ 879.739379][ T48] usb 3-1: USB disconnect, device number 19 [ 879.769758][ T48] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 880.176664][T12614] Cannot find add_set index 0 as target [ 880.295049][T12611] netdevsim netdevsim3: Direct firmware load for / [ 880.295049][T12611] failed with error -2 [ 881.678764][T12611] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 881.678764][T12611] [ 882.491961][T12628] random: crng reseeded on system resumption [ 885.058950][T12657] bridge0: port 2(bridge_slave_1) entered disabled state [ 885.067920][T12657] bridge0: port 1(bridge_slave_0) entered disabled state [ 885.452642][T12657] tipc: Resetting bearer [ 885.476958][T12657] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 885.489942][T12657] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 886.363978][ T3552] netdevsim netdevsim4 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.407463][ T3552] netdevsim netdevsim4 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.440929][ T3552] netdevsim netdevsim4 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.480453][ T3552] netdevsim netdevsim4 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 886.603515][T12673] SET target dimension over the limit! [ 886.612345][T12673] netdevsim netdevsim5: Direct firmware load for / [ 886.612345][T12673] failed with error -2 [ 886.623000][T12673] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 886.623000][T12673] [ 888.186040][T12674] team0 (unregistering): Port device team_slave_0 removed [ 888.231621][T12674] team0 (unregistering): Port device team_slave_1 removed [ 889.330471][T10076] usb 5-1: new high-speed USB device number 14 using dummy_hcd [ 889.640569][T10076] usb 5-1: Using ep0 maxpacket: 32 [ 889.684030][T10076] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 889.720505][T10076] usb 5-1: config 0 has no interface number 0 [ 889.744071][T10076] usb 5-1: config 0 interface 184 has no altsetting 0 [ 889.773440][T10076] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 889.810454][T10076] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 889.822992][T10076] usb 5-1: Product: syz [ 889.850909][T10076] usb 5-1: Manufacturer: syz [ 889.857420][T10076] usb 5-1: SerialNumber: syz [ 889.894896][T10076] usb 5-1: config 0 descriptor?? [ 889.937029][T10076] smsc75xx v1.0.0 [ 890.531004][T10076] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 890.564449][T10076] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 890.679967][T12703] veth3: entered promiscuous mode [ 891.023293][T12706] erspan0: entered allmulticast mode [ 891.267623][T10076] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 891.323534][T10076] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 891.500400][T10076] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 891.653679][T10076] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -61 [ 891.762584][T12714] Cannot find add_set index 0 as target [ 891.769233][T12714] netdevsim netdevsim3: Direct firmware load for / [ 891.769233][T12714] failed with error -2 [ 891.780555][T12714] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 891.780555][T12714] [ 892.759702][ T5903] usb 5-1: USB disconnect, device number 14 [ 892.930736][ T48] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 893.140596][ T48] usb 6-1: Using ep0 maxpacket: 32 [ 893.160830][ T48] usb 6-1: config 0 has an invalid interface number: 188 but max is 0 [ 893.210393][ T48] usb 6-1: config 0 has no interface number 0 [ 893.216542][ T48] usb 6-1: config 0 interface 188 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 32 [ 893.317075][ T48] usb 6-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 893.339478][ T48] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 893.374261][ T48] usb 6-1: Product: syz [ 893.378445][ T48] usb 6-1: Manufacturer: syz [ 893.430465][ T48] usb 6-1: SerialNumber: syz [ 893.518221][ T48] usb 6-1: config 0 descriptor?? [ 893.550698][T12721] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 893.791278][T12718] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 893.947786][T12735] netlink: 'syz.0.1680': attribute type 4 has an invalid length. [ 894.725160][ T48] asix 6-1:0.188 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -61 [ 894.751134][ T48] asix 6-1:0.188: probe with driver asix failed with error -61 [ 896.033687][T10498] usb 6-1: USB disconnect, device number 12 [ 897.136958][T12758] random: crng reseeded on system resumption [ 901.560643][T12786] xt_hashlimit: size too large, truncated to 1048576 [ 902.708356][T12796] xt_hashlimit: size too large, truncated to 1048576 [ 905.587287][T12830] random: crng reseeded on system resumption [ 905.787192][T12824] veth3: entered promiscuous mode [ 905.901281][T12827] erspan0: entered allmulticast mode [ 906.168062][T12834] random: crng reseeded on system resumption [ 906.731992][T12838] loop5: detected capacity change from 0 to 512 [ 906.762622][T12838] EXT4-fs: inline encryption not supported [ 906.807824][T12838] EXT4-fs: Warning: mounting with data=journal disables delayed allocation, dioread_nolock, O_DIRECT and fast_commit support! [ 906.993152][T12838] EXT4-fs (loop5): 1 orphan inode deleted [ 907.019798][ T60] __quota_error: 33 callbacks suppressed [ 907.019816][ T60] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 907.042700][T12838] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 907.100459][T12838] ext4 filesystem being mounted at /285/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 907.150122][ T60] EXT4-fs error (device loop5): ext4_release_dquot:7022: comm kworker/u8:4: Failed to release dquot type 1 [ 907.431806][ T30] audit: type=1800 audit(1769915441.851:439): pid=12838 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1708" name="bus" dev="loop5" ino=16 res=0 errno=0 [ 908.272773][T12846] netlink: 20 bytes leftover after parsing attributes in process `syz.1.1710'. [ 908.276132][ T5827] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 909.566657][T12856] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1714'. [ 909.642182][T12856] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1714'. [ 909.860250][T12856] syz_tun: entered promiscuous mode [ 909.913211][T12856] syz_tun: left promiscuous mode [ 911.003363][T12870] xt_hashlimit: size too large, truncated to 1048576 [ 912.731478][T12885] netlink: 84 bytes leftover after parsing attributes in process `syz.3.1721'. [ 912.771990][T12885] netlink: 'syz.3.1721': attribute type 1 has an invalid length. [ 913.272609][T12895] netlink: 20 bytes leftover after parsing attributes in process `syz.2.1725'. [ 914.941769][T12906] netlink: 'syz.2.1728': attribute type 1 has an invalid length. [ 915.122857][T12912] bond6: (slave vxcan3): The slave device specified does not support setting the MAC address [ 915.356454][T12912] bond6: (slave vxcan3): Error -95 calling set_mac_address [ 915.587050][T12914] macvlan2: entered promiscuous mode [ 915.606935][T12914] macvlan2: entered allmulticast mode [ 915.628814][T12914] bond6: entered promiscuous mode [ 915.649883][T12914] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 915.674316][T12914] bond6: left promiscuous mode [ 916.152786][T12927] netlink: 'syz.3.1732': attribute type 1 has an invalid length. [ 916.308989][T12929] bond10: (slave vxcan5): The slave device specified does not support setting the MAC address [ 916.331523][T12929] bond10: (slave vxcan5): Error -95 calling set_mac_address [ 916.358964][T12927] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1732'. [ 916.602004][T12927] macvlan4: entered promiscuous mode [ 916.639169][T12927] macvlan4: entered allmulticast mode [ 916.651384][T12927] bond10: entered promiscuous mode [ 916.661305][T12927] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 916.678899][T12927] bond10: left promiscuous mode [ 917.877037][T12953] loop3: detected capacity change from 0 to 512 [ 917.924073][T12953] EXT4-fs: inline encryption not supported [ 918.120862][T12953] EXT4-fs (loop3): 1 orphan inode deleted [ 918.151811][T12953] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 918.164842][ T3552] Quota error (device loop3): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 918.180469][ T3552] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:9: Failed to release dquot type 1 [ 918.212324][T12953] ext4 filesystem being mounted at /276/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 918.306338][ T30] audit: type=1800 audit(1769915452.881:440): pid=12953 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1739" name="bus" dev="loop3" ino=16 res=0 errno=0 [ 920.388964][ T5836] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 921.427066][T12980] loop5: detected capacity change from 0 to 512 [ 921.487024][T12980] EXT4-fs: inline encryption not supported [ 921.671941][T12980] EXT4-fs (loop5): 1 orphan inode deleted [ 921.690783][ T60] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 921.703268][T12980] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 921.780487][ T60] EXT4-fs error (device loop5): ext4_release_dquot:7022: comm kworker/u8:4: Failed to release dquot type 1 [ 921.822992][T12980] ext4 filesystem being mounted at /288/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 922.100781][ T30] audit: type=1800 audit(1769915456.471:441): pid=12980 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1744" name="bus" dev="loop5" ino=16 res=0 errno=0 [ 922.790512][T10111] usb 4-1: new high-speed USB device number 18 using dummy_hcd [ 923.014047][ T5827] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 923.030644][T10111] usb 4-1: Using ep0 maxpacket: 32 [ 923.130745][T10111] usb 4-1: config 0 has an invalid interface number: 184 but max is 0 [ 923.180867][T10111] usb 4-1: config 0 has no interface number 0 [ 923.188222][T10111] usb 4-1: config 0 interface 184 has no altsetting 0 [ 923.286229][T10111] usb 4-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 923.316340][T10111] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 923.360031][T10111] usb 4-1: Product: syz [ 923.369113][T10111] usb 4-1: Manufacturer: syz [ 923.385805][T10111] usb 4-1: SerialNumber: syz [ 923.416708][T10111] usb 4-1: config 0 descriptor?? [ 923.434448][T10111] smsc75xx v1.0.0 [ 924.592414][T10111] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 924.603706][T10111] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 925.654781][T10111] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -61 [ 925.665774][T10111] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -61 [ 925.675775][T10111] smsc75xx 4-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 925.700489][T10111] smsc75xx 4-1:0.184: probe with driver smsc75xx failed with error -61 [ 926.838483][ T48] usb 4-1: USB disconnect, device number 18 [ 927.297214][T13029] lo speed is unknown, defaulting to 1000 [ 928.727366][T13042] Cannot find add_set index 0 as target [ 928.737826][T13042] netdevsim netdevsim3: Direct firmware load for / [ 928.737826][T13042] failed with error -2 [ 928.748526][T13042] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 928.748526][T13042] [ 930.815561][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 930.822493][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 931.259606][T13065] random: crng reseeded on system resumption [ 932.594357][T13078] netlink: 'syz.3.1767': attribute type 1 has an invalid length. [ 932.860038][T13080] netlink: 28 bytes leftover after parsing attributes in process `syz.3.1767'. [ 932.877714][T13078] bond11: (slave vxcan5): The slave device specified does not support setting the MAC address [ 932.941792][T13078] bond11: (slave vxcan5): Error -95 calling set_mac_address [ 934.568697][T13091] macvlan4: entered promiscuous mode [ 935.183956][T13091] macvlan4: entered allmulticast mode [ 935.205246][T13091] bond11: entered promiscuous mode [ 935.251465][T13091] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 935.274092][T13091] bond11: left promiscuous mode [ 935.364333][T13102] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1772'. [ 935.374791][T13102] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1772'. [ 935.408227][T13102] ip6gretap0: entered promiscuous mode [ 935.415151][T13102] syz_tun: entered promiscuous mode [ 935.522312][T13102] debugfs: 'hsr1' already exists in 'hsr' [ 935.551432][T13102] Cannot create hsr debugfs directory [ 935.556970][T13102] hsr1: Slave A (ip6gretap0) is not up; please bring it up to get a fully working HSR network [ 935.610493][T13102] hsr1: Slave B (syz_tun) is not up; please bring it up to get a fully working HSR network [ 936.115387][T13110] netlink: 'syz.1.1774': attribute type 4 has an invalid length. [ 936.873609][T13114] loop4: detected capacity change from 0 to 512 [ 936.908706][T13114] EXT4-fs: inline encryption not supported [ 937.157978][T13114] EXT4-fs (loop4): 1 orphan inode deleted [ 937.171109][ T6793] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 937.226107][T13114] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 937.254007][ T6793] EXT4-fs error (device loop4): ext4_release_dquot:7022: comm kworker/u8:14: Failed to release dquot type 1 [ 937.280986][T13114] ext4 filesystem being mounted at /325/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 937.672672][ T30] audit: type=1800 audit(1769915472.031:442): pid=13114 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1776" name="bus" dev="loop4" ino=18 res=0 errno=0 [ 938.471112][ T5831] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 939.857905][T13146] random: crng reseeded on system resumption [ 943.304296][T13182] netlink: 'syz.5.1793': attribute type 4 has an invalid length. [ 945.583845][T10498] usb 1-1: new full-speed USB device number 16 using dummy_hcd [ 945.740451][ T48] usb 5-1: new high-speed USB device number 15 using dummy_hcd [ 945.763746][T10498] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 945.781362][T10498] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 945.803373][T10498] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 945.822620][T10498] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 945.848330][T10498] usb 1-1: config 0 descriptor?? [ 945.910474][ T48] usb 5-1: Using ep0 maxpacket: 32 [ 946.067276][ T48] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 946.074087][T13200] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 946.089305][ T48] usb 5-1: config 0 has no interface number 0 [ 946.107295][ T48] usb 5-1: config 0 interface 184 has no altsetting 0 [ 946.126842][ T48] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 946.129817][T13200] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 946.170861][ T48] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 946.178954][ T48] usb 5-1: Product: syz [ 946.347201][T13200] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1798'. [ 946.387225][T13200] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1798'. [ 946.410821][ T48] usb 5-1: Manufacturer: syz [ 946.434949][ T48] usb 5-1: SerialNumber: syz [ 946.568719][T10498] usbhid 1-1:0.0: can't add hid device: -71 [ 946.581340][ T48] usb 5-1: config 0 descriptor?? [ 946.603270][ T48] smsc75xx v1.0.0 [ 946.607044][T10498] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 946.660861][T10498] usb 1-1: USB disconnect, device number 16 [ 947.012685][T13215] lo speed is unknown, defaulting to 1000 [ 947.207788][ T48] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 947.248075][ T48] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 947.597838][T13224] SET target dimension over the limit! [ 947.934168][T13224] netdevsim netdevsim1: Direct firmware load for / [ 947.934168][T13224] failed with error -2 [ 947.985412][T13224] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 947.985412][T13224] [ 949.639077][ T48] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000304: -71 [ 949.739546][ T48] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to write ADDR_FILTX+4: -71 [ 949.814187][ T48] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to set mac address [ 949.890451][ T48] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 950.024042][ T48] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 950.191338][ T48] usb 5-1: USB disconnect, device number 15 [ 950.857390][T13246] loop3: detected capacity change from 0 to 512 [ 950.897977][T13246] EXT4-fs: inline encryption not supported [ 951.205000][T13246] EXT4-fs (loop3): 1 orphan inode deleted [ 951.222703][ T60] Quota error (device loop3): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 951.443107][T13246] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 951.460980][ T60] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:4: Failed to release dquot type 1 [ 951.497068][T13246] ext4 filesystem being mounted at /288/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 951.679049][ T30] audit: type=1800 audit(1769915486.251:443): pid=13246 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1809" name="bus" dev="loop3" ino=18 res=0 errno=0 [ 952.738342][ T5836] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 953.531909][ T48] usb 1-1: new full-speed USB device number 17 using dummy_hcd [ 953.722273][ T48] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 953.733850][ T48] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 953.745053][ T48] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 953.780476][ T48] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 953.903292][ T48] usb 1-1: config 0 descriptor?? [ 954.178214][T13278] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 954.201291][T13278] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 954.221430][T13284] random: crng reseeded on system resumption [ 954.293792][T13278] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1816'. [ 954.302990][T13278] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1816'. [ 954.390113][ T48] usbhid 1-1:0.0: can't add hid device: -71 [ 954.832294][ T48] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 955.001525][ T48] usb 1-1: USB disconnect, device number 17 [ 957.540489][T10111] usb 5-1: new high-speed USB device number 16 using dummy_hcd [ 957.856292][T10111] usb 5-1: Using ep0 maxpacket: 32 [ 957.871699][T10111] usb 5-1: config 0 has an invalid interface number: 184 but max is 0 [ 957.891695][T10111] usb 5-1: config 0 has no interface number 0 [ 957.943191][T10111] usb 5-1: config 0 interface 184 has no altsetting 0 [ 958.006417][T10111] usb 5-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 958.043714][T10111] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 958.076730][T10111] usb 5-1: Product: syz [ 958.099544][T10111] usb 5-1: Manufacturer: syz [ 958.134905][T10111] usb 5-1: SerialNumber: syz [ 958.169243][T10111] usb 5-1: config 0 descriptor?? [ 958.203550][T10111] smsc75xx v1.0.0 [ 959.332327][T10111] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 959.374767][T10111] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 960.656757][T10111] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000010: -71 [ 960.727224][T10111] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): Failed to read HW_CFG: -71 [ 960.764788][T10111] smsc75xx 5-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 960.853402][T10111] smsc75xx 5-1:0.184: probe with driver smsc75xx failed with error -71 [ 960.910608][T10111] usb 5-1: USB disconnect, device number 16 [ 962.682080][T13341] random: crng reseeded on system resumption [ 963.467567][T13347] netlink: 'syz.5.1832': attribute type 1 has an invalid length. [ 963.683441][T13349] bond7: (slave vxcan5): The slave device specified does not support setting the MAC address [ 963.724930][T13349] bond7: (slave vxcan5): Error -95 calling set_mac_address [ 963.905668][T13347] bond7: (slave bridge4): Enslaving as an active interface with a down link [ 964.069944][T13358] loop3: detected capacity change from 0 to 512 [ 964.081069][T13363] SET target dimension over the limit! [ 964.089754][T13363] netdevsim netdevsim1: Direct firmware load for / [ 964.089754][T13363] failed with error -2 [ 964.100735][T13363] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 964.100735][T13363] [ 964.211957][T13358] EXT4-fs: inline encryption not supported [ 964.508721][T13358] EXT4-fs (loop3): 1 orphan inode deleted [ 964.525075][T13358] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 964.547198][ T6790] Quota error (device loop3): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 964.600888][T13358] ext4 filesystem being mounted at /293/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 964.654283][ T6790] EXT4-fs error (device loop3): ext4_release_dquot:7022: comm kworker/u8:11: Failed to release dquot type 1 [ 964.900238][ T30] audit: type=1800 audit(1769915499.311:444): pid=13358 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.3.1835" name="bus" dev="loop3" ino=16 res=0 errno=0 [ 965.835490][ T5836] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 966.140393][ T30] audit: type=1804 audit(1769915500.691:445): pid=13376 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.5.1838" name="file0" dev="ramfs" ino=31506 res=1 errno=0 [ 966.463773][T13383] random: crng reseeded on system resumption [ 968.995978][T13396] loop5: detected capacity change from 0 to 512 [ 969.045910][T13396] EXT4-fs: inline encryption not supported [ 969.139693][T13396] EXT4-fs (loop5): 1 orphan inode deleted [ 969.169261][ T60] Quota error (device loop5): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 969.199086][T13396] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 969.248539][ T60] EXT4-fs error (device loop5): ext4_release_dquot:7022: comm kworker/u8:4: Failed to release dquot type 1 [ 969.308633][T13396] ext4 filesystem being mounted at /303/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 969.415699][ T30] audit: type=1800 audit(1769915503.991:446): pid=13396 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1843" name="bus" dev="loop5" ino=16 res=0 errno=0 [ 970.582052][ T5827] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 970.599053][T13413] mac80211_hwsim hwsim8 wlan0: entered allmulticast mode [ 970.630477][T10111] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 970.850804][T10111] usb 3-1: device descriptor read/64, error -71 [ 971.140594][T10111] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 971.170623][ T48] usb 6-1: new full-speed USB device number 13 using dummy_hcd [ 971.290489][T10111] usb 3-1: device descriptor read/64, error -71 [ 971.332333][ T48] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 971.353216][ T48] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 971.404079][ T48] usb 6-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 971.441755][ T48] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 971.454825][T10111] usb usb3-port1: attempt power cycle [ 971.467515][ T48] usb 6-1: config 0 descriptor?? [ 971.736622][T13419] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 971.767843][T13419] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 971.840443][T10111] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 971.902003][T10111] usb 3-1: device descriptor read/8, error -71 [ 971.903165][T13419] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1848'. [ 972.015600][ T48] usbhid 6-1:0.0: can't add hid device: -71 [ 972.039611][ T48] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 972.091724][ T48] usb 6-1: USB disconnect, device number 13 [ 972.140510][T10111] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 972.176743][T10111] usb 3-1: device descriptor read/8, error -71 [ 972.390906][T10111] usb usb3-port1: unable to enumerate USB device [ 974.402645][T13440] Cannot find add_set index 0 as target [ 974.409812][T13440] netdevsim netdevsim4: Direct firmware load for / [ 974.409812][T13440] failed with error -2 [ 974.453750][T13440] netdevsim netdevsim4: Falling back to sysfs fallback for: / [ 974.453750][T13440] [ 976.921782][T13478] SET target dimension over the limit! [ 976.931838][T13478] netdevsim netdevsim1: Direct firmware load for / [ 976.931838][T13478] failed with error -2 [ 976.942685][T13478] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 976.942685][T13478] [ 980.130399][ T5903] usb 4-1: new high-speed USB device number 19 using dummy_hcd [ 980.759741][ T5903] usb 4-1: device descriptor read/64, error -71 [ 981.083093][ T5903] usb 4-1: new high-speed USB device number 20 using dummy_hcd [ 981.293156][ T5903] usb 4-1: device descriptor read/64, error -71 [ 981.438794][ T5903] usb usb4-port1: attempt power cycle [ 981.820493][ T5903] usb 4-1: new high-speed USB device number 21 using dummy_hcd [ 981.841115][ T5903] usb 4-1: device descriptor read/8, error -71 [ 983.264250][T13523] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1871'. [ 983.277046][T13523] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1871'. [ 983.426862][T13523] lo speed is unknown, defaulting to 1000 [ 987.524678][T13549] Cannot find add_set index 0 as target [ 987.848953][T13549] netdevsim netdevsim0: Direct firmware load for / [ 987.848953][T13549] failed with error -2 [ 987.923183][T13549] netdevsim netdevsim0: Falling back to sysfs fallback for: / [ 987.923183][T13549] [ 988.453239][T13557] netlink: 'syz.4.1879': attribute type 1 has an invalid length. [ 988.621482][T13558] veth3: entered promiscuous mode [ 988.870885][T13557] 8021q: adding VLAN 0 to HW filter on device bond6 [ 988.926869][T13559] erspan0: entered allmulticast mode [ 990.175300][T13553] netlink: 100 bytes leftover after parsing attributes in process `syz.2.1878'. [ 990.330839][T13565] tipc: Enabled bearer , priority 0 [ 990.355482][T13565] syzkaller0: entered promiscuous mode [ 990.393593][T13565] syzkaller0: entered allmulticast mode [ 990.862484][T13574] tipc: Resetting bearer [ 991.650680][T13564] tipc: Resetting bearer [ 991.811881][T13564] tipc: Disabling bearer [ 992.255809][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.262530][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 992.994055][T10111] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 994.085325][T10111] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 994.694992][T10111] usb 3-1: config 0 has no interface number 0 [ 994.722872][T10111] usb 3-1: config 0 interface 122 has no altsetting 0 [ 994.743034][T10111] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 994.752634][T10111] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 994.773146][T10111] usb 3-1: Product: syz [ 994.782196][T10111] usb 3-1: Manufacturer: syz [ 994.786972][T10111] usb 3-1: SerialNumber: syz [ 994.816701][ T6793] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 994.845948][ T6793] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 994.882280][ T6793] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 994.884936][T10111] usb 3-1: config 0 descriptor?? [ 994.896953][ T6791] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 995.487052][T10111] usb 3-1: USB disconnect, device number 24 [ 995.600979][T10111] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 996.454325][T13624] loop3: detected capacity change from 0 to 2048 [ 997.462508][T13624] EXT4-fs (loop3): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 997.475828][T13624] ext4 filesystem being mounted at /302/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 998.682053][ T5836] EXT4-fs (loop3): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 999.057686][T13631] 9pnet_virtio: no channels available for device ./bus [ 1000.200723][T10111] usb 4-1: new high-speed USB device number 23 using dummy_hcd [ 1000.406183][ T30] audit: type=1326 audit(1769915534.891:447): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1000.499791][T10111] usb 4-1: Using ep0 maxpacket: 8 [ 1000.515958][T10111] usb 4-1: config 0 has an invalid interface number: 48 but max is 0 [ 1000.550466][T10111] usb 4-1: config 0 has an invalid descriptor of length 55, skipping remainder of the config [ 1000.575860][T10111] usb 4-1: config 0 has no interface number 0 [ 1000.604992][T10111] usb 4-1: too many endpoints for config 0 interface 48 altsetting 49: 55, using maximum allowed: 30 [ 1000.645697][T10111] usb 4-1: config 0 interface 48 altsetting 49 has 0 endpoint descriptors, different from the interface descriptor's value: 55 [ 1000.666047][ T30] audit: type=1326 audit(1769915534.891:448): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1000.747631][ T30] audit: type=1326 audit(1769915534.891:449): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1000.851667][T10111] usb 4-1: config 0 interface 48 has no altsetting 0 [ 1000.863049][ T30] audit: type=1326 audit(1769915534.891:450): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1000.955768][T10111] usb 4-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 1000.979407][ T30] audit: type=1326 audit(1769915534.891:451): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1001.042280][T10111] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1001.082643][T10111] usb 4-1: config 0 descriptor?? [ 1001.174035][ T30] audit: type=1326 audit(1769915534.891:452): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1001.267664][ T30] audit: type=1326 audit(1769915534.901:453): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1001.320053][T10111] usb 4-1: string descriptor 0 read error: -71 [ 1001.380604][T10111] usb 4-1: USB disconnect, device number 23 [ 1001.392348][ T30] audit: type=1326 audit(1769915534.901:454): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1001.555057][ T30] audit: type=1326 audit(1769915534.901:455): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1001.808514][ T30] audit: type=1326 audit(1769915534.901:456): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13636 comm="syz.2.1900" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f04d619aeb9 code=0x7ffc0000 [ 1003.434888][T13659] netlink: 204 bytes leftover after parsing attributes in process `syz.5.1907'. [ 1007.355475][T13680] 9pnet_virtio: no channels available for device ./bus [ 1009.973034][T13702] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1917'. [ 1009.983493][T13702] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1917'. [ 1010.622773][T13706] lo speed is unknown, defaulting to 1000 [ 1011.723849][T13719] netlink: 'syz.2.1922': attribute type 1 has an invalid length. [ 1012.179755][T13722] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1012.216043][T13726] netlink: 'syz.4.1923': attribute type 1 has an invalid length. [ 1012.228726][T13722] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 1012.675723][T13724] bond7: (slave bridge3): Enslaving as an active interface with a down link [ 1012.819080][T13727] bond7: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1012.846243][T13727] bond7: (slave vxcan3): Error -95 calling set_mac_address [ 1012.953218][T13730] macvlan4: entered promiscuous mode [ 1012.985397][T13730] macvlan4: entered allmulticast mode [ 1013.091466][T13730] bond7: entered promiscuous mode [ 1013.191831][T13730] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1013.869653][T13730] bond7: left promiscuous mode [ 1014.081020][T13722] macvlan2: entered promiscuous mode [ 1014.106870][T13722] macvlan2: entered allmulticast mode [ 1014.149481][T13722] bond7: entered promiscuous mode [ 1014.195604][T13722] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1014.258128][T13722] bond7: left promiscuous mode [ 1014.914381][T13743] 9pnet_virtio: no channels available for device ./bus [ 1022.219295][T13787] SET target dimension over the limit! [ 1022.231796][T13787] netdevsim netdevsim1: Direct firmware load for / [ 1022.231796][T13787] failed with error -2 [ 1022.402453][T13787] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 1022.402453][T13787] [ 1024.942434][T13800] random: crng reseeded on system resumption [ 1025.194672][T13811] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1938'. [ 1028.811292][T13830] netlink: 100 bytes leftover after parsing attributes in process `syz.1.1946'. [ 1029.837710][T10076] usb 5-1: new high-speed USB device number 17 using dummy_hcd [ 1030.110373][T10076] usb 5-1: config 220 has an invalid interface number: 76 but max is 2 [ 1030.163472][T10076] usb 5-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1030.225722][T10076] usb 5-1: config 220 has no interface number 2 [ 1030.253789][T10076] usb 5-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1030.421476][T10076] usb 5-1: config 220 interface 0 has no altsetting 0 [ 1030.473615][T10076] usb 5-1: config 220 interface 76 has no altsetting 0 [ 1030.523432][T10076] usb 5-1: config 220 interface 1 has no altsetting 0 [ 1030.570773][T10076] usb 5-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1030.580599][T10076] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1030.598368][T10076] usb 5-1: Product: syz [ 1030.621904][T10076] usb 5-1: Manufacturer: syz [ 1030.660377][T10076] usb 5-1: SerialNumber: syz [ 1031.904054][T13866] netlink: 'syz.1.1955': attribute type 1 has an invalid length. [ 1032.074605][T13874] random: crng reseeded on system resumption [ 1032.480813][T13873] bond7: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1032.493657][T13873] bond7: (slave vxcan5): Error -95 calling set_mac_address [ 1032.579746][T13875] macvlan5: entered promiscuous mode [ 1032.585248][T13875] macvlan5: entered allmulticast mode [ 1032.597157][T13875] bond7: entered promiscuous mode [ 1032.607469][T13875] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1032.654105][T13875] bond7: left promiscuous mode [ 1034.028203][T10076] usb 5-1: selecting invalid altsetting 0 [ 1034.132009][T10076] uvcvideo 5-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1034.175941][T10076] uvcvideo 5-1:220.0: No valid video chain found. [ 1034.372893][T10076] usb 5-1: selecting invalid altsetting 0 [ 1034.449471][T10076] usbtest 5-1:220.1: probe with driver usbtest failed with error -22 [ 1034.614332][T10076] usb 5-1: USB disconnect, device number 17 [ 1035.325804][T13901] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1962'. [ 1035.343628][T13901] netlink: 4 bytes leftover after parsing attributes in process `syz.2.1962'. [ 1035.595108][T13901] lo speed is unknown, defaulting to 1000 [ 1036.260552][T10076] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1036.473396][T10076] usb 3-1: Using ep0 maxpacket: 16 [ 1036.484119][T10076] usb 3-1: config 0 has no interfaces? [ 1036.493631][T10076] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1036.503127][T10076] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1036.563786][T10076] usb 3-1: Manufacturer: syz [ 1036.602205][T10076] usb 3-1: config 0 descriptor?? [ 1037.442605][T13908] netlink: 100 bytes leftover after parsing attributes in process `syz.0.1964'. [ 1038.962323][ T5903] usb 3-1: USB disconnect, device number 25 [ 1042.322512][T13947] netlink: 'syz.3.1976': attribute type 1 has an invalid length. [ 1042.711321][T13951] bond12: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1042.761333][T13951] bond12: (slave vxcan5): Error -95 calling set_mac_address [ 1043.054946][T13947] macvlan4: entered promiscuous mode [ 1043.153343][T13947] macvlan4: entered allmulticast mode [ 1043.172137][T13947] bond12: entered promiscuous mode [ 1043.178774][T13947] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1043.409061][T13947] bond12: left promiscuous mode [ 1044.662105][T13968] Cannot find add_set index 0 as target [ 1044.677308][T13968] netdevsim netdevsim3: Direct firmware load for / [ 1044.677308][T13968] failed with error -2 [ 1044.688262][T13968] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 1044.688262][T13968] [ 1045.682400][T13974] loop0: detected capacity change from 0 to 512 [ 1045.715486][T13974] EXT4-fs: inline encryption not supported [ 1045.830004][T13974] EXT4-fs (loop0): 1 orphan inode deleted [ 1045.847297][ T6792] __quota_error: 33 callbacks suppressed [ 1045.847315][ T6792] Quota error (device loop0): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 1045.864378][T13974] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1045.990609][ T6792] EXT4-fs error (device loop0): ext4_release_dquot:7022: comm kworker/u8:13: Failed to release dquot type 1 [ 1046.050576][T13974] ext4 filesystem being mounted at /321/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1046.465893][ T30] audit: type=1800 audit(1769915580.861:490): pid=13974 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1984" name="bus" dev="loop0" ino=16 res=0 errno=0 [ 1047.256460][ T5822] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1047.630144][ T30] audit: type=1804 audit(1769915582.201:491): pid=13986 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.0.1986" name="file0" dev="ramfs" ino=33353 res=1 errno=0 [ 1048.462111][T13999] SET target dimension over the limit! [ 1048.472059][T13999] netdevsim netdevsim5: Direct firmware load for / [ 1048.472059][T13999] failed with error -2 [ 1048.482753][T13999] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 1048.482753][T13999] [ 1049.570463][T10076] usb 1-1: new high-speed USB device number 18 using dummy_hcd [ 1049.734438][T14006] loop3: detected capacity change from 0 to 256 [ 1049.750598][T10076] usb 1-1: Using ep0 maxpacket: 32 [ 1049.762388][T10076] usb 1-1: config 0 has an invalid interface number: 67 but max is 0 [ 1049.791355][T10076] usb 1-1: config 0 has no interface number 0 [ 1049.799223][T14006] exfat: Deprecated parameter 'utf8' [ 1049.821432][T14006] exfat: Deprecated parameter 'utf8' [ 1049.827412][T10076] usb 1-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1049.867573][T14006] exfat: Deprecated parameter 'utf8' [ 1049.873479][T10076] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1049.903136][T10076] usb 1-1: Product: syz [ 1049.941235][T10076] usb 1-1: Manufacturer: syz [ 1049.949951][T14006] exFAT-fs (loop3): failed to load upcase table (idx : 0x00011f3f, chksum : 0x96b62a4c, utbl_chksum : 0xe619d30d) [ 1049.965299][T10076] usb 1-1: SerialNumber: syz [ 1049.984488][T10076] usb 1-1: config 0 descriptor?? [ 1049.994984][T10076] smsc95xx v2.0.0 [ 1050.097563][T14010] Cannot find add_set index 0 as target [ 1050.108527][T14010] netdevsim netdevsim4: Direct firmware load for / [ 1050.108527][T14010] failed with error -2 [ 1050.120693][T14010] netdevsim netdevsim4: Falling back to sysfs fallback for: / [ 1050.120693][T14010] [ 1050.407840][T10076] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1050.480704][T10076] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1051.243497][T10076] smsc95xx 1-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 1051.335440][T10076] smsc95xx 1-1:0.67: probe with driver smsc95xx failed with error -32 [ 1051.652149][T14018] Cannot find add_set index 0 as target [ 1051.785661][T14019] netdevsim netdevsim3: Direct firmware load for / [ 1051.785661][T14019] failed with error -2 [ 1051.796372][T14019] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 1051.796372][T14019] [ 1053.013614][T10076] usb 1-1: USB disconnect, device number 18 [ 1053.704089][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1053.710576][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1057.290736][ T30] audit: type=1804 audit(1769915591.861:492): pid=14053 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.2002" name="file0" dev="ramfs" ino=33442 res=1 errno=0 [ 1058.180495][ T30] audit: type=1326 audit(1769915592.691:493): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1058.270851][ T30] audit: type=1326 audit(1769915592.691:494): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1058.581738][ T30] audit: type=1326 audit(1769915592.691:495): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1058.717076][T14072] loop5: detected capacity change from 0 to 256 [ 1058.730184][T14072] exfat: Deprecated parameter 'utf8' [ 1058.735756][T14072] exfat: Deprecated parameter 'utf8' [ 1058.742369][T14072] exfat: Deprecated parameter 'utf8' [ 1058.748854][T14072] exfat: Unknown parameter '' [ 1059.198811][ T30] audit: type=1326 audit(1769915592.691:496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1059.420451][ T30] audit: type=1326 audit(1769915592.701:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1059.644546][ T30] audit: type=1326 audit(1769915592.701:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1059.805979][ T30] audit: type=1326 audit(1769915592.701:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1059.930574][ T30] audit: type=1326 audit(1769915592.701:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1059.994534][T14078] netlink: 100 bytes leftover after parsing attributes in process `syz.2.2001'. [ 1060.162947][ T30] audit: type=1326 audit(1769915592.711:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14059 comm="syz.0.2005" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7f43bcd9aeb9 code=0x7ffc0000 [ 1062.274461][T14111] SET target dimension over the limit! [ 1062.284082][T14111] netdevsim netdevsim1: Direct firmware load for / [ 1062.284082][T14111] failed with error -2 [ 1062.294836][T14111] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 1062.294836][T14111] [ 1063.507137][T14126] lo speed is unknown, defaulting to 1000 [ 1066.061424][T14142] mac80211_hwsim hwsim6 wlan0: entered allmulticast mode [ 1073.821126][ T5930] usb 5-1: new high-speed USB device number 18 using dummy_hcd [ 1075.823727][ T5930] usb 5-1: config 0 has an invalid interface number: 122 but max is 0 [ 1075.839146][ T5930] usb 5-1: config 0 has no interface number 0 [ 1075.846090][ T5930] usb 5-1: config 0 interface 122 has no altsetting 0 [ 1075.862634][ T5930] usb 5-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 1075.872165][ T5930] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1075.880177][ T5930] usb 5-1: Product: syz [ 1075.893714][ T5930] usb 5-1: Manufacturer: syz [ 1075.904196][ T5930] usb 5-1: SerialNumber: syz [ 1076.113527][ T5930] usb 5-1: config 0 descriptor?? [ 1076.131243][T14199] netlink: 44 bytes leftover after parsing attributes in process `syz.2.2040'. [ 1076.224189][T14199] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2040'. [ 1076.800546][T14199] netlink: 'syz.2.2040': attribute type 5 has an invalid length. [ 1076.952855][T14199] netlink: 43 bytes leftover after parsing attributes in process `syz.2.2040'. [ 1076.980432][ T5930] dvb_usb_m920x 5-1:0.122: probe with driver dvb_usb_m920x failed with error -71 [ 1077.041131][ T5930] usb 5-1: USB disconnect, device number 18 [ 1077.071426][T14206] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2043'. [ 1077.117180][T14206] netlink: 24 bytes leftover after parsing attributes in process `syz.0.2043'. [ 1077.362837][T14215] SET target dimension over the limit! [ 1077.372142][T14215] netdevsim netdevsim5: Direct firmware load for / [ 1077.372142][T14215] failed with error -2 [ 1077.382816][T14215] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 1077.382816][T14215] [ 1082.339257][T14265] netlink: 'syz.4.2058': attribute type 1 has an invalid length. [ 1082.799764][T14265] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2058'. [ 1083.201325][T14270] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1083.322111][T14270] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 1083.815174][T14276] bond8: (slave bridge3): Enslaving as an active interface with a down link [ 1083.896490][T14279] macvlan4: entered promiscuous mode [ 1083.902047][T14279] macvlan4: entered allmulticast mode [ 1083.908124][T14279] bond8: entered promiscuous mode [ 1083.916575][T14279] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1083.987410][T14279] bond8: left promiscuous mode [ 1084.950154][T14302] loop4: detected capacity change from 0 to 512 [ 1085.014787][T14302] EXT4-fs: inline encryption not supported [ 1085.026788][T14305] netdevsim netdevsim5: Direct firmware load for / [ 1085.026788][T14305] failed with error -2 [ 1085.070386][T14305] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 1085.070386][T14305] [ 1085.203165][T14302] EXT4-fs (loop4): 1 orphan inode deleted [ 1085.236445][ T8957] __quota_error: 39 callbacks suppressed [ 1085.236463][ T8957] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 1085.243945][T14302] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1085.444071][ T8957] EXT4-fs error (device loop4): ext4_release_dquot:7022: comm kworker/u8:18: Failed to release dquot type 1 [ 1085.649508][T14302] ext4 filesystem being mounted at /371/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1085.760047][ T30] audit: type=1800 audit(1769915620.331:541): pid=14302 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2064" name="bus" dev="loop4" ino=18 res=0 errno=0 [ 1086.632412][ T5831] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1090.930048][T14334] loop4: detected capacity change from 0 to 512 [ 1090.968350][T14334] EXT4-fs: inline encryption not supported [ 1091.192137][T14334] EXT4-fs (loop4): 1 orphan inode deleted [ 1091.219179][ T6792] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 1091.250373][T14334] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1091.270014][ T6792] EXT4-fs error (device loop4): ext4_release_dquot:7022: comm kworker/u8:13: Failed to release dquot type 1 [ 1091.385831][T14334] ext4 filesystem being mounted at /374/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1091.508714][ T30] audit: type=1800 audit(1769915626.081:542): pid=14334 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.2072" name="bus" dev="loop4" ino=18 res=0 errno=0 [ 1091.963890][ T5831] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1092.360135][T14352] loop2: detected capacity change from 0 to 512 [ 1092.367706][T14352] EXT4-fs: Ignoring removed mblk_io_submit option [ 1092.404883][T14352] EXT4-fs: inline encryption not supported [ 1092.444860][T14352] EXT4-fs: Ignoring removed mblk_io_submit option [ 1092.620396][T14352] EXT4-fs (loop2): Test dummy encryption mode enabled [ 1092.776107][T14357] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.2081'. [ 1092.785590][T14352] EXT4-fs (loop2): encrypted files will use data=ordered instead of data journaling mode [ 1093.335620][T14352] EXT4-fs (loop2): 1 truncate cleaned up [ 1093.357627][T14352] EXT4-fs (loop2): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1093.718657][T14372] Cannot find add_set index 0 as target [ 1093.727694][T14372] netdevsim netdevsim3: Direct firmware load for / [ 1093.727694][T14372] failed with error -2 [ 1093.738559][T14372] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 1093.738559][T14372] [ 1094.932013][ T5824] EXT4-fs (loop2): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1097.051426][T14398] netlink: 'syz.2.2088': attribute type 1 has an invalid length. [ 1097.385720][T14400] bond8: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1097.397534][T14400] bond8: (slave vxcan3): Error -95 calling set_mac_address [ 1097.588104][T14398] macvlan2: entered promiscuous mode [ 1097.600444][T14398] macvlan2: entered allmulticast mode [ 1097.606665][T14398] bond8: entered promiscuous mode [ 1097.638074][T14398] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 1097.764637][T14398] bond8: left promiscuous mode [ 1098.081536][T14406] netlink: 20 bytes leftover after parsing attributes in process `syz.4.2091'. [ 1098.572619][T14414] netlink: 1752 bytes leftover after parsing attributes in process `syz.5.2094'. [ 1098.700388][T14421] random: crng reseeded on system resumption [ 1099.152668][T14432] loop2: detected capacity change from 0 to 16 [ 1099.584197][T14432] erofs (device loop2): mounted with root inode @ nid 36. [ 1100.662025][T14438] netlink: 'syz.5.2100': attribute type 1 has an invalid length. [ 1100.812617][T14438] 8021q: adding VLAN 0 to HW filter on device bond8 [ 1100.887361][T14442] veth3: entered promiscuous mode [ 1101.205714][T14447] loop5: detected capacity change from 0 to 16 [ 1101.253851][T14447] erofs (device loop5): mounted with root inode @ nid 36. [ 1102.409147][T14452] netlink: 'syz.1.2105': attribute type 1 has an invalid length. [ 1102.638592][T14455] bond8: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1102.731157][T14455] bond8: (slave vxcan5): Error -95 calling set_mac_address [ 1102.793454][T14452] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2105'. [ 1102.803078][T14452] netlink: 24 bytes leftover after parsing attributes in process `syz.1.2105'. [ 1103.058533][T14466] random: crng reseeded on system resumption [ 1103.191807][T14457] bond8: (slave bridge3): Enslaving as an active interface with a down link [ 1103.280455][T10498] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1103.397793][T14462] macvlan5: entered promiscuous mode [ 1103.412566][T14462] macvlan5: entered allmulticast mode [ 1103.476254][T14462] bond8: entered promiscuous mode [ 1103.496251][T14462] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1103.509417][T10498] usb 3-1: config 0 has an invalid interface number: 122 but max is 0 [ 1103.531254][T10498] usb 3-1: config 0 has no interface number 0 [ 1103.628047][T10498] usb 3-1: config 0 interface 122 has no altsetting 0 [ 1103.640044][T10498] usb 3-1: New USB device found, idVendor=13d3, idProduct=3219, bcdDevice=7a.67 [ 1103.929546][T10498] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1103.938431][T10498] usb 3-1: Product: syz [ 1103.942800][T10498] usb 3-1: Manufacturer: syz [ 1103.947400][T10498] usb 3-1: SerialNumber: syz [ 1103.955112][T10498] usb 3-1: config 0 descriptor?? [ 1103.987672][T14462] bond8: left promiscuous mode [ 1104.796720][T14471] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.2110'. [ 1104.873093][ T5930] usb 3-1: USB disconnect, device number 26 [ 1104.882037][ T5930] dvb-usb: generic DVB-USB module successfully deinitialized and disconnected. [ 1105.172365][T14480] syzkaller0: entered promiscuous mode [ 1105.190741][T14480] syzkaller0: entered allmulticast mode [ 1105.302156][T14482] random: crng reseeded on system resumption [ 1108.260823][T14513] netlink: 1752 bytes leftover after parsing attributes in process `syz.3.2124'. [ 1110.282001][T14534] Cannot find add_set index 0 as target [ 1110.303095][T14534] netdevsim netdevsim4: Direct firmware load for / [ 1110.303095][T14534] failed with error -2 [ 1110.320935][T14534] netdevsim netdevsim4: Falling back to sysfs fallback for: / [ 1110.320935][T14534] [ 1111.599807][ T5930] usb 1-1: new high-speed USB device number 19 using dummy_hcd [ 1111.848762][ T5930] usb 1-1: Using ep0 maxpacket: 32 [ 1111.900436][ T5930] usb 1-1: config 0 has an invalid interface number: 184 but max is 0 [ 1111.930889][ T5930] usb 1-1: config 0 has no interface number 0 [ 1112.106247][ T5930] usb 1-1: config 0 interface 184 has no altsetting 0 [ 1112.146243][ T5930] usb 1-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1112.295314][ T5930] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1112.329363][ T5930] usb 1-1: Product: syz [ 1112.345440][ T5930] usb 1-1: Manufacturer: syz [ 1112.353852][ T5930] usb 1-1: SerialNumber: syz [ 1112.389941][ T5930] usb 1-1: config 0 descriptor?? [ 1112.801122][ T5930] smsc75xx v1.0.0 [ 1114.424648][ T5930] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -71 [ 1114.460353][ T5930] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1114.486778][T14568] loop4: detected capacity change from 0 to 512 [ 1114.518917][ T5930] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -71 [ 1114.566276][ T5930] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -71 [ 1114.641586][T14568] EXT4-fs: Ignoring removed mblk_io_submit option [ 1114.675976][ T5930] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1114.728059][T14568] EXT4-fs: inline encryption not supported [ 1114.734185][ T5930] smsc75xx 1-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -71 [ 1114.754716][T14568] EXT4-fs: Ignoring removed mblk_io_submit option [ 1114.793037][ T5930] smsc75xx 1-1:0.184: probe with driver smsc75xx failed with error -71 [ 1114.831184][T14577] SET target dimension over the limit! [ 1114.907100][T14568] EXT4-fs (loop4): Test dummy encryption mode enabled [ 1114.930383][T14568] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 1114.963979][ T5930] usb 1-1: USB disconnect, device number 19 [ 1115.064465][T14577] netdevsim netdevsim2: Direct firmware load for / [ 1115.064465][T14577] failed with error -2 [ 1115.080825][T14577] netdevsim netdevsim2: Falling back to sysfs fallback for: / [ 1115.080825][T14577] [ 1115.154534][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.172579][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.261891][T14568] EXT4-fs (loop4): 1 truncate cleaned up [ 1115.277142][T14568] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1116.305303][ T5831] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1119.674742][T14606] netlink: 'syz.0.2149': attribute type 1 has an invalid length. [ 1120.622231][T14608] bond11: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1120.933416][T14606] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2149'. [ 1121.134896][T14608] bond11: (slave vxcan3): Error -95 calling set_mac_address [ 1122.054179][T14610] bond11: (slave bridge9): Enslaving as an active interface with a down link [ 1122.063587][T10076] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1122.182078][T14615] macvlan4: entered promiscuous mode [ 1122.221431][T14615] macvlan4: entered allmulticast mode [ 1122.240456][T10076] usb 3-1: Using ep0 maxpacket: 32 [ 1122.241502][T14615] bond11: entered promiscuous mode [ 1122.265256][T14615] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1122.270535][T10076] usb 3-1: config 0 has an invalid interface number: 188 but max is 0 [ 1122.301829][T10076] usb 3-1: config 0 has no interface number 0 [ 1122.309820][T14615] bond11: left promiscuous mode [ 1122.369210][T10076] usb 3-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1122.450396][T10076] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1122.500355][T10076] usb 3-1: Product: syz [ 1122.504703][T10076] usb 3-1: Manufacturer: syz [ 1122.545891][T10076] usb 3-1: SerialNumber: syz [ 1122.628222][T10076] usb 3-1: config 0 descriptor?? [ 1122.675607][T10076] asix 3-1:0.188: probe with driver asix failed with error -22 [ 1123.306549][ T6792] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.323515][ T6792] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.356022][ T6792] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.383638][ T6792] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1123.697020][T14645] loop5: detected capacity change from 0 to 512 [ 1123.711694][T14645] EXT4-fs: Ignoring removed mblk_io_submit option [ 1123.719381][T14645] EXT4-fs: inline encryption not supported [ 1123.746776][T14645] EXT4-fs: Ignoring removed mblk_io_submit option [ 1123.806256][T14645] EXT4-fs (loop5): Test dummy encryption mode enabled [ 1123.836563][T14650] netlink: 'syz.4.2162': attribute type 1 has an invalid length. [ 1123.859518][T14645] EXT4-fs (loop5): encrypted files will use data=ordered instead of data journaling mode [ 1124.043143][T14645] EXT4-fs (loop5): 1 truncate cleaned up [ 1124.049220][T14656] netlink: 60 bytes leftover after parsing attributes in process `syz.4.2162'. [ 1124.074080][T14645] EXT4-fs (loop5): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1124.217791][T14654] bond9: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1124.770458][ T5930] usb 3-1: USB disconnect, device number 27 [ 1124.811181][T14654] bond9: (slave vxcan3): Error -95 calling set_mac_address [ 1124.839851][T14660] loop0: detected capacity change from 0 to 16 [ 1124.860990][T14660] erofs (device loop0): mounted with root inode @ nid 36. [ 1124.929488][T14662] loop2: detected capacity change from 0 to 128 [ 1125.010168][T14662] syz.2.2164: attempt to access beyond end of device [ 1125.010168][T14662] loop2: rw=2049, sector=145, nr_sectors = 8 limit=128 [ 1125.223987][T14662] syz.2.2164: attempt to access beyond end of device [ 1125.223987][T14662] loop2: rw=2049, sector=161, nr_sectors = 8 limit=128 [ 1125.840358][T14650] macvlan4: entered promiscuous mode [ 1125.938915][T14650] macvlan4: entered allmulticast mode [ 1125.977195][T14662] syz.2.2164: attempt to access beyond end of device [ 1125.977195][T14662] loop2: rw=2049, sector=177, nr_sectors = 24 limit=128 [ 1126.010528][T14650] bond9: entered promiscuous mode [ 1126.039899][T14650] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1126.078700][T14662] syz.2.2164: attempt to access beyond end of device [ 1126.078700][T14662] loop2: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 1126.169392][T14664] syz.2.2164: attempt to access beyond end of device [ 1126.169392][T14664] loop2: rw=2049, sector=305, nr_sectors = 8 limit=128 [ 1126.184380][T14650] bond9: left promiscuous mode [ 1126.235100][ T5827] EXT4-fs (loop5): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1126.244396][T14662] syz.2.2164: attempt to access beyond end of device [ 1126.244396][T14662] loop2: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 1126.711040][T14662] syz.2.2164: attempt to access beyond end of device [ 1126.711040][T14662] loop2: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 1126.777998][T14662] syz.2.2164: attempt to access beyond end of device [ 1126.777998][T14662] loop2: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 1126.887565][T14662] syz.2.2164: attempt to access beyond end of device [ 1126.887565][T14662] loop2: rw=2049, sector=273, nr_sectors = 8 limit=128 [ 1126.967607][T14662] syz.2.2164: attempt to access beyond end of device [ 1126.967607][T14662] loop2: rw=2049, sector=289, nr_sectors = 9 limit=128 [ 1128.640179][T14684] loop4: detected capacity change from 0 to 128 [ 1130.189986][T14684] syz.4.2170: attempt to access beyond end of device [ 1130.189986][T14684] loop4: rw=2049, sector=145, nr_sectors = 8 limit=128 [ 1130.320543][T14684] syz.4.2170: attempt to access beyond end of device [ 1130.320543][T14684] loop4: rw=2049, sector=161, nr_sectors = 8 limit=128 [ 1130.683553][T14695] syz.4.2170: attempt to access beyond end of device [ 1130.683553][T14695] loop4: rw=2049, sector=305, nr_sectors = 80 limit=128 [ 1130.704122][T14684] syz.4.2170: attempt to access beyond end of device [ 1130.704122][T14684] loop4: rw=2049, sector=177, nr_sectors = 24 limit=128 [ 1131.012588][T14703] netlink: 'syz.0.2175': attribute type 1 has an invalid length. [ 1131.019078][T14684] syz.4.2170: attempt to access beyond end of device [ 1131.019078][T14684] loop4: rw=2049, sector=209, nr_sectors = 8 limit=128 [ 1131.179412][T14684] syz.4.2170: attempt to access beyond end of device [ 1131.179412][T14684] loop4: rw=2049, sector=225, nr_sectors = 8 limit=128 [ 1131.358384][ T48] usb 4-1: new high-speed USB device number 24 using dummy_hcd [ 1131.424052][T14684] syz.4.2170: attempt to access beyond end of device [ 1131.424052][T14684] loop4: rw=2049, sector=241, nr_sectors = 8 limit=128 [ 1131.675333][T14695] syz.4.2170: attempt to access beyond end of device [ 1131.675333][T14695] loop4: rw=2049, sector=393, nr_sectors = 8 limit=128 [ 1131.677449][T14703] 8021q: adding VLAN 0 to HW filter on device bond12 [ 1131.722404][ T48] usb 4-1: config 220 has an invalid interface number: 76 but max is 2 [ 1131.731102][T14684] syz.4.2170: attempt to access beyond end of device [ 1131.731102][T14684] loop4: rw=2049, sector=257, nr_sectors = 8 limit=128 [ 1131.752329][ T48] usb 4-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1131.776261][ T48] usb 4-1: config 220 has no interface number 2 [ 1131.788303][ T48] usb 4-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1131.804189][T14705] veth3: entered promiscuous mode [ 1131.827006][T14695] syz.4.2170: attempt to access beyond end of device [ 1131.827006][T14695] loop4: rw=2049, sector=409, nr_sectors = 8 limit=128 [ 1131.848975][T14705] bond12: (slave veth3): Enslaving as an active interface with a down link [ 1131.878352][ T48] usb 4-1: config 220 interface 0 has no altsetting 0 [ 1132.017629][ T48] usb 4-1: config 220 interface 76 has no altsetting 0 [ 1132.025043][ T48] usb 4-1: config 220 interface 1 has no altsetting 0 [ 1132.071185][ T48] usb 4-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1132.094985][ T48] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1132.123809][ T48] usb 4-1: Product: syz [ 1132.138155][ T48] usb 4-1: Manufacturer: syz [ 1132.163676][ T48] usb 4-1: SerialNumber: syz [ 1132.213050][T14713] loop2: detected capacity change from 0 to 16 [ 1132.259810][T14713] erofs (device loop2): mounted with root inode @ nid 36. [ 1132.652547][T14717] loop0: detected capacity change from 0 to 16 [ 1133.423319][T14717] erofs (device loop0): mounted with root inode @ nid 36. [ 1135.315768][T14734] overlayfs: failed to resolve './file0': -2 [ 1136.980403][T10076] usb 1-1: new high-speed USB device number 20 using dummy_hcd [ 1137.031853][T14746] SET target dimension over the limit! [ 1137.039355][T14746] netdevsim netdevsim1: Direct firmware load for / [ 1137.039355][T14746] failed with error -2 [ 1137.190380][T10076] usb 1-1: Using ep0 maxpacket: 32 [ 1137.191129][T14746] netdevsim netdevsim1: Falling back to sysfs fallback for: / [ 1137.191129][T14746] [ 1137.282378][T10076] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 1137.364009][T10076] usb 1-1: config 0 has no interface number 0 [ 1137.383950][ T48] usb 4-1: selecting invalid altsetting 0 [ 1137.390150][ T48] uvcvideo 4-1:220.0: Found UVC 7.01 device syz (8086:0b07) [ 1137.471122][T10076] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1137.486866][T10076] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1137.522967][ T48] uvcvideo 4-1:220.0: No valid video chain found. [ 1137.532752][T10076] usb 1-1: Product: syz [ 1137.536947][T10076] usb 1-1: Manufacturer: syz [ 1137.559989][T10076] usb 1-1: SerialNumber: syz [ 1137.589657][ T48] usb 4-1: selecting invalid altsetting 0 [ 1137.626948][T10076] usb 1-1: config 0 descriptor?? [ 1137.663496][ T48] usbtest 4-1:220.1: probe with driver usbtest failed with error -22 [ 1137.769614][ T48] usb 4-1: USB disconnect, device number 24 [ 1137.776583][T10076] asix 1-1:0.188: probe with driver asix failed with error -22 [ 1140.076021][T14763] loop5: detected capacity change from 0 to 256 [ 1140.948709][ T5903] usb 1-1: USB disconnect, device number 20 [ 1141.992000][T14763] exFAT-fs (loop5): failed to load upcase table (idx : 0x00010000, chksum : 0xf6dff195, utbl_chksum : 0xe619d30d) [ 1147.141536][T10076] usb 4-1: new high-speed USB device number 25 using dummy_hcd [ 1147.350397][T10076] usb 4-1: Using ep0 maxpacket: 32 [ 1147.371631][T10076] usb 4-1: config 0 has an invalid interface number: 188 but max is 0 [ 1147.391854][T10076] usb 4-1: config 0 has no interface number 0 [ 1147.436525][T10076] usb 4-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1147.616013][T10076] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1147.630868][T10076] usb 4-1: Product: syz [ 1147.635067][T10076] usb 4-1: Manufacturer: syz [ 1147.801114][T14823] overlayfs: failed to resolve './file0': -2 [ 1148.249042][T10076] usb 4-1: SerialNumber: syz [ 1148.463297][T10076] usb 4-1: config 0 descriptor?? [ 1148.577415][T10076] asix 4-1:0.188: probe with driver asix failed with error -22 [ 1148.877363][T14831] loop0: detected capacity change from 0 to 512 [ 1148.901121][T14831] EXT4-fs: Ignoring removed mblk_io_submit option [ 1148.907779][T14831] EXT4-fs: inline encryption not supported [ 1148.935088][T14831] EXT4-fs: Ignoring removed mblk_io_submit option [ 1148.975126][T14831] EXT4-fs (loop0): Test dummy encryption mode enabled [ 1148.992431][T14831] EXT4-fs (loop0): encrypted files will use data=ordered instead of data journaling mode [ 1149.068845][T14831] EXT4-fs (loop0): 1 truncate cleaned up [ 1149.107558][T14831] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1150.163183][ T5822] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1150.512100][T14845] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2212'. [ 1150.536596][T14845] netlink: 52 bytes leftover after parsing attributes in process `syz.5.2212'. [ 1151.148261][ T5930] usb 4-1: USB disconnect, device number 25 [ 1151.732704][T14855] overlayfs: failed to resolve './file0': -2 [ 1152.666255][T14861] netlink: 'syz.4.2218': attribute type 1 has an invalid length. [ 1152.889483][T14865] bond10: (slave vxcan3): The slave device specified does not support setting the MAC address [ 1152.890140][T14865] bond10: (slave vxcan3): Error -95 calling set_mac_address [ 1152.973988][T14868] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2218'. [ 1154.385518][T14861] bond10: (slave bridge4): Enslaving as an active interface with a down link [ 1154.830408][T10076] usb 1-1: new high-speed USB device number 21 using dummy_hcd [ 1154.862874][T14870] macvlan4: entered promiscuous mode [ 1154.891232][T14870] macvlan4: entered allmulticast mode [ 1154.970705][T14870] bond10: entered promiscuous mode [ 1154.980588][T14870] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1155.040703][T10076] usb 1-1: Using ep0 maxpacket: 32 [ 1155.068472][T10076] usb 1-1: config 0 has an invalid interface number: 188 but max is 0 [ 1155.093796][T14870] bond10: left promiscuous mode [ 1155.102983][T10076] usb 1-1: config 0 has no interface number 0 [ 1155.138907][T10076] usb 1-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1155.171524][T10076] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1155.213864][T10076] usb 1-1: Product: syz [ 1155.232279][T10076] usb 1-1: Manufacturer: syz [ 1155.289215][T10076] usb 1-1: SerialNumber: syz [ 1155.343456][T10076] usb 1-1: config 0 descriptor?? [ 1155.500954][T10076] asix 1-1:0.188: probe with driver asix failed with error -22 [ 1155.606300][T14882] syzkaller0: entered promiscuous mode [ 1155.614117][T14882] syzkaller0: entered allmulticast mode [ 1157.413507][T14904] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.2230'. [ 1157.540119][T14906] loop3: detected capacity change from 0 to 256 [ 1158.446376][T14906] exFAT-fs (loop3): failed to load upcase table (idx : 0x00010000, chksum : 0xf6dff195, utbl_chksum : 0xe619d30d) [ 1159.535010][ T5903] usb 1-1: USB disconnect, device number 21 [ 1169.606740][T14966] netlink: 1752 bytes leftover after parsing attributes in process `syz.4.2247'. [ 1172.850911][T14971] random: crng reseeded on system resumption [ 1174.382335][T15001] loop2: detected capacity change from 0 to 256 [ 1175.399299][T15001] exFAT-fs (loop2): failed to load upcase table (idx : 0x00010000, chksum : 0xf6dff195, utbl_chksum : 0xe619d30d) [ 1177.312580][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1177.312650][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1179.062464][T15023] overlayfs: failed to resolve './file0': -2 [ 1181.165009][T15045] netlink: 'syz.3.2268': attribute type 1 has an invalid length. [ 1181.808956][T15050] bond13: (slave bridge4): making interface the new active one [ 1181.822797][T15050] bond13: (slave bridge4): Enslaving as an active interface with an up link [ 1181.839939][T15051] macvlan4: entered promiscuous mode [ 1181.846114][T15051] macvlan4: entered allmulticast mode [ 1181.873535][T15051] bond13: entered promiscuous mode [ 1181.878733][T15051] bridge4: entered promiscuous mode [ 1181.885561][T15051] 8021q: adding VLAN 0 to HW filter on device macvlan4 [ 1181.901797][T15051] bond13: (slave macvlan4): the slave hw address is in use by the bond; couldn't find a slave with a free hw address to give it (this should not have happened) [ 1181.999945][T15051] bond13: left promiscuous mode [ 1182.010450][T15051] bridge4: left promiscuous mode [ 1189.248678][T15096] netlink: 36 bytes leftover after parsing attributes in process `syz.1.2281'. [ 1189.734583][T15101] netlink: 'syz.5.2283': attribute type 1 has an invalid length. [ 1190.540549][T10111] usb 5-1: new high-speed USB device number 19 using dummy_hcd [ 1190.890387][T10111] usb 5-1: Using ep0 maxpacket: 32 [ 1190.920114][T10111] usb 5-1: config 0 has an invalid interface number: 188 but max is 0 [ 1190.940954][T15109] bond9: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1190.960466][T10111] usb 5-1: config 0 has no interface number 0 [ 1190.976960][T10111] usb 5-1: New USB device found, idVendor=17ef, idProduct=7203, bcdDevice=2e.36 [ 1191.139767][T15109] bond9: (slave vxcan5): Error -95 calling set_mac_address [ 1191.149235][T10111] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1192.153797][T10111] usb 5-1: Product: syz [ 1192.158001][T10111] usb 5-1: Manufacturer: syz [ 1192.171029][T15110] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2283'. [ 1193.000407][T10111] usb 5-1: SerialNumber: syz [ 1193.046030][T10111] usb 5-1: config 0 descriptor?? [ 1193.200941][T10111] usb 5-1: can't set config #0, error -71 [ 1193.208734][T15101] bond9: (slave bridge5): Enslaving as an active interface with a down link [ 1193.217898][T10111] usb 5-1: USB disconnect, device number 19 [ 1193.508126][T15128] loop4: detected capacity change from 0 to 512 [ 1193.635449][T15128] EXT4-fs error (device loop4): ext4_orphan_get:1391: inode #15: comm syz.4.2289: inode has both inline data and extents flags [ 1193.980454][T15128] EXT4-fs error (device loop4): ext4_orphan_get:1396: comm syz.4.2289: couldn't read orphan inode 15 (err -117) [ 1194.712793][T15128] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1194.928994][T15142] EXT4-fs error (device loop4): ext4_empty_dir:3075: inode #2: comm syz.4.2289: invalid size [ 1195.663653][ T5831] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1197.245998][T15158] netlink: 1752 bytes leftover after parsing attributes in process `syz.2.2280'. [ 1197.709693][T15166] capability: warning: `syz.4.2298' uses deprecated v2 capabilities in a way that may be insecure [ 1199.470907][T15170] loop0: detected capacity change from 0 to 256 [ 1204.815543][T15170] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xf6dff195, utbl_chksum : 0xe619d30d) [ 1206.290776][T12066] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 1206.300842][T12066] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 1206.322219][T12066] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 1206.357960][T12066] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 1206.366435][T12066] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 1206.446413][T15180] lo speed is unknown, defaulting to 1000 [ 1206.864494][ T30] audit: type=1107 audit(1769915741.441:543): pid=15186 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='' [ 1207.755707][T15180] chnl_net:caif_netlink_parms(): no params data found [ 1209.580371][T12066] Bluetooth: hci6: command tx timeout [ 1210.423651][T15180] bridge0: port 1(bridge_slave_0) entered blocking state [ 1210.452017][T15180] bridge0: port 1(bridge_slave_0) entered disabled state [ 1210.459305][T15180] bridge_slave_0: entered allmulticast mode [ 1210.512611][T15180] bridge_slave_0: entered promiscuous mode [ 1210.542348][T15180] bridge0: port 2(bridge_slave_1) entered blocking state [ 1210.549611][T15180] bridge0: port 2(bridge_slave_1) entered disabled state [ 1210.782559][T15180] bridge_slave_1: entered allmulticast mode [ 1210.823650][T15180] bridge_slave_1: entered promiscuous mode [ 1210.976206][ T30] audit: type=1326 audit(1769915745.511:544): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1211.069561][ T30] audit: type=1326 audit(1769915745.511:545): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1211.186177][ T30] audit: type=1326 audit(1769915745.511:546): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=135 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1211.530724][ T30] audit: type=1326 audit(1769915745.511:547): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1211.750283][T12066] Bluetooth: hci6: command tx timeout [ 1211.776085][ T30] audit: type=1326 audit(1769915745.511:548): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1212.617740][ T30] audit: type=1326 audit(1769915745.511:549): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1212.715288][T15180] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1212.747209][ T30] audit: type=1326 audit(1769915745.511:550): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1212.762372][T15230] loop4: detected capacity change from 0 to 16 [ 1212.788077][T15180] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1212.925836][T15230] erofs (device loop4): mounted with root inode @ nid 36. [ 1213.026098][ T30] audit: type=1326 audit(1769915745.511:551): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1213.180521][ T30] audit: type=1326 audit(1769915745.511:552): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1213.211233][ T30] audit: type=1326 audit(1769915745.521:553): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=188 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1213.234099][ T30] audit: type=1326 audit(1769915745.521:554): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1213.880364][T12066] Bluetooth: hci6: command tx timeout [ 1213.992293][ T30] audit: type=1326 audit(1769915745.521:555): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1214.150295][ T30] audit: type=1326 audit(1769915745.521:556): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1214.233517][ T30] audit: type=1326 audit(1769915745.521:557): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=49 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1214.310459][ T30] audit: type=1326 audit(1769915745.521:558): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=15210 comm="syz.1.2312" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fad54b9aeb9 code=0x7ffc0000 [ 1214.368226][T15180] team0: Port device team_slave_0 added [ 1214.462372][T15180] team0: Port device team_slave_1 added [ 1214.785018][T15180] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1214.818920][T15180] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1215.180477][T15180] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1215.218624][T15180] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1215.310672][T15180] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1215.377591][T15180] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1215.531139][T10111] usb 4-1: new high-speed USB device number 26 using dummy_hcd [ 1215.652856][T15247] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2315'. [ 1216.797104][T15246] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1216.890359][T12066] Bluetooth: hci6: command tx timeout [ 1216.896744][T10111] usb 4-1: Using ep0 maxpacket: 16 [ 1216.912527][T10111] usb 4-1: config 0 has an invalid interface number: 180 but max is 0 [ 1216.932728][T10111] usb 4-1: config 0 has no interface number 0 [ 1216.952044][T10111] usb 4-1: config 0 interface 180 has no altsetting 0 [ 1216.966983][T10111] usb 4-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=e8.1f [ 1216.985082][T10111] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1217.004878][T10111] usb 4-1: Product: syz [ 1217.009062][T10111] usb 4-1: Manufacturer: syz [ 1217.022135][T10111] usb 4-1: SerialNumber: syz [ 1217.071304][T10111] usb 4-1: config 0 descriptor?? [ 1217.084116][T15180] hsr_slave_0: entered promiscuous mode [ 1217.118863][T15180] hsr_slave_1: entered promiscuous mode [ 1217.147698][T15180] debugfs: 'hsr0' already exists in 'hsr' [ 1217.170389][T15180] Cannot create hsr debugfs directory [ 1217.335382][T10111] viperboard 4-1:0.180: version 0.00 found at bus 004 address 026 [ 1217.477642][T10111] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1217.513806][T10111] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 1217.571006][ T6790] bridge_slave_1: left allmulticast mode [ 1217.602290][ T6790] bridge_slave_1: left promiscuous mode [ 1217.618598][T10111] usb 4-1: USB disconnect, device number 26 [ 1217.625688][ T6790] bridge0: port 2(bridge_slave_1) entered disabled state [ 1217.741990][ T6790] bridge_slave_0: left allmulticast mode [ 1217.758461][ T6790] bridge_slave_0: left promiscuous mode [ 1217.805319][ T6790] bridge0: port 1(bridge_slave_0) entered disabled state [ 1218.407210][T15265] random: crng reseeded on system resumption [ 1222.293196][ T6790] bond1 (unregistering): (slave gretap1): Releasing active interface [ 1222.328230][T10111] usb 1-1: new high-speed USB device number 22 using dummy_hcd [ 1222.511435][T10111] usb 1-1: Using ep0 maxpacket: 16 [ 1222.522651][T10111] usb 1-1: config 0 has an invalid interface number: 180 but max is 0 [ 1222.534531][T10111] usb 1-1: config 0 has no interface number 0 [ 1222.564966][T10111] usb 1-1: config 0 interface 180 has no altsetting 0 [ 1222.596606][T10111] usb 1-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=e8.1f [ 1222.612478][T10111] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1222.644278][T10111] usb 1-1: Product: syz [ 1222.648702][T10111] usb 1-1: Manufacturer: syz [ 1222.723081][T10111] usb 1-1: SerialNumber: syz [ 1222.767184][T10111] usb 1-1: config 0 descriptor?? [ 1223.193998][ C0] raw-gadget.0 gadget.0: ignoring, device is not running [ 1223.201313][T10111] viperboard 1-1:0.180: version 0.00 found at bus 001 address 022 [ 1223.236131][T10111] viperboard-i2c viperboard-i2c.2.auto: error -EIO: failure setting i2c_bus_freq to 100 [ 1223.288334][T10111] viperboard-i2c viperboard-i2c.2.auto: probe with driver viperboard-i2c failed with error -5 [ 1223.535313][T10111] usb 1-1: USB disconnect, device number 22 [ 1223.549516][ T6790] bond3 (unregistering): (slave bridge1): Releasing active interface [ 1225.891539][T15301] netlink: 36 bytes leftover after parsing attributes in process `syz.0.2330'. [ 1226.140810][ T6790] bond7 (unregistering): (slave bridge3): Releasing active interface [ 1227.305698][ T6790] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1228.102307][ T6790] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1228.138880][ T6790] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1228.169399][ T6790] bond0 (unregistering): Released all slaves [ 1228.201230][ T6790] bond1 (unregistering): Released all slaves [ 1228.252156][ T6790] bond2 (unregistering): Released all slaves [ 1228.294060][ T6790] bond3 (unregistering): Released all slaves [ 1228.343694][ T6790] bond4 (unregistering): Released all slaves [ 1228.370473][ T6790] bond5 (unregistering): Released all slaves [ 1229.535888][ T6790] bond6 (unregistering): Released all slaves [ 1229.609136][ T6790] bond7 (unregistering): Released all slaves [ 1229.635966][ T6790] bond8 (unregistering): Released all slaves [ 1230.171852][T15328] SET target dimension over the limit! [ 1230.201890][T15328] netdevsim netdevsim5: Direct firmware load for / [ 1230.201890][T15328] failed with error -2 [ 1230.247776][T15328] netdevsim netdevsim5: Falling back to sysfs fallback for: / [ 1230.247776][T15328] [ 1231.783718][T15345] fuse: Bad value for 'fd' [ 1234.258174][T15180] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1234.369276][T15180] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1234.513053][T15180] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1234.595038][T15180] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1234.986465][T15359] loop4: detected capacity change from 0 to 512 [ 1235.065123][T15359] ext4: Unknown parameter 'fsuuid' [ 1238.261009][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 1238.270399][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 1238.335848][T15369] syz.4.2344 (15369) used greatest stack depth: 15328 bytes left [ 1238.609499][ T6790] hsr_slave_0: left promiscuous mode [ 1238.670450][ T6790] hsr_slave_1: left promiscuous mode [ 1238.710467][ T6790] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1238.795754][ T6790] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1240.330280][T15383] overlayfs: failed to resolve './file0': -2 [ 1241.170159][T15388] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2350'. [ 1244.026222][T15407] loop4: detected capacity change from 0 to 512 [ 1244.053644][T15407] EXT4-fs: Ignoring removed oldalloc option [ 1244.073146][T15407] EXT4-fs (loop4): encrypted files will use data=ordered instead of data journaling mode [ 1244.151830][T15407] EXT4-fs warning (device loop4): ext4_expand_extra_isize_ea:2858: Unable to expand inode 11. Delete some EAs or run e2fsck. [ 1244.181162][T15407] EXT4-fs (loop4): 1 truncate cleaned up [ 1244.206789][T15407] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1244.740006][ T5831] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1244.903174][T15413] loop4: detected capacity change from 0 to 512 [ 1244.923548][T15413] ext4: Unknown parameter 'fsuuid' [ 1247.950627][T15433] overlayfs: failed to resolve './file0': -2 [ 1248.752078][T15441] Cannot find add_set index 0 as target [ 1250.100307][T15441] netdevsim netdevsim3: Direct firmware load for / [ 1250.100307][T15441] failed with error -2 [ 1250.111635][T15441] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 1250.111635][T15441] [ 1250.230986][T15180] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1251.667430][T15180] 8021q: adding VLAN 0 to HW filter on device team0 [ 1251.713702][ T1032] bridge0: port 1(bridge_slave_0) entered blocking state [ 1251.720887][ T1032] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1251.891545][T15282] bridge0: port 2(bridge_slave_1) entered blocking state [ 1251.898745][T15282] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1252.283361][T15459] netlink: 1624 bytes leftover after parsing attributes in process `syz.5.2363'. [ 1252.396024][ T6790] IPVS: stop unused estimator thread 0... [ 1253.649011][T15180] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1261.375989][T15512] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1264.141362][T15180] veth0_vlan: entered promiscuous mode [ 1264.341752][T15180] veth1_vlan: entered promiscuous mode [ 1265.629304][ T5847] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 1265.639138][ T5847] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 1265.647175][ T5847] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 1265.655335][ T5847] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 1265.663080][ T5847] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 1266.679501][T15539] chnl_net:caif_netlink_parms(): no params data found [ 1268.006271][T12066] Bluetooth: hci2: command tx timeout [ 1268.265818][T15567] netlink: 'syz.1.2381': attribute type 1 has an invalid length. [ 1268.465703][T15567] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2381'. [ 1268.524627][T15578] macvlan5: entered promiscuous mode [ 1268.529962][T15578] macvlan5: entered allmulticast mode [ 1268.545114][T15578] bond9: entered promiscuous mode [ 1268.552341][T15578] 8021q: adding VLAN 0 to HW filter on device macvlan5 [ 1268.612144][T15578] bond9: left promiscuous mode [ 1268.651757][T15583] Cannot find add_set index 0 as target [ 1270.182329][T12066] Bluetooth: hci2: command tx timeout [ 1270.349405][T15575] bond9: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1270.390821][T15575] bond9: (slave vxcan5): Error -95 calling set_mac_address [ 1270.474505][T15596] netlink: 1624 bytes leftover after parsing attributes in process `syz.5.2376'. [ 1270.483841][ T5930] usb 5-1: new high-speed USB device number 20 using dummy_hcd [ 1270.690313][ T5930] usb 5-1: Using ep0 maxpacket: 8 [ 1270.697287][ T5930] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1270.719408][T15583] netdevsim netdevsim3: Direct firmware load for / [ 1270.719408][T15583] failed with error -2 [ 1270.730113][T15583] netdevsim netdevsim3: Falling back to sysfs fallback for: / [ 1270.730113][T15583] [ 1270.740898][ T5930] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1270.854263][ T5930] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1270.918411][ T5930] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1270.960602][ T5930] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1270.976383][ T5930] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1271.214614][T15539] bridge0: port 1(bridge_slave_0) entered blocking state [ 1271.238445][ T5930] usb 5-1: GET_CAPABILITIES returned 0 [ 1271.244316][T15539] bridge0: port 1(bridge_slave_0) entered disabled state [ 1271.285851][T15605] random: crng reseeded on system resumption [ 1271.332544][ T5930] usbtmc 5-1:16.0: can't read capabilities [ 1271.339908][T15539] bridge_slave_0: entered allmulticast mode [ 1272.514460][T12066] Bluetooth: hci2: command tx timeout [ 1272.520514][T15539] bridge_slave_0: entered promiscuous mode [ 1272.611563][T15539] bridge0: port 2(bridge_slave_1) entered blocking state [ 1272.704463][T15539] bridge0: port 2(bridge_slave_1) entered disabled state [ 1272.718844][T10497] usb 5-1: USB disconnect, device number 20 [ 1272.784678][T15539] bridge_slave_1: entered allmulticast mode [ 1272.825908][T15539] bridge_slave_1: entered promiscuous mode [ 1273.136065][T15539] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1273.179343][T15539] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1273.531197][T15539] team0: Port device team_slave_0 added [ 1273.590581][T15539] team0: Port device team_slave_1 added [ 1273.850887][T15122] usb 5-1: new high-speed USB device number 21 using dummy_hcd [ 1273.961227][T15539] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1273.978637][T15539] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1274.032340][T15122] usb 5-1: Using ep0 maxpacket: 32 [ 1274.045474][T15122] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1274.061379][T15122] usb 5-1: config 0 has no interface number 0 [ 1274.067647][T15539] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1274.135592][T15122] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1274.163056][T15539] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1274.172198][T15122] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1274.185437][T15122] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1274.200661][T15539] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1274.235748][T15122] usb 5-1: Product: syz [ 1274.250433][T15122] usb 5-1: Manufacturer: syz [ 1274.260540][T15122] usb 5-1: SerialNumber: syz [ 1274.277153][T15122] usb 5-1: config 0 descriptor?? [ 1274.290018][T15539] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1274.311211][T15122] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1274.337738][T15122] em28xx 5-1:0.89: Video interface 89 found: bulk [ 1274.487390][ T36] bridge_slave_1: left allmulticast mode [ 1274.519210][ T36] bridge_slave_1: left promiscuous mode [ 1274.539916][ T36] bridge0: port 2(bridge_slave_1) entered disabled state [ 1275.159432][T15629] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1276.398772][T12066] Bluetooth: hci2: command tx timeout [ 1276.427121][T15122] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 1276.444172][ T36] bridge_slave_0: left allmulticast mode [ 1276.460379][ T36] bridge_slave_0: left promiscuous mode [ 1276.466197][ T36] bridge0: port 1(bridge_slave_0) entered disabled state [ 1276.760127][T15122] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1276.771895][T15122] em28xx 5-1:0.89: board has no eeprom [ 1276.850403][T15122] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 1276.857689][T15122] em28xx 5-1:0.89: analog set to bulk mode. [ 1276.878199][ T5930] em28xx 5-1:0.89: Registering V4L2 extension [ 1277.047628][T15122] usb 5-1: USB disconnect, device number 21 [ 1277.069611][ T5930] em28xx 5-1:0.89: reading from i2c device at 0x4a failed (error=-19) [ 1277.084437][T15122] em28xx 5-1:0.89: Disconnecting em28xx [ 1277.099965][ T5930] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 1277.202498][ T5930] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 1277.226352][ T5930] em28xx 5-1:0.89: No AC97 audio processor [ 1277.254978][ T5930] usb 5-1: Decoder not found [ 1277.265203][ T5930] em28xx 5-1:0.89: failed to create media graph [ 1277.286493][ T5930] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 1277.327832][ T5930] em28xx 5-1:0.89: Registering snapshot button... [ 1277.360690][ T5930] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input38 [ 1277.400564][ T5930] em28xx 5-1:0.89: Remote control support is not available for this card. [ 1277.418274][T15122] em28xx 5-1:0.89: Closing input extension [ 1277.484486][T15122] em28xx 5-1:0.89: Deregistering snapshot button [ 1277.883280][T15122] em28xx 5-1:0.89: Freeing device [ 1277.902653][ T36] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1277.972101][ T36] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1277.996092][ T36] bond0 (unregistering): Released all slaves [ 1280.074870][T15539] hsr_slave_0: entered promiscuous mode [ 1280.102012][T15539] hsr_slave_1: entered promiscuous mode [ 1280.114722][T15539] debugfs: 'hsr0' already exists in 'hsr' [ 1280.144978][T15539] Cannot create hsr debugfs directory [ 1280.186162][ T36] hsr_slave_0: left promiscuous mode [ 1280.200007][ T36] hsr_slave_1: left promiscuous mode [ 1280.215382][ T36] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1280.236808][ T36] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1280.303895][ T36] veth1_vlan: left promiscuous mode [ 1280.316581][ T36] veth0_vlan: left promiscuous mode [ 1280.475269][T15655] netlink: 1624 bytes leftover after parsing attributes in process `syz.3.2398'. [ 1283.612224][ T36] team0 (unregistering): Port device team_slave_1 removed [ 1283.734183][ T36] team0 (unregistering): Port device team_slave_0 removed [ 1289.257790][ T1032] netdevsim netdevsim3 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1289.304922][ T1032] netdevsim netdevsim3 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1289.465338][ T1032] netdevsim netdevsim3 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1289.528346][T15731] netlink: 'syz.3.2410': attribute type 1 has an invalid length. [ 1289.586451][ T1032] netdevsim netdevsim3 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1290.966085][T15735] bond14: (slave vxcan5): The slave device specified does not support setting the MAC address [ 1291.000150][T15735] bond14: (slave vxcan5): Error -95 calling set_mac_address [ 1291.187081][T15738] bond14: (slave bridge5): Enslaving as an active interface with a down link [ 1291.278007][T15708] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1291.460707][T15708] usb 6-1: Using ep0 maxpacket: 32 [ 1291.480309][T15689] usb 5-1: new high-speed USB device number 22 using dummy_hcd [ 1291.499821][T15708] usb 6-1: config 0 has an invalid interface number: 89 but max is 0 [ 1291.533036][T15708] usb 6-1: config 0 has no interface number 0 [ 1291.539174][T15708] usb 6-1: config 0 interface 89 has no altsetting 0 [ 1291.570295][T15708] usb 6-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1291.582300][T15708] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.591421][T15708] usb 6-1: Product: syz [ 1291.595606][T15708] usb 6-1: Manufacturer: syz [ 1291.640455][T15689] usb 5-1: Using ep0 maxpacket: 32 [ 1291.648106][T15689] usb 5-1: config 0 has an invalid interface number: 89 but max is 0 [ 1291.657501][T15708] usb 6-1: SerialNumber: syz [ 1291.665102][T15708] usb 6-1: config 0 descriptor?? [ 1291.670272][T15689] usb 5-1: config 0 has no interface number 0 [ 1291.676307][T15708] em28xx 6-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1291.676380][T15689] usb 5-1: config 0 interface 89 has no altsetting 0 [ 1291.686164][T15708] em28xx 6-1:0.89: Video interface 89 found: bulk [ 1291.747923][T15689] usb 5-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1291.873260][T15539] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 1291.891986][T15689] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.928305][T15539] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 1291.960701][T15539] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 1291.973150][T15539] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 1291.992471][T15689] usb 5-1: Product: syz [ 1292.020380][T15689] usb 5-1: Manufacturer: syz [ 1292.025029][T15689] usb 5-1: SerialNumber: syz [ 1292.063039][T15689] usb 5-1: config 0 descriptor?? [ 1292.102602][T15689] em28xx 5-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1292.133618][T15689] em28xx 5-1:0.89: Video interface 89 found: bulk [ 1292.344870][T15708] em28xx 6-1:0.89: unknown em28xx chip ID (0) [ 1292.466622][T15539] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1292.552198][T15539] 8021q: adding VLAN 0 to HW filter on device team0 [ 1292.610133][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1292.617375][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1292.629736][T15708] em28xx 6-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1292.648343][T15708] em28xx 6-1:0.89: board has no eeprom [ 1292.697121][ T8957] bridge0: port 2(bridge_slave_1) entered blocking state [ 1292.704322][ T8957] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1292.740308][T15708] em28xx 6-1:0.89: Identified as Terratec Grabby (card=67) [ 1292.783932][T15689] em28xx 5-1:0.89: unknown em28xx chip ID (0) [ 1292.790148][T15708] em28xx 6-1:0.89: analog set to bulk mode. [ 1292.809318][T15702] em28xx 6-1:0.89: Registering V4L2 extension [ 1292.880017][T15708] usb 6-1: USB disconnect, device number 14 [ 1292.893139][T15689] em28xx 5-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1292.926814][T15708] em28xx 6-1:0.89: Disconnecting em28xx [ 1292.957565][T15689] em28xx 5-1:0.89: board has no eeprom [ 1293.041105][T15689] em28xx 5-1:0.89: Identified as Terratec Grabby (card=67) [ 1293.083448][T15689] em28xx 5-1:0.89: analog set to bulk mode. [ 1293.099823][T15702] em28xx 6-1:0.89: Config register raw data: 0xffffffed [ 1293.138992][T15702] em28xx 6-1:0.89: AC97 chip type couldn't be determined [ 1293.162764][T15689] usb 5-1: USB disconnect, device number 22 [ 1293.181531][T15702] em28xx 6-1:0.89: No AC97 audio processor [ 1293.201687][T15689] em28xx 5-1:0.89: Disconnecting em28xx [ 1293.241439][T15702] usb 6-1: Decoder not found [ 1293.246077][T15702] em28xx 6-1:0.89: failed to create media graph [ 1293.288287][T15702] em28xx 6-1:0.89: V4L2 device video103 deregistered [ 1293.339416][T15702] em28xx 6-1:0.89: Registering snapshot button... [ 1293.375082][T15702] input: em28xx snapshot button as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.89/input/input39 [ 1293.416645][T15702] em28xx 6-1:0.89: Remote control support is not available for this card. [ 1293.455643][T15708] em28xx 6-1:0.89: Closing input extension [ 1294.598254][T15708] em28xx 6-1:0.89: Deregistering snapshot button [ 1295.180292][T15299] em28xx 5-1:0.89: Registering V4L2 extension [ 1295.199933][T15708] em28xx 6-1:0.89: Freeing device [ 1295.399634][T15299] em28xx 5-1:0.89: Config register raw data: 0xffffffed [ 1297.050529][T15299] em28xx 5-1:0.89: AC97 chip type couldn't be determined [ 1297.057627][T15299] em28xx 5-1:0.89: No AC97 audio processor [ 1297.069309][T15299] usb 5-1: Decoder not found [ 1297.074293][T15299] em28xx 5-1:0.89: failed to create media graph [ 1297.150706][T15299] em28xx 5-1:0.89: V4L2 device video103 deregistered [ 1297.191629][T15299] em28xx 5-1:0.89: Registering snapshot button... [ 1297.240603][T15815] ================================================================== [ 1297.248707][T15815] BUG: KASAN: slab-use-after-free in v4l2_fh_open+0xac/0x420 [ 1297.256073][T15815] Read of size 8 at addr ffff888073404740 by task v4l_id/15815 [ 1297.263658][T15815] [ 1297.265974][T15815] CPU: 1 UID: 0 PID: 15815 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1297.265998][T15815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1297.266011][T15815] Call Trace: [ 1297.266021][T15815] [ 1297.266031][T15815] dump_stack_lvl+0xe8/0x150 [ 1297.266062][T15815] print_report+0xba/0x230 [ 1297.266085][T15815] ? v4l2_fh_open+0xac/0x420 [ 1297.266114][T15815] kasan_report+0x117/0x150 [ 1297.266136][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1297.266163][T15815] ? v4l2_fh_open+0xac/0x420 [ 1297.266192][T15815] v4l2_fh_open+0xac/0x420 [ 1297.266217][T15815] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1297.266246][T15815] em28xx_v4l2_open+0x157/0x9a0 [ 1297.266280][T15815] ? do_raw_spin_lock+0x12b/0x2f0 [ 1297.266309][T15815] v4l2_open+0x1bf/0x3a0 [ 1297.266339][T15815] chrdev_open+0x4cd/0x5e0 [ 1297.266362][T15815] ? __pfx_chrdev_open+0x10/0x10 [ 1297.266382][T15815] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1297.266413][T15815] ? __pfx_chrdev_open+0x10/0x10 [ 1297.266434][T15815] do_dentry_open+0x7ce/0x1420 [ 1297.266466][T15815] vfs_open+0x3b/0x340 [ 1297.266488][T15815] ? path_openat+0x346e/0x3e20 [ 1297.266520][T15815] path_openat+0x3486/0x3e20 [ 1297.266566][T15815] ? kmem_cache_alloc_noprof+0x370/0x6e0 [ 1297.266597][T15815] ? getname_flags+0xb7/0x540 [ 1297.266621][T15815] ? __pfx_path_openat+0x10/0x10 [ 1297.266652][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1297.266675][T15815] ? __lock_acquire+0x6b5/0x2cf0 [ 1297.266713][T15815] do_filp_open+0x22d/0x490 [ 1297.266745][T15815] ? __pfx_do_filp_open+0x10/0x10 [ 1297.266787][T15815] ? _raw_spin_unlock+0x28/0x50 [ 1297.266818][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1297.266842][T15815] ? alloc_fd+0x64b/0x6c0 [ 1297.266870][T15815] do_sys_openat2+0x12f/0x220 [ 1297.266897][T15815] ? __pfx_do_sys_openat2+0x10/0x10 [ 1297.266923][T15815] ? exc_page_fault+0x6a/0xc0 [ 1297.266946][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1297.266970][T15815] ? do_user_addr_fault+0xc7c/0x1360 [ 1297.267005][T15815] __x64_sys_openat+0x138/0x170 [ 1297.267034][T15815] do_syscall_64+0xe2/0xf80 [ 1297.267057][T15815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1297.267078][T15815] ? trace_irq_disable+0x37/0x100 [ 1297.267102][T15815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1297.267127][T15815] RIP: 0033:0x7f9cccea7407 [ 1297.267146][T15815] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1297.267164][T15815] RSP: 002b:00007ffee23922f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1297.267186][T15815] RAX: ffffffffffffffda RBX: 00007f9ccd582880 RCX: 00007f9cccea7407 [ 1297.267202][T15815] RDX: 0000000000000000 RSI: 00007ffee2393f1b RDI: ffffffffffffff9c [ 1297.267217][T15815] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1297.267229][T15815] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1297.267243][T15815] R13: 00007ffee2392540 R14: 00007f9ccd6e9000 R15: 0000562d2d4a54d8 [ 1297.267268][T15815] [ 1297.267276][T15815] [ 1297.561857][T15815] Allocated by task 15299: [ 1297.566257][T15815] kasan_save_track+0x3e/0x80 [ 1297.570924][T15815] __kasan_kmalloc+0x93/0xb0 [ 1297.575500][T15815] __kmalloc_cache_noprof+0x3d1/0x6e0 [ 1297.580859][T15815] em28xx_v4l2_init+0x10b/0x2e70 [ 1297.585793][T15815] em28xx_init_extension+0x120/0x1c0 [ 1297.591068][T15815] process_scheduled_works+0xaec/0x17a0 [ 1297.596615][T15815] worker_thread+0xda6/0x1360 [ 1297.601289][T15815] kthread+0x726/0x8b0 [ 1297.605345][T15815] ret_from_fork+0x51b/0xa40 [ 1297.609931][T15815] ret_from_fork_asm+0x1a/0x30 [ 1297.614693][T15815] [ 1297.617001][T15815] Freed by task 15299: [ 1297.621048][T15815] kasan_save_track+0x3e/0x80 [ 1297.625718][T15815] kasan_save_free_info+0x46/0x50 [ 1297.630747][T15815] __kasan_slab_free+0x5c/0x80 [ 1297.635497][T15815] kfree+0x1be/0x650 [ 1297.639383][T15815] em28xx_v4l2_init+0x1683/0x2e70 [ 1297.644404][T15815] em28xx_init_extension+0x120/0x1c0 [ 1297.649683][T15815] process_scheduled_works+0xaec/0x17a0 [ 1297.655225][T15815] worker_thread+0xda6/0x1360 [ 1297.659905][T15815] kthread+0x726/0x8b0 [ 1297.663964][T15815] ret_from_fork+0x51b/0xa40 [ 1297.668553][T15815] ret_from_fork_asm+0x1a/0x30 [ 1297.673311][T15815] [ 1297.675620][T15815] The buggy address belongs to the object at ffff888073404000 [ 1297.675620][T15815] which belongs to the cache kmalloc-8k of size 8192 [ 1297.689668][T15815] The buggy address is located 1856 bytes inside of [ 1297.689668][T15815] freed 8192-byte region [ffff888073404000, ffff888073406000) [ 1297.703640][T15815] [ 1297.705978][T15815] The buggy address belongs to the physical page: [ 1297.712379][T15815] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73400 [ 1297.721130][T15815] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1297.729620][T15815] ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1297.737500][T15815] page_type: f5(slab) [ 1297.741474][T15815] raw: 00fff00000000040 ffff88813fe27280 ffffea0001faca00 0000000000000003 [ 1297.750049][T15815] raw: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1297.758633][T15815] head: 00fff00000000040 ffff88813fe27280 ffffea0001faca00 0000000000000003 [ 1297.767301][T15815] head: 0000000000000000 0000000080020002 00000000f5000000 0000000000000000 [ 1297.775969][T15815] head: 00fff00000000003 ffffea0001cd0001 00000000ffffffff 00000000ffffffff [ 1297.784641][T15815] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1297.793299][T15815] page dumped because: kasan: bad access detected [ 1297.799694][T15815] page_owner tracks the page as allocated [ 1297.805386][T15815] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5822, tgid 5822 (syz-executor), ts 89001723470, free_ts 84917730864 [ 1297.826743][T15815] post_alloc_hook+0x228/0x280 [ 1297.831502][T15815] get_page_from_freelist+0x24dc/0x2580 [ 1297.837041][T15815] __alloc_frozen_pages_noprof+0x18d/0x380 [ 1297.842834][T15815] alloc_pages_mpol+0x232/0x4a0 [ 1297.847673][T15815] allocate_slab+0x86/0x3a0 [ 1297.852167][T15815] ___slab_alloc+0xd82/0x1760 [ 1297.856833][T15815] __slab_alloc+0x65/0x100 [ 1297.861236][T15815] __kmalloc_noprof+0x46c/0x7e0 [ 1297.866072][T15815] ops_init+0x7b/0x5c0 [ 1297.870137][T15815] setup_net+0x118/0x340 [ 1297.874369][T15815] copy_net_ns+0x50e/0x730 [ 1297.878773][T15815] create_new_namespaces+0x3e7/0x6a0 [ 1297.884053][T15815] unshare_nsproxy_namespaces+0x11a/0x160 [ 1297.889770][T15815] ksys_unshare+0x4f4/0x900 [ 1297.894261][T15815] __x64_sys_unshare+0x38/0x50 [ 1297.899013][T15815] do_syscall_64+0xe2/0xf80 [ 1297.903501][T15815] page last free pid 5807 tgid 5807 stack trace: [ 1297.909803][T15815] __free_frozen_pages+0xbf8/0xd70 [ 1297.914901][T15815] __folio_put+0x414/0x4f0 [ 1297.919304][T15815] skb_release_data+0x4df/0x8e0 [ 1297.924147][T15815] __kfree_skb+0x5d/0x210 [ 1297.928465][T15815] tcp_ack+0x2317/0x68c0 [ 1297.932701][T15815] tcp_rcv_established+0x13e6/0x25b0 [ 1297.937983][T15815] tcp_v4_do_rcv+0xa90/0x1430 [ 1297.942643][T15815] __release_sock+0x265/0x3a0 [ 1297.947314][T15815] __sk_flush_backlog+0x36/0xc0 [ 1297.952158][T15815] tcp_sendmsg_locked+0x417e/0x55b0 [ 1297.957349][T15815] tcp_sendmsg+0x2f/0x50 [ 1297.961581][T15815] sock_write_iter+0x421/0x550 [ 1297.966341][T15815] vfs_write+0x61d/0xb90 [ 1297.970578][T15815] ksys_write+0x150/0x270 [ 1297.974902][T15815] do_syscall_64+0xe2/0xf80 [ 1297.979390][T15815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1297.985267][T15815] [ 1297.987571][T15815] Memory state around the buggy address: [ 1297.993181][T15815] ffff888073404600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1298.001224][T15815] ffff888073404680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1298.009353][T15815] >ffff888073404700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1298.017394][T15815] ^ [ 1298.023529][T15815] ffff888073404780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1298.031578][T15815] ffff888073404800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1298.039618][T15815] ================================================================== [ 1298.053814][T15299] input: em28xx snapshot button as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.89/input/input40 [ 1298.070956][T15299] em28xx 5-1:0.89: Remote control support is not available for this card. [ 1298.080243][T15689] em28xx 5-1:0.89: Closing input extension [ 1298.086145][T15689] em28xx 5-1:0.89: Deregistering snapshot button SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1298.290264][T15815] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1298.297506][T15815] CPU: 1 UID: 0 PID: 15815 Comm: v4l_id Not tainted syzkaller #0 PREEMPT(full) [ 1298.306533][T15815] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 [ 1298.316587][T15815] Call Trace: [ 1298.319862][T15815] [ 1298.322779][T15815] vpanic+0x1e0/0x670 [ 1298.326762][T15815] panic+0xc5/0xd0 [ 1298.330476][T15815] ? __pfx_panic+0x10/0x10 [ 1298.334890][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1298.340515][T15815] ? preempt_schedule_common+0x82/0xd0 [ 1298.345969][T15815] ? v4l2_fh_open+0xac/0x420 [ 1298.350550][T15815] check_panic_on_warn+0x89/0xb0 [ 1298.355485][T15815] ? v4l2_fh_open+0xac/0x420 [ 1298.360065][T15815] end_report+0x6f/0x140 [ 1298.364300][T15815] kasan_report+0x128/0x150 [ 1298.368794][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1298.374422][T15815] ? v4l2_fh_open+0xac/0x420 [ 1298.379012][T15815] v4l2_fh_open+0xac/0x420 [ 1298.383421][T15815] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1298.389398][T15815] em28xx_v4l2_open+0x157/0x9a0 [ 1298.394249][T15815] ? do_raw_spin_lock+0x12b/0x2f0 [ 1298.399271][T15815] v4l2_open+0x1bf/0x3a0 [ 1298.403517][T15815] chrdev_open+0x4cd/0x5e0 [ 1298.407926][T15815] ? __pfx_chrdev_open+0x10/0x10 [ 1298.412856][T15815] ? fsnotify_open_perm_and_set_mode+0x135/0x6d0 [ 1298.419186][T15815] ? __pfx_chrdev_open+0x10/0x10 [ 1298.424117][T15815] do_dentry_open+0x7ce/0x1420 [ 1298.428881][T15815] vfs_open+0x3b/0x340 [ 1298.432939][T15815] ? path_openat+0x346e/0x3e20 [ 1298.437701][T15815] path_openat+0x3486/0x3e20 [ 1298.442301][T15815] ? kmem_cache_alloc_noprof+0x370/0x6e0 [ 1298.447934][T15815] ? getname_flags+0xb7/0x540 [ 1298.452608][T15815] ? __pfx_path_openat+0x10/0x10 [ 1298.457545][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1298.463169][T15815] ? __lock_acquire+0x6b5/0x2cf0 [ 1298.468116][T15815] do_filp_open+0x22d/0x490 [ 1298.472617][T15815] ? __pfx_do_filp_open+0x10/0x10 [ 1298.477667][T15815] ? _raw_spin_unlock+0x28/0x50 [ 1298.482515][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1298.488138][T15815] ? alloc_fd+0x64b/0x6c0 [ 1298.492460][T15815] do_sys_openat2+0x12f/0x220 [ 1298.497136][T15815] ? __pfx_do_sys_openat2+0x10/0x10 [ 1298.502327][T15815] ? exc_page_fault+0x6a/0xc0 [ 1298.506995][T15815] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1298.512619][T15815] ? do_user_addr_fault+0xc7c/0x1360 [ 1298.517909][T15815] __x64_sys_openat+0x138/0x170 [ 1298.522761][T15815] do_syscall_64+0xe2/0xf80 [ 1298.527255][T15815] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1298.533309][T15815] ? trace_irq_disable+0x37/0x100 [ 1298.538329][T15815] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1298.544211][T15815] RIP: 0033:0x7f9cccea7407 [ 1298.548615][T15815] Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff [ 1298.568217][T15815] RSP: 002b:00007ffee23922f0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 [ 1298.576635][T15815] RAX: ffffffffffffffda RBX: 00007f9ccd582880 RCX: 00007f9cccea7407 [ 1298.584600][T15815] RDX: 0000000000000000 RSI: 00007ffee2393f1b RDI: ffffffffffffff9c [ 1298.592560][T15815] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 [ 1298.600517][T15815] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 1298.608472][T15815] R13: 00007ffee2392540 R14: 00007f9ccd6e9000 R15: 0000562d2d4a54d8 [ 1298.616442][T15815] [ 1298.619769][T15815] Kernel Offset: disabled [ 1298.624081][T15815] Rebooting in 86400 seconds..